CN104837134B - A kind of web authentication user login method, equipment and system - Google Patents

Abstract

A method, device and system for web authentication user login, comprising: after receiving a login request message sent by a terminal and carrying the login account, the terminal's IP address and MAC address information, the portal server determines the IP address The IP address status of the IP address and the MAC address status of the MAC address, the Portal server sends a Challenge request message to the access gateway when it is determined that the IP address status of the IP address and the MAC address status of the MAC address are not online. arts. In the solution of the embodiment of the present invention, due to checking the IP address status and the MAC address status of the terminal when the terminal logs in this time, when it is determined that neither is online, that is to say, the IP address and the MAC address can only be online once. The Challenge interaction process is performed only when there are certain restrictions, so that the user can successfully perform web authentication.

Description

A method, device and system for web authentication user login

technical field

The invention relates to the technical field of wireless communication, in particular to a method, device and system for web authentication user login.

Background technique

Web authentication based on portal (Portal) protocol and hypertext transfer protocol (Hypertext Transfer Protocol, HTTP) redirection is widely used in authentication control of Internet access. The typical signaling process of web authentication is shown in Figure 1, including the following steps:

Step 101: the terminal sends an HTTP connection request message to the access gateway;

Step 102: the access gateway judges (generally based on the IP address or MAC address of the terminal) that the terminal is in an unauthenticated state, and pushes an HTTP redirect message to the unauthenticated terminal;

Generally, the HTTP redirect message contains a constructed Uniform Resource Locator (Union ResourceLocation, URL), and the following URL is an example: http://221.176.1.140:8080/wlan/index.php? wlanuserip＝183.241.167.185&wlanacname＝1201.0010.100.00&ssid＝CMCC&NASID＝8047202010000460

It contains information such as the IP address (221.176.1.140) of the Portal server and the user IP address (wlanuserip=183.241.167.185) required for initiating the subsequent authentication process.

Step 103: the terminal sends an HTTP connection request message to the Portal server;

The terminal uses the above URL to send an HTTP request to the Portal server. Since the URL constructed by the access gateway during HTTP redirection contains the terminal's IP address, step 103 can realize that the unique identification information, that is, the terminal's IP address, is passed to the Portal server. server.

Step 104: the Portal server pushes the unified authentication Portal login page to the terminal;

Step 105: the terminal receives the account number and password input by the user and sends a login request to the Portal server;

Step 106: the Portal server queries the Radius server for user billing information;

Step 107: the Radius server returns the query result to the Portal server;

Step 108: when the Portal server determines that the query result is successful, it sends a Challenge message to the access gateway;

The Challenge message includes the user IP address (wlanuserip) extracted from the URL by the Portal.

Step 109: the access gateway sends the assigned Challenge to the Portal server;

Step 110: the Portal server encrypts the username and password with the received Challenge, and sends information such as the account password to the access gateway;

Step 111: the access gateway forwards the received authentication data to the Remote Authentication Dial In User Service (Radius) server for verification;

Step 112: the access gateway receives the authentication result fed back by the Radius server;

In this step 112 , the access gateway configures the IP address to pass the authentication state after receiving the authentication passing message replied by the Radius server during the online authentication process.

Step 113: the access gateway forwards the authentication result fed back by the Radius server to the Portal server;

Step 114: the Portal server pushes a login success page to the terminal.

Step 115: the Portal server sends an authentication success message to the access gateway.

Under normal circumstances, the terminal can go through the above process smoothly and successfully pass the web authentication. However, the above web authentication process cannot judge the abnormal login behavior of the terminal, and eventually lead to login failure.

The following describes the login failure through the case where the abnormal login behavior caused by the terminal to initiate multiple online processes leads to the failure of the online process:

As shown in Figure 2, when the userip (user IP address) in the challenge request (req_challenge) message sent by the Portal server to the access gateway during the online process is an authenticated and online IP address at the AC, the access The gateway will reject the challenge interaction application of the Portal server, resulting in the failure of the user to go online.

Actual message interaction process: the user goes online for the first time (21) normally, but then the user initiates the second online (22) (for example, after clicking Go Online, the user clicks the "Back button" on the mobile phone interface to go back to Portal login page and initiate the authentication process again), the second process access gateway rejected the challenge interaction request and the user failed to go online.

When the user initiates multiple logins, such as returning to the Portal login page based on the browser and initiating the login process again after login, or opening the saved Portal login page and initiating the login process, etc., in this case, when the Portal server sends a challenge message , the access gateway will return a packet that assigns a challenge error. The error types include the terminal being in the process of authentication, the terminal being in the online state, etc., resulting in the failure of the user's online process and login failure, resulting in poor perception of the user's use of the network. .

Contents of the invention

Embodiments of the present invention provide a web authentication user login method, device and system to solve the problem in the prior art that the WEB authentication process cannot judge the user's abnormal login behavior and eventually lead to login failure.

