Abstract:
The present application discloses a service access method based on the WLAN access authentication, which includes: in the process of performing the WLAN access authentication, a WLAN portal server transmits a first Cookie to a terminal, which has passed the WLAN access authentication; the terminal requests to access the service of the application system, and the service authentication center associated with the application system determines the terminal has passed the WLAN access authentication according to the first Cookie; the associated service authentication center obtains the identity token of the terminal through the first Cookie; the associated service authentication center transmits the obtained identity token of the terminal to the application system; and according to the identity token of the terminal, the application system provides the service access for the terminal. By the method, after the terminal passes the WLAN access authentication, it can access the service provided by several application systems without the service authentication, thus improving the user experience and reducing the system overhead of the application system.

Description:
FIELD 
       [0001]    The present invention relates to the field of radio communications and particularly to a service access method, system and device based upon Wireless local Area Network (WLAN) access authentication. 
       BACKGROUND 
       [0002]    As radio communication technologies have been developed and the infomationization extent of the society has been improved, there are an increasing number of access demands for an application system providing a value-added service via a WLAN on one hand and also an increasing number of application systems capable of providing a service access on the other hand. 
         [0003]      FIG. 1  illustrates a structure of a WLAN access authentication system  1  which may include a user equipment  11 , an Access Point (AP)  12 , an Access Controller (AC)  13 , an access authentication server  14  and a portal server  15 . In the system  1 , the access point  12  can provide a radio access of the user equipment  11 . The access controller  13  controls an access of the user equipment  11  to a WLAN. The access controller  13 , the access authentication server  14  and the portal server  15  cooperate to perform access authentication on the user equipment  11 . This WLAN access authentication method has been detailed in the pending Chinese Patent Application No. 200610169785.0 (Publication No. CN 101212297 A) of the present applicant, the disclosure of which is incorporated here by reference in its entirety and will not be further described here. 
         [0004]      FIG. 2  illustrates a single-site login system  2  which enables a user equipment to access services of a plurality of application systems through one service authentication process. The system  2  may include application systems, service authentication centers and user equipment databases. The application systems may be divided into a first level application system  21  and a second level application system  22  which are associated respectively with a first level service authentication center  23  and a second level service authentication center  24 . The application system can acquire a desired user equipment identity token through an associated service authentication center and provide a user equipment with a service access according to the user equipment identity token. Each second level service authentication center  24  is associated with a user equipment database  25  in which a plurality of user equipment information are recorded. This single-site login system has been detailed in the unpublished Chinese Patent Application No. 200810116578.8 of the present applicant, the disclosure of which is incorporated here by reference in its entirety and will not be further described here. 
         [0005]    However since WLAN access authentication is separate from service authentication of the single-site login system, the user equipment which has passed WLAN access authentication has to perform at least one service authentication process to access a service provided from an application system. Such repeated authentication hinders the experience of a user and also increases an overhead of the application system because the system has to maintain user equipment data desired for service authentication. 
       SUMMARY 
       [0006]    In order to overcome the foregoing problem of repeated authentication in the prior art, there is provided according to an embodiment of the invention a service access method based upon Wireless Local Area Network, WLAN, access authentication which includes: a WLAN portal server transmitting a first cookie to a user equipment which has passed WLAN access authentication during WLAN access authentication of the user equipment; a service authentication center associated with an application system determining, from the first cookie in the user equipment which has passed WLAN access authentication, that the user equipment has passed WLAN access authentication when the user equipment requests to access a service of the application system; the associated service authentication center acquiring a user equipment identity token of the user equipment using the first cookie; the associated service authentication center transmitting the acquired user equipment identity token to the application system; and the application system providing the user equipment with a service access according to the user equipment identity token. 
         [0007]    This application provides a service access system based upon Wireless Local Area Network, WLAN, access authentication which includes: 
         [0008]    a WLAN portal server configured to transmit a first cookie to a user equipment which has passed WLAN access authentication during WLAN access authentication of the user equipment; 
         [0009]    an associated service authentication center configured to determine, from the first cookie in the user equipment which has passed WLAN access authentication, that the user equipment has passed WLAN access authentication, acquire a user equipment identity token of the user equipment token using the first cookie and transmit the acquired user equipment identity token to an application system, when the user equipment requests to access a service of the application system; and 
         [0010]    the application system configured to provide the user equipment with a service access according to the user equipment identity token. 
         [0011]    This application provides a service access device based upon Wireless Local Area Network, WLAN, access authentication which includes: 
         [0012]    a determining module configured to determine from a first cookie in a user equipment that the user equipment has passed WLAN access authentication, wherein the first cookie is transmitted from a WLAN portal server to the user equipment which has passed WLAN access authentication during WLAN access authentication of the user equipment; 
         [0013]    a acquiring module configured to acquire a user equipment identity token of the user equipment using the first cookie; and 
         [0014]    a first transmitting module configured to transmit the acquired user equipment identity token to an application system. 
         [0015]    This application provides a service access device based upon Wireless Local Area Network, WLAN, access authentication which includes: 
         [0016]    a generating module configured to generate a first cookie for a user equipment which has passed WLAN access authentication during WLAN access authentication of the user equipment; and 
         [0017]    a second transmitting module configured to transmit the first cookie to the user equipment which has passed WLAN access authentication so that the user equipment requesting to access a service of an application system acquires a user equipment identity token of the user equipment using the first cookie. 
         [0018]    With the foregoing method, the user equipment which has passed WLAN access authentication can access services provided from a plurality of application systems without any service authentication, thereby improving the experience of a user and alleviating a system overhead of the application systems. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0019]      FIG. 1  is a schematic structural diagram of a WLAN access authentication system; 
           [0020]      FIG. 2  is a schematic structural diagram of a single-site login system; 
           [0021]      FIG. 3  is a flow chart of a service access method based upon WLAN access authentication according to a first implementation solution of the invention; 
           [0022]      FIG. 4  is a flow chart of a service access method based upon WLAN access authentication according to a second implementation solution of the invention; 
           [0023]      FIG. 5  is a flow chart of a service access method based upon WLAN access authentication according to a third implementation solution of the invention; 
           [0024]      FIG. 6  is a flow chart of a service access method based upon WLAN access authentication according to a fourth implementation solution of the invention; 
           [0025]      FIG. 7  is a flow chart of a service access method based upon WLAN access authentication according to a fifth embodiment of the invention; 
           [0026]      FIG. 8  is a process flow chart of a service access method based upon WLAN access authentication in an illustrative application scenario according to the invention; 
           [0027]      FIG. 9  is a process flow chart of a service access method based upon WLAN access authentication in another illustrative application scenario according to the invention; 
           [0028]      FIG. 10  is a flow chart of a service access method based upon WLAN access authentication according to a first implementation solution of the invention; 
           [0029]      FIG. 11  is a flow chart of a service access method based upon WLAN access authentication according to a second implementation solution of the invention; 
           [0030]      FIG. 12  is a flow chart of a service access method based upon WLAN access authentication according to a third implementation solution of the invention; 
           [0031]      FIG. 13  is a flow chart of a service access method based upon WLAN access authentication according to a fourth implementation solution of the invention; 
           [0032]      FIG. 14  is a process flow chart of a service access method based upon WLAN access authentication in a specific application scenario according to the invention; 
           [0033]      FIG. 15  is a schematic structural diagram of a service access system based upon Wireless Local Area Network (WLAN) access authentication according to the invention; 
           [0034]      FIG. 16  is a schematic structural diagram of a service access device based upon Wireless Local Area Network (WLAN) access authentication according the invention; and 
           [0035]      FIG. 17  is a schematic structural diagram of another service access device based upon Wireless Local Area Network (WLAN) access authentication according to the invention. 
