CN107547562B - Portal authentication method and device - Google Patents
Portal authentication method and device Download PDFInfo
- Publication number
- CN107547562B CN107547562B CN201710875442.4A CN201710875442A CN107547562B CN 107547562 B CN107547562 B CN 107547562B CN 201710875442 A CN201710875442 A CN 201710875442A CN 107547562 B CN107547562 B CN 107547562B
- Authority
- CN
- China
- Prior art keywords
- user
- portal
- authentication
- portal authentication
- network request
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 43
- 230000032683 aging Effects 0.000 claims abstract description 12
- 238000001514 detection method Methods 0.000 claims description 21
- 238000012545 processing Methods 0.000 claims description 17
- 230000008569 process Effects 0.000 description 8
- 238000010586 diagram Methods 0.000 description 4
- 239000000523 sample Substances 0.000 description 4
- 230000009471 action Effects 0.000 description 3
- 230000004044 response Effects 0.000 description 3
- 230000006855 networking Effects 0.000 description 2
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 230000002431 foraging effect Effects 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- COCAUCFPFHUGAA-MGNBDDOMSA-N n-[3-[(1s,7s)-5-amino-4-thia-6-azabicyclo[5.1.0]oct-5-en-7-yl]-4-fluorophenyl]-5-chloropyridine-2-carboxamide Chemical compound C=1C=C(F)C([C@@]23N=C(SCC[C@@H]2C3)N)=CC=1NC(=O)C1=CC=C(Cl)C=N1 COCAUCFPFHUGAA-MGNBDDOMSA-N 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 239000007787 solid Substances 0.000 description 1
- 238000012546 transfer Methods 0.000 description 1
Images
Landscapes
- Mobile Radio Communication Systems (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The application discloses a portal authentication method and device. The method comprises the following steps: receiving a network request message sent by a sender, wherein the network request message carries a user identifier; detecting whether portal authentication can be carried out based on the network request message or not according to the user identification, and enabling a portal user table and an ARP table entry corresponding to the user identification stored on a BRAS when the portal authentication cannot be carried out; and after the portal user table and the ARP table entry are deleted, carrying out portal authentication based on the network request message. According to the method and the device, cross-VLAN roaming can be supported, a user can be guaranteed to trigger roaming to be on line in time, and the user can be on line without waiting for the aging of a portal user table.
Description
Technical Field
The present application relates to the field of network communication technologies, and in particular, to a portal authentication method and apparatus.
Background
portal authentication (portal authentication) is also commonly called Web authentication, that is, a user name and a password input by a user are received through a Web page, and identity authentication is performed on the user, so that the purpose of controlling user access is achieved. The portal network mainly comprises: the Access device comprises a portal client, an Access device and a portal Server, wherein the Access device can be a BRAS (broadband Access Server).
In the portal network, an external network is connected, for example, an access device connected with the internet is connected with a portal client and a portal server, and the access device mainly plays a role in controlling the flow initiated by the portal client for accessing the external network; the portal server is used for receiving an authentication request of the portal client and providing a Web authentication page for the portal client so that a user can input authentication information such as a user name and a password in the Web authentication page to authenticate the authentication information of the portal client.
Disclosure of Invention
The application provides a portal authentication method and a portal authentication device, which are used for solving the problem that the conventional portal authentication does not support roaming across VALNs.
In order to achieve the purpose, the technical scheme of the application is realized as follows:
in one aspect, the present application provides a portal authentication method, which is applied to a BRAS, and the method includes:
receiving a network request message sent by a sender, wherein the network request message carries a user identifier;
detecting whether portal authentication can be carried out based on the network request message or not according to the user identification, and enabling a portal user table and an ARP table entry corresponding to the user identification stored on a BRAS when the portal authentication cannot be carried out;
and after the portal user table and the ARP table entry are disabled, carrying out portal authentication based on the network request message.
On the other hand, the application also provides a portal authentication device, which is applied to the BRAS and comprises:
a receiving unit, configured to receive a network request message sent by a sender, where the network request message carries a user identifier;
the detection unit is used for detecting whether portal authentication can be carried out based on the network request message or not according to the user identification;
the authentication processing unit is used for enabling the portal user table and the ARP table entry corresponding to the user identification stored on the BRAS when the portal authentication cannot be carried out; and after the portal user table and the ARP table entry are disabled, carrying out portal authentication based on the network request message.
