CN107820246B - User authentication method, device and system - Google Patents

Abstract

A method, device and system for user authentication, which can improve authentication efficiency. It includes: the first AC receives the first information sent by the second AC, the first information includes the identifier of the second AC, and the first information is used to instruct the first user terminal to roam to the second AC; the first AC receives the information sent by the authentication server. Portal authentication message to the first user terminal; the first AC sends indication information to the authentication server, where the indication information is used to indicate that the first user terminal has roamed to the second AC.

Description

User authentication method, device and system

technical field

The present invention relates to the field of communications, and in particular, to a method, device and system for user authentication.

Background technique

A wireless local area network (wireless local area network, WLAN for short) generally includes an access controller (AC for short) and an access point (AP for short). The user terminal accesses the network through the AP, and the AC is used to centrally control the AP.

In some high-density scenarios, such as gymnasiums and exhibition halls that can accommodate a large number of spectators, in order to meet the needs of a large number of users accessing the network through WLAN, many access points will be deployed, and some of the access points will be controlled by multiple ACs. Ensure the network coverage and communication performance of the entire high-density scenario. User terminals can roam among multiple ACs. To ensure that the service of the user terminal will not be interrupted, the network configuration of the user terminal will not be changed during the process of the user terminal roaming among multiple ACs in the same AC roaming group. The above-mentioned network configuration may include an Internet Protocol (Internet Protocol, IP for short) address of the user terminal. For example, FIG. 1 shows a schematic diagram of a scenario of a method for user authentication in the prior art. As shown in FIG. 1 , after the user terminal roams from the first AC to the second AC, the user terminal still uses the IP address allocated to the user terminal by the first AC. When the user terminal needs to perform the portal (English: Portal) authentication service, the authentication server still obtains the IP address configured by the first AC for the user terminal, and the authentication server determines that the IP address belongs to the management scope of the first AC according to the IP address. , so the authentication server encapsulates the request into a Portal authentication packet and sends it to the first AC to which the user terminal belongs before roaming. Because the user terminal has roamed to the second AC, the first AC cannot find the matching information of the user terminal in the local user entry. At this time, the first AC will send a Portal authentication response packet to the authentication server, indicating that the authentication fails. . After receiving the Portal authentication response message indicating that the authentication fails, the authentication server sends the Portal authentication message to all ACs in the AC roaming group to which the first AC belongs. Until an AC (for example, the second AC) in the AC roaming group returns a Portal authentication response message indicating successful authentication to the authentication server, the authentication server will not consider the authentication of the user terminal successful; otherwise, it will consider the authentication failed and reject the user Terminal is online.

In the AC roaming scenario, after the first authentication of the user terminal fails, the authentication server sends Portal authentication packets to all ACs in the AC roaming group. In high-density venues, there are usually a large number of users and more devices in an AC roaming group. In this case, the number of Portal authentication packets processed by the authentication server and the AC device will be very large, which may cause the authentication server to fail to process them, resulting in the loss of authentication packets. In addition, a large number of Portal authentication packets will be occupied. Large network bandwidth affects the performance of the entire network.

SUMMARY OF THE INVENTION

The present application provides a method, device and system for user authentication, which can improve authentication efficiency.

In a first aspect, a method for user authentication is provided, including: a first access controller AC receiving first information sent by a second AC, where the first information includes an identifier of the second AC, and the first access controller AC receives first information sent by a second AC. The information is used to instruct the first user terminal to roam to the second AC; the first AC receives the Portal authentication packet for the first user terminal sent by the authentication server; the first AC sends the authentication server Sending indication information, where the indication information is used to indicate that the first user terminal has roamed to the second AC.

In this way, the first AC can obtain information indicating the AC to which the user terminal currently belongs from other ACs, so that when the authentication server sends the Portal authentication packet of the user terminal to the first AC, the first AC indicates to the authentication server the current state of the user terminal. It belongs to the second AC, so that the authentication server can re-send Portal authentication packets to the second AC. Therefore, the authentication server only needs to re-send Portal authentication packets to the second AC, which saves signaling overhead and improves authentication performance.

In a possible implementation manner, the indication information is carried in a Portal authentication response packet, and the Portal authentication response packet includes authentication failure type information, and the authentication failure type information is used to indicate the Portal authentication of the first user terminal. The authentication failure type of the authentication packet is authentication failure caused by user terminal roaming.

The first AC indicates to the authentication server the second AC to which the first user terminal currently belongs by carrying the indication information in the Portal authentication response packet, so that the authentication server only re-sends the Portal authentication packet to the second AC, without the need for roaming. All ACs in the group send Portal authentication packets, saving signaling overhead and improving authentication performance.