       
    
    
     DETAILED DESCRIPTION 
       [0036]    According to the invention, when a user equipment initiates a request to access a service of an application system, if the user equipment has passed WLAN access authentication, then the application system can acquire a user equipment identity token through a service authentication center associated with the user equipment and provide the user equipment with a service access according to the user equipment identity token without any service authentication. Those skilled in the art can appreciate that the user equipment identity token is information desired for the application system to provide the user equipment with the service access, e.g., a Mobile Station international ISDN number (MSISDN) of the user equipment, charge information, etc. 
         [0037]    In an existing WLAN access method, a portal server can transmit an access authentication result page to a user equipment. According to an embodiment of the invention, the portal server can transmit a cookie to the user equipment in addition to the access authentication result page transmitted to the user equipment which has passed WLAN access authentication. The cookie is a text file stored at the user equipment, and the contents of the cookie transmitted from the portal server to the user equipment can include a user equipment identifier and an access authentication pass indication. In embodiments of the invention, the user equipment identifier is an identification code which can identify uniquely the identity of the user equipment, e.g., the MSISDN of the user equipment, etc. The access authentication pass indication can be various pieces of information which can indicate that the user equipment has passed WLAN access authentication, the identifier of the portal server (e.g., the name or address of the portal server, etc.) as a non-limiting example. As can be appreciated, the portal server can transmit the cookie together with the access authentication result page to the user equipment or transmit the cookie separately to the user equipment before or after the access authentication result page is transmitted. 
         [0038]    A service access method based upon WLAN access authentication according to the invention will be described below with reference to  FIG. 3  to  FIG. 7 , where a system providing a service access is in the two-level architecture as illustrated in  FIG. 2 . The first operation of the method illustrated in  FIG. 3  to  FIG. 7  (the operation  301  in  FIG. 3 , the operation  401  in  FIG. 4 , the operation  501  in  FIG. 5 , the operation  601  in  FIG. 6  and the operation  701  in  FIG. 7 ) can be the operation as described above in which a portal server transmits a cookie to a user equipment which has passed WLAN access authentication. As can be appreciated, after the user equipment transmits a service access request to an application system, the application system can check whether there is a user equipment identity token present therein, and if so, then the application system can provide the user equipment directly with a service access. Therefore respective operations following the first operation in the method as illustrated in  FIG. 3  to  FIG. 7  in which the portal server transmits the cookie to the user equipment which has passed WLAN access authentication will be performed only in the case that the user equipment identity token of the user equipment requesting the service access is absent in the application system. 
         [0039]    In the method according to a first implementation solution of the invention as illustrated in  FIG. 3 , when the user equipment initiates a request to access a service of an application system after the operation  301 , a service authentication center associated with the application system can determine from the cookie in the user equipment whether the user equipment has passed WLAN access authentication (the operation  302 ). At this time the application system redirects the service access request to the service authentication center associated with the application system. For example, if the user equipment is to access a service of a first level application system, then a first level service authentication center determines whether the user equipment has passed WLAN access authentication; or if the user equipment is to access a service of a second level application system, then a second level service authentication center associated with the second level application system determines whether the user equipment has passed WLAN access authentication. As described above, the portal server has transmitted the cookie including a user equipment identifier and an access authentication pass indication to the user equipment which has passed WLAN access authentication during WLAN access authentication of the user equipment, thus the service authentication center can determine from the access authentication pass indication included in the cookie in the user equipment that the user equipment has passed WLAN access authentication. 
         [0040]    Then the service authentication center can acquire a desired user equipment identity token using the cookie (the operation  303 ). The service authentication center transmits the user equipment identity token to the application system upon reception thereof (the operation  304 ), and the application system can provide the user equipment with a service access according to the user equipment identity token (the operation  305 ). As can be appreciated, alternatively in the operation  304  in which the service authentication center transmits the user equipment identity token to the application system, the service authentication center can firstly transmit the user equipment identity token to the user equipment which in turn transmits it to the application system so that the application can provide the user equipment with the desired service access. 
         [0041]    In a second implementation solution of the invention as illustrated in  FIG. 4 , a portal server transmits a cookie to a user equipment which has passed WLAN access authentication in the operation  401 . After a service authentication center determines from the cookie in the user equipment that the user equipment has passed WLAN access authentication (the operation  402 ), the service authentication center can acquire a user equipment identity token using the cookie in such a way that the service authentication center can acquire a user equipment identifier from the cookie and request the user equipment identity token from a second level service authentication center to which the user equipment is homed according to the user equipment identifier (the operation  403 ). The service authentication center transmits the user equipment identity token to an application system upon reception thereof (the operation  404 ). The application system can provide the user equipment with a service access according to the user equipment identity token (the operation  405 ). 
         [0042]    As described above, each second level service authentication center is associated with a user equipment database in which information of user equipments is recorded. In embodiments of the invention, a user equipment being “homed” to a specific second level service authentication center refers to that information of the user equipment is recorded in a user equipment database associated with the second level service authentication center. The service authentication center will firstly determine which second level service authentication center the user equipment is homed to before the user equipment identity token is requested from the second level service authentication center to which the user equipment is homed, and the service authentication center can determine the second level service authentication center, to which the user equipment is homed, according to the user equipment identifier acquired from the cookie in various existing methods, none of which will be detailed in the invention for the sake of brevity. The service authentication center transmits the user equipment identifier to the second level service authentication center, to which the user equipment is homed, to request the user equipment identity token, and thus the second level service authentication center to which the user equipment is homed can acquire the corresponding user equipment identity token according to the user equipment identifier and transmit it to the service authentication center. Those skilled in the art can appreciate that the second level service authentication center to which the user equipment is homed can search the user equipment database associated therewith for the user equipment identity token according to the user equipment identifier in various existing methods, none of which will be further described here. 
         [0043]    Optionally the user equipment identity token can be stored at the service authentication center. Thus in the operation  403  illustrated in  FIG. 4 , the service authentication center can firstly determine whether the user equipment identity token corresponding to the user equipment identifier is stored locally after acquiring the user equipment identifier from the cookie, and if not, then the service authentication center will request the user equipment identity token from the second level service authentication center to which the user equipment is homed according to the user equipment identifier; otherwise, the process of requesting the user equipment identity token from the second level service authentication center to which the user equipment is homed can be omitted. For example, a table of user equipment identity tokens, in which user equipment identity tokens are stored, can be configured at the service authentication center. As can be appreciated, each user equipment identity token can be indexed with a user equipment identifier in the table of user equipment identity tokens. Stated otherwise, correspondence relationships between user equipment identifiers and user equipment identity tokens can be recorded in the table of user equipment identity tokens. Therefore the service authentication center can search the table of user equipment identity tokens for the corresponding user equipment identity token according to the user equipment identifier. 
