WO2016090994A1

WO2016090994A1 - Authentication method and apparatus

Info

Publication number: WO2016090994A1
Application number: PCT/CN2015/090792
Authority: WO
Inventors: 曹淑玲; 王林梅
Original assignee: 中兴通讯股份有限公司
Priority date: 2014-12-08
Filing date: 2015-09-25
Publication date: 2016-06-16
Also published as: CN105743845A

Abstract

An authentication method and apparatus are provided by the present invention, wherein the method includes: receiving a message sent by a user terminal, wherein the message comprises a user name; determining, according to the received user name, whether local authentication is performed for the user terminal; and performing remote authentication processing for the user terminal when the determination result is no. The present invention solves the problem existing in related art that user experience is low because distinct authentication services cannot be provided for users, thereby achieving the effect that different authentication services are provided for different users and user experience is improved.

Description

Authentication method and device

Technical field

The present invention relates to the field of communications, and in particular to an authentication method and apparatus.

Background technique

The IEEE802 LAN/WAN committee proposed the 802.1X protocol to solve the problem of wireless LAN network security. Later, the 802.1X protocol, which is a common access control mechanism for LAN ports, is widely used in Ethernet, mainly to solve the problems of authentication and security in Ethernet. If the user equipment connected to the port can pass the authentication, it can access the resources in the LAN; if it cannot pass the authentication, the resources in the LAN cannot be accessed.

The architecture of the 802.1X protocol generally includes three important parts: the Supplicant System, the Authenticator System, and the Authentication Server System. The client system is generally a user terminal system. The terminal system usually has a client software installed. The user initiates the 802.1X authentication process by starting the client software. To support port-based access control, the client system needs to support the Extensible Authentication Protocol Over LAN (EAPOL). The authentication system is usually a network device that supports the 802.1X protocol, such as a switch. The authentication server can store information about the user, such as the priority of the user, the access control list of the user, and the like. After the user passes the authentication, the authentication server will transmit the relevant information of the user to the authentication system, and the authentication system constructs a dynamic access control list, and the subsequent traffic of the user will be supervised by the above parameters.

There are two common 802.1X authentication methods:

The first method is remote authentication. The authentication process is completed between the authentication system and the remote server. The remote authentication dial-in user service (RADIUS) and the terminal access controller control system protocol (Terminal Access) are supported. Protocols such as the Controller Access Control System (TACACS) are used. The common RADIUS authentication is shown in Figure 1. Figure 1 is a flowchart of remote authentication in the related art. The authentication server is a RADIUS server. EAPOL is used between the client and the authentication system. The format encapsulation EAP protocol transmits authentication information, and the authentication system and the authentication server transmit authentication information through the RADIUS protocol. The authentication system generally uses the EAP-MD5 authentication encryption algorithm by default. The remote authentication process includes the following steps:

Step S102: When the user has access to the network requirement, open the 802.1X client program, input the user name and password that have been applied for and registered, and send a LAN-based extended authentication protocol-start (EAPoL-Start) message to the authentication system. Start 802.1X authentication access.

Step S104: The authentication system sends an extended authentication protocol-request/recognition (EAP-Request/Identity) message to the client, and requests the client to send the username.

In step S106, the client responds to an extended authentication protocol-response/identity (EAP-Response/Identity) message to the authentication system, including the username.

In the step S108, the authentication system encapsulates the extended authentication protocol-response/identity (EAP-Response/Identity) packet into the RADIUS Access-Request packet and sends it to the authentication server.

Step S110: After receiving the username information forwarded by the authentication system, the authentication server compares the information with the username table in the database, finds the password information corresponding to the username, and uses a randomly generated random number Challenge (cryptographic word) The encryption process is performed, and the random number Challenge is also sent to the authentication system through a remote authentication dial-up authentication service access-random number (RADIUS Access-Challenge) message.

Step S112, the authentication system forwards the Challenge to the client program through the extended authentication protocol-request/message digest algorithm fifth board-random number (EAP-Request/MD5-Challenge) message.

Step S114, after receiving the extended authentication protocol-request/message digest algorithm fifth board-random number (EAP-Request/MD5-Challenge) message, the client encapsulates the password and the random number Challenge into the MD5 algorithm. The extended authentication protocol-response/message digest algorithm fifth board-random number (EAP-Response/MD5-Challenge) is sent to the authentication system.