In another aspect, the present application provides a portal authentication device comprising a processor and a machine-readable storage medium storing machine-executable instructions executable by the processor, the processor being caused by the machine-executable instructions to: the portal authentication method described above is performed.
In another aspect, the present application provides a machine-readable storage medium storing machine-executable instructions that, when invoked and executed by a processor, cause the processor to: the portal authentication method described above is performed.
The beneficial effect of this application is: based on the premise that when the portal user table and the ARP table entry corresponding to the user identifier are stored in the BRAS, the ARP table entry cannot realize data forwarding between the BRAS and a sender, whether portal authentication can be performed is detected through the user identifier of the network request message, and when the portal authentication cannot be performed, the portal user table and the ARP table entry corresponding to the user identifier stored in the BRAS are deleted, so that the portal authentication can be performed based on the network request message, the user is ensured to trigger roaming on-line in time, and the portal user table does not need to wait for aging.
Drawings
Fig. 1 is a schematic view of portal networking in a roaming scenario according to an embodiment of the present application;
fig. 2 is a flowchart of a portal authentication method according to an embodiment of the present application;
fig. 3 is a schematic view of a portal authentication process provided in an embodiment of the present application;
fig. 4 is a block diagram of a portal authentication apparatus according to an embodiment of the present application;
fig. 5 is a schematic diagram of a hardware structure of a portal authentication apparatus according to an embodiment of the present application.
Detailed Description
Reference will now be made in detail to the exemplary embodiments, examples of which are illustrated in the accompanying drawings. When the following description refers to the accompanying drawings, like numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.
The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. As used in this application and the appended claims, the singular forms "a", "an", and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It should also be understood that the term "and/or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.
It is to be understood that although the terms first, second, third, etc. may be used herein to describe various information, such information should not be limited to these terms. These terms are only used to distinguish one type of information from another. For example, first information may also be referred to as second information, and similarly, second information may also be referred to as first information, without departing from the scope of the present application. The word "if" as used herein may be interpreted as "at … …" or "when … …" or "in response to a determination", depending on the context.
In the current portal authentication mode, after a user accesses a BRAS from a registration Area, the user roams to a roaming Area and accesses the BRAS from a Virtual Local Area Network (VLAN) of the roaming Area, at this time, if the user accesses the BRAS in the registration Area and a portal user table generated on the BRAS is not aged, if portal authentication is initiated again in the roaming Area, an authentication interface cannot be pushed out, and the portal authentication cannot be performed.
Fig. 1 exemplarily shows a portal networking diagram in a roaming scenario, where a user accesses a BRAS from a vlan a in an area a and then accesses a BRAS from a vlan B in an area B after roaming to the area B, and at this time, if the user accesses the BRAS in the area a and a portal user table generated on the BRAS is not aged, the user initiates a portal authentication again after reaching the area B, which may result in that no authentication interface can be derived, and the problem is caused because the user issues a corresponding ARP entry, such as an ARP entry with Index 1 in table 1, after generating the portal user table when accessing the area a, and generates an ARP entry with Index 2 in table 1 when the user initiates a network access again from the area B.
TABLE 1
| Index | IP | MAC | VLAN | PORT | Type |
| 1 | User-ip | User-mac | a | Port1 | R |
| 2 | User-ip | User-mac | b | Port2 | D |
As shown in table 1, after the user is online in the area B, the Type of the ARP entry generated by the BRAS is R, and if the portal user entry corresponding to the area a is not aged, the ARP entry with the corresponding Index 1 is not aged, and since the ARP entry 1 is generated earlier than the ARP entry 2, all subsequent traffic hitting the user on the BRAS is preferentially hit and traffic is sent according to the ARP entry 1.
Therefore, when a user initiates network access from the area B, the BRAS pushes the authentication interface of the WEB server, and at this time, since there is no problem in the traffic of the user to the server, the traffic returned from the server to the user will hit the ARP entry 1 preferentially when three-layer forwarding is performed on the BRAS, so that the traffic is issued to the area a, and the user in the area B cannot acquire the portal authentication interface naturally, and finally the user roaming fails.
In view of the above situation, embodiments of the present application provide a portal authentication method, which implements cross-VLAN or cross-port roaming.
Fig. 2 is a flowchart of a portal authentication method according to an embodiment of the present application, where the method of the present embodiment is applied to a BRAS, as shown in fig. 2, the method includes:
s210, receiving a network request message sent by a sender, wherein the network request message carries a user identifier.
