CN102594800A - Method and device for processing Web authentication server - Google Patents

Abstract

The present invention provides a method and device for processing a Web authentication server. The method includes sending a detection message to the Web authentication server, wherein the detection message is used to detect the function of the Web authentication server; After the server responds to the detection message, it determines the detection of the function of the Web authentication server. Through the present invention, it solves the problems in the prior art when the function of the Web authentication server cannot be used normally, which causes the user to fail to work normally. The problem of authentication, and then achieve the effect of confirming whether the function of the Web authentication server is available before authentication through the Web authentication server, thereby ensuring that the Web authentication server that authenticates the user can successfully authenticate.

Description

Web authentication server processing method and device

technical field

The present invention relates to the communication field, in particular to a processing method and device for a Web authentication server.

Background technique

Web authentication is widely used in current WLAN broadband access. In the web authentication process, the web authentication server plays a very important role.

Figure 1 is a flow chart of Web authentication in the related art, as shown in Figure 1, the process includes the following steps:

S1. The user obtains an IP address from a Broadband Network Gateway (BNG) control device. After obtaining the IP address, the user does not have the right to access the Internet through the BNG control device because he has not passed the authentication;

S2, when a user visits any web page, BNG (for example, the user access gateway server) will tell the user operator the address of the web authentication server and the URL of the authentication page through the Hypertext Transfer Protocol (Hype Text Transfer Protocol, referred to as HTTP) redirection technology information;

S3, the user accesses the operator's web authentication server according to the content redirected by the BNG, and enters the user name and password on the web authentication server page to request authentication;

S4, the Web authentication server interacts with the BNG to start the user access authentication process. After the user is successfully authenticated, the BNG will release the user's access to the Internet, and the user can access the Internet.

The Web authentication server has two functions: Web service and Portal authentication service.

In the above S2, the Web service function of the Web authentication server is used. If the Web service function of the user's Web authentication server is unavailable, the server will not be able to launch an authentication prompt page to the user successfully, and the user will not be able to perform authentication, resulting in the user being unable to access the Internet successfully.

In the above S3, the Portal authentication service function of the Web authentication server is used. Normal Portal authentication user Web on, Web off interaction process is as follows:

S1, after the user enters the user name and password in the authentication page, the user will tell the Web authentication server the user name and password authentication information through the HTTP message;

S2. The web authentication server will ask whether the current authentication method is PPP (point-to-point) protocol (Challenge Handshake Authentication Protocol, referred to as CHAP) or password authentication protocol (Password Authentication Protocol, referred to as PAP), and constructs an authentication request according to the Portal protocol The message is sent to BNG;

S3. After BNG receives the authentication request message from the Web authentication server, it performs authentication according to the authentication request information. After the authentication is successful, it notifies the operator's billing server to start billing, and the user Web is on;

S4, the user clicks the logout button to notify the Web authentication server of the Web off operation, and the Web authentication server will construct a Logout message to the BNG according to the Portal protocol;

S5. After receiving the Logout message sent by the web authentication server, the BNG will notify the accounting server to stop accounting for the user and close the user's authority to access the webpage.

In the above S3, if the Portal authentication function of the Web authentication server is not available, the server cannot successfully construct an authentication request message to the BNG after the user enters the user name and password, resulting in the user being unable to successfully authenticate the Internet. Moreover, after the user is successfully authenticated, the user logs out, and the Web authentication server cannot successfully construct a Logout message to the BNG. As a result, the BNG cannot perceive that the user has been Web-off, and cannot notify the billing server in time to stop billing, resulting in inaccurate billing. .

Therefore, there is a problem in the prior art that when the function of the web authentication server cannot be used normally, the user cannot be authenticated normally.

Contents of the invention

The present invention provides a processing method and device for a Web authentication server to at least solve the problem in the prior art that when the function of the Web authentication server cannot be used normally, the user cannot be authenticated normally.

According to one aspect of the present invention, a method for processing a Web authentication server is provided, including: sending a detection message to the Web authentication server, wherein the detection message is used to detect the function of the Web authentication server; After receiving the response message from the Web authentication server to the detection message, it is determined to detect the function of the Web authentication server.