In step S116, the authentication system sends the random number Challenge, the encrypted password and the user name to the authentication server through the remote authentication dial-up authentication service access-request (RADIUS Access-Request) message, and the authentication server performs authentication.

In step S118, the authentication server compares the received encrypted password with the locally calculated encrypted password. If the authentication is the same, the user is considered to be a valid user, and the authentication is successful. Otherwise, the user is considered to be an unauthorized user and the authentication fails. The authentication result is then encapsulated in a remote authentication dial-up authentication service RADIUS Access-Accept message and sent to the authentication system.

In step S120, if the authentication system receives the authentication success packet, the authentication system sends an extended authentication protocol-success (EAP-Success) message to the client, and the port is changed to the authorization state, allowing the user to access the network through the port. Otherwise, an extended authentication protocol-failure (EAP-Failure) message is sent to the client, and the user is prohibited from accessing the network through the port.

The second method is local authentication, the authentication process is completed on the authentication system, and the user information (including the user name, password, and various attributes) is configured on the authentication system. FIG. 2 is a flowchart of local authentication in the related art, as shown in FIG. 2 The client and the authentication system use the EAPOL format to encapsulate the EAP protocol to transmit authentication information. The certification process includes the following steps:

Step S202: When the user has access to the network requirement, open the 802.1X client program, input the user name and password that have been applied for and registered, and send a LAN-based extended authentication protocol-start (EAPoL-Start) message to the authentication system. Start 802.1X authentication access.

Step S204: The authentication system sends an extended authentication protocol-request/identity (EAP-Request/Identity) message to the client, and requests the client to send the username.

In step S206, the client responds to an extended authentication protocol-response/identity (EAP-Response/Identity) message to the authentication system, including the username.

Step S208, after the authentication system receives the user name information sent by the client, the authentication system randomly generates a random number Challenge (encrypted word), and also passes the random number Challenge to the extended authentication protocol-request/random number (EAP-Request). /Challenge) The message is sent to the client.

Step S210: After receiving the extended authentication protocol-request/random number (EAP-Request/Challenge) message, the client encapsulates the encrypted password of the password and the random number Challenge into the MD5 algorithm, and encapsulates the extended authentication protocol-response/message summary. The fifth board-random number (EAP-Response/MD5-Challenge) of the algorithm responds to the authentication system.

In step S212, the authentication system compares the received encrypted password with the locally calculated encrypted password. If the authentication is the same, the user is considered to be a valid user, and the authentication succeeds. The extended authentication protocol is sent to the client-success (EAP-Success) The message is changed to the authorization state, allowing the user to access the network through the port. Otherwise, the user is considered to be an unauthorized user, and the authentication fails. The extended authentication protocol-failure (EAP-Failure) packet is sent to the client, and the user is prohibited from accessing the network through the port.

Remote authentication, such as RADIUS authentication, has the advantage that user information is centrally managed on the server, enabling large-capacity, high-reliability, and centralized unified authentication for multiple devices. The disadvantages are related to the client, authentication system, and remote authentication server. Packet exchange between users, network overhead, and authentication speed is slow. The advantage of local authentication is that it only needs to involve interaction between the client and the authentication system. The speed is fast and the operation cost can be reduced. The disadvantage is that the amount of stored information is limited by the hardware conditions of the authentication system and cannot provide authentication for more users.

It can be seen that the two common authentication methods of 802.1X, remote authentication and local authentication have their own advantages and disadvantages, and the user experience is not ideal. Especially with the development of various IP technologies, the number of network users is growing rapidly. It is more and more important to provide differentiated services for different users, and the existing authentication methods cannot meet the operational needs of the market.

In view of the problem that the related technology cannot provide differentiated authentication services for users and the user experience is low, an effective solution has not been proposed yet.

Summary of the invention

The invention provides an authentication method and device, so as to at least solve the problem that cannot exist for the user For the difference authentication service, the user experience is low.

According to an aspect of the present invention, an authentication method is provided, including: receiving a message including a user name sent by a user terminal; determining, according to the received user name, whether to perform local authentication for the user terminal; In the case of no, remote authentication processing is performed on the user terminal.

