CN113079512B - Method, device and storage medium for supporting terminal roaming - Google Patents

Abstract

The present invention relates to a method, a device and a storage medium for supporting terminal roaming. The method includes: acquiring a first instruction, and enabling a second-time authentication-free function according to the first instruction; acquiring and sending a terminal after switching wireless access points or roaming networks. According to the traffic packet, determine the user's mac information and the inbound interface corresponding to the received traffic packet; according to the user's mac information and the inbound interface, determine whether the terminal has been authenticated and go online. The new IP address formed after the terminal switches the wireless access point is added to the authenticated user table. The present invention is applied to the surfing behavior management equipment. When multiple APs are connected to it, the same terminal can surf the Internet through the same AP, and when the network is switched from IPv4 to IPv6, roaming can be realized without secondary authentication. In addition, it can be realized that the same terminal needs to be re-authenticated when accessing the Internet through different APs, so as to achieve the requirement of SSID isolation.

Description

A method, device and storage medium for supporting terminal roaming

technical field

The present invention relates to the technical field of network management, and in particular, to a method, a device and a storage medium for supporting terminal roaming.

Background technique

At present, the online behavior management product performs Portal authentication for end users whose traffic passes through the device to go online, so as to control the online behavior. There are two main methods for Portal authentication online control: one is based on the end user's IP, and the other is based on the end user's MAC, and the Portal is not aware of the online.

However, for Portal authentication based on user IP, when the end user's network is switched from IPv4 to IPv6, because the IP address changes, and the end user traffic passes through the device, a second authentication is required, which seriously affects the user experience. Based on the terminal user's MAC, the non-sensing online mode is implemented. The terminal switches APs. The traffic of terminals with the same MAC and different IP passes through the device. According to the user terminal MAC, the device needs to send a request message to the NAS device to confirm whether the terminal has been authenticated by Portal. If it has been online , the traffic of the terminal will be released directly through the device, no secondary authentication is required, and the requirement of SSID isolation cannot be achieved. In conclusion, how to perform efficient authentication when a terminal switches networks or APs is an urgent problem to be solved.

SUMMARY OF THE INVENTION

In view of this, it is necessary to provide a method for supporting terminal roaming, so as to solve the problem of how to perform efficient authentication when the terminal switches between networks or APs.

The present invention provides a method for supporting terminal roaming, which is applied to a surfing behavior management device, wherein the surfing behavior management device is communicatively connected to a wireless access point, and the method for supporting terminal roaming includes:

Acquire a first instruction, according to the first instruction, enable the function of exempting secondary authentication; acquire a traffic packet sent by the terminal after switching a wireless access point or switching a roaming network, and according to the traffic packet, determine the user's mac information and receiving the inbound interface corresponding to the traffic packet;

According to the user mac information and the inbound interface, it is judged whether the function of exempting secondary authentication is enabled. The wireless access point is added to the list of authenticated users.

Further, according to the user mac information and the inbound interface, judging whether to enable the function of exempting secondary authentication includes:

According to the user mac information and the inbound interface, it is determined whether the terminal has been authenticated to go online, and if it has been authenticated, the second authentication-free function is enabled.

Further, judging whether the terminal has been authenticated and going online according to the user mac information and the inbound interface includes:

Using the user mac information and the inbound interface as key values, query in a pre-stored hash table to determine whether there is a corresponding authentication record;

If it exists, the terminal has been authenticated to go online.

Further, the obtaining the traffic packets sent by the terminal after switching the wireless access point or switching the roaming network includes:

Obtain an IPv6 traffic packet, wherein the IPv6 traffic packet is a packet sent by the user of the terminal after switching from the IPv4 network to the IPv6 network using the same AP.

Further, the obtaining the traffic packets sent by the terminal after switching the wireless access point or switching the roaming network includes:

A packet after the AP switching is obtained, wherein the packet after the AP switching is a traffic packet with the same mac address and different IP addresses received for the first time by different interfaces of the surfing behavior management device.

Further, the method for supporting terminal roaming also includes:

If the authentication is not online, the Portal authentication page is pushed to the terminal, so that the terminal performs Portal authentication.

Further, the form of the authenticated user table is a hash table.

The present invention also provides a device for supporting terminal roaming, including:

an obtaining unit, configured to obtain a first instruction, and according to the first instruction, enable the function of avoiding secondary authentication; obtain the traffic packets sent by the terminal after switching the wireless access point or switching the roaming network, and according to the traffic packets, Determine the user mac information and the ingress interface corresponding to receiving the traffic packet;

The processing unit is configured to determine whether to enable the second authentication-free function according to the user mac information and the inbound interface; New IP addresses or new wireless access points are added to the list of authenticated users.