In a possible implementation manner, the identifier of the second AC includes an IP address of the second AC or a media access control (Media Access Control, MAC for short) address of the second AC, or includes the first AC address. The IP address of the second AC and the MAC address of the second AC.

In a possible implementation manner, the method further includes: the first AC sends second information to other ACs except the first AC, where the second information includes an identifier of the first AC, and The second information is used to indicate that the second user terminal has currently roamed to the first AC.

In a second aspect, a method for user authentication is provided, including: an authentication server receiving an authentication request from a user terminal, where the authentication request includes an identifier of the user terminal; and the authentication server sends a request to a first AC according to the authentication request. Sending a first Portal authentication message; the authentication server receives indication information from the first AC, the indication information indicates that the user terminal has currently roamed to the second AC; the authentication server, according to the indication information, Send a second Portal authentication packet to the second AC.

In the above authentication method, after sending the first Portal authentication message to the first AC, the authentication server may receive indication information from the first AC, and determine the second AC to which the user terminal currently belongs through the indication information, so that the authentication server can send the second AC to the second AC. Portal authentication packets are resent. Therefore, after the first Portal authentication fails, the authentication server only needs to resend Portal authentication packets to the second AC, which saves signaling overhead and improves authentication performance.

In a possible implementation manner, the indication information is carried in a Portal authentication response packet, and the Portal authentication response packet includes authentication failure type information, and the authentication failure type information is used to indicate the first user terminal The authentication failure type of the Portal authentication packet is authentication failure caused by user terminal roaming.

The first AC indicates to the authentication server the second AC to which the first user terminal currently belongs by carrying the indication information in the Portal authentication response packet, so that the authentication server only re-sends the Portal authentication packet to the second AC, without the need for roaming. All ACs in the group send Portal authentication packets, saving signaling overhead and improving authentication performance.

In a possible implementation manner, the indication information includes an identifier of the second AC; the identifier of the second AC may be the IP address of the second AC, or the MAC address of the second AC , or the IP address and MAC address of the second AC.

In a possible implementation manner, the identifier of the user terminal includes the IP address of the user terminal.

In a third aspect, there is provided an apparatus comprising means for performing the method of the first aspect. Based on the same inventive concept, since the principle of the device for solving the problem corresponds to the solution in the method design of the first aspect, the implementation of the device can refer to the implementation of the method, and repeated details will not be repeated.

In a fourth aspect, there is provided an apparatus comprising means for performing the method of the second aspect. Based on the same inventive concept, since the principle of the device for solving the problem corresponds to the solution in the method design of the second aspect, the implementation of the device can refer to the implementation of the method, and the repetition will not be repeated.

In a fifth aspect, a communication system is provided, where the communication system includes the apparatus of the third aspect and the apparatus of the fourth aspect.

In a sixth aspect, an apparatus is provided, comprising a memory for storing a program; a transceiver for communicating with other devices; a processor for executing a program in the memory, when the program is executed, when all When the program is executed, the processor is configured to execute the method of the first aspect.

In a seventh aspect, an apparatus is provided, comprising a memory for storing a program; a transceiver for communicating with other devices; a processor for executing a program in the memory, when the program is executed, when all When the program is executed, the processor is configured to execute the method of the second aspect.

In an eighth aspect, a communication system is provided, where the communication system includes the device of the sixth aspect and the device of the seventh aspect.

In a ninth aspect, a computer storage medium is provided for storing a computer program, the computer program comprising instructions for performing the method in the first aspect or any possible implementation manner of the first aspect.

In a tenth aspect, a computer storage medium is provided for storing a computer program, the computer program comprising instructions for performing the method in the second aspect or any possible implementation manner of the second aspect.

Description of drawings

In order to illustrate the technical solutions of the embodiments of the present invention more clearly, the following briefly introduces the accompanying drawings that need to be used in the embodiments of the present invention. Obviously, the drawings described below are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained from these drawings without any creative effort.

FIG. 1 is a schematic block diagram of a method for user authentication according to an embodiment of the present invention.

FIG. 2 is a schematic diagram of an application scenario of a method for user authentication provided by an embodiment of the present invention.

FIG. 3 is a flowchart of another user authentication method provided by an embodiment of the present invention.

FIG. 4 is a flowchart of a method for user authentication provided by an embodiment of the present invention.

FIG. 5 is a schematic block diagram of a method for user authentication provided by an embodiment of the present invention.

FIG. 6 is a schematic diagram of a format of a Portal packet provided by an embodiment of the present invention.

FIG. 7 is a schematic structural diagram of an apparatus for user authentication provided by an embodiment of the present invention.

FIG. 8 is a schematic structural diagram of another apparatus for user authentication provided by an embodiment of the present invention.