A method for web authentication user login, said method comprising:

The Portal server determines the IP address state of the IP address and the MAC address of the MAC address after receiving the login request message sent by the terminal and carrying the login account, the terminal's IP address, and the terminal's MAC address information. Status, the IP address status and the MAC address status both include: offline, online and authentication process;

When the Portal server determines that both the IP address status of the IP address and the MAC address status of the MAC address are offline, the Portal server sends a Challenge request message to the access gateway.

A kind of Portal server, described Portal server comprises:

The receiving unit is used to receive the login request message sent by the terminal and carry the login account, the terminal's IP address and the terminal's MAC address information;

A determining unit, configured to determine the IP address status of the IP address and the MAC address status of the MAC address, where both the IP address status and the MAC address status include: offline, online, and in the process of authentication;

A sending unit, configured to send a Challenge request message to the access gateway when it is determined that both the IP address status of the IP address and the MAC address status of the MAC address are offline.

A Web authentication user login system, the system includes: a terminal, a Portal server and an access gateway;

The terminal is configured to send a login request message carrying the login account, the terminal's IP address and the terminal's MAC address information to the Portal server;

The Portal server is configured to determine the IP address status of the IP address and the MAC address status of the MAC address after receiving the login request message, the IP address status and the MAC address status both include: offline, Online and in the authentication process; and when it is determined that the IP address status of the IP address and the MAC address status of the MAC address are not online, send a Challenge request message to the access gateway;

The access gateway is used to receive the Challenge request message sent by the Portal server.

In the solution of the embodiment of the present invention, due to checking the IP address status and MAC address status of the terminal when the terminal logs in this time, when it is determined that neither is online, that is to say, the IP address and the MAC address can only be online once. The Challenge interaction process is performed only when there are certain restrictions, so that the user can successfully perform web authentication.

Description of drawings

FIG. 1 is a schematic diagram of the signaling process of Web authentication in the background technology;

Fig. 2 is the screenshot of the packet captured in the background technology;

Fig. 3 is one of the flow charts of the Web authentication user login method in the embodiment of the present invention;

Fig. 4 is the second flow chart of the Web authentication user login method in the embodiment of the present invention;

Fig. 5 is the signaling flowchart of Web authentication user login in the embodiment of the present invention;

Fig. 6 is the structural representation of Portal server in the embodiment of the present invention;

FIG. 7 is a schematic diagram of the system structure of Web authentication user login in the embodiment of the present invention.

Detailed ways

In order to clearly illustrate the solutions of the embodiments of the present invention, the basic principles of the solutions of the embodiments of the present invention will be firstly described below.

In the signaling interaction process of Web authentication, there are two types of identification information to identify the user, namely IP address (identifying the user's unique index in the access gateway) and MAC address (identifying the user's terminal). Therefore, if a user is to be uniquely identified, the two types of identification information must meet uniqueness constraints, that is, both IP and MAC are available and can only be online at one time, and one IP address cannot be assigned to two terminals, and one terminal cannot You can only go online once if you go online twice.

In the solution of the embodiment of the present invention, after the user terminal initiates the online process and before the Portal server initiates the Challenge interaction, information detection is performed on the above two types of identification information, and the online account when the MAC is online is compared with the current login account Information is detected, and the Challenge interaction and subsequent signaling process can only be executed after the two types of identification information meet the uniqueness restriction conditions and the online account conflict is resolved.

Usually, abnormal situations include the following two types:

The first type: IP address is online: the biggest possibility is that the user IP address (userip) obtained by the portal server through the Portal URL is not the correct IP address. In this case, the user will be redirected to WWW.10086.CN (not limited to This website), so that the user terminal performs an HTTP redirection process, and accesses the login page through the correct Portal URL;

The second type: MAC address online: Indicates that the user terminal is already online. If the account is the same, the log-on process will be executed to make the user log in successfully. If the account is different, in this case, the user needs to be prompted that the terminal has passed the account** *Completed the authentication process, currently in the authentication pass state, and executes the login process of the corresponding account according to the user's choice.

The solution of the present invention will be described in detail below in conjunction with specific embodiments.

As shown in Figure 3, it is a schematic diagram of a method for logging in a Web authentication user in an embodiment of the present invention, and the method specifically includes the following steps:

Step 301: The Portal server receives the login request message carrying the login account, the terminal's IP address and the terminal's MAC address information sent by the terminal, and executes step 302;

Step 302: the Portal server determines the IP address status of the IP address and the MAC address status of the MAC address, and the IP address status and the MAC address status both include: offline, online and authentication process;

When the Portal server determines that the IP address state of the IP address is in the authentication process or the MAC address state of the MAC address is in the authentication process, step 303 is performed;

When the Portal server determines that the IP address status of the IP address and the MAC address status of the MAC address are not online, step 304 is performed;

When the Portal server determines that the IP address status is online, step 305 is performed;

When the Portal server determines that the MAC address status is online, step 306 is performed;

Step 303: end.