When a user initiates a network access, a user terminal sends a network request message, such as an HTTP (HyperText Transfer Protocol) message, to a BRAS, where in this embodiment, a user identifier is illustratively a source IP address of the network request message, and certainly, in practical application, an MAC address may also be used as a user identifier, which is not specifically limited in this embodiment, as long as the user identifier can uniquely identify a portal user table, an ARP entry, and a roaming entry prohibited for the user in the entire portal network.
And S220, detecting whether portal authentication can be carried out based on the network request message according to the user identifier, and enabling a portal user table and an ARP table entry corresponding to the user identifier stored on the BRAS when the portal authentication cannot be carried out.
The portal user table and the ARP table entry corresponding to the user identifier can be enabled in a deleting and invalidating mode. In order to save the storage space of the BRAS and facilitate the BRAS to manage the portal user table and the ARP entry, in the embodiment of the present application, when portal authentication is not possible, the portal user table and the ARP entry corresponding to the user identifier are deleted.
The embodiment of the application can detect whether the BRAS has a portal user table corresponding to the user identifier, and if the BRAS does not have the portal user table corresponding to the user identifier, the portal authentication can be carried out; if the fact that the user identification has the corresponding portal user table is detected, and the user corresponding to the portal user table is online, judging that the currently received network request message is an illegal message, and at the moment, not performing portal authentication; correspondingly, if the fact that the user identifier has the corresponding portal user table and the user corresponding to the portal user table is not online is detected, it is judged that the sender is in a roaming state, and portal authentication can be performed at the moment.
S130, after the portal user table and the ARP table entry are enabled, portal authentication is carried out based on the network request message.
Illustratively, if the authentication passes, a corresponding portal user table is generated, and if the authentication fails, the sender is prompted that the authentication fails.
In this embodiment, when the portal user table and the ARP entry corresponding to the user identifier are stored in the BRAS, on the premise that the ARP entry cannot realize data forwarding between the BRAS and the sender, whether portal authentication is possible is detected through the user identifier of the network request packet, and when portal authentication is not possible, the portal user table and the ARP entry corresponding to the user identifier stored in the BRAS are enabled, so that portal authentication can be performed based on the network request packet, and it is ensured that a user triggers roaming on-line in time, and the on-line can be performed without waiting for the aging of the portal user table.
In an implementation of this embodiment, whether portal authentication can be performed based on a received network request packet is detected according to the following manner:
detecting whether a corresponding portal user table exists in the user identification, if not, performing portal authentication based on the network request message, if so, generating a corresponding portal user table, if not, prompting that the sender fails in authentication;
if the portal user table exists, whether the sender is online is detected, if the sender is not online, the portal user table and the corresponding ARP table entry are enabled, portal authentication is carried out based on the network request message, the portal authentication is passed, the corresponding portal user table is generated, and the portal authentication is not passed, so that the sender authentication failure is prompted.
In this embodiment, when it is detected that the sender is not online, a user roaming prohibition entry may be generated based on the user identifier, and the user roaming prohibition entry is prohibited from passing through the unique user identifier.
In one implementation mode, if a sender is online, marking a network request message as an illegal message, and forbidding the sender to perform portal authentication; in practical application, when the network request message is detected to be an illegal message, the illegal packet message can be discarded or deleted.
In practical application, a source IP address of a network request packet may be detected, for example, referring to fig. 2, a BRAS sends an ICMP (Internet Control Message Protocol) detection packet to a user through a VLAN a, and if a response is received within a detection time, the user is considered to be online, otherwise, the user is considered to be offline.
In order to prevent the BRAS from being attacked by the network and timely and effectively process the illegal network request message, in this embodiment, before portal authentication is performed based on the network request message, it is first detected whether the user identifier has a corresponding entry prohibiting user roaming.
If the user identification has a forbidden user roaming list item, forbidding a sender to carry out portal authentication; in this embodiment, when detecting that the user identifier has the corresponding prohibited user roaming entry, the network request packet may be discarded without performing subsequent portal authentication processing.
If the user identification does not have the forbidden user roaming list item, detecting whether the user identification has a corresponding portal user list or not, and carrying out portal authentication processing according to the scheme.
In another implementation of this embodiment, the forbidden user roaming entry may be generated by:
and extracting one or more of an IP field, an MAC field, an authentication interface PORT field, a VLAN field and a fixed TIME TIME field in a portal user table corresponding to the user identification to generate a user roaming forbidden table item.