FIG. 9 is a schematic structural diagram of an apparatus for user authentication provided by an embodiment of the present invention.

FIG. 10 is a schematic structural diagram of another apparatus for user authentication provided by an embodiment of the present invention.

Detailed ways

In order to make the purposes, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be described below with reference to the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the present invention. examples, but not all examples. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

The user terminal may be a mobile phone supporting WLAN technology, a laptop (laptop), a vehicle-mounted mobile device, and the like.

FIG. 2 is a schematic diagram of an application scenario of a method for user authentication according to an embodiment of the present invention. As shown in Figure 2, in a high-density scenario, an AC roaming group includes multiple ACs, and each AC may need to manage many APs. The ACs in the AC roaming group may transmit data through a communication link, and the communication link may be a tunnel. The user terminal can access the network through the AP. When the user terminal roams in the same AC roaming group, the network configuration information may not be changed. That is, the user terminal can always use the network configuration information allocated by the AC when it first accesses an AC in the AC roaming group. The network configuration information may include an IP address of the user terminal, an access control list (access control list, ACL) of the user terminal, a virtual local area network (virtual local area network, VLAN) where the user terminal is located, and the like. For example, the IP address of the user terminal in the roaming process in FIG. 2 may be the IP address configured for the user terminal by the first AC when the user terminal initially accesses the first AC in the AC roaming group.

FIG. 3 is a schematic block diagram of a method 300 for user authentication according to an embodiment of the present invention. As shown in Figure 3, the method 300 includes:

S301. A first AC receives first information sent by a second AC, where the first information includes an identifier of the second AC, and the first information is used to instruct a first user terminal to roam to the second AC.

The first AC and the second AC may be ACs belonging to the same AC roaming group. The AC roaming group may include multiple ACs. A communication link exists between the ACs in the AC roaming group, and each AC in the AC roaming group can perform data synchronization and packet forwarding through the communication link.

Optionally, the first AC may be an AC to which the first user terminal belongs before roaming. Optionally, the current network configuration of the user terminal may be configured by the first AC for the user terminal.

Optionally, when the first user terminal roams to a new AC in the AC roaming group, the new AC may indicate to other ACs in the roaming group the AC to which the first user terminal currently roams. For example, when the first user terminal roams to the second AC, the second AC may send first information to each AC in the AC roaming group, where the first information is used to indicate that the first user terminal is currently roaming to the second AC . The second AC can be any AC in the roaming group. Alternatively, the second AC determines that the IP address of the first user terminal belongs to the management of the first AC by parsing the IP address of the first user terminal. The second AC may only send the first information to the first AC to save signaling overhead. After receiving the first information, other ACs in the roaming group may locally save or update the first information. In other words, the first AC may store the mapping relationship between the first user terminal and the second AC to which the first user terminal currently roams.

ACs in a roaming group can synchronize information through communication links between ACs. Information synchronized between ACs may include network configuration information of user terminals managed by each AC. For example, the IP addresses of the user terminals, the ACL information of the user terminals, and the VLAN information of the user terminals can be synchronized between the ACs. Optionally, the ACs in the AC roaming group may also synchronize the mapping relationship between the user terminal and the second AC to which the user terminal currently belongs.

Optionally, the identifier of the second AC may include at least one of the following information: an IP address of the second AC and a MAC address of the second AC.

Optionally, the AC in this embodiment of the present invention may be a wireless access controller. Optionally, the above-mentioned roaming of the first user terminal to the first AC may refer to the roaming of the first user terminal to the coverage of the AP managed by the first AC. In other words, the AP currently connected to by the first user terminal is an AP managed by the first AC.

S302, the first AC receives a Portal authentication packet for the first user terminal sent by an authentication server.

Optionally, an authentication server can be used to control access rights. For example, the authentication server can be used to verify the user's account and password during the process of the user terminal accessing the network.

Optionally, before the authentication server sends the Portal authentication message of the first user terminal, the first user terminal may send a Portal authentication request to the authentication server, and the Portal authentication request may be used to request the authentication server to authenticate the access authority of the first user terminal. .

Optionally, the authentication server may send a Portal authentication packet to the first AC according to the Portal authentication request. Those skilled in the art can understand that since the network configuration of the first user terminal after roaming is not changed, that is, the network configuration of the first user terminal is still the network configuration before roaming (ie the network configuration configured by the first AC). Therefore, after analyzing the network configuration information of the first user terminal, the authentication server determines that the first user terminal is managed by the first AC. Therefore, the authentication server sends the Portal authentication packet to the first AC according to the Portal authentication request. As an example, the Portal authentication request sent by the first user terminal to the authentication server may include the IP address of the first user terminal, and the first AC determines that the first user terminal is managed by the first AC according to the IP address of the first user terminal. Alternatively, before the first user terminal sends the Portal authentication request to the authentication server, the first user terminal needs to establish a hypertext transfer protocol (Hyper Text Transfer Protocol, HTTP) link with the authentication server. Since the IP address used by the first user terminal when establishing the HTTP link is the IP address managed by the first AC, the first AC can also obtain the IP address of the first user terminal by querying the HTTP link, and further determine that the first user terminal is managed by the first AC. One AC management. Therefore, the authentication server will send the Portal authentication packet of the first user terminal to the first AC.

