CN101272387B - Method and terminal unit for launching re-authentication answering to network side equipment - Google Patents

Abstract

The invention relates to the technical field of communication, and discloses a method and a terminal device for initiating re-authentication for a network side device. The method includes: receiving an authentication request from a network-side device; if the authentication request is not the first authentication request, obtaining stored authentication information; generating and sending an authentication message carrying the authentication information to the network-side device The authentication request response. The embodiment of the present invention can avoid the problem of data connection interruption caused by not responding to the re-authentication request initiated by the network side device, thereby improving user experience.

Description

Method and terminal equipment for re-authentication initiated by network side equipment

technical field

The present invention relates to the field of communication technology, in particular to a method and a terminal device for initiating re-authentication for a network side device.

Background technique

In recent years, it has become a very common application for a host-side device (such as a PC, etc.) to perform data services such as Internet access through a terminal device (such as a mobile phone, etc.). In this application, the user usually initiates a dial-up connection from the host-side device, and sends authentication information to the network-side device through the terminal device for the authentication request from the network-side device, and the network-side device Perform authentication, if the authentication is successful, establish a corresponding data service connection, and the host side device can access the Internet through the data service connection; after the data service connection is established, if there is no traffic within a certain period of time, the host side device The device or the network side device will initiate to enter the dormant state. After entering the dormant state, the established data service connection will continue to be maintained, and the service channel will be released by the data service. When data operations such as Internet access are required, the data service will be occupied again. traffic channel.

In some carrier network environments, after the network-side device establishes a data service connection, if it detects that the IP address of the host-side device is abnormal, it will initiate re-authentication of the host-side device. In the above-mentioned prior art solution, The host-side device will not respond to the re-authentication initiated by the network-side device, and the network-side device may interrupt the data service connection when the re-authentication request is not responded to. At this time, if the user wants to continue surfing the Internet, You need to re-initiate the dial-up connection.

Contents of the invention

The technical problem to be solved by the embodiments of the present invention is to provide a method and a terminal device for re-authentication initiated by a network-side device, which can prevent the user from re-initiating a dial-up connection when the network-side device initiates a re-authentication, thereby improving user experience.

In order to solve the above technical problems, embodiments of the present invention provide the following technical solutions:

A method for responding to re-authentication initiated by a network-side device, including:

receiving an authentication request from a network side device;

If the authentication request is not the first authentication request, acquiring stored authentication information;

Generate and send an authentication request response carrying the authentication information to the network side device.

A terminal device comprising:

An authentication request receiving unit, configured to receive an authentication request from a network side device;

A judging unit, configured to judge whether the authentication request is the first authentication request;

An authentication information acquiring unit, configured to acquire the stored authentication information when the result of the judgment is No;

An authentication request response generating unit, configured to generate and send an authentication request response carrying the authentication information to the network side device when the result of the judgment is negative.

It can be seen from the above technical solutions that in the embodiment of the present invention, the authentication information is pre-stored on the terminal device, and when the network-side device initiates re-authentication, the terminal device sends an authentication message carrying the stored authentication information to the network-side device. Request a response, so that the re-authentication initiated by the network-side device can be responded, so that the data connection interruption problem caused by not responding to the re-authentication request initiated by the network-side device can be avoided, thereby improving user experience.

Description of drawings

FIG. 1 is a flow chart of Embodiment 1 of a method for initiating re-authentication for a network-side device according to an embodiment of the present invention;

FIG. 2 is a flow chart of Embodiment 2 of a method for initiating re-authentication for a network-side device according to an embodiment of the present invention;

FIG. 3 is a structural diagram of Embodiment 1 of a terminal device of the present invention;

FIG. 4 is a structural diagram of Embodiment 2 of the terminal device of the present invention;

FIG. 5 is a structural diagram of Embodiment 3 of a terminal device according to the present invention.

Detailed ways

The method for initiating re-authentication for a network-side device provided by the embodiments of the present invention and recommended embodiments of a terminal device will be described in detail below with reference to the accompanying drawings.

Embodiment 1 of the method for initiating re-authentication for network-side devices in the present invention; this embodiment provides the basic flow of the method for initiating re-authentication for network-side devices in the present invention. Referring to Figure 1, the method in this embodiment includes the following process:

A1. Receive an authentication request from a network side device.

A2. If the authentication request is not the first authentication request, obtain stored authentication information.

Wherein, the stored authentication information may be obtained during the first authentication, or it may be directly recorded in the terminal device when making a software version of the terminal device according to market and operator's customization requirements, the said The authentication information may be an authentication account number and password.