For example, referring to the following table 2, the user roaming prohibition entry generated in this embodiment includes an IP field, an MAC field, a PORT field, a VLAN field, and a TIME field, where the IP field is a user IP address, the MAC field is a user MAC address, the PORT field is an interface for user access authentication, the VLAN field is a VLAN for user access authentication, the TIME field is a user roaming prohibition TIME, and the value of the TIME field may be second level, minute level, and the like, and may be configured according to application requirements.
TABLE 2
For the aging TIME of the forbidden user roaming table entry, the aging TIME of the forbidden user roaming table entry can be configured according to the value of the TIME field, or the forbidden user roaming table entry is configured to be associated with the portal user table, and the forbidden user roaming table entry is deleted in a linkage manner when the portal user table is deleted.
The portal authentication process provided in this embodiment is described in detail in the present application through the following embodiments.
Fig. 3 is a schematic view of a portal authentication process provided in the embodiment of the present application, and as shown in fig. 3, the portal authentication process is as follows:
s310, determining whether the forbidden user roaming list is hit based on the access request message, if yes, performing step S370, and if not, performing step S320.
When a user initiates network access, an access request message is sent to the BRAS platform, the BRAS platform obtains a source IP in the access request message, a forbidden user roaming list item is checked based on the source IP, if the forbidden user roaming list item corresponding to the source IP exists, step S370 is executed, otherwise step S320 is executed.
S320, judging whether the portal user table is hit based on the source IP, if so, executing the step S330, and if not, executing the step S340.
And detecting whether a portal user table corresponding to the source IP exists on the BRAS platform, if so, executing step S330, and if not, executing step S340.
S330, detecting the source IP, executing the step S350 if the detection is successful, deleting the portal user table and the corresponding ARP table entry if the detection is failed, and executing the step S340.
Illustratively, the BRAS sends an ICMP probe packet to the user through the VLAN in the portal user table, and if a response is received within the probe time, the user is considered to be online, at this time, the probe is successful, otherwise, the user is considered to be offline, at this time, the probe fails.
S340, performing portal authentication based on the access request message, wherein the authentication is passed to perform step S360, and the authentication is not passed to perform step S370.
And S350, generating a forbidden user roaming list item.
In step S350, it is determined that the user of the portal user table corresponding to the source IP is online, and then the access request message in step S310 is an illegal message, and at this time, portal authentication by the user is prohibited.
Since the attack time of the illegal message is generally below the second level, for example, attack is performed at the microsecond level, the aging time of the forbidden user roaming list item is set to the second level or the minute level in the embodiment of the application, so as to avoid the attack of the illegal message.
And the aging time of the forbidden user roaming list item is set to be second level or minute level, so that the condition that the user roaming cannot be on line in time in the aging time of the forbidden user roaming list item can be avoided. In practical application, the time for the user to roam is usually more than an hour level, that is, the time for the user to roam is usually longer than the aging time of the roaming list item of the forbidden user, so that the aging time of the roaming list item of the forbidden user set by the application can ensure that the legal user can be online in time when roaming.
S360, generating a portal user table.
At this time, a corresponding ARP entry may be generated according to the portal user table, and relevant data such as an authentication interface and the like may be sent to the user terminal based on the ARP entry, so that the user performs portal authentication.
S370, forbidding the user to carry out portal authentication.
Corresponding to the portal authentication method, the portal authentication device is provided.
Fig. 4 is a block diagram of a portal authentication apparatus according to an embodiment of the present invention, where the portal authentication apparatus of the present embodiment is applied to a BRAS, as shown in fig. 4, the apparatus 40 includes: a receiving unit 41, a detecting unit 42, and an authentication processing unit 43;
a receiving unit 41, configured to receive a network request message sent by a sender, where the network request message carries a user identifier, and the user identifier is a source IP address of the network request message;
a detecting unit 42, configured to detect whether portal authentication can be performed based on the network request packet according to the user identifier;
and the authentication processing unit 43 is configured to, when portal authentication is not possible, enable the portal user table and the ARP entry corresponding to the user identifier stored in the BRAS, and perform portal authentication based on the network request packet after enabling the portal user table and the ARP entry.