The present invention also provides a device for supporting terminal roaming, including a processor and a memory, where a computer program is stored in the memory, and when the computer program is executed by the processor, the above-mentioned method for supporting terminal roaming is implemented.

The present invention also provides a computer-readable storage medium, which, when the program is executed by the processor, implements the above-mentioned method for supporting terminal roaming.

Compared with the prior art, the beneficial effects of the present invention include: firstly, the function of exempting the second authentication is enabled for the online behavior management device, and the opening and closing of the function of exempting the second authentication is controlled by issuing the first instruction, thereby ensuring the safety of the device. The flexibility of use; then, obtain the traffic packets after the terminal switches the wireless access point (AP) or roaming network (IPv4, IPv6) during the network roaming process, effectively parse the traffic packets, and determine the corresponding user. The mac information and the corresponding ingress interface of the online behavior management device to receive the traffic packet; finally, combined with the user mac information and ingress interface to determine whether the terminal has been authenticated and online, fully considering various information, directly query on the device whether the terminal has been online. Authentication goes online, avoiding sending the end user's mac and IP information to the NAS device every time to check whether the user is online, reducing the sending of data messages, and reducing the pressure on the online behavior management device and the NAS device to process data packets. After authentication goes online, the user's traffic will be released directly. The manifestation is that the user can directly access the Internet and access network resources without authentication. At the same time, the user's new IP address is added to the authenticated user table, and the IPv6 address will be received next time. The traffic packets will no longer be triggered to query whether the user has been authenticated through Portal. To sum up, the present invention is applied to an online behavior management device. When multiple APs are connected to it, the same terminal can access the Internet through the same AP, and when the network is switched from IPv4 to IPv6, roaming can be realized without the need for two Secondary authentication, and it can be realized that the same terminal needs to be re-authenticated when accessing the Internet through different APs, so as to achieve the requirement of SSID isolation.

Description of drawings

1 is a schematic flowchart of a method for supporting terminal roaming provided by the present invention;

FIG. 2 is a schematic flow chart of judging whether a terminal has been authenticated and online provided by the present invention;

FIG. 3 is a schematic block diagram of an apparatus for supporting terminal roaming provided by the present invention.

Detailed ways

The preferred embodiments of the present invention are specifically described below with reference to the accompanying drawings, wherein the accompanying drawings constitute a part of the present application, and together with the embodiments of the present invention, are used to explain the principles of the present invention, but are not used to limit the scope of the present invention.

Example 1

An embodiment of the present invention provides a method for supporting terminal roaming. Referring to FIG. 1, FIG. 1 is a schematic flowchart of the method for supporting terminal roaming provided by the present invention. The above-mentioned method for supporting terminal roaming includes steps S1 to S3, wherein :

In step S1, the first instruction is obtained, and according to the first instruction, the function of exempting secondary authentication is enabled;

In step S2, obtain the traffic packets sent by the terminal after switching the wireless access point or switching the roaming network, and according to the traffic packets, determine the user mac information and the ingress interface corresponding to the received traffic packets;

In step S3, according to the user's mac information and the inbound interface, it is judged whether the function of exempting secondary authentication is enabled. Click to add to the list of authenticated users.

In the embodiment of the present invention, firstly, the function of exempting the second authentication is enabled for the online behavior management device, and the opening and closing of the function of exempting the second authentication is controlled by issuing the first instruction, so as to ensure the flexibility of use; then, Obtain the traffic packets after the terminal switches wireless access points (APs) or roaming networks (IPv4, IPv6) during network roaming, effectively parse the traffic packets, and determine the corresponding user mac information and surfing behavior management equipment The corresponding inbound interface that receives the traffic packet; finally, combined with the user's mac information and inbound interface to determine whether the terminal has been authenticated and online, fully considering various information, directly query the device on the device whether the terminal has been authenticated and online, to avoid every time. Send the end user's mac and IP information to the NAS device to check whether the user is online, which reduces the transmission of data messages, and also reduces the pressure on the online behavior management device and the NAS device to process data packets. The user traffic is expressed in the form that the user can directly access the Internet and access network resources without authentication. At the same time, the user's new IP address is added to the authenticated user table, and the next time it receives traffic packets of this IPv6 address, it will not be Trigger to check whether the user has been authenticated through Portal.