         [0044]    In order to improve the security, the cookie transmitted from the portal server to the user equipment can include an encrypted user equipment identifier, and thus the service authentication center shall acquire the user equipment identifier only after the encrypted user equipment identifier in the cookie is decrypted. Those skilled in the art can encrypt and decrypt the user equipment identifier in various cipher systems. In a specific embodiment, a symmetric cipher algorithm can be adopted, that is, the portal server and the service authentication center share a key Ka. Specifically the cookie in the user equipment which has passed WLAN access authentication includes a cipher text generated by the portal server encrypting the user equipment identifier with the key Ka, and the service authentication center acquires the correct user equipment identifier after the encrypted user equipment identifier is decrypted with the key Ka upon acquisition of the cookie. Various symmetric cipher algorithms can be adopted, e.g., the DES algorithm, the 3-DES algorithm, the AES algorithm, etc. In another specific embodiment, an asymmetric cipher algorithm can be adopted, that is, the cookie in the user equipment which has passed WLAN access authentication includes a cipher text generated by the portal server encrypting the user equipment identifier with a public key Kp, and the service authentication center can decrypt the encrypted user equipment identifier with its private key Ks upon acquisition of the cookie. Various asymmetric cipher algorithms can be adopted, e.g., the RSA algorithm, the ElGmal algorithm, the ECC algorithm, etc. 
         [0045]    As can be appreciated, a replay attack may still occur although the security can be improved to some extent because the user equipment identifier is added to the cookie after being encrypted. For this reason, the service authentication center can store the user equipment identifier after the user equipment identifier is acquired from the cookie and allocate a user equipment identifier index to each user equipment identifier in an embodiment of the invention. In this case, the service authentication center can transmit a rewritten cookie to the user equipment to replace the cookie provided previously from the portal server, and the rewritten cookie can include the identifier of the service authentication center (e.g., the name or address of the service authentication center, etc.) and the user equipment identifier index corresponding to the user equipment identifier. As described above, the service authentication center can firstly transmit the user equipment identity token to the user equipment which in turn transmits it to the application system, in the operation in which the service authentication center transmits the user equipment identity token to the application system. Therefore the rewritten cookie can be transmitted to the user equipment to replace the original cookie while the service authentication center transmits the user equipment identity token to the application system via the user equipment. Thus when the user equipment requests to access a service of another application system, a service authentication center associated with the other application system can transmit the user equipment identifier index included in the rewritten cookie to the service authentication center represented by the identifier of the service authentication center included in the rewritten cookie according to the identifier of the service authentication center and the user equipment identifier index, and the service authentication center represented by the identifier of the service authentication center acquires the corresponding user equipment identifier according to the user equipment identifier index to thereby acquire the desired user equipment identity token. In the case as described above that the table of user equipment identity tokens, in which user equipment identity tokens are stored, is created in the service authentication center, the table of user equipment identity tokens can be modified by including therein a table entry in which the user equipment identifier index corresponding to the user equipment identifier is recorded. Thus the service authentication center represented by the identifier of the service authentication center in the rewritten cookie can search the table of user equipment identity tokens according to the user equipment identifier index, and if no corresponding user equipment identity token is found, then the service authentication center can acquire the corresponding user equipment identifier from the table of user equipment identity tokens and acquire the desired user equipment identity token according to the user equipment identifier. In this way, the cookie including the user equipment identifier will be used once only if it is the first time for the user equipment to request a service access after which has passed WLAN access authentication to thereby avoid a replay attack. 
         [0046]    As can be appreciated, secure transmission channels can be established between the service authentication center and the second level service authentication center to which the user equipment is homed and between the service authentication center and the associated application system for transmission of the user equipment identifier and/or the user equipment identity token. As an example, the secure transmission channels can be a Virtual Private Network (VPN), e.g., an SSL secure tunnel, etc. 
         [0047]      FIG. 5  and  FIG. 6  illustrates a service access method based upon WLAN access authentication in a third implementation solution and a fourth implementation solution of the invention, where a second level service authentication center requests via a first level service authentication center a user equipment identity token from a second level service authentication center to which a user equipment is homed instead of requesting the user equipment identity token directly from the second level service authentication center to which the user equipment is homed, and this can avoid a mesh access condition due to interconnectivity between the different second level service authentication centers and hence avoid possible information congestion. 
         [0048]    Specifically a portal server transmits a cookie to a user equipment which has passed WLAN access authentication (the operation  501  in  FIG. 5  and the operation  601  in  FIG. 6 ), and a service authenticator center determines from the cookie in the user equipment that the user equipment has passed WLAN access authentication (the operation  502  in  FIG. 5  and the operation  602  in  FIG. 6 ). Thereafter it can be determined whether the level of the service authenticator center is a first level or a second level (the operation  503  in  FIG. 5  and the operation  603  in  FIG. 6 ). If the service authentication center is determined as a first level service authentication center, then the first level service authentication center acquires a user equipment identifier from the cookie and requests a user equipment identity token from a second level service authentication center to which the user equipment is homed according to the user equipment identifier (the operation  504  in  FIG. 5  and the operation  604  in  FIG. 6 ). If the service authentication center is determined as a second level service authentication center, then a process of the method illustrated in  FIG. 5  is slightly different from that of the method illustrated in  FIG. 6 . 
         [0049]    In the case that the service authentication center is determined as a second level service authentication center, as illustrated in  FIG. 5 , the second level service authentication center transmits a user equipment identifier to a first level service authentication center after the user equipment identifier is acquired from the cookie (the operation  505 ), and the first level service authentication center requests a user equipment identity token from a second level service authentication center to which the user equipment is homed according to the user equipment identifier (the operation  506 ) and transmits the user equipment identity token to the second level service authentication center requesting the user equipment identity token (the operation  507 ). And as illustrated in  FIG. 6 , the second level service authentication center transmits the cookie to a first level service authentication center (the operation  605 ), and the first level service authentication center acquires a user equipment identifier from the cookie and requests a user equipment identity token from a second level service authentication center to which the user equipment is homed according to the user equipment identifier (the operation  606 ) and transmits the user equipment identity token to the second level service authentication center requesting the user equipment identity token (the operation  607 ). As can be apparent, the second level service authentication center is responsible for acquiring the user equipment identifier from the cookie in the method illustrated in  FIG. 5 , and the first level service authentication center acquires the user equipment identifier from the cookie in the method illustrated in  FIG. 6 . 
         [0050]    The service authentication center will perform the same process of the method illustrated in  FIG. 5  as that of the method illustrated in  FIG. 6  upon reception of the user equipment identity token in that the service authentication center transmits the user equipment identity token to an application system (the operation  508  in  FIG. 5  and the operation  608  in  FIG. 6 ), and the application system can provide the user equipment with a service access according to the user equipment identity token (the operation  509  in  FIG. 5  and the operation  609  in  FIG. 6 ). 
         [0051]    Alternatively the user equipment identity token can be stored and also a table of user equipment identity tokens, in which correspondence relationships between user equipment identifiers and user equipment identity tokens are recorded, can be created at the service authentication center. Thus if the service authentication center is determined as a first level service authentication center in the operation  503  illustrated in  FIG. 5  or the operation  603  illustrated in  FIG. 6 , then the first level service authentication center can firstly determine whether the desired user equipment identity token is stored locally at the first level service authentication center after the user equipment identifier is acquired from the cookie, and if not, then the service authentication center can request the user equipment identity token from the second level service authentication center to which the user equipment is homed according to the user equipment identifier; otherwise, the process of requesting the user equipment identity token from the second level service authentication center to which the user equipment is homed can be omitted. On the other hand, in the case that the service authentication center is a second level service authentication center, in the method illustrated in  FIG. 5 , the second level service authentication center can determine whether the desired user equipment identity token is stored locally after the user equipment identifier is acquired from the cookie, and if so, then the subsequent process in which the first level service authentication center requests the user equipment identity token from the second level service authentication center to which the user equipment is homed can be omitted; and in the method illustrated in  FIG. 6 , the first level service authentication center determines whether the desired user equipment identity token is stored at the first level service authentication center after the user equipment identifier is acquired from the cookie received from the second level service authentication center, and if so, then the process of requesting the user equipment identity token from the second level service authentication center to which the user equipment is homed can be omitted. 