S303, the first AC sends indication information to the authentication server, where the indication information is used to indicate that the first user terminal has roamed to the second AC.

Optionally, after the first AC receives the Portal authentication packet of the first user terminal. The first AC may locally query the status of the first user terminal. Since the first AC can locally save the mapping relationship between the first user terminal and the second AC according to the first information, the first AC can determine that the first user terminal currently belongs to the second AC according to the mapping relationship or the first information. AC's management scope. Therefore, the first AC can send the above-mentioned indication information to the authentication server. In order to facilitate the authentication server to re-send the Portal authentication packet to the second AC according to the indication information.

In this embodiment of the present invention, the first AC may obtain information indicating the AC to which the user terminal currently belongs from other ACs, so that when the authentication server sends the Portal authentication packet of the user terminal to the first AC, the first AC sends the authentication message to the authentication server. The server indicates the second AC to which the user terminal currently belongs, so that the authentication server can re-send the Portal authentication packet to the second AC. Therefore, the authentication server only needs to re-send the Portal authentication packet to the second AC, which saves signaling overhead and improves the Certified performance.

Optionally, in method 300, the indication information can be carried in a Portal authentication response message, and the Portal authentication response message includes authentication failure type information, and the authentication failure type information is used to indicate the first user. The authentication failure type of the Portal authentication packet of the terminal is authentication failure caused by user terminal roaming.

For example, after receiving the Portal authentication packet of the first user terminal, the first user terminal may query the state of the first user terminal in a local user table entry. Since the first user terminal has roamed to the second AC. The first AC cannot query the matching information of the first user terminal in the user entry. Therefore, the first AC can send a Portal authentication response message to the authentication server. and carry the indication information in the Portal authentication response message. At the same time, the Portal authentication response packet may carry authentication failure type information to indicate that the authentication failure type is authentication failure caused by user terminal roaming.

In the embodiment of the present invention, the first AC indicates the second AC to which the first user terminal currently belongs to the authentication server by carrying the indication information in the Portal authentication failure packet, so that the authentication server only re-sends the Portal to the second AC authentication packets, instead of sending Portal authentication packets to all ACs in the roaming group, saving signaling overhead and improving authentication performance.

Optionally, in method 300, the indication information includes at least one of the following information: an IP address of the second AC and a MAC address of the second AC.

For example, in a scenario where the first user terminal is not authenticated, after the first user terminal roams from the first AC to the second AC, the second AC notifies the first AC through the communication link between the ACs that the first user terminal has been connected to the second AC, and report the IP address or MAC address of the second AC to the first AC. The first AC needs to maintain the mapping relationship between the first user terminal and the second AC, which is used to inform the authentication server of the IP address or the second AC to which the first user terminal actually roams through instruction information after the first user terminal fails to roam authentication. MAC address of the second AC, so that the authentication server can resend Portal authentication packets to the second AC.

Optionally, in the method 300, the method further includes: the first AC sends second information to other ACs except the first AC, where the second information includes an identifier of the first AC, and the second information includes an identifier of the first AC. The second information is used to indicate that the second user terminal has currently roamed to the first AC.

The above-mentioned other ACs may be ACs located in the same AC roaming group as the first AC. When the second user terminal roams to the management range of the first AC, the first AC may send second information to other ACs in the same AC roaming group through the communication link to indicate that the second user terminal is currently roaming to the first AC. In order to facilitate information synchronization of other ACs in the roaming group, for example, the other ACs may save the mapping relationship between the second user terminal and the first AC.

Optionally, FIG. 4 shows a schematic block diagram of a method 400 for user authentication according to an embodiment of the present invention, and the method 400 may be executed by an authentication server. The content in the method shown in FIG. 4 that is the same as or similar to that in FIG. 3 can be referred to the description related to FIG. 2 , and details are not repeated here. Method 400 includes:

S401. An authentication server receives an authentication request from a user terminal, where the authentication request includes an identifier of the user terminal.

Optionally, the identifier of the user terminal includes the IP address of the user terminal. The IP address of the user terminal may be allocated by the first AC for the user terminal.