It should be noted that when it is determined that the status of the IP address of the IP address is in the process of authentication or the status of the MAC address of the MAC address is in the process of authentication, it means that there is a problem with the browser of the terminal or that the network is congested. The user cannot log in, and no operation is performed at this time.

Step 304: Send a Challenge request message to the access gateway.

Step 305: Push a page of "Please re-enter account information" to the terminal, and push a Portal login page to the terminal when receiving confirmation from the terminal to re-enter the account information.

This step 305 is carried out aiming at the situation that the IP address is online, the reason that the IP address is online is likely to be that the user uses the saved Portal URL to open the Portal page, and then the Portal server obtains the terminal information from the URL. The IP address is wrong. In this case, redirect the terminal to the Portal page to obtain the correct IP address.

Step 306: The Portal server judges whether the account corresponding to the MAC address is the same as the current login account; if they are the same, execute step 307; if not, execute step 308.

Step 307: Send an instruction to the access gateway, instruct the access gateway to send a stop charging request message to the Radius server, and perform step 309;

Step 309: After receiving the stop-accounting response message from the Radius server returned by the access gateway, the Portal server sends a Challenge request message to the access gateway.

The Portal server judges that the account corresponding to the MAC address is the same as the login account described this time, indicating that the terminal has already used the account to log in, and this time the same account is used to log in repeatedly. Therefore, the above steps 307 and 309 are executed to achieve To achieve the purpose of taking the online account offline and re-opening the account.

The Portal server judges whether the account corresponding to the MAC address is the same as the login account described this time, indicating that the terminal has already used an account (that is, an online account) to log in, and this time it is using another account (that is, this login account). account) to log in, because the same terminal cannot log in two accounts at the same time, therefore, perform the following steps 308, 401, and 402 to achieve the online login process of restarting the online account after the online account is offline or perform the following steps 308 and 501 to 504 to achieve the purpose of deactivating the online account and starting the online login process of the current login account;

Step 308: push a page to the terminal containing the information "already online, the account is the account corresponding to the MAC address, please select the online account to log in or the current login account to log in";

When the Portal server receives the current login account login information sent by the terminal, it performs the following steps 401 and 402:

Step 401: Send an instruction to the Radius server, instructing the access gateway to send a stop charging request message to the Radius server, so as to stop charging the online account;

Step 402: After receiving the stop accounting response message from the Radius server returned by the access gateway, send a Challenge request message to the access gateway;

When the Portal server receives the online account login information sent by the terminal, it performs the following steps 501-step 504:

Step 501: Push the Portal login page to the terminal, asking the user to input the password of the online account;

Step 502: receiving a login request sent by the terminal and carrying the online account and the password of the online account;

Step 503: Send an offline instruction to the access gateway, instructing the access gateway to send a stop charging request message to the Radius server to stop charging the online account;

Step 504: After receiving the stop-accounting response message from the Radius server returned by the access gateway, send a Challenge request message to the access gateway.

Preferably, determining the IP address status of the IP address and the MAC address status of the MAC address specifically includes:

When the Portal server locally maintains the corresponding relationship between the account number, the IP address status and the MAC address status, the Portal server utilizes the locally maintained corresponding relationship to determine the IP address status of the IP address and the MAC address of the MAC address state;

When the Portal server does not locally maintain the corresponding relationship between the account number, the IP address state and the MAC address state, the Portal server sends the account number, the IP address and the MAC address in the login request message to the remote user dial-up authentication system Radius server. Query the user billing information request message, and according to the query response message of the IP address status of the IP address and the MAC address status information of the MAC address returned by the Radius server, determine the IP address status and status of the IP address The MAC address state of the MAC address, the Radius server maintains the corresponding relationship between the account, the IP address state and the MAC address state.

Preferably, the Portal server determines whether the account corresponding to the MAC address is the same as the current login account, specifically including:

When the Portal server locally maintained the corresponding relationship between the account number, the IP address status and the MAC address status, the Portal server utilized the locally maintained corresponding relationship to determine the account corresponding to the MAC address, and the account corresponding to the MAC address and Compared with the current login account;

When the Portal server locally does not maintain the corresponding relationship between the account number, the IP address state and the MAC address state, the Portal server sends to the Radius server the inquiry user charging information request message carrying the account number, the IP address and the MAC address, And receive the inquiry response message that carries described MAC address online that Radius server returns, and the account corresponding to described MAC address is identical with described this login account number, has maintained account number, IP address status and MAC address in the Radius server Correspondence between states.