         [0052]    Similarly a secure transmission channel can also be established for transmission of the user equipment identifier and/or the user equipment identity token. As an example, the secure transmission channel can be a VPN, e.g., an SSL secure tunnel, etc. 
         [0053]    In an embodiment, the cookie transmitted from the WLAN portal server to the user equipment can include an encrypted user equipment identifier. As can be appreciated, in the case that the user equipment identifier is encrypted, the first level service authentication center acquires the user equipment identifier from the cookie in the method illustrated in  FIG. 6 , thus it is not necessary for the second level service authentication center to store a key Ka (a symmetric encryption algorithm) or a private key Ks (an asymmetric encryption algorithm) required for decryption, and thus the amount of stored data and the amount of computation of the second level service authentication center can be lowered. 
         [0054]    As can be appreciated, the method illustrated in  FIG. 5  and  FIG. 6  can further include the operation in which the service authentication center transmits a rewritten cookie to the user equipment to replace the cookie provided previously from the portal server, where the rewritten cookie can include the identifier of the service authentication center and a user equipment identifier index corresponding to the user equipment identifier. It shall be noted that in the method illustrated in  FIG. 6 , if the service authentication center is a second level authentication center, then the first level service authentication center can alternatively transmit the user equipment identifier to the second level service authentication center when the user equipment identifier token is transmitted to the second level service authentication center although the first level service authentication center acquires the user equipment identifier from the cookie. Therefore the service authentication center can store the user equipment identifier and allocate a user equipment identifier index to each user equipment identifier after the user equipment identifier is acquired. 
         [0055]    In the method described above with reference to  FIG. 3  to  FIG. 6 , the service authentication center transmits the user equipment identifier token to the application system upon acquisition thereof As an alternative, in the case that the service authentication center can configure, for example, a table of user equipment identifier tokens in which acquired user equipment identifier tokens are stored, the service authentication center can set a corresponding user equipment identifier token number for each stored user equipment identifier token.  FIG. 7  illustrates the method in this implementation, after the operation  701  in which a portal server transmits a cookie to a user equipment which has passed WLAN access authentication, the operation  702  in which a service authentication center determines from the cookie in the user equipment that the user equipment has passed WLAN access authentication and the operation  703  in which the service authentication center acquires a user equipment identity token, the service authentication center stores the user equipment identity token, for example, in a table of user equipment identity tokens instead of transmitting the user equipment identity token directly to an application system and sets a corresponding user equipment identity token number thereof Therefore the service authentication center transmits the user equipment identity token number to the application system (the operation  704 ) instead of transmitting the user equipment identity token directly. The application system establishes a secure transmission channel with the service authentication center upon reception of the user equipment identity token number and provides the service authentication center with the user equipment identity token number, and the service authentication center searches the table of user equipment identity tokens for the corresponding user equipment identity token and further transmits the user equipment identity token to the application system via the secure transmission channel (the operation  705 ). As an example, a VPN, e.g., an SSL secure tunnel, etc., can be established between the service authentication center and the application system for transmission of the user equipment identity token. The application system can provide the user equipment with a service access according to the user equipment identity token after the user equipment identity token is acquired (the operation  706 ). 
         [0056]    As described previously, the service authentication center can transmit the user equipment identity token to the application system via the user equipment so that the application system can provide the user equipment with the desired service access. However the security of a transmission channel between the service authentication center and the user equipment and a transmission channel between the user equipment and the application system is typically poor, thus transmission of the user equipment identity token may result in such a potential security risk that the user equipment identity token may be stolen. In the method illustrated in  FIG. 7 , the service authentication center transmits only the user equipment identity token number to the application system via the user equipment, and the user equipment identity token is transmitted on the secure transmission channels, thereby improving the security. 
         [0057]    In order to facilitate understanding, a specific process of the service access method based upon WLAN access authentication according to an embodiment of the invention will be described below in two specific application scenarios with reference to  FIG. 8  and  FIG. 9 . 
         [0058]      FIG. 8  represents an illustrative scenario in which a user equipment ‘a’ which has passed WLAN access authentication accesses a first level application system A, where the first level application system A is associated with a first level service authentication center  1 , and a second level service authentication center  2  is associated with a user equipment database B in which information of the user equipment ‘a’ is recorded, that is, the user equipment ‘a’ is homed to the second level service authentication center  2 . During WLAN access authentication of the user equipment ‘a’, a WLAN portal server transmits a cookie including an access authentication pass indication and an encrypted user equipment identifier to the user equipment ‘a’ which has passed WLAN access authentication.  FIG. 8  illustrates the following process flow: 
         [0059]    Operation  801 : The user equipment ‘a’ initiates a service access request to the first level application system A; 
         [0060]    Operation  802 : The first level application system A checks whether a user equipment identity token of the user equipment ‘a’ is present, and if so, then the flow jumps to the operation  814 ; 
         [0061]    Operation  803 : The first level application system A redirects the service access request of the user equipment ‘a’ to the first level service authentication center  1 ; 
         [0062]    Operation  804 : The first level service authentication center  1  determines whether the user equipment ‘a’ has passed WLAN access authentication according to whether the cookie in the user equipment ‘a’ includes the access authentication pass indication, and if so, then the first level service authentication center  1  decrypts the encrypted user equipment identifier in the cookie, acquires the user equipment identifier, stores the user equipment identifier and sets a corresponding user equipment identifier index thereof; otherwise, the first level service authentication center  1  performs WLAN access authentication of the user equipment ‘a’; 
         [0063]    Operation  805 : The first level service authentication center  1  establishes a secure transmission channel to the second level service authentication center  2  and transmits the user equipment identifier to the second level service authentication center  2  to request the user equipment identity token; 
         [0064]    Operation  806 : The second level service authentication center  2  transmits a user equipment identity token request to the user equipment database B; 
         [0065]    Operation  807 : The user equipment database B transmits the user equipment identity token to the second level service authentication center  2 ; 
         [0066]    Operation  808 : The second level service authentication center  2  transmits the user equipment identity token to the first level service authentication center  1  on the secure transmission channel established in the operation  805 ; 
         [0067]    Operation  809 : The first level service authentication center  1  stores the user equipment identity token, sets a user equipment identity token number for the user equipment identity token and generates a new cookie including the identifier of the first level service authentication center  1  and the user equipment identifier index; 
         [0068]    Operation  810 : The first level service authentication center  1  redirects the service access request of the user equipment ‘a’ to the first level application system A, here by transmitting the user equipment identity token number to the first level application system A, and transmits the new cookie to the user equipment ‘a’ to replace the cookie provided previously from the portal server; 
         [0069]    Operation  811 : The first level application system A establishes a secure transmission channel with the first level service authentication center  1  and transmits the user equipment identity token number to the first level service authentication center  1  to request the user equipment identity token; 
         [0070]    Operation  812 : The first level service authentication center  1  acquires the user equipment identity token according to the user equipment identity token number; 
         [0071]    Operation  813 : The first level service authentication center  1  transmits the user equipment identity token to the first level application system A on the secure transmission channel established in the operation  811 ; and 
         [0072]    Operation  814 : The first level application system A provides the user equipment ‘a’ with a service access according to the user equipment identity token. 