Optionally, after determining, according to the received username, whether to perform local authentication for the user terminal, the method further includes: performing local authentication processing on the user terminal if the determination result is yes.

Optionally, before determining, according to the received username, whether to perform local authentication for the user terminal, the method further includes: recording, in a user name table of a database for performing local authentication on the user terminal, a user that meets a predetermined condition Username.

Optionally, determining whether to perform local authentication for the user terminal according to the received username includes: determining whether the user name matches information in a username list of the database; and if the determination result is no, It is determined to abandon the execution of local authentication for the user terminal.

Optionally, performing the remote authentication process on the user terminal includes: determining whether the authentication mode for authenticating the user terminal is a combined authentication mode, where the combined authentication mode is to use the local authentication and the remote authentication to the user The terminal performs authentication; if the determination result is yes, the remote authentication process is performed on the user terminal.

According to another aspect of the present invention, an authentication apparatus is provided, including: a receiving module, configured to receive a message including a user name sent by a user terminal; and a determining module configured to determine, according to the received user name, whether the device is The user terminal performs local authentication; the first processing module is configured to perform remote authentication processing on the user terminal if the determination result of the determination module is negative.

Optionally, the authentication apparatus further includes: a second processing module, configured to perform local authentication processing on the user terminal if the determination result of the determining module is yes.

Optionally, the authentication apparatus further includes: a recording module configured to record a user name of the user that satisfies the predetermined condition in a username list of a database for performing local authentication on the user terminal.

Optionally, the determining module includes: a first determining unit, configured to determine whether the user name matches information in a username list of the database; and the determining unit is configured to determine a result in the first determining unit In the case of No, it is determined to abandon local authentication for the user terminal.

Optionally, the first processing module includes: a second determining unit, configured to determine whether the authentication mode for authenticating the user terminal is a combined authentication mode, where the combined authentication mode is to use local authentication and remote authentication. The user terminal is authenticated; and the processing unit is configured to perform remote authentication processing on the user terminal if the determination result is yes.

According to the present invention, a message including a user name sent by the user terminal is received; whether the local authentication is performed for the user terminal is determined according to the received user name; and if the determination result is negative, the user terminal is executed. The remote authentication process solves the problem that the user cannot provide the differentiated authentication service and the user experience is low in the related technologies, thereby achieving the effect of providing different authentication services for different users and improving the user experience.

DRAWINGS

The drawings described herein are intended to provide a further understanding of the invention, and are intended to be a part of the invention. In the drawing:

1 is a flow chart of remote authentication in the related art;

2 is a flow chart of local authentication in the related art;

3 is a flow chart of an authentication method according to an embodiment of the present invention;

4 is a structural block diagram of an authentication apparatus according to an embodiment of the present invention;

FIG. 5 is a block diagram showing a preferred structure of an authentication apparatus according to an embodiment of the present invention; FIG.

6 is a block diagram showing another preferred structure of an authentication apparatus according to an embodiment of the present invention;

FIG. 7 is a structural block diagram of a determining module 44 in an authentication apparatus according to an embodiment of the present invention;

FIG. 8 is a structural block diagram of a first processing module 46 in an authentication apparatus according to an embodiment of the present invention;

FIG. 9 is a schematic flowchart of an authentication method for providing a differentiated service for a user according to an embodiment of the present invention; FIG.

10 is a flow chart of local cryptographic processing in accordance with an embodiment of the present invention;

11 is a flow chart of remote cryptographic processing in accordance with an embodiment of the present invention;

FIG. 12 is a schematic structural diagram of a network device according to an embodiment of the present invention; FIG.

FIG. 13 is a structural diagram of a message processing module 1212 according to an embodiment of the present invention.

detailed description

The invention will be described in detail below with reference to the drawings in conjunction with the embodiments. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict.

An authentication method is provided in this embodiment. FIG. 3 is a flowchart of an authentication method according to an embodiment of the present invention. As shown in FIG. 3, the process includes the following steps:

Step S302, receiving a message including a user name sent by the user terminal;

Step S304, determining, according to the received user name, whether to perform local authentication for the user terminal;

Step S306, if the determination result is no, perform remote authentication processing on the user terminal.