Preferably, it also includes setting a timer, after sending the detection message to the Web authentication server, and when the timer expires, no response from the Web authentication server to the detection message has been received message, it is determined that the Web authentication server is unavailable.

Preferably, when the timer expires and the response message from the Web authentication server to the detection message has not been received, determining that the Web authentication server is unavailable includes calculating and sending to the Web authentication server The number of times the detection message is sent; when the timer expires, it is judged whether the number of times the detection message is sent exceeds the predetermined number of times; If the Web authentication server does not respond to the detection packet, it is determined that the Web authentication server is unavailable.

Preferably, after determining the detection of the function of the Web authentication server, the method further includes, when it is determined that the Web authentication server is available, authenticating the user through the Web authentication server.

Preferably, the detection message is at least one of the following: transmission control protocol synchronous TCP SYN message, wherein, the TCP SYN message is used to detect the Web service function of the Web authentication server; forced offline NTF_LOGOUT message , wherein the NTF_LOGOUT message is used to detect the Portal authentication function of the Web authentication server.

Preferably, before sending the detection message to the Web authentication server, the source IP address in the detection message is configured, and the source IP address is not the IP address of the actual valid user.

Preferably, a setting switch is also included, and the switch is used to control whether to send a detection message to the Web authentication server.

According to another aspect of the present invention, a processing device for a Web authentication server is provided, including: a sending module, configured to send a detection message to the Web authentication server, wherein the detection message is used to detect the Web authentication The function of the server; a determining module, configured to determine the detection of the function of the Web authentication server after receiving the response message from the Web authentication server to the detection message.

Preferably, it also includes a setting module, configured to set a timer, after sending the detection message to the Web authentication server, and when the timer expires, the Web authentication server has not received the In the case of the response packet of the detection packet, it is determined that the web authentication server is unavailable.

Preferably, the determination module includes a calculation module, configured to calculate the number of times the detection message is sent to the Web authentication server; a judging module, configured to determine whether to send the detection message when the timer expires Whether the number of times exceeds the predetermined number of times; the second determination module, in the case that the number of times the detection message is sent exceeds the predetermined number of times and no response message from the Web authentication server to the detection message is received, determine The web authentication server is unavailable.

According to the present invention, a detection message is sent to the Web authentication server, wherein the detection message is used to detect the function of the Web authentication server; after receiving the response of the Web authentication server to the detection message After the message, it is determined to detect the function of the Web authentication server, which solves the problem in the prior art that the user cannot be authenticated normally when the function of the Web authentication server cannot be used normally, and then achieves the authentication through the Web. Before the authentication server performs authentication, it is confirmed whether the function of the Web authentication server is available, so as to ensure that the Web authentication server that authenticates the user can successfully perform authentication.

Description of drawings

The accompanying drawings described here are used to provide a further understanding of the present invention and constitute a part of the application. The schematic embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations to the present invention. In the attached picture:

FIG. 1 is a flow chart of Web authentication in the related art;

Fig. 2 is the flow chart of the Web authentication server processing method according to the embodiment of the present invention;

Fig. 3 is a structural block diagram of a Web authentication server processing device according to an embodiment of the present invention;

Fig. 4 is a structural block diagram of a Web authentication server processing device according to a preferred embodiment of the present invention;

Fig. 5 is a structural block diagram of a determining module 34 according to a preferred embodiment of the present invention;

Fig. 6 is a flowchart of a method for detecting the function of a Web authentication server implemented according to the present invention;

FIG. 7 is a flow chart of a method for detecting a TCP forced chain building function according to an embodiment of the present invention;

Fig. 8 is the flowchart of the UDP authentication function detection method according to the embodiment of the present invention;

Fig. 9 is a flowchart of a method for timing detection of a Web authentication server according to an embodiment of the present invention;

Fig. 10 is a flow chart of detecting the Web service function of the Web authentication server using a TCP+HTTP combination method according to a preferred embodiment of the present invention;

Fig. 11 is a flow chart of the Portal authentication function of the Web authentication server detected by the Portal protocol message NTF_LOGOUT message according to the preferred embodiment of the present invention.