Since the existing Radius server stores the corresponding relationship information between account number, IP address status and MAC address status, therefore, when the Portal server does not locally store the corresponding relationship information in the embodiment of the present invention, the Radius in the embodiment of the present invention When the server returns the query response message, it cleverly carries the MAC address status, IP address status, and whether the login account and the MAC address are online (if any) are the same in the query response message. It is given to the Portal server, without affecting the interaction of the existing query user billing information messages, and without using additional request messages to obtain these information.

The Web authentication user login method shown in Figure 4 is essentially the same as the process in Figure 3 above, and is a relatively simplified flow chart that can clearly and concisely illustrate the solution of the embodiment of the present invention, including the following steps:

Step 601: the Portal server judges whether the IP address status is in the authentication process or the MAC address status is in the authentication process; if so, then end; otherwise, execute step 602;

Step 602: the Portal server judges whether the IP address status is online, if the judgment result is no, then execute step 603; if the judgment result is yes, then execute step 605;

Step 603: the Portal server judges whether the MAC address status is online, if the judgment result is no, then execute step 604; if the judgment result is yes, then execute step 607;

Step 604: the Portal server starts the online process;

Step 605: The Portal server pushes "Please re-enter account information", redirects the terminal to www.10086.CN, and executes Step 606;

Step 606: the terminal is redirected to the Portal login page;

Step 607: the Portal server judges whether the new account number (that is, the login account number) is the same as the online account number; if the judgment result is yes, then execute step 608; if the judgment result is no, then execute step 610;

Step 608: the Portal server executes the offline operation of the online account, and executes step 609;

Step 609: the Portal server starts the online operation of the new account;

Step 610: The Portal server pushes "Already online, account ****, please choose to log in with a new account/login with an already online account", and execute step 611;

Step 611: The terminal makes a selection; if a new account is selected to log in, then step 612 is executed; if an online account is selected to log in, then step 614 is executed;

Step 612: the Portal server executes the offline operation of the online account; and executes step 613;

Step 613: the Portal server executes the online process of starting a new account;

Step 614: The Portal server pushes to the terminal, please enter the password of the online account; and after receiving the terminal's login request carrying the password of the online account, execute step 615;

Step 615: the Portal server executes the online account offline operation and the online account online process.

What Fig. 5 shows is the interactive flowchart of Web signaling of the embodiment of the present invention; Portal server obtains MAC address state, IP address state and this login account number and MAC address online (if any) from Radius server whether identical information; Specifically Include the following steps:

Step 701 to step 705 are the same as step 101 to step 105 in the background technology, and will not be repeated here;

Step 706: the Portal server sends an inquiry user billing information to the Radius server;

Step 707: The Radius server returns the query result to the Portal server, which includes the MAC address status of the terminal, the IP address status of the terminal, and whether the login account and the MAC address are already online (if any) are the same information ;

Step 708: Thereafter, the Portal server performs different signaling interactions according to the query results; specifically, the following 4 signaling interactions are included:

1) When the IP address is online:

The Portal server pushes "Please re-enter account information" to the terminal;

The terminal sends "OK" to the Portal server;

The Portal server redirects the terminal to www.10086.cn;

The terminal is redirected to the Portal login page, and the online process is re-flowed;

2) When the MAC address is online and the accounts are the same:

The Portal server sends an offline instruction to the access gateway, and changes the status of the IP address to the access gateway to be offline;

The access gateway sends a stop accounting message to the Radius server;

Send a Challenge request message to the access gateway after going offline;

3) When the MAC address is online and the accounts are different:

The Portal server pushes to the terminal "Already online, account ****, please select this login account to log in/log in with an online account";

The terminal sends the selection result to the Portal server;

3.1) When the selection result is an online account login:

The Portal server pushes the page to the terminal, please enter the password of the online account;

The terminal receives the password entered by the user and sends a login request to the Portal server;

The Portal server sends an offline instruction to the access gateway, and the access gateway changes the IP address status to offline;

The access gateway sends a stop accounting message to the Radius server;

Send a Challenge request message to the access gateway after going offline;

3.2) When the selection result is this login account login:

The Portal server sends an offline instruction to the access gateway, and the access gateway changes the IP address status to offline;

The access gateway sends a stop accounting message to the Radius server;

Send a Challenge request message to the access gateway after going offline;

4) MAC address and IP address are not online

Send a Challenge request message to the access gateway;

Step 709 to step 715 are the same as step 109 to step 115 in the background art, and will not be repeated here.

The embodiment of the present invention also proposes a Portal server, the structural diagram of which is shown in Figure 6, including: a receiving unit 61, a determining unit 62, and a sending unit 63, wherein:

The receiving unit 61 is configured to receive a login request message sent by the terminal and carrying the current login account, the terminal's IP address and the terminal's MAC address information;

The determination unit 62 is configured to determine the IP address state of the IP address and the MAC address state of the MAC address, and the IP address state and the MAC address state both include: offline, online, and in the authentication process;

The sending unit 63 is configured to send a challenge request message to the access gateway when it is determined that both the IP address status of the IP address and the MAC address status of the MAC address are offline.