         [0073]      FIG. 9  represents an illustrative scenario in which a user equipment ‘a’ which has passed WLAN access authentication accesses a second level application system A′, where the second level application system A′ is associated with a second level service authentication center  3  which is associated with a first level service authentication center  1 . A second level service authentication center  2  is associated with a user equipment database B in which information of the user equipment ‘a’ is recorded, that is, the user equipment ‘a’ is homed to the second level service authentication center  2 . During WLAN access authentication of the user equipment ‘a’, a WLAN portal server transmits a cookie including an access authentication pass indication and an encrypted user equipment identifier to the user equipment ‘a’ which has passed WLAN access authentication.  FIG. 9  illustrates the following process flow: 
         [0074]    Operation  901 : The user equipment ‘a’ initiates a service access request to the second level application system A′; 
         [0075]    Operation  902 : The second level application system A′ checks whether a user equipment identity token of the user equipment ‘a’ is present, and if so, then the flow jumps to the operation  917 ; 
         [0076]    Operation  903 : The second level application system A′ redirects the service access request of the user equipment ‘a’ to the second level service authentication center  3 ; 
         [0077]    Operation  904 : The second level service authentication center  3  determines whether the user equipment ‘a’ has passed WLAN access authentication according to whether the cookie in the user equipment ‘a’ includes the access authentication pass indication, and if not, then the second level service authentication center  3  performs WLAN access authentication of the user equipment ‘a’; 
         [0078]    Operation  905 : The second level service authentication center  3  transmits the cookie to the first level service authentication center  1  to request the user equipment identify token from the first level service authentication center  1 ; 
         [0079]    Operation  906 : The first level service authentication center  1  decrypts the encrypted user equipment identifier in the cookie, acquires the user equipment identifier and stores the user equipment identifier; 
         [0080]    Operation  907 : The first level service authentication center  1  establishes a secure transmission channel to the second level service authentication center  2  and transmits the user equipment identifier to the second level service authentication center  2  to request the user equipment identity token; 
         [0081]    Operation  908 : The second level service authentication center  2  transmits a user equipment identity token request to the user equipment database B; 
         [0082]    Operation  909 : The user equipment database B transmits the user equipment identity token to the second level service authentication center  2 ; 
         [0083]    Operation  910 : The second level service authentication center  2  transmits the user equipment identity token to the first level service authentication center  1  on the secure transmission channel established in the operation  907 ; 
         [0084]    Operation  911 : The first level service authentication center  1  transmits the user equipment identity token and the user equipment identifier to the second level service authentication center  3 ; 
         [0085]    Operation  912 : The second level service authentication center  3  stores the user equipment identity token and the user equipment identifier, sets a user equipment identity token number for the user equipment identity token and a user equipment identifier index for the user equipment identifier and generates a new cookie including the identifier of the second level service authentication center  3  and the user equipment identifier index; 
         [0086]    Operation  913 : The second level service authentication center  3  redirects the service access request of the user equipment ‘a’ to the second level application system A′, here by transmitting the user equipment identity token number to the second level application system A′, and transmits the new cookie to the user equipment ‘a’ to replace the cookie provided previously from the portal server; 
         [0087]    Operation  914 : The second level application system A′ establishes a secure transmission channel with the second level service authentication center  3  and transmits the user equipment identity token number to the second level service authentication center  3  to request the user equipment identity token; 
         [0088]    Operation  915 : The second level service authentication center  3  acquires the user equipment identity token according to the user equipment identity token number; 
         [0089]    Operation  916 : The second level service authentication center  3  transmits the user equipment identity token to the second level application system A′ on the secure transmission channel established in the operation  914 ; and 
         [0090]    Operation  917 : The second level application system A′ provides the user equipment a with a service access according to the user equipment identity token. 
         [0091]    In the embodiment of the invention, when a user equipment initiates a request to access a service of a specific application system, if the user equipment has passed WLAN access authentication, then the application system can acquire a user equipment identity token through an associated service authentication center which can acquire the user equipment identity token through a WLAN portal server, and after the user equipment identity token of the user equipment is acquired, the application server can provide the user equipment with a service access according to the user equipment identity token without any service authentication. Again those skilled in the art can appreciate that the user equipment identity token is information desired for the application system to provide the user equipment with the service access, e.g., a Mobile Station international ISDN number (MSISDN) of the user equipment, charge information, etc. 
         [0092]    Furthermore in an existing WLAN access method, a portal server can transmit an access authentication result page to a user equipment. According to an embodiment of the invention, the portal server can transmit a cookie to the user equipment in addition to the access authentication result page transmitted to the user equipment which has passed WLAN access authentication. The cookie is a text file stored at the user equipment, and the contents of the cookie transmitted from the portal server to the user equipment can include an access authentication pass indication which can be various pieces of information which can indicate that the user equipment has passed WLAN access authentication, the identifier of the WLAN portal server (e.g., the name or address of the portal server, etc.) as a non-limiting example. Furthermore the cookie transmitted from the portal server to the user equipment can further include a user equipment identifier index of the user equipment. In embodiments of the invention, the user equipment identifier can be an identification code which can identify uniquely the identity of the user equipment, e.g., the MSISDN of the user equipment, etc, and the user equipment identifier index refers to information from which the portal server can determine the user equipment identifier. In an embodiment, a table of user equipment identifiers, in which each user equipment identifier corresponds to one user equipment identifier index, is set in the portal server, and thus the portal server can search the table of user equipment identifiers for the corresponding user equipment identifier according to the user equipment identifier index. As can be appreciated, the portal server can acquire the user equipment identifier during WLAN access authentication of the user equipment, and thus the portal server can add the correspondence relationship between the user equipment identifier and the user equipment identifier index to the table of user equipment identifiers each time the user equipment identifier is acquired. 
         [0093]    Therefore the cookie including the access authentication pass indication and the user equipment identifier index is stored in the user equipment which has passed WLAN access authentication. As can be appreciated, the portal server can transmit the cookie together with the access authentication result page to the user equipment or transmit the cookie separately to the user equipment before or after the access authentication result page is transmitted. 
         [0094]    A service access method based upon WLAN access authentication according to the invention will be detailed below with reference to  FIG. 10  to  FIG. 13 , where a system providing a service access is in the two-level architecture as illustrated in  FIG. 2 . The first operation of the method illustrated in  FIG. 10  to  FIG. 13  (the operation  1001  in  FIG. 10 , the operation  1101  in  FIG. 11 , the operation  1201  in  FIG. 12  and the operation  1301  in  FIG. 13 ) can be the operation as described above in which a portal server transmits a cookie to a user equipment which has passed WLAN access authentication. As can be appreciated, after the user equipment transmits a service access request to an application system, the application system can check whether there is a user equipment identity token present in the application system, and if so, then the application system can provide the user equipment directly with a service access. Therefore respective operations following the first operation in the method as illustrated in  FIG. 10  to  FIG. 13  will be performed only in the case that the user equipment identity token of the user equipment requesting the service access is absent in the application system. 
         [0095]    In the method according to a first implementation solution of the invention as illustrated in  FIG. 10 , when the user equipment initiates a request to access a service of an application system after the operation  1001 , a service authentication center associated with the application system can determine from the cookie in the user equipment whether the user equipment has passed WLAN access authentication (the operation  1002 ). At this time the application system redirects the service access request to the service authentication center associated with the application system. For example, if the user equipment is to access a service of a first level application system, then a first level service authentication center associated with the first level application system determines whether the user equipment has passed WLAN access authentication; or if the user equipment is to access a service of a second level application system, then a second level service authentication center associated with the second level application system determines whether the user equipment has passed WLAN access authentication. As described above, the cookie can include, for example, an access authentication pass indication and a user equipment identifier index, thus the service authentication center can determine, for example, from the access authentication pass indication included in the cookie in the user equipment that the user equipment has passed WLAN access authentication. 