Detailed ways

Hereinafter, the present invention will be described in detail with reference to the drawings and examples. It should be noted that, in the case of no conflict, the embodiments in the present application and the features in the embodiments can be combined with each other.

There is no active packet detection mechanism in the currently released Portal protocol, and there is no relevant Web authentication server detection mechanism proposed in the industry for the time being. This embodiment proposes an active detection mechanism to detect the Web service function of the Web authentication server to ensure that the server selected by the BNG for the user can successfully launch the authentication page, and the proposed active detection mechanism detects the Portal authentication function of the Web server , to ensure that the server selected by BNG for the user can be successfully authenticated. The mechanism for actively detecting the web authentication function is described below.

In this embodiment, a method for processing a Web authentication server is provided. FIG. 2 is a flowchart of a method for processing a Web authentication server according to an embodiment of the present invention. As shown in FIG. 2 , the process includes the following steps:

Step S202, sending a detection message to the Web authentication server, wherein the detection message is used to detect the function of the Web authentication server;

Step S204, after receiving the response message from the Web authentication server to the detection message, determine the function detection of the Web authentication server.

Through the above steps, a detection message is sent to the Web server to detect whether the function of the Web server is available. Through such steps, when the user is authenticated by the Web authentication server, it is possible to know in advance whether the Web authentication server is available. , so as to ensure the success of the authentication. Compared with the prior art, the Web authentication server is not detected in advance, that is, the authentication is performed without knowing whether the Web server is really available, which wastes resources and affects the user experience. Obtaining the functional status of the Web authentication server through the detection of the above steps can provide users with a reliable Web authentication server, perform authentication smoothly, and improve user experience.

In order to improve the detection efficiency of the Web authentication server, a timer can be set, and the time set by the timer can be determined according to specific needs. If the response message to the detection message from the web authentication server has not been received by then, it is determined that the web authentication server is unavailable. Preferably, it is also possible to determine whether the Web authentication server is available by sending a predetermined number of detections within a predetermined time, for example, calculating the number of times the detection message is sent to the Web authentication server; when the timer expires, it is determined to send the detection Whether the number of times of the message exceeds the predetermined number of times; when the number of times the detection message is sent exceeds the predetermined number of times and the response message to the detection message of the Web authentication server has not been received, it is determined that the Web authentication server is unavailable, that is, Give up authenticating the user through the Web authentication server. On the contrary, the response message of the detection message is received within a predetermined time, that is, when it is determined that the Web authentication server is available, the user is authenticated through the Web authentication server.

The detection message that detects the Web authentication server can be various, it can be a TCP message, and it can also be a combined message of TCP+HTTP. For example, the detection message is a Transmission Control Protocol synchronous TCP SYN message, wherein the The TCP SYN message is used to detect the Web service function of the Web authentication server; the detection message can also be a forced offline NTF_LOGOUT message, where the NTF_LOGOUT message is used to detect the Portal authentication function of the Web authentication server.

It should be noted that in order to make the detection of the Web authentication server more accurate, a series of configuration preparations can be performed before sending the detection packet to the Web authentication server. For example, the detection switch of the Web authentication server can be set. It is used to control whether to send detection packets to the web authentication server. The switch is turned on when detection is required, and the switch is closed when detection is not required. You can also configure the source IP address in the detection message. The source IP address cannot be configured as the address of the actual user, that is, the IP address of the non-actual and valid user. The configured source IP address is used as the Web authentication server The user IP address field in the active detection packet. Such processing can make detection more convenient and effective.

In this embodiment, a processing device for a Web authentication server is also provided, which is used to implement the above embodiments and preferred implementation modes, and what has been explained will not be repeated here. As used below, the term "module" may be a combination of software and/or hardware that realizes a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, implementations in hardware, or a combination of software and hardware are also possible and contemplated.