Preferably, the determining unit 62 is specifically configured to determine the IP address of the IP address by using the locally maintained corresponding relationship when the corresponding relationship between the account, the IP address status and the MAC address status is maintained locally. state and the MAC address state of the MAC address; when there is no corresponding relationship between the maintenance account, IP address state and MAC address state locally, send the account number in the login request message to the remote user dial-up authentication system Radius server , IP address and MAC address query user billing information request message, and according to the query response message carrying the IP address status of the IP address and the MAC address status information of the MAC address returned by the Radius server, determine the The IP address state of the IP address and the MAC address state of the MAC address, the corresponding relationship between the account number, the IP address state and the MAC address state is maintained in the Radius server.

Preferably, the sending unit 63 is further configured to push a page of "Please re-enter account information" to the terminal when the determining unit determines that the IP address status is online;

The receiving unit 61 is also used to receive the determination of the terminal to re-input the account information;

Described Portal server also includes:

The redirection unit 64 is configured to redirect the terminal to the Portal login page when receiving a confirmation from the terminal to re-enter the account information.

Preferably, the determining unit 62 is further configured to determine whether the account corresponding to the MAC address is the same as the current login account when determining that the status of the MAC address is online;

The sending unit 63 is also configured to send an instruction to the access gateway when the determining unit determines that the account corresponding to the MAC address is the same as the login account, indicating that the access gateway sends a stop charging request report to the Radius server. text; and after the receiving unit receives the stop accounting response message from the Radius server returned by the access gateway, it sends a Challenge request message to the access gateway;

The receiving unit 61 is further configured to receive a stop-accounting response message from the Radius server returned by the access gateway.

Preferably, the sending unit 63 is further configured to, when it is determined that the account corresponding to the MAC address is not the same as the current login account, push to the terminal a message containing "already online, the online account is the For the account corresponding to the MAC address, please select the page where you have already logged in with an online account or the "login with this login account" information;

The receiving unit 61 is also used to receive the online account login information and current account login information sent by the terminal, and receive the login request carrying the online account and the password of the online account sent by the terminal;

The sending unit 63 is further configured to send an instruction to the access gateway when receiving information about the current login account login sent by the terminal or receiving a login request that carries an online account and a password of the online account sent by the terminal , instructing the access gateway to send a stop-accounting request message to the Radius server; when receiving the online account login information sent by the terminal, push the Portal login page to the terminal, asking the user to enter the password of the online account, and in the receiving unit When receiving the login request carrying the online account and the password of the online account sent by the terminal, an instruction is sent to the access gateway, instructing the access gateway to send a stop charging request message to the Radius server.

Preferably, the determining unit 62 is specifically configured to determine the account corresponding to the MAC address by using the locally maintained corresponding relationship when the corresponding relationship between the account, the IP address status and the MAC address status is maintained locally, And compare the account number corresponding to the MAC address with the login account number this time; when there is no correspondence between the maintenance account number, IP address status and MAC address status locally, send the remote user dial-up authentication system Radius server carrying the This account, IP address and MAC address query user billing information request message, and receive the query that carries the MAC address online and whether the account corresponding to the MAC address is the same as the login account returned by the Radius server In response to the message, the Radius server maintains the corresponding relationship between the account, the IP address status and the MAC address status.

The embodiment of the present invention also proposes a Web authentication user login system, its structural diagram is shown in Figure 7, including: the system includes: a terminal 71, a Portal server 72 and an access gateway 73;

The terminal 71 is configured to send a login request message carrying the login account, the terminal's IP address and the terminal's MAC address information to the Portal server;

The Portal server 72 is configured to determine the IP address status of the IP address and the MAC address status of the MAC address after receiving the login request message, the IP address status and the MAC address status both include: not online , online and during the authentication process; and when it is determined that both the IP address status of the IP address and the MAC address status of the MAC address are offline, sending a Challenge request message to the access gateway;

The access gateway 73 is configured to receive the Challenge request message sent by the Portal server.

Preferably, when the Portal server locally maintains the corresponding relationship between the account number, the IP address state and the MAC address state, the Portal server 72 is specifically used to determine the IP address by using the locally maintained corresponding relationship. IP address status and the MAC address status of the MAC address;

When the Portal server locally does not maintain the corresponding relationship between the account number, the IP address state and the MAC address state, the system also includes: a Radius server 74;

Described Portal server 72 is also used for sending to Radius server the inquiry user billing information request message that carries the account number in the login request message, IP address and MAC address, and carries described IP address according to Radius server return A query response message of the IP address status of the IP address and the MAC address status information of the MAC address to determine the IP address status of the IP address and the MAC address status of the MAC address;

The Radius server 74 is configured to receive the query request message for user billing information, and return the query response message carrying the IP address status of the IP address and the MAC address status information of the MAC address to the Portal server, The Radius server maintains the corresponding relationship between account number, IP address status and MAC address status.