It should be noted that Internet behavior management products refer to products that help Internet users control and manage the use of the Internet. Its main functions include: filtering web page access, network application control, bandwidth traffic management, information sending and receiving audit, and user behavior analysis.

Preferably, according to the user mac information and the inbound interface, judging whether to enable the function of exempting secondary authentication includes: judging whether the terminal has been authenticated and going online according to the user mac information and the inbound interface, and if so, enabling the function of exempting secondary authentication. As a specific embodiment, the embodiment of the present invention effectively enables the second authentication-free function based on the user mac information of the terminal and the ingress interface of the surfing behavior management device for receiving user traffic.

Preferably, with reference to FIG. 2 , FIG. 2 is a schematic flowchart of judging whether the terminal has been authenticated to go online provided by the present invention. The above step S3 includes steps S31 to S32, wherein:

In step S31, the user mac information and the inbound interface are used as key values, and a query is performed in the pre-stored hash table to determine whether there is a corresponding authentication record;

In step S32, if it exists, the terminal has been authenticated to go online.

As a specific embodiment, the embodiment of the present invention is based on the user mac information of the terminal and the ingress interface of the user traffic received by the surfing behavior management device as the key value, and the data is stored on the surfing behavior management device in the form of a hash linked list, which is convenient for effective data processing Store and search, combined with the user's mac information and inbound interface, to search for data in multiple aspects, effectively identifying the situation of the terminal switching wireless access points or switching roaming networks.

Preferably, obtaining the traffic packets sent by the terminal after switching the wireless access point or switching the roaming network includes:

Obtain IPv6 traffic packets, where the IPv6 traffic packets are sent by the terminal user using the same AP after switching from the IPv4 network to the IPv6 network.

As a specific embodiment, the embodiment of the present invention identifies a situation in which the terminal uses the same AP but switches to different networks, so as to realize authentication-free roaming and surfing the Internet in this situation.

Preferably, obtaining the traffic packets sent by the terminal after switching the wireless access point or switching the roaming network includes:

Obtain the packets after the AP is switched, wherein the packets after the AP switch are traffic packets with the same mac address and different IP addresses that are received for the first time by different interfaces of the online behavior management device.

As a specific embodiment, the embodiment of the present invention identifies a situation in which a terminal switches an AP, and at this time, re-authentication is required to ensure network security.

Preferably, the above-mentioned method for supporting terminal roaming further includes:

If the authentication is not online, the Portal authentication page is pushed to the terminal so that the terminal can perform Portal authentication.

As a specific embodiment, in the embodiment of the present invention, re-authentication is required in the case of no authentication, so as to achieve the requirement of SSID isolation.

Preferably, the form of the authenticated user table is a hash table. As a specific embodiment, the embodiment of the present invention constructs an authentication user table in the form of a hash table, which is convenient for the next authentication query.

Example 2

An embodiment of the present invention provides an apparatus for supporting terminal roaming. Referring to FIG. 3, FIG. 3 is a schematic structural diagram of the apparatus for supporting terminal roaming provided by the present invention. The above-mentioned apparatus 300 for supporting terminal roaming includes:

The obtaining unit 301 is configured to obtain a first instruction, and according to the first instruction, enable the function of avoiding secondary authentication; obtain a traffic packet sent by the terminal after switching a wireless access point or switching a roaming network, and determine the user mac according to the traffic packet information and the ingress interface corresponding to receiving the traffic packet;

The processing unit 302 is configured to determine whether to enable the second authentication-free function according to the user's mac information and the inbound interface, and if so, release traffic packets, and transfer the new IP address or new wireless access point formed after the terminal switches to the wireless access point. The entry point is added to the list of authenticated users.

Example 3

An embodiment of the present invention provides an apparatus for supporting terminal roaming, including a processor and a memory, where a computer program is stored in the memory, and when the computer program is executed by the processor, the above-mentioned method for supporting terminal roaming is implemented.

Example 4

An embodiment of the present invention provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the above-mentioned method for supporting terminal roaming is implemented.