FIG. 3 is a structural block diagram of a Web authentication server processing device according to an embodiment of the present invention. As shown in FIG. 3 , the device includes a sending module 32 and a determining module 34 . The device will be described below.

The sending module 32 is configured to send a detection message to the Web authentication server, wherein the detection message is used to detect the function of the Web authentication server; the determination module 34 is connected to the sending module 32 and is used to receive the Web authentication After the server sends a response message to the detection message, it is determined to test the function of the web authentication server.

FIG. 4 is a structural block diagram of a Web authentication server processing device according to a preferred embodiment of the present invention. As shown in FIG. 4 , the device includes not only all the modules in FIG. 3 , but also a setting module 42 . The device will be described below. The setting module 42 is used to set the timer, after sending the detection message to the Web authentication server, and under the situation that the response message of the detection message of the Web authentication server has not been received when the timer expires, determine The web authentication server is unavailable.

Fig. 5 is the structural block diagram of determining module 34 according to the preferred embodiment of the present invention, as shown in Fig. 5, this determining module 34 comprises, calculating module 342, is used for calculating the number of times that this detection message is sent to this Web authentication server; Module 344, is connected to calculation module 342, is used for when this timer expires, judges whether the number of times that sends this detection message exceeds predetermined number of times; The second determination module 346, is connected to judging module 344, when sending this detection message When the number of times exceeds the predetermined number of times, it is determined that the Web authentication server is unavailable.

In this embodiment, an active detection mechanism of a Web authentication server is provided. Based on the mechanism, a method and device for actively detecting a Web authentication server in a Web authentication scenario are provided. This scheme can not only detect whether the Web service function of the Web authentication server is available, but also detect whether the Portal authentication function of the Web authentication server is available. The main steps of this mechanism are described below.

S1, BNG constructs a TCP SYN message to determine whether the Web service function of the Web authentication server is available;

S2, if the Web authentication server responds, then the BNG considers that the Web service of the Web authentication server is available, and the BNG terminates the TCP connection;

S3, if the Web service is available, the BNG constructs an NTF_LOGOUT message as an active detection message to detect whether the Web authentication server Portal authentication service is available;

S4. If the BNG receives the ACK_NTF_LOGOUT (forced logout confirmation) message responded by the Web authentication server, the BNG considers that the Portal service of the Web authentication server is available, and the BNG sets the Portal server as available.

In addition, it should be noted that the BNG in the active detection mechanism of the Web authentication server can control whether the BNG needs to open this detection mechanism through a switch; when detecting whether the Web service of the Web authentication server is available, the source IP of the TCP connection can be configured by the BNG An IP; when detecting whether the Portal service of the Web authentication server is available, the source IP of the Portal protocol sent can be an IP configured by BNG; when detecting whether the Web service of the Web authentication server is available, BNG can construct a TCP message detection, A combination of TCP+HTTP can be used to detect;

Through the above mechanism, it is possible to detect not only the function of TCP forced chain building of the Web authentication server, but also the UDP authentication function of the Web authentication server, which ensures that the server selected after the detection can satisfy the normal Web authentication of the user, so that the user cannot access the Internet. Affected.

Embodiments and preferred embodiments of the present invention will be described below in conjunction with the accompanying drawings.

Fig. 6 is the flow chart of the detection Web authentication server function method implemented according to the present invention, as shown in Fig. 6, this flow process comprises the following steps:

Step S602, BNG receives a user request to visit a web page;

Step S604, finding an available server, actively detecting whether the server is available, and starting a timeout timer;

Step S606, when the timeout expires, judge whether a response message from the server has been received, and if it is judged to be yes, go to step S608, otherwise, go to step S610;

Step S608, setting the status of the server as available;

Step S610, setting the status of the server as unavailable, and starting a recovery (deadtime) timer;

Step S612, when the recovery time is up, the server is revived, and the server status is restored to usable.