Preferably, the Portal server 72 is also configured to push a page of "Please re-enter account information" to the terminal when it is determined that the IP address status is online, and when receiving a confirmation from the terminal to re-enter the account information, Redirect the terminal to the Portal login page.

Preferably, the Portal server 72 is also used to determine whether the account corresponding to the MAC address is the same as the current login account when the MAC address status of the MAC address is online; When the corresponding account is the same as the login account this time, an instruction is sent to the access gateway, indicating that the access gateway sends a stop billing request message to the Radius server; after receiving the stop billing from the Radius server returned by the access gateway After the response message, send a challenge request message to the access gateway.

Preferably, the Portal server 72 is further configured to, when it is determined that the account corresponding to the MAC address is not the same as the login account this time, push to the terminal a message containing "already online, the online account is the For the account corresponding to the MAC address, please select the page where you have already logged in with the online account or the "login with the current login account" information; and when receiving the information about the login with the current login account sent by the terminal, perform the following operations: Send an instruction to instruct the access gateway to send a stop accounting request message to the Radius server to stop accounting for the online account; after receiving the stop accounting response message from the Radius server returned by the access gateway, send The ingress gateway sends a challenge request message; when receiving the online account login information sent by the terminal, perform the following operations: push the Portal login page to the terminal, and ask the user to enter the password of the online account; receive the online account information sent by the terminal and the login request of the password of the online account; send an instruction to the access gateway to instruct the access gateway to send a stop accounting request message to the Radius server; after receiving the stop accounting response message from the Radius server returned by the access gateway After that, send a challenge request packet to the access gateway.

Preferably, the Portal server 72 is specifically configured to locally maintain the corresponding relationship between the account number, the IP address status and the MAC address status, and the Portal server utilizes the locally maintained corresponding relationship to determine the corresponding MAC address. Account, and the account corresponding to the MAC address is compared with the account number for this login; when there is no correspondence between the maintenance account, IP address status and MAC address status locally, send a packet to the Radius server of the remote user dial-up authentication system. The current account number, IP address and MAC address query user billing information request message, and receive the return of the Radius server carrying the MAC address online, whether the account corresponding to the MAC address is the same as the current login account In the query response message, the Radius server maintains the corresponding relationship between the account number, IP address status and MAC address status.

Those skilled in the art should understand that the embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present application is described with reference to flowcharts and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present application. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and a combination of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a An apparatus for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions The device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby The instructions provide steps for implementing the functions specified in the flow chart or blocks of the flowchart and/or the block or blocks of the block diagrams.

While preferred embodiments of the present application have been described, additional changes and modifications to these embodiments can be made by those skilled in the art once the basic inventive concept is appreciated. Therefore, the appended claims are intended to be construed to cover the preferred embodiment and all changes and modifications which fall within the scope of the application.

Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalent technologies, the present invention also intends to include these modifications and variations.

Claims (18)