         [0096]    Then the service authentication center can transmit a request to the portal server using the cookie, and the portal server provides a user equipment identity token (the operation  1003 ). The service authentication center transmits the user equipment identity token to the application system upon reception thereof (the operation  1004 ), and the application system can provide the user equipment with a service access according to the user equipment identity token (the operation  1005 ). As can be appreciated, alternatively in the operation  1004  in which the service authentication center transmits the user equipment identity token to the application system, the service authentication center can firstly transmit the user equipment identity token to the user equipment which in turn transmits it to the application system so that the application can provide the user equipment with the desired service access. 
         [0097]    As can be appreciated, a secure transmission channels can be established between the service authentication center and the portal server and between the service authentication center and the application system for transmission of the user equipment identifier and the user equipment identity token. As an example, a Virtual Private Network (VPN), e.g., an SSL secure tunnel, etc., can be established between the service authentication center and the portal server and between the service authentication center and the application system for transmission of the user equipment identifier and the user equipment identity token. 
         [0098]    In a second implementation solution of the invention, after the operation  1101 , a service authentication center determines from the cookie in the user equipment that the user equipment has passed WLAN access authentication (the operation  1102 ), and the service authentication center can acquire a user equipment identifier index from the cookie and transmit the user equipment identifier index to the portal server to request a user equipment identity token (the operation  1103 ). As described, the cookie transmitted from the portal server to the user equipment can include the user equipment identifier index of the user equipment, and the portal server configures and maintains a table of user equipment identifiers in which correspondence relationships between user equipment identifier indexes and user equipment identifiers are recorded. Therefore the portal server can, for example, search the table of user equipment identifiers for a corresponding user equipment identifier according to the user equipment identifier index received from the service authentication center, request the user equipment identity token from a second level service authentication center to which the user equipment is homed according to the user equipment identifier and transmit the acquired user equipment identity token to the requesting service authentication center (the operation  1104 ). The service authentication center transmits the user equipment identity token to an application system upon acquisition thereof (the operation  1105 ), and the application system can provide the user equipment with a service access according to the user equipment identity token (the operation  1106 ). 
         [0099]    As described above, each second level service authentication center is associated with a user equipment database in which information of user equipments is recorded. In embodiments of the invention, a user equipment being “homed” to a specific second level service authentication center refers to that information of the user equipment is recorded in a user equipment database associated with the second level service authentication center. The portal server can determine which second level service authentication center the user equipment is homed to before the user equipment identity token is requested from the second level service authentication center to which the user equipment is homed. As can be apparent to those skilled in the art, the portal server can determine the second level service authentication center, to which the user equipment is homed, according to the user equipment identifier in various existing methods, none of which will be detailed in the invention. The portal server can transmit the user equipment identifier to the second level service authentication center, to which the user equipment is homed, to request the user equipment identity token from the second level service authentication center. Thus the second level service authentication center can acquire the corresponding user equipment identity token according to the user equipment identifier and transmit it to the portal server. Those skilled in the art can appreciate that the second level service authentication center to which the user equipment is homed can search the associated user equipment database for the user equipment identity token according to the user equipment identifier in various existing methods, none of which will be further described here. 
         [0100]    As an alternative solution of the method illustrated in  FIG. 11 ,  FIG. 12  illustrates the method according to a third implementation solution of the invention, where user equipment identity tokens can be stored at a portal server, and the portal server can extend the table of user equipment identifiers described previously, in which correspondence relationships between user equipment identifier indexes and user equipment identifiers are recoded, by recoding therein correspondence relationship between the stored user equipment identity tokens and user equipment identifiers. Thus the portal server can search the extended table of user equipment identifiers for a corresponding user equipment identity token according to a user equipment identifier. Specific operations of the method illustrated in  FIG. 12  will be detailed below. 
         [0101]    Firstly a portal server transmits a cookie to a user equipment which has passed WLAN access authentication (the operation  1201 ), and thereafter a service authentication center can determine from the cookie in the user equipment that the user equipment requesting a service access has passed WLAN access authentication (the operation  1202 ) and acquire from the cookie and transmit a user equipment identifier index to the portal server to request a user equipment identity token (the operation  1203 ). The portal server can acquire a corresponding user equipment identifier according to the received user equipment identifier index and determine from the user equipment identifier whether the corresponding user equipment identity token is stored locally at the portal server in the operation  1204  of the method illustrated in  FIG. 12 . As can be appreciated, the portal server can search the extended table of user equipment identifiers to determine whether the corresponding user equipment identity token is stored. If the corresponding user equipment identity token is stored locally at the portal server, then the user equipment identity token can be transmitted to the service authentication center (the operation  1205 ). On the other hand, if the corresponding user equipment identity token is not stored locally at the portal server, then the user equipment identity token can be requested from a second level service authentication center to which the user equipment is homed according to the user equipment identifier, and the user equipment identity token is transmitted to the service authentication center requesting the user equipment identity token and also stored locally at the portal server upon acquisition thereof (the operation  1206 ). The service authentication center transmits the user equipment identity token to an application system upon acquisition thereof (the operation  1207 ), and the application system can provide the user equipment with the service access according to the user equipment identity token (the operation  1208 ). As can be appreciated, the portal server can update the correspondence relationship between the user equipment identity token and the user equipment identifier in the extended table of user equipment identifiers each time the user equipment identity token is stored. 
         [0102]    As can be appreciated, secure transmission channels can be established between the service authentication center and the portal server, between the portal server and the second level service authentication center to which the user equipment is homed and between the service authentication center and the application system for transmission of the user equipment identifier and the user equipment identity token in the method illustrated in  FIG. 11  and  FIG. 12 . As an example, a VPN, e.g., an SSL secure tunnel, etc., can be established between the service authentication center and the portal server, between the portal server and the second level service authentication center to which the user equipment is homed and between the service authentication center and the application system for transmission of the user equipment identifier and the user equipment identity token. 
         [0103]    In the method described above with reference to  FIG. 10  to  FIG. 12 , the service authentication center transmits the user equipment identity token to the application system after it is acquired through the portal server. As an alternative, the service authentication center can store the acquired user equipment identity token, for example, configure a table of user equipment identity tokens and set a corresponding user equipment identity token number for each user equipment identity token.  FIG. 13  illustrates the method in this implementation solution, where a portal server transmits a cookie to a user equipment which has passed WLAN access authentication during WLAN access authentication of the user equipment (the operation  1301 ). Next a service authentication center determines from the cookie that the user equipment has passed WLAN access authentication (the operation  1302 ), and the portal server receives a request from the service authentication center for a user equipment identity token and transmits the user equipment identity token to the service authentication center (the operation  1303 ), and then the service authentication center stores the user equipment identity token, for example, in a table of user equipment identity tokens instead of transmitting the user equipment identity token directly to an application system and sets a corresponding user equipment identity token number thereof. Therefore the service authentication center transmits the user equipment identity token number to the application system (the operation  1304 ) instead of transmitting the user equipment identity token directly. The application system establishes a secure transmission channel with the service authentication center upon reception of the user equipment identity token number and provides the service authentication center with the user equipment identity token number, and the service authentication center searches the table of user equipment identity tokens for the corresponding user equipment identity token and further transmits the user equipment identity token to the application system via the secure transmission channel (the operation  1305 ). As an example, a VPN, e.g., an SSL secure tunnel, etc., can be established between the service authentication center and the application system for transmission of the user equipment identity token. The application system can provide the user equipment with a service access according to the user equipment identity token after the user equipment identity token is acquired (the operation  1306 ). 