Fig. 7 is a flow chart of a method for detecting a TCP forcibly pushing a link building function according to an embodiment of the present invention. As shown in Fig. 7, the process includes the following steps:

Step S702, turn on the active detection switch, and configure the detection IP;

Step S704, the detection IP of current configuration is used as the source address of the TCP message, and the server address is used as the destination address to construct a TCP SYN message and send it to the Portal server;

Step S706, judge whether to receive the TCP SYN+ACK message that Portal server responds, under the situation that judges as yes, enter step S708, otherwise enter step S710;

Step S708, determining that the Portal server is available;

Step S710, determining that the Portal server is unavailable.

Fig. 8 is a flow chart of the UDP authentication function detection method according to an embodiment of the present invention, as shown in Fig. 8, the process includes the following steps:

Step S802, turn on the active detection switch, and configure the detection IP;

Step S804, using the configured detection IP as the user IP, constructing an NTF_LOGOUT message and sending it to the server;

Step S806, judge whether to receive the ACK_NTF_LOGOUT message that Portal server responds, in the situation that judges as yes, enter step S808, otherwise enter step S810;

Step S808, determining that the Portal server is available;

Step S810, determining that the Portal server is unavailable.

Fig. 9 is a flowchart of a method for timing detection of a Web authentication server according to an embodiment of the present invention. As shown in Fig. 9, the process includes the following steps:

Step S902, turning on the active detection switch to enable active detection;

Step S904, using the listening port number configured by the server to construct an active detection message to send, starting from the main listening port number;

Step S906, start the detection timer;

Step S908, when the detection interval time is up, judge whether a detection confirmation message from the server has been received, and if it is judged to be yes, proceed to step S910, otherwise proceed to step S916;

Step S910, recording the current listening port number, using the listening port number to construct an active detection message to continue detection and start a detection timer;

Step S912, after reaching the number of detections, judge whether to receive the response message of the server, if judged to be yes, enter step S914, set the server status as available (ALIVE), otherwise, return to step S904;

Step S914, setting the server status as ALIVE;

Step S916, judging whether it is the last listening port number configured by the server; if it is judged yes, go to step S918, otherwise, go back to step S904.

Fig. 10 is a flow chart of detecting the Web service function of the Web authentication server using the TCP+HTTP combination method according to a preferred embodiment of the present invention. As shown in Fig. 10, the process includes the following steps: It should be noted that in Fig. Use the combination of TCP and HTTP to detect the Web service of the Web authentication server, and find that the Web service function of the Web authentication server is unavailable.

Step S1002, turn on the active detection switch of the Web authentication server on the BNG, configure the detection IP, detection times and detection interval;

Step S1004; on the BNG, adopt detection IP as the source address of the TCP connection, construct a TCP SYN message and build a chain with the Web authentication server;

Step S1006; the web authentication server does not reply the SYN+ACK message;

Step S1008; BNG does not receive the SYN+ACK message from the server when the detection interval time is up, and continues to detect when the number of detections is not 0. When the number of detections is 0, if the server has not responded yet, it is considered The web service function of this server is not available.

Fig. 11 is the flow chart of Portal authentication function that the Portal agreement message NTF_LOGOUT message detects Web authentication server according to the preferred embodiment of the present invention, as shown in Fig. 11, this flow process comprises the following steps: It should be noted that, in Fig. 11 The BNG uses the Portal protocol packet NTF_LOGOUT to detect the Portal authentication function of the Web authentication server, and finds that the Portal authentication function of the Web authentication server is not available.

Step S1102; Turn on the active detection switch of the Web authentication server on the BNG, configure the detection IP, detection times and detection interval;

Step S1104; The detection IP is used as the user IP on the BNG, and the NTF_LOGOUT message is constructed according to the Portal protocol and sent to the Web authentication server;

Step S1106; the web authentication server does not reply the ACK_NTF_LOGOUT message;

Step S1108: BNG does not receive the ACK_NTF_LOGOUT message from the server when the detection interval time is up, and continues to detect when the number of detections is not 0. When the number of detections is 0, if the server has not responded, it is considered that the server The Portal authentication function is not available.