S402, the authentication server sends a first Portal authentication packet to the first AC according to the authentication request.

Optionally, the first AC may be an AC to which the user terminal belongs before roaming.

Optionally, the authentication server determines that the AC corresponding to the user terminal is the first AC by analyzing the authentication request. The authentication server may also determine the first AC according to the network configuration information of the user terminal. As an example, the Portal authentication request sent by the first user terminal to the authentication server may include the IP address of the first user terminal, and the first AC determines that the first user terminal is managed by the first AC according to the IP address of the first user terminal. Or, before the first user terminal sends the Portal authentication request to the authentication server, the first user terminal needs to establish an HTTP link with the authentication server. Since the IP address used by the first user terminal when establishing the HTTP link is the IP address managed by the first AC, the first AC can also obtain the IP address of the first user terminal by querying the HTTP link, and further determine that the first user terminal is managed by the first AC. One AC management. Therefore, the authentication server will send the Portal authentication packet of the first user terminal to the first AC.

S403: The authentication server receives indication information from the first AC, where the indication information indicates that the user terminal has currently roamed to the second AC.

Optionally, the indication information may be carried in a Portal authentication response packet, and the Portal authentication response packet is used to respond to the first Portal authentication packet. The Portal authentication response message includes authentication failure type information, and the authentication failure type information is used to indicate that the authentication failure type of the Portal authentication message of the first user terminal is an authentication failure caused by user terminal roaming.

Optionally, the indication information may include at least one of the following information: the IP address of the second AC and the MAC address of the second AC.

S404, the authentication server sends a second Portal authentication packet to the second AC according to the indication information.

Optionally, the authentication server may determine the IP address and/or MAC address of the second AC according to the indication information, and send the second Portal authentication packet to the second AC.

In this embodiment of the present invention, after sending the first Portal authentication packet to the first AC, the authentication server may receive indication information from the first AC, and use the indication information to determine the second AC to which the user terminal currently belongs, so that the authentication server can send the first AC to the first AC. The second AC resends Portal authentication packets. Therefore, after the first Portal authentication fails, the authentication server only needs to resend Portal authentication packets to the second AC. This saves signaling overhead and improves authentication performance.

The following describes the embodiments of the present invention in more detail with reference to specific examples. It should be noted that the example in FIG. 5 is only for helping those skilled in the art to understand the embodiment of the present invention, and is not intended to limit the embodiment of the present invention to the exemplified specific numerical values or specific scenarios. According to the example shown in FIG. 5 , those skilled in the art can obviously make various equivalent modifications or changes, and such modifications or changes also fall within the scope of the embodiments of the present invention. As shown in FIG. 5 , AP1 is managed by the first AC, and AP2 is managed by the second AC. The method 500 of user authentication shown in FIG. 5 includes:

S501, after the user terminal roams from the area covered by AP1 to the area covered by AP2 (the IP address of the user terminal will not change when roaming between ACs), a Portal authentication request is initiated to the authentication server.

Optionally, after the user terminal roams to the coverage area of AP2, the second AC may send first information to the first AC through the inter-AC communication link to indicate that the user terminal is currently roaming within the coverage area of the second AC. The first information may include the IP address and MAC address of the second AC.

S502, after receiving the Portal authentication request from the user terminal, the authentication server encapsulates the Portal authentication request into a first Portal authentication packet and sends it to the first AC.

For example, the Portal authentication request may include a username and password. After receiving the Portal authentication request and verifying the user name and password, the authentication server encapsulates the Portal authentication request into a Portal authentication packet and sends it to the first AC.

S503, the first AC locally inquires that the user terminal has roamed to the second AC, and sends a Portal authentication failure message to the authentication server.

Optionally, the packet may include a roaming authentication error code, and the IP address and/or MAC address of the second AC. The roaming authentication error code is used to indicate that Portal authentication fails due to roaming.

S504, after receiving the Portal authentication failure message, the authentication server determines that the AC to which the user terminal currently roams is the second AC, and re-sends the second Portal authentication request to the second AC.

S505, after receiving the second Portal authentication request, the second AC sends an authentication success message to the authentication server, and the user terminal successfully goes online on the second AC.

In the embodiment of the present invention, for the problem that Portal authentication fails due to roaming of the user terminal without authentication, the AC to which the user terminal actually belongs after roaming only needs to be re-authenticated to find out, which reduces the need for authentication servers and equipment. and bandwidth burden, which improves the authentication performance of the authentication server in the roaming scenario.

Optionally, in the methods described in FIGS. 3 to 5 , after the roaming authentication fails, the first AC may carry the IP address and MAC address of the AC to which the user terminal actually belongs to the authentication failure message, and return it to the authentication failure message. server.