Through the above steps, performing local authentication for a predetermined user and performing remote authentication for other users realizes the purpose of performing differentiated authentication on the user terminal, so that the advanced user can quickly complete the authentication process and protect the interests of the advanced user. The invention solves the problem that the user cannot provide the differentiated authentication service and the user experience is low, and thus achieves the effect of providing different authentication services for different users and improving the user experience.

In an optional embodiment, after determining that the user terminal needs to perform local authentication according to the received user name, performing local authentication processing on the user terminal, where the user is an advanced user enjoying the differentiated service, thereby implementing Provide differentiated services for different levels of users.

The operation of configuring user information may also be performed before determining whether to perform local authentication for the user terminal according to the received user name. In an optional embodiment, before performing the authentication process on the user, the user terminal may be used for the user terminal. The user name of the user who satisfies the predetermined condition is recorded in the user name table of the database that performs local authentication, that is, only the user information of the advanced user can be written into the local authentication database, so that when the user authentication judgment is performed, the local authentication database can be Advanced users perform local authentication, saving certification time.

When determining whether to perform local authentication for the user, the method may be determined by using various methods. In an optional embodiment, determining whether to perform local authentication for the user terminal according to the received user name includes: determining the user name and the database. Whether the information in the username table matches; if the judgment result is no, it is determined to abandon the local authentication for the user terminal.

After the local authentication is not performed on the user, the authentication mode of the user terminal is determined to be a combined authentication mode, where the combined authentication mode is a method for authenticating the user terminal by using local authentication and remote authentication. And when the determination result is YES, the remote authentication process is performed on the user terminal. Thereby achieving the purpose of providing authentication services for ordinary users. It not only saves the storage resources of the local authentication database, but also provides the purpose of providing authentication for all users. It also provides a secondary guarantee for the successful authentication of advanced users, which greatly improves the user experience.

An authentication device is also provided in this embodiment, which is used to implement the above-mentioned embodiments and preferred embodiments, and will not be described again. As used below, the term "module" may implement a combination of software and/or hardware of a predetermined function. Although the device described in the following embodiments is preferably implemented in software, it is hard Implementation of a piece, or a combination of software and hardware, is also possible and conceived.

4 is a block diagram showing the structure of an authentication apparatus according to an embodiment of the present invention. As shown in FIG. 4, the apparatus includes a receiving module 42, a determining module 44, and a first processing module 46, which will be described below.

The receiving module 42 is configured to receive a message including a user name sent by the user terminal, and the determining module 44 is connected to the receiving module 42 and configured to determine, according to the received user name, whether to perform local authentication for the user terminal; the first processing module 46. Connect to the above-mentioned judging module 44, and set to perform remote authentication processing on the user terminal when the judgment result of the judging module 44 is NO.

FIG. 5 is a block diagram of a preferred structure of an authentication apparatus according to an embodiment of the present invention. As shown in FIG. 5, the apparatus includes a second processing module 52 in addition to all the modules shown in FIG. Description.

The second processing module 52 is connected to the determining module 44, and is configured to perform local authentication processing on the user terminal when the determination result of the determining module 44 is YES.

6 is a block diagram showing another preferred structure of an authentication apparatus according to an embodiment of the present invention. As shown in FIG. 6, the apparatus includes a recording module 62 in addition to all the modules shown in FIG. .

The recording module 62 is connected to the above-described judging module 44, and is configured to record the user name of the user who satisfies the predetermined condition in the user name table of the database for performing local authentication on the user terminal.

FIG. 7 is a block diagram showing the structure of the determining module 44 in the authentication apparatus according to the embodiment of the present invention. As shown in FIG. 7, the determining module 44 includes a first determining unit 72 and a determining unit 74. The determining module 44 will be described below.

The first determining unit 72 is configured to determine whether the user name matches the information in the user name table of the database; the determining unit 74 is connected to the first determining unit 72, and is set to be the case that the determination result of the first determining unit 72 is NO. Next, it is determined to abandon the local authentication for the above user terminal.