1. A Web authentication user login method, characterized in that the method comprises: After receiving the login request message carrying the login account, the terminal's IP address and the terminal's MAC address information sent by the terminal, the portal server determines the IP address status of the IP address and the MAC address of the MAC address. Address status, the IP address status and the MAC address status both include: offline, online and authentication process; When the Portal server determines that both the IP address status of the IP address and the MAC address status of the MAC address are offline, the Portal server sends a Challenge request message to the access gateway. 2. The method according to claim 1, wherein the determining the IP address state of the IP address and the MAC address state of the MAC address specifically comprises: When the Portal server locally maintains the corresponding relationship between the account number, the IP address status and the MAC address status, the Portal server utilizes the locally maintained corresponding relationship to determine the IP address status of the IP address and the MAC address of the MAC address state; When the Portal server does not locally maintain the corresponding relationship between the account number, the IP address state and the MAC address state, the Portal server sends the account number, the IP address and the MAC address in the login request message to the remote user dial-up authentication system Radius server. Query the user billing information request message, and according to the query response message of the IP address status of the IP address and the MAC address status information of the MAC address returned by the Radius server, determine the IP address status and status of the IP address The MAC address state of the MAC address, the Radius server maintains the corresponding relationship between the account, the IP address state and the MAC address state. 3. The method according to claim 1, wherein the Portal server pushes a page of "please re-enter account information" to the terminal when determining that the IP address status is online; When receiving confirmation from the terminal to re-enter the account information, the terminal is redirected to the Portal login page. 4. The method according to claim 1, characterized in that, when the MAC address status of the MAC address is online, the Portal server determines whether the account corresponding to the MAC address is identical to the login account this time; When it is determined that the account corresponding to the MAC address is the same as the login account this time, an instruction is sent to the access gateway to instruct the access gateway to send a stop charging request message to the Radius server; After receiving the stop-accounting response message from the Radius server returned by the access gateway, the Portal server sends a Challenge request message to the access gateway. 5. The method according to claim 4, wherein when it is determined that the account corresponding to the MAC address is not the same as the current login account, a push message containing "already online, the online account is the If the account corresponding to the MAC address is mentioned above, please select the page where the online account is logged in or the account is logged in this time; When the Portal server receives the login information of this login account sent by the terminal, it will perform the following operations: Send an instruction to the access gateway to instruct the access gateway to send a stop charging request message to the Radius server to stop charging the online account; After receiving the stop accounting response message from the Radius server returned by the access gateway, send a Challenge request message to the access gateway; When the Portal server receives the online account login information sent by the terminal, it performs the following operations: Push the Portal login page to the terminal, asking the user to enter the password of the online account; Receive the login request sent by the terminal with the online account and the password of the online account; Send an instruction to the access gateway, instructing the access gateway to send a stop accounting request message to the Radius server; After receiving the stop-accounting response message from the Radius server returned by the access gateway, it sends a challenge request message to the access gateway. 6. The method according to claim 4, wherein the Portal server determines whether the account corresponding to the MAC address is the same as the current login account, specifically comprising: When the Portal server locally maintained the corresponding relationship between the account number, the IP address status and the MAC address status, the Portal server utilized the locally maintained corresponding relationship to determine the account corresponding to the MAC address, and the account corresponding to the MAC address and Compared with the current login account; When the Portal server does not maintain the corresponding relationship between the account number, IP address status and MAC address status locally, the Portal server sends the query user accounting that carries the current account number, IP address and MAC address to the Radius server of the remote user dial-up authentication system. information request message, and receive the query response message that carries the MAC address online and the account corresponding to the MAC address is the same as the current login account returned by the Radius server, and maintains the account number, IP Correspondence between address status and MAC address status. 7. a portal Portal server, is characterized in that, described Portal server comprises: The receiving unit is used to receive the login request message sent by the terminal and carry the login account, the terminal's IP address and the terminal's MAC address information; A determining unit, configured to determine the IP address status of the IP address and the MAC address status of the MAC address, where both the IP address status and the MAC address status include: offline, online, and in the process of authentication; A sending unit, configured to send a challenge request message to the access gateway when it is determined that both the IP address status of the IP address and the MAC address status of the MAC address are offline. 8. The Portal server according to claim 7, wherein the determining unit is specifically configured to utilize the locally maintained correspondence between the account number, the IP address status and the MAC address status when the corresponding relationship between the account number and the IP address status is maintained locally. Correspondence, determining the IP address status of the IP address and the MAC address status of the MAC address; When there is no corresponding relationship between the maintenance account number, IP address status and MAC address status locally, send to the remote user dial-up authentication system Radius server to carry the account number in the login request message, IP address and MAC address query user accounting information request message, and according to the query response message carrying the IP address state of the IP address and the MAC address state information of the MAC address returned by the Radius server, determine the IP address state of the IP address and the MAC address MAC address status, the Radius server maintains the corresponding relationship between account number, IP address status and MAC address status. 9. The Portal server according to claim 7, wherein the sending unit is further configured to push a page of “please re-enter account information” to the terminal when the determining unit determines that the IP address status is online; The receiving unit is also used for receiving the confirmation of the terminal to re-input the account information; Described Portal server also includes: The redirection unit is configured to redirect the terminal to the Portal login page when receiving the determination of the terminal to re-enter the account information. 10. The Portal server according to claim 7, wherein the determining unit is further configured to determine whether the account corresponding to the MAC address is identical to the current login account when determining that the MAC address status is online ; The sending unit is also used to send an instruction to the access gateway when the determining unit determines that the account corresponding to the MAC address is the same as the current login account, instructing the access gateway to send a stop charging request message to the Radius server ; and after the receiving unit receives the stop accounting response message from the Radius server returned by the access gateway, it sends a Challenge request message to the access gateway; The receiving unit is further configured to receive a stop-accounting response message from the Radius server returned by the access gateway. 