A Portal packet consists of a packet field and an attribute field, and FIG. 6 shows a schematic diagram of the format of the Portal packet according to an embodiment of the present invention. Referring to Figure 6, the message fields may include: version number (Ver), message type (Type), authentication mode (AuthType), reserved field (Rsvd), message serial number (SerialNo), message ID (RequestID), user's IP address (UserIP) and port number (UserPort), error type (ErrorCode) and attribute number (AttrNum); the attribute field (Attribute Data) includes: attribute type (AttrType), attribute length (AttrLen) , attribute value (Data). Attribute fields are used to describe user information, such as user name, password, etc. A packet can contain multiple attribute fields. The packet type is used to indicate the type of Portal packet. For example, the packet types may include Portal authentication request packets and Portal authentication response packets.

In this embodiment of the present invention, a roaming authentication error code, such as 99, may be carried in the ErrorCode field of the Portal packet, which is used to identify the type (cause) of the authentication failure that the roaming authentication fails. In addition, a type-length-value (type-length-vlaue, abbreviated TLV) may be added to the Attribute Data field, which is used to carry the IP address and/or MAC address of the second AC to which the user terminal is currently roaming. . An attribute number (Attribute) may be added to identify the IP address and MAC address of the AC to which the user terminal currently roams; as an example, the attribute number of the IP address may be 0xE1, and the attribute number of the MAC address may be 0xE2.

The user authentication method according to the embodiment of the present invention is described above with reference to FIG. 1 to FIG. 6 , and the apparatus of the embodiment of the present invention will be described in detail below with reference to FIG. 7 to FIG. 10 .

FIG. 7 shows a schematic block diagram of an apparatus 700 for user authentication according to an embodiment of the present invention. The apparatus 700 may be an AC, or the apparatus 700 may also be a physical module having an AC function. The apparatus 700 may perform the steps performed by the first AC in the methods of FIGS. 1 to 6 . In this embodiment of the present invention, the apparatus 700 may be referred to as the first AC. Apparatus 700 includes:

A receiving module 710, configured to receive first information sent by a second AC, where the first information includes an identifier of the second AC, and the first information is used to instruct the first user terminal to roam to the second AC ;

The receiving module 710 receives the Portal authentication message to the first user terminal sent by the authentication server;

The sending module 720 is configured to send indication information to the authentication server, where the indication information is used to indicate that the first user terminal has roamed to the second AC.

In this embodiment of the present invention, the first AC may obtain information indicating the AC to which the user terminal currently belongs from other ACs, so that when the authentication server sends the Portal authentication packet of the user terminal to the first AC, the first AC sends the authentication message to the authentication server. The server indicates the second AC to which the user terminal currently belongs, so that the authentication server can re-send the Portal authentication packet to the second AC. Therefore, the authentication server only needs to re-send the Portal authentication packet to the second AC, which saves signaling overhead and improves the Certified performance.

FIG. 8 shows a schematic block diagram of an apparatus 800 according to an embodiment of the present invention. The apparatus 800 may be an authentication server, or the apparatus 800 may also be an entity module having an authentication server function. The apparatus 800 may perform the steps performed by the authentication server in the methods of FIGS. 1 to 6 . In this embodiment of the present invention, the apparatus 800 may be referred to as an authentication server. Apparatus 800 includes:

A receiving module 810, configured to receive an authentication request from a user equipment user terminal, where the authentication request includes an identifier of the user terminal;

A sending module 820, configured to send a first Portal authentication message to the first access controller AC according to the authentication request;

The receiving module 810 is further configured to receive indication information from the first AC, where the indication information indicates that the user terminal has currently roamed to the second AC;

The sending module 820 is further configured to send a second Portal authentication packet to the second AC according to the indication information.

In this embodiment of the present invention, after sending the first Portal authentication packet to the first AC, the authentication server may receive indication information from the first AC, and use the indication information to determine the second AC to which the user terminal currently belongs, so that the authentication server can send the first AC to the first AC. The second AC resends Portal authentication packets. Therefore, after the first Portal authentication fails, the authentication server only needs to resend Portal authentication packets to the second AC. This saves signaling overhead and improves authentication performance.

FIG. 9 shows a schematic block diagram of an apparatus 900 according to an embodiment of the present invention. The apparatus 900 may be an AC, or the apparatus 900 may also be a physical module having an AC function. The apparatus 900 may perform the steps performed by the first AC in the methods of FIGS. 1 to 6 . In this embodiment of the present invention, the apparatus 900 may be referred to as the first AC. Apparatus 900 includes:

a memory 910 for storing programs;

A transceiver 920 for communicating with other devices;

The processor 930 is configured to execute the program in the memory 910. When the program is executed, the processor 930 is configured to receive first information sent by the second AC, where the first information includes the second AC , the first information is used to instruct the first user terminal to roam to the second AC; and receive the Portal authentication message for the first user terminal sent by the authentication server through the transceiver 920; The transceiver 920 sends indication information to the authentication server, where the indication information is used to indicate that the first user terminal has roamed to the second AC.