In an implementation scheme of this embodiment, the detecting unit 42 is further configured to detect whether a user identifier has a corresponding portal user table, and detect whether a sender is online when the user identifier has the portal user table; an authentication processing unit 43, configured to perform portal authentication based on the network request message when the detection unit 42 detects that the user identifier does not have a portal user table; and when the detection unit 42 detects that the sender is not online, enabling the portal user table and the corresponding ARP table entry, and performing portal authentication based on the network request message.
In this implementation, the authentication processing unit 43 is further configured to mark the network request packet as an illegal packet and prohibit the sender from performing portal authentication when the detection unit 42 detects that the sender is online; in practical application, when the detection unit detects that the network request packet is an illegal packet, the authentication processing unit 43 discards or deletes the illegal packet.
The authentication processing unit 43 of this implementation scheme is further configured to extract one or more of an IP address field, a physical address field, an authentication interface field, a virtual local area network field, and a fixed time field in the portal user table to generate a roaming entry of the prohibited user when the detecting unit 42 detects that the sender is online; and forbidding the user roaming list item to carry out portal authentication on the network request message carrying the user identifier through the unique user identifier.
In practical applications, the authentication processing unit 43 is further configured to configure the aging time of the prohibited user roaming entry, or configure the prohibited user roaming entry to be associated with the portal user table, so that the prohibited user roaming entry is deleted in a linkage manner when the portal user table is deleted.
In another implementation of this embodiment, the detecting module 42 is further configured to detect whether the user identifier has a corresponding forbidden user roaming table entry before detecting whether the user identifier has a corresponding portal user table. The authentication processing unit 43 prohibits the portal authentication of the sender when the detection unit 42 detects that the corresponding user roaming prohibition entry exists in the user identifier, detects that the user identifier does not exist in the user roaming prohibition entry in the detection unit 42, and drives the detection unit 42 to detect whether the corresponding portal user table exists in the user identifier.
For the device embodiments, since they substantially correspond to the method embodiments, reference may be made to the partial description of the method embodiments for relevant points. The above-described embodiments of the apparatus are merely illustrative, and the units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the present embodiment. One of ordinary skill in the art can understand and implement it without inventive effort.
The portal authentication device provided by the application can be realized by software, or can be realized by hardware or a combination of hardware and software. Taking a software implementation as an example, referring to fig. 5, the portal authentication apparatus 40 provided by the present application may include a processor 501 and a machine-readable storage medium 502 storing machine-executable instructions. The processor 501 and the machine-readable storage medium 502 may communicate via a system bus 503. Also, the processor 501 may perform the portal authentication method described above by reading and executing machine-executable instructions in the machine-readable storage medium 502 corresponding to the portal authentication logic.
The machine-readable storage medium 502 referred to herein may be any electronic, magnetic, optical, or other physical storage device that can contain or store information such as executable instructions, data, and the like. For example, the machine-readable storage medium may be: a RAM (random Access Memory), a volatile Memory, a non-volatile Memory, a flash Memory, a storage drive (e.g., a hard drive), a solid state drive, any type of storage disk (e.g., a compact disk, a DVD, etc.), or similar storage medium, or a combination thereof.
According to an example disclosed herein, there is also provided a machine-readable storage medium, such as machine-readable storage medium 502 in fig. 5, comprising machine-executable instructions executable by processor 501 in the portal authentication device 40 to implement the portal authentication method described above.
It is noted that, herein, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. The terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other identical elements in a process, method, article, or apparatus that comprises the element.
The above description is only for the preferred embodiment of the present application, and is not intended to limit the scope of the present application. Any modification, equivalent replacement, improvement and the like made within the spirit and principle of the present application are included in the protection scope of the present application.
Claims (12)
1. A portal authentication method is applied to a Broadband Remote Access Server (BRAS), and comprises the following steps:
receiving a network request message sent by a sender, wherein the network request message carries a user identifier;
detecting whether portal authentication can be carried out based on the network request message or not according to the user identification, and enabling a portal user table and an ARP table entry corresponding to the user identification stored on a BRAS when the portal authentication can be carried out;
and after the portal user table and the ARP table entry are disabled, carrying out portal authentication based on the network request message.
2. The portal authentication method of claim 1, wherein the detecting whether portal authentication can be performed based on the network request packet according to the user identifier comprises:
detecting whether the user identification has a corresponding portal user table, if not, judging that portal authentication can be performed, and performing portal authentication based on the network request message;
if the portal user table exists, whether the sender is online is detected, if the sender is not online, portal authentication can be carried out, at the moment, the portal user table and a corresponding ARP table item are enabled, and the portal authentication is carried out based on the network request message.