A3. Generate and send an authentication request response carrying the authentication information to the network side device.

In the embodiment of the present invention, the authentication information is pre-stored on the terminal device. When the network-side device initiates re-authentication, the terminal device sends an authentication request response carrying the stored authentication information to the network-side device. In this way, the network-side device The initiated re-authentication can be responded, so that the data connection interruption problem caused by not responding to the re-authentication request initiated by the network side device can be avoided, thereby improving user experience.

Embodiment 2 of the method for re-authentication initiated by the network side device in the present invention; referring to FIG. 2 , the method of this embodiment includes the following process:

B1. The terminal device receives the authentication request from the network side device.

The authentication request received by the terminal device can be the first authentication request sent by the network side device according to the dial-up connection request initiated by the host side device, or it can be sent by the network side device after the first authentication of the host side device is passed. Re-authentication request.

B2. The terminal device judges whether the received authentication request is the first authentication request, if yes, execute step B3; if not, execute step B8.

In this embodiment, the authentication information in the terminal device is obtained during the first authentication, so the terminal device can judge whether the received authentication request is the first authentication request by judging whether the authentication information is stored locally. If there is authentication information, the received authentication request is not the first authentication request; if no authentication information is stored locally, the received authentication request is the first authentication request.

B3. The terminal device forwards the first authentication request to the host-side device.

B4. After receiving the first-time authentication request, the host-side device sends a first-time authentication request response carrying authentication information to the terminal device.

The authentication information may be an authentication account number and password.

B5. The terminal device parses the first-time authentication request response, obtains and stores the authentication information carried therein; on the other hand, forwards the first-time authentication request response to the network side device.

B6. The network side device parses the received first authentication request response, obtains the authentication information carried therein, and performs authentication according to the obtained authentication information, and establishes a data service connection if the authentication is successful.

When the authentication information is an authentication account number and a password, the network side device can obtain the password corresponding to the authentication account from the database according to the authentication account number, and compare the password obtained from the database with the password obtained by parsing, If the two match, the authentication is successful; otherwise, the authentication fails.

Since the security and reliability of directly using the authentication account number and plaintext password for authentication is relatively low, in the embodiment of the present invention, the authentication information that is encrypted can also be used for authentication, and the authentication information that is encrypted The information may be, for example, an authentication account, an MD5 digest value, and a currently generated random number, and the MD5 digest value may be obtained by hashing a password and the currently generated random number. After the network side device analyzes and obtains the authentication information in the first authentication request response, it obtains the password corresponding to the authentication account from the database according to the authentication account, and combines the password obtained from the database with the authentication information obtained by the analysis. The random number is subjected to the same Hash processing to obtain the MD5 digest value, and then the MD5 digest value obtained by the Hash processing is compared with the MD5 digest value in the authentication information obtained by parsing. If the two match, the authentication is successful, otherwise, the authentication right failed.

B7. The network side device sends a re-authentication request to the terminal device; continue to execute B1.

The network-side device may periodically send a re-authentication request to the terminal device, or may send a re-authentication request to the terminal device when it detects that the IP address of the host-side device is abnormal.

B8. The terminal device acquires the stored authentication information, generates and sends an authentication request response carrying the authentication information to the network side device.

The authentication information stored by the terminal device is obtained after parsing the first authentication request response sent by the host-side device.

B9. The network side device judges whether the authentication request response is received within the predetermined time, if yes, execute B10; if not, interrupt the established data service connection, and end the process.

B10. The network side device parses the received authentication request response, obtains the authentication information carried in it, and performs authentication according to the obtained authentication information. If the authentication is successful, continue to maintain the data service connection and execute B11 ; Otherwise, interrupt the established data service connection and end the process.

B11. The network side device sends a re-authentication request to the terminal device.

The network-side device may periodically send a re-authentication request to the terminal device, or may send a re-authentication request to the terminal device when it detects that the IP address of the host-side device is abnormal.

Embodiment 3 of the method for initiating re-authentication for network-side devices in the present invention; this embodiment provides a detailed implementation of the method for initiating re-authentication for network-side devices in the present invention. The method in this embodiment includes the following process:

C1. The terminal device receives a Point-to-Point Protocol (PPP for short) packet from the network side device.

C2, the terminal device judges whether the protocol field of the PPP packet is a PPP Challenge-Handshake Authentication Protocol (Challenge-Handshake Authentication Protocol, CHAP for short) authentication packet, if so, then execute C3; if not, then end the process of this method.

C3. The terminal device further judges whether the authentication packet received this time is an authentication request for the first time, and if so, execute step C4; if the authentication packet received this time is an authentication request but not the first authentication request, execute Step C9.