11. The Portal server according to claim 10, wherein the sending unit is further configured to, when determining that the account corresponding to the MAC address is not the same as the current login account, push the terminal to include "Already online, the online account is the account corresponding to the MAC address described above, please select the online account to log in or the account to log in this time" information page; The receiving unit is also used to receive the online account login information and current account login information sent by the terminal, and receive the login request carrying the online account and the password of the online account sent by the terminal; The sending unit is further configured to send an instruction to the access gateway when receiving information about the current login account login sent by the terminal or receiving a login request carrying an online account and a password of the online account sent by the terminal, Instruct the access gateway to send a stop billing request message to the Radius server; when receiving the online account login information sent by the terminal, push the Portal login page to the terminal, ask the user to enter the password of the online account, and receive it in the receiving unit When receiving a login request carrying an online account and a password of the online account sent by the terminal, an instruction is sent to the access gateway to instruct the access gateway to send a stop-accounting request message to the Radius server. 12. The Portal server according to claim 10, wherein the determining unit is specifically configured to utilize the locally maintained correspondence between the account number, the IP address status and the MAC address status when the corresponding relationship between the account number and the IP address status is maintained locally. Correspondence, determining the account corresponding to the MAC address, and comparing the account corresponding to the MAC address with the current login account; When there is no corresponding relationship between the maintenance account number, IP address status and MAC address status locally, send a query user accounting information request message carrying the current account number, IP address and MAC address to the Radius server of the remote user dial-up authentication system , and receive a query response message that carries the MAC address online and whether the account corresponding to the MAC address is the same as the current login account returned by the Radius server, and the Radius server maintains the account number, IP address status and MAC Correspondence between address states. 13. A Web authentication user login system, characterized in that the system includes: a terminal, a portal server and an access gateway; The terminal is configured to send a login request message carrying the login account, the terminal's IP address and the terminal's MAC address information to the Portal server; The Portal server is configured to determine the IP address status of the IP address and the MAC address status of the MAC address after receiving the login request message, the IP address status and the MAC address status both include: offline, Online and during the authentication process; and when it is determined that the IP address status of the IP address and the MAC address status of the MAC address are not online, send a Challenge request message to the access gateway; The access gateway is used to receive the Challenge request message sent by the Portal server. 14. The system according to claim 13, wherein, when the Portal server locally maintains the corresponding relationship between the account number, the IP address state and the MAC address state, the Portal server is specifically used to utilize all the locally maintained The corresponding relationship, determine the IP address status of the IP address and the MAC address status of the MAC address; When the Portal server locally does not maintain the corresponding relationship between the account number, the IP address state and the MAC address state, the system also includes: a remote user dial-up authentication system Radius server; Described Portal server is also used for sending to Radius server the inquiry user billing information request message that carries the account number in the login request message, IP address and MAC address, and carries described IP address according to Radius server An IP address status and a query response message of the MAC address status information of the MAC address to determine the IP address status of the IP address and the MAC address status of the MAC address; Described Radius server is used for receiving described inquiry user billing information request message, the query response message that carries the IP address state of described IP address and the MAC address state information of described MAC address that Portal server returns, so The corresponding relationship among account number, IP address status and MAC address status is maintained in the Radius server. 15. The system according to claim 13, wherein the Portal server is further configured to push a page of “Please re-enter account information” to the terminal when it is determined that the IP address status is online, and when receiving When the terminal is confirmed to re-enter the account information, the terminal will be redirected to the Portal login page. 16. The system according to claim 13, wherein the Portal server is further configured to determine that the account corresponding to the MAC address is related to the current login account when the MAC address status of the MAC address is online. Whether the accounts are the same; when it is determined that the account corresponding to the MAC address is the same as the login account described this time, an instruction is sent to the access gateway to instruct the access gateway to send a stop charging request message to the Radius server; upon receiving the access After the gateway returns the Stop Accounting Response message from the Radius server, it sends a Challenge request message to the access gateway. 17. The system according to claim 16, wherein the Portal server is further configured to, when it is determined that the account corresponding to the MAC address is different from the current login account, push a message containing " Already online, the online account is the account corresponding to the MAC address mentioned above, please select the page where you have logged in with the online account or the "login with the current login account" information; and after receiving the information about the login with the current login account sent by the terminal , perform the following operations: send an instruction to the access gateway to instruct the access gateway to send a stop accounting request message to the Radius server to stop charging the online account; After the stop accounting response message, send a challenge request message to the access gateway; when receiving the online account login information sent by the terminal, perform the following operations: push the Portal login page to the terminal, and ask the user to enter the online account login information. password; receive the login request that carries the online account and the password of the online account sent by the terminal; send an instruction to the access gateway, instructing the access gateway to send a stop accounting request message to the Radius server; After receiving the Stop Accounting Response message from the Radius server, send a Challenge request message to the access gateway. 18. The system according to claim 16, wherein the Portal server is specifically configured to use the locally maintained correspondence between the account, the IP address state and the MAC address state when the Portal server is locally maintained. The above corresponding relationship, determine the account corresponding to the MAC address, and compare the account corresponding to the MAC address with the current login account; when the corresponding relationship between the account, IP address status and MAC address status is not maintained locally, Send the query user billing information request message carrying the current account number, IP address and MAC address to the Radius server of the remote user dial-up authentication system, and receive the information that carries the online MAC address and corresponds to the MAC address returned by the Radius server. An inquiry response message indicating whether the account number is the same as the current login account number, the corresponding relationship between the account number, IP address status and MAC address status is maintained in the Radius server.