3. The portal authentication method of claim 2, wherein upon detecting that the sender is online, the method further comprises:
and judging that portal authentication cannot be performed, at the moment, extracting one or more of an IP address field, a physical address field, an authentication interface field, a virtual local area network field and a fixed time field in the portal user table to generate a user roaming prohibition table item, wherein the user roaming prohibition table item passes through the unique user identifier, and is used for prohibiting a network request message carrying the user identifier of the user from performing portal authentication.
4. The portal authentication method of claim 3, wherein prior to detecting whether the user identifier exists in the corresponding portal user table, the method further comprises:
detecting whether the user identification has a corresponding forbidden user roaming list item, and if the forbidden user roaming list item exists, forbidding the sender to carry out portal authentication;
and if the forbidden user roaming list item does not exist, detecting whether the user identification has a corresponding portal user list or not.
5. The portal authentication method of claim 3, wherein when generating the forbidden user roaming entry, the method further comprises:
configuring the aging time of the forbidden user roaming list item;
or configuring the forbidden user roaming list item to be associated with the portal user table, and deleting the forbidden user roaming list item in a linkage manner when the portal user table is deleted.
6. A portal authentication device is applied to a Broadband Remote Access Server (BRAS), and comprises the following components:
a receiving unit, configured to receive a network request message sent by a sender, where the network request message carries a user identifier;
a detection unit, configured to detect whether portal authentication can be performed based on the network request packet according to the user identifier;
and the authentication processing unit is used for enabling the portal user table and the ARP table entry corresponding to the user identifier stored on the BRAS when portal authentication can be performed, and performing portal authentication based on the network request message after the portal user table and the ARP table entry are enabled.
7. The portal authentication device of claim 6,
the detection unit is used for detecting whether the user identifier has a corresponding portal user table or not, and detecting whether the sender is online or not when the user identifier has the portal user table;
the authentication processing unit is configured to determine that portal authentication is possible when the detection unit detects that the user identifier does not exist in the portal user table, and perform portal authentication based on the network request packet; and when the detection unit detects that the sender is not on line, the portal authentication can be carried out, the portal user table and the corresponding ARP table entry are enabled, and the portal authentication is carried out based on the network request message.
8. The portal authentication apparatus according to claim 7, wherein the authentication processing unit is further configured to determine that portal authentication is not possible when the detection unit detects that the sender is online, extract one or more of an IP address field, a physical address field, an authentication interface field, a virtual local area network field, and a fixed time field in the portal user table to generate a user roaming prohibition entry, where the user roaming prohibition entry is used to prohibit a network request packet carrying a user identifier thereof to perform portal authentication.
9. The portal authentication device of claim 8,
the detection module is further configured to detect whether the user identifier has a corresponding user roaming prohibition entry before detecting whether the user identifier has a corresponding portal user table;
the authentication processing unit is configured to prohibit portal authentication by the sender when the detection unit detects that the user identifier has the corresponding prohibited user roaming entry, and drive the detection unit to detect whether the user identifier has the corresponding portal user table when the detection unit detects that the user identifier does not have the prohibited user roaming entry.
10. The portal authentication apparatus according to claim 8, wherein the authentication processing unit is further configured to configure an aging time of the user roaming-prohibited entry, or configure the user roaming-prohibited entry to be associated with the portal user table, so that the user roaming-prohibited entry is deleted in a linkage manner when the portal user table is deleted.
11. A message processing apparatus comprising a processor and a machine-readable storage medium storing machine-executable instructions executable by the processor, the processor being caused by the machine-executable instructions to: executing the portal authentication method according to any of claims 1 to 5.