The embodiments and preferred embodiments implemented by applying the above detection mechanism can not only successfully detect the TCP forced chain building function of the Web authentication server, but also successfully detect the UDP authentication function of the Web authentication server. At the same time, the above-mentioned embodiments and preferred embodiments also adopt a timing detection mechanism, which effectively avoids the situation that the detection state is incorrect due to the change of the status of the Web authentication server, and ensures the correctness of the current detection state. Correctly detecting the current status of the Web authentication server and providing an available server to the user can ensure that the user can perform Web authentication normally and finally achieve the goal of normal Internet access. In addition, the present invention is compatible with all application scenarios of the current Portal protocol, can realize successful docking with different Web authentication servers, and does not affect normal Web authentication of users.

Obviously, those skilled in the art should understand that each module or each step of the above-mentioned present invention can be realized by a general-purpose computing device, and they can be concentrated on a single computing device, or distributed in a network formed by multiple computing devices Alternatively, they may be implemented in program code executable by a computing device so that they may be stored in a storage device to be executed by a computing device, and in some cases in an order different from that shown here The steps shown or described are carried out, or they are separately fabricated into individual integrated circuit modules, or multiple modules or steps among them are fabricated into a single integrated circuit module for implementation. As such, the present invention is not limited to any specific combination of hardware and software.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and changes. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims (10)

1. a web authentication server process method is characterized in that, comprising:

Send detection messages to said web authentication server, wherein, said detection messages is used to detect the function of said web authentication server;

After receiving the response message of said web authentication server, confirm detection to the function of said web authentication server to said detection messages.

2. method according to claim 1; It is characterized in that; Also comprise, timer is set, after said web authentication server sends said detection messages; And at said timer to also not receiving constantly under the situation of said web authentication server to the response message of said detection messages, confirm that said web authentication server is unavailable.

3. method according to claim 1 and 2 is characterized in that, to also not receiving constantly under the situation of said web authentication server to the response message of said detection messages, confirms said web authentication server unavailable comprising at said timer,

Calculating is sent the number of times of said detection messages to said web authentication server;

To constantly, judge whether the number of times that sends said detection messages surpasses pre-determined number at said timer;

Surpass said pre-determined number at the number of times that sends said detection messages and also do not receive under the situation of said web authentication server to the response message of said detection messages, confirm that said web authentication server is unavailable.

4. method according to claim 1 is characterized in that, after the detection of the function of confirming said web authentication server, also comprises, is confirming through said web authentication server the user to be carried out authentication under the situation that said web authentication server can be used.

5. method according to claim 1 is characterized in that, said detection messages be following one of at least:

The synchronous TCP SYN of transmission control protocol message, wherein, said TCP SYN message is used to detect the Web service function of said web authentication server;

The pressure NTF_LOGOUT message that rolls off the production line, wherein, said NTF_LOGOUT message is used to detect the Portal authentication function of said web authentication server.

6. method according to claim 1 is characterized in that, before said web authentication server sends detection messages, the source IP address in the said detection messages is configured, and said source IP address is the IP address of non-actual validated user.

7. method according to claim 1 is characterized in that, also comprises switch is set, and whether said switch is used for controlling to said web authentication server transmission detection messages.

8. a web authentication server process device is characterized in that, comprising:

Sending module is used for sending detection messages to said web authentication server, and wherein, said detection messages is used to detect the function of said web authentication server;

Determination module is used for after receiving the response message of said web authentication server to said detection messages, confirms the detection to the function of said web authentication server.

9. device according to claim 8; It is characterized in that, also comprise, module is set; Be used to be provided with timer; After said web authentication server sends said detection messages, and at said timer to also not receiving constantly under the situation of said web authentication server to the response message of said detection messages, confirm that said web authentication server is unavailable.

10. device according to claim 9 is characterized in that, said determination module comprises,

Computing module is used to calculate to said web authentication server and sends the number of times of said detection messages;

Judge module is used for arriving constantly at said timer, judges whether the number of times that sends said detection messages surpasses pre-determined number;

Second determination module surpasses said pre-determined number at the number of times that sends said detection messages and does not also receive under the situation of said web authentication server to the response message of said detection messages, confirms that said web authentication server is unavailable.

Images