If the type of the PPP CHAP authentication packet received by the terminal device is a CHAP challenge (CHALLENGE), and the authentication information is not stored locally, the received authentication packet is the first authentication request.

If the type of the PPP CHAP authentication packet received by the terminal device is a CHAP challenge (CHALLENGE), but the authentication information is stored locally, then the received authentication packet is an authentication request but not the first authentication request.

C4. The terminal device forwards the PPP CHAP authentication packet of the CHAP challenge type to the host-side device.

C5. After receiving the PPP CHAP authentication packet of the CHAP challenge type, the host side device sends a CHAP response (RESPONSE) type PPP CHAP authentication packet to the terminal device, which carries authentication information.

Wherein, the authentication information may be an authentication account number and password.

C6, the terminal device judges whether the type of the received PPP CHAP authentication packet is a CHAP response, if so, then obtains the authentication information carried therein from the PPP CHAP authentication packet and then stores it; on the other hand, to The network side device forwards the received PPPCHAP authentication packet of the CHAP response type.

C7. The network side device parses the received PPP CHAP authentication packet of the CHAP response type, obtains the authentication information carried therein, and performs authentication according to the obtained authentication information. If the authentication is successful, the establishment Data business connection.

When the authentication information is an authentication account number and a password, the network side device can obtain the password corresponding to the authentication account from the database according to the authentication account number, and compare the password obtained from the database with the password obtained by parsing, If the two match, the authentication is successful; otherwise, the authentication fails.

C8. Whether the network side device detects that the IP address of the host side device is abnormal, if so, resends the PPP CHAP authentication packet of the CHAP challenge type to the terminal device, and continues to execute C1; otherwise, continues to execute C8.

C9. The terminal device obtains the stored authentication information, generates and sends a CHAP response type PPP CHAP authentication packet to the network side device, which carries the authentication information.

C10, the network side device judges whether the PPP CHAP authentication packet of the CHAP response type is received within a predetermined time, if so, then execute C11; if not, then interrupt the established data service connection, and end the process.

C11. The network side device analyzes the received PPP CHAP authentication packet of the CHAP response type, obtains the authentication information carried therein, and performs authentication according to the obtained authentication information. If the authentication is successful, continue Keep the data service connection; otherwise, interrupt the established data service connection.

Embodiment 4 of the method for initiating re-authentication for network-side devices in the present invention; the method of this embodiment includes the following procedures:

D1. The terminal device receives the authentication request from the network side device.

The authentication request received by the terminal device can be the first authentication request sent by the network side device according to the dial-up connection request initiated by the host side device, or it can be sent by the network side device after the first authentication of the host side device is passed. Re-authentication request.

D2. The terminal device judges whether the received authentication request is the first authentication request, if yes, execute step D3; if not, execute step D8.

In this embodiment, an authentication flag indicating whether it is the first authentication request can be maintained in the terminal device, and the terminal device can judge whether the received authentication request is the first authentication request according to the authentication flag. If the flag indicates that the first authentication has been performed, the received authentication request is not the first authentication request; if the authentication flag indicates that the first authentication has not been performed, the received authentication request is the first authentication request.

D3. The terminal device forwards the first authentication request to the host-side device.

D4. After receiving the first-time authentication request, the host-side device sends a first-time authentication request response carrying authentication information to the terminal device.

The authentication information may be an authentication account number and password.

D5. The terminal device forwards the first authentication request response to the network side device.

D6. The network side device parses the received first authentication request response, obtains the authentication information carried therein, and performs authentication according to the obtained authentication information, and establishes a data service connection if the authentication is successful.

When the authentication information is an authentication account number and a password, the network side device can obtain the password corresponding to the authentication account from the database according to the authentication account number, and compare the password obtained from the database with the password obtained by parsing, If the two match, the authentication is successful; otherwise, the authentication fails.

Since the security and reliability of directly using the authentication account number and plaintext password for authentication is relatively low, in the embodiment of the present invention, the authentication information that is encrypted can also be used for authentication, and the authentication information that is encrypted The information may be, for example, an authentication account, an MD5 digest value, and a currently generated random number, and the MD5 digest value may be obtained by hashing a password and the currently generated random number. After the network side device analyzes and obtains the authentication information in the first authentication request response, it obtains the password corresponding to the authentication account from the database according to the authentication account, and combines the password obtained from the database with the authentication information obtained by the analysis. The random number is subjected to the same Hash processing to obtain the MD5 digest value, and then the MD5 digest value obtained by the Hash processing is compared with the MD5 digest value in the authentication information obtained by parsing. If the two match, the authentication is successful, otherwise, the authentication right failed.