12. A machine-readable storage medium storing machine-executable instructions that, when invoked and executed by a processor, cause the processor to: executing the portal authentication method according to any of claims 1 to 5.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710875442.4A CN107547562B (en) | 2017-09-25 | 2017-09-25 | Portal authentication method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710875442.4A CN107547562B (en) | 2017-09-25 | 2017-09-25 | Portal authentication method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN107547562A CN107547562A (en) | 2018-01-05 |
| CN107547562B true CN107547562B (en) | 2020-04-28 |
Family
ID=60964713
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201710875442.4A Active CN107547562B (en) | 2017-09-25 | 2017-09-25 | Portal authentication method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN107547562B (en) |
Families Citing this family (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109587175A (en) * | 2019-01-11 | 2019-04-05 | 杭州迪普科技股份有限公司 | A kind of illegal external connection processing method and system |
| CN109861892A (en) * | 2019-03-28 | 2019-06-07 | 新华三技术有限公司 | A kind of terminal roaming method and device |
| CN119728276A (en) * | 2024-12-27 | 2025-03-28 | 北京天融信网络安全技术有限公司 | Network protection method, computing device, machine-readable storage medium and program product |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102075904A (en) * | 2010-12-24 | 2011-05-25 | 杭州华三通信技术有限公司 | Method and device for preventing re-authentication of roaming user |
| US8514828B1 (en) * | 2012-10-30 | 2013-08-20 | Aruba Networks, Inc. | Home virtual local area network identification for roaming mobile clients |
| US8769626B2 (en) * | 2011-11-29 | 2014-07-01 | Cisco Technology, Inc. | Web authentication support for proxy mobile IP |
| CN105959188A (en) * | 2016-06-07 | 2016-09-21 | 华为技术有限公司 | Method and device for controlling user terminal to be online |
-
2017
- 2017-09-25 CN CN201710875442.4A patent/CN107547562B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102075904A (en) * | 2010-12-24 | 2011-05-25 | 杭州华三通信技术有限公司 | Method and device for preventing re-authentication of roaming user |
| US8769626B2 (en) * | 2011-11-29 | 2014-07-01 | Cisco Technology, Inc. | Web authentication support for proxy mobile IP |
| US8514828B1 (en) * | 2012-10-30 | 2013-08-20 | Aruba Networks, Inc. | Home virtual local area network identification for roaming mobile clients |
| CN105959188A (en) * | 2016-06-07 | 2016-09-21 | 华为技术有限公司 | Method and device for controlling user terminal to be online |
Non-Patent Citations (1)
| Title |
|---|
| Demonstrating a personalized secure-by-default bring your own device solution based on software defined networking;Steffen Gebert等;《2016 28th International Teletraffic Congress (ITC 28) 1》;20160916;197-200 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN107547562A (en) | 2018-01-05 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US10601766B2 (en) | Determine anomalous behavior based on dynamic device configuration address range | |
| CN109327395B (en) | Message processing method and device | |
| CN110535744B (en) | Message processing method and device and Leaf equipment | |
| JP2020529776A (en) | Methods, systems, and computer-readable media for mobility management entity (MME: MOBILITY MANAGEMENT ENTITY) authentication for outbound roaming subscribers using the Diameter Edge Agent (DEA: DIAMETER EDGE AGENT). | |
| CN101621525B (en) | Method and equipment for treating legal entries | |
| CN107707435B (en) | Message processing method and device | |
| CN112272164B (en) | Message processing method and device | |
| CN107547562B (en) | Portal authentication method and device | |
| CN106302384A (en) | DNS message processing method and device | |
| WO2017215492A1 (en) | Device detection method and apparatus | |
| US20150381739A1 (en) | Network session control | |
| CN107666662A (en) | A kind of terminal identification method and access point | |
| US8887237B2 (en) | Multimode authentication | |
| CN111654485B (en) | Client authentication method and device | |
| CN106603501A (en) | Method, system and firewall device for preventing hijacking of domain name | |
| CN101415002A (en) | Method for preventing message aggression, data communication equipment and communication system | |
| CN108243115A (en) | Message processing method and device | |
| CN102333013B (en) | Method, device and system for detecting medium access control (MAC) address conflicts | |
| CN107800697B (en) | Access authentication method and device | |
| CN107105072B (en) | Method and device for creating ARP (Address resolution protocol) table entry | |
| CN107181759B (en) | Authentication method and device for user equipment | |
| CN104869117A (en) | A security authentication method and device | |
| CN108718280B (en) | Message forwarding method and device | |
| CN107547324B (en) | MAC address issuing method, device, equipment and machine readable storage medium | |
| CN101567883A (en) | Realization method for preventing MAC address forgery |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20230627 Address after: 310052 11th Floor, 466 Changhe Road, Binjiang District, Hangzhou City, Zhejiang Province Patentee after: H3C INFORMATION TECHNOLOGY Co.,Ltd. Address before: 310052 Changhe Road, Binjiang District, Hangzhou, Zhejiang Province, No. 466 Patentee before: NEW H3C TECHNOLOGIES Co.,Ltd. |
|
| TR01 | Transfer of patent right |