         [0104]    As described previously, the service authentication center can transmit the user equipment identity token to the application system via the user equipment so that the application system can provide the user equipment with the desired service access. However the security of a transmission channel between the service authentication center and the user equipment and a transmission channel between the user equipment and the application system is typically poor, thus transmission of the user equipment identity token may result in such a potential security risk that the user equipment identity token may be stolen. In the method illustrated in  FIG. 13 , the service authentication center transmits only the user equipment identity token number to the application system via the user equipment, and the user equipment identity token is transmitted on the secure transmission channels, thereby improving the security. 
         [0105]    In order to facilitate understanding, a specific process of the service access method based upon WLAN access authentication according to an embodiment of the invention will be described below in a specific application scenario with reference to  FIG. 14 . 
         [0106]    In the specific example as illustrated in  FIG. 14 , an application system A is associated with a service authentication center  1 , where the application system A can be a first level application system or a second level application system, and in correspondence therewith, the service authentication center  1  can be a first level service authentication center or a second level service authentication center. A second level service authentication center  2  is associated with a user equipment database B in which information of a user equipment ‘a’ is recorded, that is, the user equipment ‘a’ is homed to the second level service authentication center  2 . A portal server P transmits a cookie including an access authentication pass indication and a user equipment identifier index to the user equipment ‘a’ which has passed WLAN access authentication, and the portal server P is capable of storing user equipment identity tokens.  FIG. 14  illustrates the following process flow of the specific example: 
         [0107]    Operation  1401 : The user equipment ‘a’ initiates a service access request to the application system A; 
         [0108]    Operation  1402 : The application system A checks whether a user equipment identity token of the user equipment ‘a’ is present, and if so, then the flow jumps to the operation  1418 ; 
         [0109]    Operation  1403 : The application system A redirects the service access request of the user equipment ‘a’ to the service authentication center  1 ; 
         [0110]    Operation  1404 : The service authentication center  1  determines whether the user equipment ‘a’ has passed WLAN access authentication according to whether the cookie in the user equipment ‘a’ includes the access authentication pass indication, and if not so, then the service authentication center  1  performs WLAN access authentication of the user equipment ‘a’; 
         [0111]    Operation  1405 : The service authentication center  1  establishes a secure transmission channel to the portal server P and transmits the user equipment identifier index acquired from the cookie to the portal server P to request the user equipment identity token; 
         [0112]    Operation  1406 : The portal server P checks whether the user equipment identity token of the user equipment ‘a’ is stored locally according to a user equipment identifier corresponding to the user equipment identifier index, and if so, then flow jumps to the operation  1412 ; 
         [0113]    Operation  1407 : The portal server P establishes a secure transmission channel with the second level service authentication center  2  and transmits a user equipment identity token request to the second level service authentication center  2 ; 
         [0114]    Operation  1408 : The second level service authentication center  2  transmits the user equipment identity token request to the user equipment database B; 
         [0115]    Operation  1409 : The user equipment database B transmits the user equipment identity token to the second level service authentication center  2 ; 
         [0116]    Operation  1410 : The second level service authentication center  2  transmits the user equipment identity token to the portal server P on the secure transmission channel established in the operation  1407 ; 
         [0117]    Operation  1411 : The portal server P stores the acquired user equipment identity token locally; 
         [0118]    Operation  1412 : The portal server P transmits the user equipment identity token to the service authentication center  1  on the secure transmission channel established in the operation  1405 ; 
         [0119]    Operation  1413 : The service authentication center  1  stores the acquired user equipment identity token and sets a user equipment identity token number for the user equipment identity token; 
         [0120]    Operation  1414 : The service authentication center  1  redirects the service access request of the user equipment ‘a’ to the application system A, here by transmitting the user equipment identity token number to the application system A; 
         [0121]    Operation  1415 : The application system A establishes a secure transmission channel with the service authentication center  1  and transmits the user equipment identity token number to the service authentication center  1  to request the user equipment identity token; 
         [0122]    Operation  1416 : The service authentication center  1  acquires the user equipment identity token according to the user equipment identity token number; 
         [0123]    Operation  1417 : The service authentication center  1  transmits the user equipment identity token to the application system A on the secure transmission channel established in the operation  1415 ; and 
         [0124]    Operation  1418 : The application system A provides the user equipment ‘a’ with a service access according to the user equipment identity token. 
         [0125]      FIG. 15  is a schematic structural diagram of a service access system based upon Wireless local Area Network (WLAN) access authentication according to the invention, and the system includes: 
         [0126]    a WLAN portal server  150  configured to transmit a first cookie to a user equipment which has passed WLAN access authentication during WLAN access authentication of the user equipment; 
         [0127]    the user equipment  151  configured to receive the first cookie transmitted from the WLAN portal server; 
         [0128]    an associated service authentication center  152  configured to determine, from the first cookie in the user equipment which has passed WLAN access authentication, that the user equipment has passed WLAN access authentication, acquire a user equipment identity token of the user equipment using the first cookie and transmit the acquired user equipment identity token to an application system  153 , when the user equipment requests to access a service of the application system; and 
         [0129]    the application system  153  configured to provide the user equipment with a service access according to the user equipment identity token. 
         [0130]    The associated service authentication center  152  is particularly configured to acquire a user equipment identifier from the first cookie and to request the user equipment identity token from a second level service authentication center to which the user equipment is homed according to the user equipment identifier. 
         [0131]    When the associated service authentication center is a second level service authentication center, the system further includes a first level service authentication center  154 ; 
         [0132]    The associated service authentication center  152  is particularly configured to acquire the user equipment identity token via the first level service authentication center  154 ; and 
         [0133]    The first level service authentication center  154  is configured to request, from the second level service authentication center to which the user equipment is homed using the first cookie, the user equipment identity token to be provided to the associated service authentication center  152 . 
         [0134]    When the associated service authentication center is a second level service authentication center, the associated service authentication center is particularly configured to transmit the first cookie to the first level service authentication center  154 ; and 
         [0135]    The first level service authentication center  154  is particularly configured to acquire the user equipment identifier from the first cookie, to request the user equipment identity token from the second level service authentication center to which the user equipment is homed according to the user equipment identifier, and to transmit the user equipment identity token and the user equipment identifier to the associated service authentication center  152 . 
         [0136]    The associated service authentication center  152  is further configured to store the user equipment identifier transmitted from the first level service authentication center  154  and allocate a user equipment identifier index for the user equipment identifier upon reception of the user equipment identifier, and to transmit a second cookie including the identifier of the associated service authentication center  152  and the user equipment identifier index to the user equipment to replace the first cookie. 
         [0137]    When the associated service authentication center  152  is a second level service authentication center, the associated service authentication center  152  is particularly configured to acquire the user equipment identifier from the first cookie and transmit the user equipment identifier to a first level service authentication center  154 ; and 
         [0138]    The first level service authentication center  154  is particularly configured to request the user equipment identity token from the second level service authentication center to which the user equipment is homed according to the user equipment identifier and to transmit the user equipment identity token to the associated service authentication center  152 . 