D7. The network-side device detects whether the IP address of the host-side device is abnormal, and if so, sends a re-authentication request to the terminal device, and continues to execute D1; otherwise, executes D7.

The network side device may periodically send a re-authentication request to the terminal device.

D8. The terminal device obtains the pre-stored authentication information locally, generates and sends an authentication request response carrying the authentication information to the network side device.

In this embodiment, when making the software version of the terminal device, the authentication information is recorded in the terminal device in advance, so the terminal device does not store the authentication information when it receives the first authentication request response, and receives it again later. When an authentication request is made, the authentication information stored locally in advance is obtained, and an authentication request response is generated. The authentication information locally stored in the terminal device may be customized requirements for markets and operators, and the like.

D9. The network side device judges whether the authentication request response is received within the predetermined time, if yes, execute D10; if not, interrupt the established data service connection, and end the process.

D10. The network side device analyzes the received authentication request response, obtains the authentication information carried in it, and performs authentication according to the obtained authentication information. If the authentication is successful, continue to maintain the data service connection and execute D11 ; Otherwise, interrupt the established data service connection and end the process.

D11. The network-side device detects whether the IP address of the host-side device is abnormal, and if so, sends a re-authentication request to the terminal device, and proceeds to D1; otherwise, proceeds to D11.

In more embodiments of the present invention, the network side device may also carry an authentication flag indicating whether it is the first authentication request in the authentication request sent to the terminal device, and the terminal device judges the received authentication request according to the authentication flag. Whether the authorization request is the first authentication request.

Those of ordinary skill in the art can understand that all or part of the steps in the method of the above-mentioned embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, and the program can be executed when executed , may include the following steps: receiving an authentication request from a network-side device; if the authentication request is not the first authentication request, obtaining stored authentication information; generating and sending a message carrying the authentication to the network-side device; Authentication request response for authorization information. The storage medium referred to here, such as: ROM/RAM, magnetic disk, optical disk, etc.

Embodiment 1 of the terminal device of the present invention, referring to FIG. 3 , the terminal device includes an authentication request receiving unit 310, a judging unit 320, an authentication information obtaining unit 330, and an authentication request response generating unit 340:

An authentication request receiving unit 310, configured to receive an authentication request from a network side device.

A judging unit 320, configured to judge whether the authentication request is a first-time authentication request.

The authentication information obtaining unit 330 is configured to obtain the stored authentication information when the result of the determination is negative.

The authentication request response generation unit 340 is configured to generate and send an authentication request response carrying the authentication information to the network side device when the result of the judgment is negative.

Embodiment 2 of the terminal device of the present invention, referring to FIG. 4 , the terminal device includes an authentication request receiving unit 410, a judging unit 420, an authentication information obtaining unit 430, an authentication request response generating unit 440, and an authentication request forwarding unit 450 , the first authentication request response receiving unit 460 and the authentication request response forwarding unit 470:

An authentication request receiving unit 410, configured to receive an authentication request from a network side device.

A judging unit 420, configured to judge whether the authentication request is a first-time authentication request.

The authentication information obtaining unit 430 is configured to obtain the stored authentication information when the result of the determination is negative.

Wherein, the stored authentication information may be directly recorded in the terminal device when the software version of the terminal device is produced according to the customization requirements of the market and the operator.

The authentication request response generation unit 440 is configured to generate and send an authentication request response carrying the authentication information to the network side device when the result of the determination is negative.

The authentication request forwarding unit 450 is configured to forward the first authentication request to the host side device when the judgment result is yes.

The first authentication request response receiving unit 460 is configured to receive the first authentication request response from the host device, which carries authentication information.

An authentication request response forwarding unit 470, configured to send the first authentication request response to the network side device.

This embodiment can be implemented by using the method in Embodiment 4 of the method for initiating re-authentication by a network-side device.

Embodiment 3 of the terminal device of the present invention, referring to FIG. 5 , the terminal device includes an authentication request receiving unit 510, a judging unit 520, an authentication request forwarding unit 530, a first authentication request response receiving unit 540, an authentication request response forwarding unit Unit 550, analysis unit 560, authentication information acquisition unit 570 and authentication request response generation unit 580:

An authentication request receiving unit 510, configured to receive an authentication request from a network side device.

A judging unit 520, configured to judge whether the authentication request is a first-time authentication request.

The authentication request forwarding unit 530 is configured to forward the first authentication request to the host-side device when the judgment result is yes.