The invention discloses a method, a device and a storage medium for supporting terminal roaming. First of all, the function of freeing secondary authentication is enabled for an online behavior management device, and the opening and closing of the function of exempting secondary authentication is controlled by issuing a first instruction. , to ensure the flexibility of use; then, obtain the traffic packets after the terminal switches the wireless access point (AP) or roaming network (IPv4, IPv6) during the network roaming process, and effectively analyze the traffic packets to determine which Corresponding user mac information and the corresponding ingress interface of the Internet behavior management device to receive the traffic packet; finally, combined with the user mac information and ingress interface to determine whether the terminal has been authenticated and online, fully considering various information, and directly query on the device Whether the terminal has been authenticated to go online, to avoid sending the terminal user's mac and IP information to the NAS device every time, to check whether the user is online, reduce the transmission of data messages, and reduce the pressure on the online behavior management device and the NAS device to process data packets , if the user has been authenticated to go online, the user's traffic will be released directly. The expression is that the user can directly access the Internet and access network resources without authentication. At the same time, the user's new IP address is added to the authenticated user table, and the user will receive it next time. Traffic packets of this IPv6 address will no longer trigger the query to see whether the user has been authenticated through Portal.

The technical scheme of the present invention is applied to an online behavior management device. When multiple APs are connected to it, the same terminal can surf the Internet through the same AP, and when the network is switched from IPv4 to IPv6, roaming can be realized, avoiding the need for two Secondary authentication, and it can be realized that the same terminal needs to be re-authenticated when accessing the Internet through different APs, so as to achieve the requirement of SSID isolation.

The above description is only a preferred embodiment of the present invention, but the protection scope of the present invention is not limited to this. Substitutions should be covered within the protection scope of the present invention.

Claims (8)

1. A method for supporting terminal roaming, characterized in that, it is applied to a surfing behavior management device, the surfing behavior management device is communicatively connected to a wireless access point, and the method for supporting terminal roaming comprises: Acquiring a first instruction, and controlling the enabling of the secondary authentication-free function according to the first instruction; acquiring a traffic packet, where the traffic packet includes switching from an IPv4 network to an IPv6 network by a user of the terminal using the same wireless access point IPv6 traffic packets sent later, or packets after the wireless access point is switched with the same mac address for the first time on different interfaces of the online behavior management device, and determine the user according to the traffic packets mac information and the ingress interface corresponding to receiving the traffic packet; According to the user's mac information and the inbound interface, it is judged whether it is necessary to perform secondary authentication. The new IPV6 address is added to the authenticated user table; if not, re-authentication is required, and the new IPV6 address or new wireless access point formed after the terminal switches wireless access points is added to the authenticated user table. 2 . The method for supporting terminal roaming according to claim 1 , wherein, according to the user mac information and the inbound interface, judging whether it is necessary to perform secondary authentication-free comprises: 2 . According to the user mac information and the inbound interface, it is determined whether the terminal has been authenticated to go online, and if it has been authenticated, the second authentication is exempted. 3. The method for supporting terminal roaming according to claim 2, wherein the determining whether the terminal has been authenticated to go online according to the user mac information and the inbound interface comprises: Using the user mac information and the inbound interface as key values, query in a pre-stored hash table to determine whether there is a corresponding authentication record; If it exists, the terminal has been authenticated to go online. 4. The method for supporting terminal roaming according to claim 1, wherein the method for supporting terminal roaming further comprises: If the authentication is not online, the Portal authentication page is pushed to the terminal, so that the terminal performs Portal authentication. 5 . The method for supporting terminal roaming according to claim 1 , wherein the form of the authenticated user table is a hash table. 6 . 6. A device for supporting terminal roaming, comprising: an obtaining unit, configured to obtain a first instruction, and according to the first instruction, control the activation of the second-time authentication-free function; and also be used to obtain a traffic packet, the traffic packet includes a user of the terminal using the same wireless access point , the IPv6 traffic packets sent after switching from the IPv4 network to the IPv6 network, or the packets after the wireless access point switching with the same mac address and different IP addresses received by different interfaces of the online behavior management device for the first time, and according to the described Traffic packets, determine the user mac information and the ingress interface corresponding to receiving the traffic packets; The processing unit is configured to determine whether the second authentication is required according to the user mac information and the inbound interface, and if so, release the traffic packet, and add the new IPV6 address formed after the terminal switches IPs into the authenticated user table; if not, re-authentication is required, and the new IPV6 address or new wireless access point formed after the terminal switches wireless access points is added to the authenticated user table. 7. A device for supporting terminal roaming, comprising a processor and a memory, and a computer program is stored on the memory, and when the computer program is executed by the processor, the supporting terminal according to any one of claims 1-5 is realized. method of roaming. 8. A computer-readable storage medium on which a computer program is stored, characterized in that, when the computer program is executed by a processor, the method for supporting terminal roaming according to any one of claims 1-5 is realized .

Images