         [0139]    The associated service authentication center  152  is further configured to store the user equipment identifier and allocate a user equipment identifier index for the user equipment identifier after the user equipment identifier is acquired from the first cookie, and to transmit a second cookie including the identifier of the associated service authentication center  152  and the user equipment identifier index to the user equipment to replace the first cookie. 
         [0140]    The associated service authentication center  152  is further configured to transmit a request to the WLAN portal server using the first cookie and to acquire the user equipment identity token of the user equipment from the WLAN portal server; and 
         [0141]    The WLAN portal server  150  is further configured to acquire the user equipment identity token of the user equipment and to transmit the user equipment identity token to the associated service authentication center  152 . 
         [0142]    The WLAN portal server  150  is further configured to configure and maintain a table of user equipment identifiers in which correspondence relationships between user equipment identifier indexes and user equipment identifiers are recorded. 
         [0143]    The WLAN portal server  150  is particularly configured to acquire from the table of user equipment identifiers a user equipment identifier corresponding to a user equipment identifier index transmitted from the associated service authentication center  152  according to the user equipment identifier index, where the user equipment identifier index is acquired by the associated service authentication center  152  from the first cookie, to request the user equipment identity token of the user equipment from a second level service authentication center to which the user equipment is homed according to the corresponding user equipment identifier, and to transmit the acquired user equipment identity token to the associated service authentication center  152 . 
         [0144]    The WLAN portal server  150  is further configured to store the user equipment identity token, and the table of user equipment identifiers further includes correspondence relationships between user equipment identity tokens and user equipment identifiers. 
         [0145]    The WLAN portal server  150  is particularly configured to search the table of user equipment identifiers for the user equipment identifier according to a user equipment identifier index transmitted from the associated service authentication center  152 , where the user equipment identifier index is acquired by the associated service authentication center  152  from the first cookie, and if the user equipment identity token corresponding to the user equipment identifier is not stored locally, then request the user equipment identity token from a second level service authentication center to which the user equipment is homed according to the user equipment identifier, and store locally and transmit the acquired user equipment identity token to the associated service authentication center  152 ; or if the user equipment identity token corresponding to the user equipment identifier is stored locally, then transmit the corresponding user equipment identity token to the associated service authentication center  152 . 
         [0146]    The associated service authentication center  152  is further configured to establish a secure transmission channel with the WLAN portal server  150  and the application system  153  and to transmit the user equipment identity token on the established secure transmission channel. 
         [0147]    The associated service authentication center  152  is further configured to store the user equipment identity token and to set a user equipment identity token number corresponding to each user equipment identity token; and 
         [0148]    The associated service authentication center  152  is particularly configured to transmit the user equipment identity token number to the application system  153  and to transmit the user equipment identity token corresponding to the user equipment identity token number to the application system  153  on a secure transmission channel established with the application system  153  according to the user equipment identity token number transmitted from the application system  153  to request the user equipment identity token. 
         [0149]      FIG. 16  is a schematic structural diagram of a service access device based upon Wireless Local Area Network (WLAN) access authentication according to the invention, and the device includes: 
         [0150]    a determining module  161  configured to determine from a first cookie in a user equipment that the user equipment has passed WLAN access authentication, where the first cookie is transmitted from a WLAN portal server to the user equipment which has passed WLAN access authentication during WLAN access authentication of the user equipment; 
         [0151]    a acquiring module  162  configured to acquire a user equipment identity token of the user equipment using the first cookie; and 
         [0152]    a first transmitting module  163  configured to transmit the acquired user equipment identity token to an application system. 
         [0153]    The acquiring module  162  includes: 
         [0154]    a first acquiring unit  1621  configured to acquire a user equipment identifier from the first cookie; and 
         [0155]    a second acquiring unit  1622  configured to request the user equipment identity token from a second level service authentication center to which the user equipment is homed according to the user equipment identifier. 
         [0156]    The device further includes: 
         [0157]    a storing and transmitting module  164  configured to store the user equipment identifier and allocate a user equipment identifier index for the user equipment identifier after the user equipment identifier is acquired from the first cookie, and to transmit a second cookie including the identifier of the associated service authentication center and the user equipment identifier index to the user equipment. 
         [0158]    The acquiring module  162  is particularly configured to transmit a request to the WLAN portal server using the first cookie and to acquire the user equipment identity token of the user equipment from the WLAN portal server. 
         [0159]    The storing and transmitting module  164  is further configured to store the acquired user equipment identity token of the user equipment and to set a corresponding user equipment identity token number for each user equipment identity token. 
         [0160]    In the device, 
         [0161]    the first transmitting module  163  is further configured to transmit the user equipment identity token number to the application system and to transmit the user equipment identity token corresponding to the user equipment identity token number to the application system on a secure transmission channel established with the application system according to the user equipment identity token number transmitted from the application system to request the user equipment identity token. 
         [0162]      FIG. 17  is a schematic structural diagram of a service access device based upon Wireless Local Area Network (WLAN) access authentication according to the invention, and the device includes: 
         [0163]    a generating module  171  configured to generate a first cookie for a user equipment which has passed WLAN access authentication during WLAN access authentication of the user equipment; and 
         [0164]    a second transmitting module  172  configured to transmit the first cookie to the user equipment which has passed WLAN access authentication so that the user equipment requesting to access a service of an application system acquires a user equipment identity token of the user equipment using the first cookie. 
         [0165]    The device further includes: 
         [0166]    a second acquiring module  173  configured to acquire the user equipment identity token in response to a request transmitted from an associated service authentication center. 
         [0167]    The device further includes: 
         [0168]    a storing module  174  configured to configure and maintain a table of user equipment identifiers in which correspondence relationships between user equipment identifier indexes and user equipment identifiers are recorded. 
         [0169]    The second acquiring module  173  includes: 
         [0170]    an identifier acquiring unit  1731  configured to acquire from the table of user equipment identifiers a user equipment identifier corresponding to a user equipment identifier index transmitted from the associated service authentication center according to the user equipment identifier index, where the user equipment identifier index is acquired by the associated service authentication center from the first cookie; and 
         [0171]    a token acquiring unit  1732  configured to request the user equipment identity token of the user equipment from a second level service authentication center to which the user equipment is homed according to the corresponding user equipment identifier, and to transmit the acquired user equipment identity token to the associated service authentication center through the second transmitting module  172 . 
         [0172]    The storing module  174  is further configured to store the user equipment identity token, and the table of user equipment identifiers further includes correspondence relationships between user equipment identity tokens and user equipment identifiers. 
         [0173]    In the device, 
         [0174]    the identifier acquiring unit  1731  is further configured to search the table of user equipment identifiers for the user equipment identifier according to a user equipment identifier index transmitted from the associated service authentication center, where the user equipment identifier index is acquired by the associated service authentication center from the first cookie; and 
         [0175]    the token acquiring unit  1732  is further configured to, if the user equipment identity token corresponding to the user equipment identifier is not stored locally, then request the user equipment identity token from a second level service authentication center to which the user equipment is homed according to the user equipment identifier, and store locally and transmit the acquired user equipment identity token to the associated service authentication center through the second transmitting unit  172 ; if the user equipment identity token corresponding to the user equipment identifier is stored locally, transmit the corresponding user equipment identity token to the associated service authentication center through the second transmitting unit  172 . 
         [0176]    The illustrative implementation solutions of the invention have been described above with reference to the drawings. Those skilled in the art shall appreciate the foregoing implementation solutions are merely illustrative examples presented for the purpose of the description but not to be limiting. Any modifications, equivalent substitutions, etc., made without departing from the claimed scope of the teaching and the claims of the invention shall come into the claimed scope of the invention.