The first authentication request response receiving unit 540 is configured to receive the first authentication request response from the host device, which carries authentication information.

An authentication request response forwarding unit 550, configured to send the first authentication request response to the network side device.

The parsing unit 560 is configured to parse the first authentication request response received by the first authentication request response receiving unit 540, and obtain and store the authentication information carried therein.

The authentication information acquiring unit 570 is configured to acquire the authentication information stored in the parsing unit 560 when the result of the determination is negative.

The authentication request response generation unit 580 is configured to generate and send an authentication request response carrying the authentication information to the network side device when the result of the determination is negative.

This embodiment can be implemented by using the method in Embodiment 2 or 3 of the method for initiating re-authentication by a network-side device.

In the embodiment of the present invention, the authentication information is pre-stored on the terminal device. When the network-side device initiates re-authentication, the terminal device sends an authentication request response carrying the stored authentication information to the network-side device. In this way, the network-side device The initiated re-authentication can be responded, so that the data connection interruption problem caused by not responding to the re-authentication request initiated by the network side device can be avoided, thereby improving user experience.

The method for initiating re-authentication of the network-side device and the terminal device provided by the embodiment of the present invention are described above in detail. In this paper, specific examples are used to illustrate the principle and implementation of the present invention. The description of the above embodiment is only It is used to help understand the method and idea of the present invention; at the same time, for those of ordinary skill in the art, according to the idea of the present invention, there will be changes in the specific implementation and scope of application. In summary, this specification The content should not be construed as a limitation of the invention.

Claims (10)

1. A method for initiating re-authentication to a network side device is characterized by comprising the following steps:

receiving an authentication request from network side equipment;

judging whether authentication information is stored or not, if so, judging that the authentication request is not a first authentication request, and if not, judging that the received authentication request is a first authentication request; or,

judging whether the authentication mark is the first authentication, if so, judging that the received authentication request is not the first authentication request, and if not, judging that the received authentication request is the first authentication request;

if the authentication request is not the first authentication request, acquiring stored authentication information;

and generating and sending an authentication request response carrying the authentication information to the network side equipment.

2. The method as claimed in claim 1, wherein said generating and sending an authentication request response carrying said authentication information to said network side device further comprises:

if the network side equipment receives the authentication request response within the preset time, analyzing the received authentication request response to obtain the authentication information carried in the received authentication request response;

and authenticating according to the obtained authentication information, and if the authentication is successful, keeping the established data service connection.

3. The method of claim 1, wherein receiving the authentication request from the network-side device further comprises: and if the authentication request is a first authentication request, forwarding the first authentication request to host side equipment.

4. The method of claim 3, wherein forwarding the first authentication request to the host-side device further comprises:

receiving a first authentication request response from host side equipment, wherein the first authentication request response carries authentication information;

and sending the first authentication request response to the network side equipment.

5. The method of claim 4, wherein receiving the first authentication request response from the host-side device further comprises: and analyzing the first authentication request response to obtain and store the authentication information carried in the first authentication request response.

6. The method as claimed in claim 4 or 5, wherein said sending the first authentication request response to the network side device further comprises: the network side equipment analyzes the received first authentication request response to obtain the authentication information carried in the first authentication request response, authenticates according to the obtained authentication information, and establishes data service connection if the authentication is successful.

7. A terminal device, comprising:

an authentication request receiving unit, configured to receive an authentication request from a network side device;

the judging unit is used for judging whether authentication information is stored or not, if so, the authentication request is not a first authentication request, and if not, the received authentication request is a first authentication request; or, judging whether the authentication mark is the first authentication, if so, judging that the received authentication request is not the first authentication request, and if not, judging that the received authentication request is the first authentication request;

an authentication information acquisition unit for acquiring the stored authentication information when the authentication request is not the first authentication request;

and the authentication request response generating unit is used for generating and sending an authentication request response carrying the authentication information to the network side equipment when the authentication request is not the first authentication request.

8. The terminal device according to claim 7, wherein the terminal device further comprises an authentication request forwarding unit, configured to forward the first authentication request to the host-side device if a result of the determination is yes.

9. The terminal device of claim 8, wherein the terminal device further comprises:

a first authentication request response receiving unit, configured to receive a first authentication request response from the host side device, where the first authentication request response carries authentication information;

and the authentication request response forwarding unit is used for sending the first authentication request response to the network side equipment.

10. The terminal device of claim 9, wherein the terminal device further comprises:

and the analysis unit is used for analyzing the first authentication request response received by the first authentication request response receiving unit to obtain and store the authentication information carried in the first authentication request response.

Images