In this embodiment of the present invention, the first AC may obtain information indicating the AC to which the user terminal currently belongs from other ACs, so that when the authentication server sends the Portal authentication packet of the user terminal to the first AC, the first AC sends the authentication message to the authentication server. The server indicates the second AC to which the user terminal currently belongs, so that the authentication server can re-send the Portal authentication packet to the second AC. Therefore, the authentication server only needs to re-send the Portal authentication packet to the second AC, which saves signaling overhead and improves the Certified performance.

FIG. 10 shows a schematic block diagram of an apparatus 1000 according to an embodiment of the present invention. The apparatus 1000 may be an authentication server, or the apparatus 1000 may also be an entity module having an authentication server function. The apparatus 1000 may perform the steps performed by the authentication server in the methods of FIGS. 1 to 6 . In this embodiment of the present invention, the apparatus 1000 may be referred to as an authentication server. Apparatus 1000 includes:

a memory 1010 for storing programs;

A transceiver 1020 for communicating with other devices;

The processor 1030 is configured to execute the program in the memory 1010. When the program is executed, the processor 1030 is configured to receive, through the transceiver 1020, an authentication request from a user terminal of user equipment, where the authentication request includes the the identifier of the user terminal; and for sending a first Portal authentication message to the first access controller AC through the transceiver 1020 according to the authentication request; and for sending the first Portal authentication message from the first AC through the transceiver 1020 receiving indication information, where the indication information indicates that the user terminal has currently roamed to the second AC; and being configured to send a second Portal authentication packet to the second AC through the transceiver 1020 according to the indication information.

In this embodiment of the present invention, after sending the first Portal authentication packet to the first AC, the authentication server may receive indication information from the first AC, and use the indication information to determine the second AC to which the user terminal currently belongs, so that the authentication server can send the first AC to the first AC. The second AC resends Portal authentication packets. Therefore, after the first Portal authentication fails, the authentication server only needs to resend Portal authentication packets to the second AC. This saves signaling overhead and improves authentication performance.

Additionally, the terms "system" and "network" are often used interchangeably herein. The term "and/or" in this article is only an association relationship to describe the associated objects, indicating that there can be three kinds of relationships, for example, A and/or B, it can mean that A exists alone, A and B exist at the same time, and A and B exist independently B these three cases. In addition, the character "/" in this document generally indicates that the related objects are an "or" relationship.

It should be understood that, in various embodiments of the present invention, the size of the sequence numbers of the above-mentioned processes does not mean the sequence of execution, and the execution sequence of each process should be determined by its functions and internal logic, rather than the embodiments of the present invention. implementation constitutes any limitation.

It can be understood that the processor in the embodiment of the present invention may be an integrated circuit chip, which has signal processing capability. In the implementation process, each step of the above method embodiments may be completed by a hardware integrated logic circuit in a processor or an instruction in the form of software. The above-mentioned processor may be a general-purpose processor, a digital signal processor (Digital Signal Processor, DSP for short), an application specific integrated circuit (Application Specific Integrated Circuit, ASIC for short), or other programmable logic devices, discrete gate or transistor logic devices, and discrete hardware. components. The methods, steps, and logical block diagrams disclosed in the embodiments of the present invention can be implemented or executed. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like. The steps of the method disclosed in conjunction with the embodiments of the present invention may be directly embodied as executed by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules may be located in random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, registers and other storage media mature in the art. The storage medium is located in the memory, and the processor reads the information in the memory, and completes the steps of the above method in combination with its hardware.

It can be understood that the memory in the embodiment of the present invention may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory. Wherein, the non-volatile memory may be Read-Only Memory (ROM), Programmable Read-Only Memory (PROM), Erasable Programmable Read-Only Memory (Erasable PROM, EPROM), Erase programmable read-only memory (Electrically EPROM, EEPROM) or flash memory. The volatile memory may be random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (Double Data Rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (Enhanced SDRAM, ESDRAM), synchronous link dynamic random access memory (Synchlink DRAM, SLDRAM) And direct memory bus random access memory (DirectRambus RAM, DR RAM). It should be noted that the memory of the systems and methods described herein is intended to include, but not be limited to, these and any other suitable types of memory.

Those of ordinary skill in the art can realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each particular application, but such implementations should not be considered beyond the scope of the present invention.

Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described systems, devices and units may refer to the corresponding processes in the foregoing method embodiments, which will not be repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed system, apparatus and method may be implemented in other manners. For example, the apparatus embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented. On the other hand, the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.

The functions, if implemented in the form of software functional units and sold or used as independent products, may be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention can be embodied in the form of a software product in essence, or the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other media that can store program codes .

The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention. should be included within the protection scope of the present invention. Therefore, the protection scope of the present invention should be subject to the protection scope of the claims.

Claims (10)

1. A method of user authentication, comprising:

a first Access Controller (AC) receives first information sent by a second AC, wherein the first information comprises an identifier of the second AC, and the first information is used for indicating a first user terminal to roam to the second AC;

the first AC receives a first Portal authentication message sent by an authentication server to the first user terminal, wherein the first Portal authentication message is used for verifying a Portal authentication request sent by the first user terminal;

the first AC sends a Portal authentication response message to the authentication server, the Portal authentication response message is used for indicating that the first Portal authentication message fails to be authenticated, the Portal authentication response message comprises indication information, and the indication information is used for indicating that the first user terminal roams to the second AC, so that the authentication server sends a second Portal authentication message to the second AC.

2. The method of claim 1, wherein the Portal authentication response message includes authentication failure type information, and the authentication failure type information is used to indicate that the authentication failure type of the Portal authentication message of the first user terminal is authentication failure caused by user terminal roaming.

3. The method of claim 1 or 2, wherein the method further comprises:

and the first AC sends second information to other ACs except the first AC, wherein the second information comprises the identifier of the first AC, and the second information is used for indicating that a second user terminal has roamed to the first AC currently.

4. A method of user authentication, comprising:

an authentication server receives an authentication request of a user terminal, wherein the authentication request comprises an identifier of the user terminal;

the authentication server sends a first Portal authentication message to a first Access Controller (AC) according to the authentication request, wherein the first Portal authentication message is used for verifying a Portal authentication request sent by the user terminal;

the authentication server receives a Portal authentication response message from the first AC, the Portal authentication response message is used for indicating that the first Portal authentication message fails to authenticate, the Portal authentication response message comprises indication information, and the indication information indicates that the user terminal has roamed to a second AC currently;

and the authentication server sends a second Portal authentication message to the second AC according to the indication information, wherein the second Portal authentication message is used for verifying the Portal authentication message.

5. The method according to claim 4, wherein the indication information is carried in the Portal authentication response message, the Portal authentication response message includes authentication failure type information, and the authentication failure type information is used for indicating that the authentication failure type of the Portal authentication message of the user terminal is authentication failure caused by user terminal roaming.

6. An apparatus for user authentication, comprising:

a receiving module, configured to receive first information sent by a second access controller AC, where the first information includes an identifier of the second AC, and the first information is used to indicate that a first user terminal roams to the second AC;

the receiving module is further configured to receive a first Portal authentication message sent by an authentication server to the first user terminal, where the first Portal authentication message is used to verify a Portal authentication request sent by the first user terminal;

and the sending module is used for sending a Portal authentication response message to the authentication server, wherein the Portal authentication response message is used for indicating that the first Portal authentication message fails to be authenticated, and the Portal authentication response message comprises indication information which is used for indicating that the first user terminal roams to the second AC so that the authentication server can send a second Portal authentication message to the second AC.

7. The apparatus of claim 6, wherein the Portal authentication response message includes authentication failure type information indicating that the authentication failure type of the Portal authentication message of the first user terminal is authentication failure caused by user terminal roaming.

8. The apparatus according to claim 6 or 7, wherein the apparatus is a first AC, and the sending module is further configured to send second information to other ACs except the first AC, where the second information includes an identifier of the first AC, and the second information is used to indicate that a second user terminal has currently roamed to the first AC.

9. An apparatus for user authentication, comprising:

a receiving module, configured to receive an authentication request of a user terminal, where the authentication request includes an identifier of the user terminal;

a sending module, configured to send a first Portal authentication packet of the user terminal to a first access controller AC according to the authentication request, where the first Portal authentication packet is used to verify a Portal authentication request sent by the user terminal;

the receiving module is further configured to receive a Portal authentication response message from the first AC, where the Portal authentication response message is used to indicate that the first Portal authentication message fails to authenticate, and the Portal authentication response message includes indication information indicating that the user terminal has currently roamed to a second AC;

the sending module is further configured to send a second Portal authentication packet to the second AC according to the indication information, where the second Portal authentication packet is used to verify the Portal authentication packet.

10. The apparatus of claim 9, wherein the Portal authentication response message includes authentication failure type information indicating that the authentication failure type of the Portal authentication message of the user terminal is authentication failure caused by user terminal roaming.

Images