FIG. 8 is a structural block diagram of a first processing module 46 in an authentication apparatus according to an embodiment of the present invention. As shown in FIG. 8, the first processing module 46 includes a second determining unit 82 and a processing unit 84. A processing module 46 is described.

The second determining unit 82 is configured to determine whether the authentication mode for authenticating the user terminal is a combined authentication mode, wherein the combined authentication mode is to authenticate the user terminal by using local authentication and remote authentication; and the processing unit 84 is connected to The second determination unit 82 is configured to perform remote authentication processing on the user terminal when the determination result of the second determination unit 82 is YES.

In order to solve the problem that the related services in the related art cannot provide differentiated services for the user, and thus the requirements of the market operation are not satisfied, an authentication method and device for providing differentiated services for the user are also provided in the embodiment of the present invention. Local authentication and remote authentication (this remote authentication is described by taking RADIUS authentication as an example) The authentication method can provide differentiated access authentication services for network users. The combination authentication method is to perform the process similar to the local authentication. If the user is not in the user name list of the database of the authentication system and then transferred to the RADIUS authentication process, the method combines the advantages of local authentication and RADIUS authentication, complementing the two. Defects. In particular, the combination authentication method is adopted, and the information of the high-end VIP user (that is, the advanced user) is configured on the authentication system, and the information of all legal users, that is, the information of the high-end VIP user and the ordinary legal user is configured on the RADIUS authentication server. Provide differentiated access authentication services for network users.

For high-end VIP users, provide fast and efficient local authentication service. If the user is not in the local database user name list of the authentication system due to some abnormal reasons, such as database table entries, the user is provided with RADIUS authentication. The user can still be authenticated successfully under abnormal conditions; for ordinary users, RADIUS authentication service is provided. The method of configuring only the information of the high-end VIP user on the authentication system with a small storage capacity, effectively saving the storage resources of the authentication system, configuring the information of all legal users on the large-capacity RADIUS authentication server, and making full use of the large storage capacity of the RADIUS authentication server. The advantage is not only to provide secondary protection for the successful authentication of high-end VIP users, but also to provide authentication services for ordinary users, and to provide differentiated services for different users as a whole, and the user experience is better.

The method for providing a differentiated service for a user according to an embodiment of the present invention may include the following steps:

Configure the 802.1X authentication mode as the combined authentication mode on the authentication system and record the type of the configuration.

Configure the information of the high-end VIP user on the authentication system, and record the user information of the configuration in the user name table of the database;

Configure information about all legitimate users on the authentication server.

The authentication system receives the EAPoL-Start message from the client;

The authentication system sends an EAP-Request/Identity packet to the client, and asks the client to send the username.

The authentication system receives the EAP-Response/Identity packet from the client, and the packet includes the username.

The authentication system reads the 802.1X authentication mode configuration. If it is the combined authentication mode, it searches the user name table in the database for the received user name. If it finds, it performs local password processing on the user. Otherwise, if it is not found, The user performs remote password processing; if it is local authentication, performs local password processing on the user; if it is RADIUS authentication, performs remote password processing on the user;

Among them, local password processing, including the following steps:

The authentication system randomly generates a Challenge for the user, and sends the Challenge to the client through the EAP-Request/Challenge message.

The authentication system receives the EAP-Response/MD5-Challenge message from the client, and the packet contains the encrypted password after the Challenge and the password used by the client are used by the client to perform the MD5 algorithm.

The authentication system searches the user name table in the database for the user name of the user, extracts the configured password of the user from the matched entry, and generates the generated Challenge, and uses the password and Challenge to do the MD5 algorithm to generate the encrypted password, and If the password is the same as that of the encrypted password received from the client, the user is considered to be a valid user. The authentication succeeds. The EAP-Success message is sent to the client and the port is changed to the authorized state. The user is allowed to access the network through the port. If the user is an unauthorized user, the authentication fails. The EAP-Failure packet is sent to the client and the user is prohibited from accessing the network through the port.

Remote password handling, including the following steps:

The authentication system encapsulates the received EAP-Response/Identity packet from the client into a RADIUS Access-Request packet and sends the packet to the authentication server.

The authentication system receives a RADIUS Access-Challenge packet from the authentication server, where the packet includes a Challenge randomly generated by the authentication server.

The authentication system encapsulates the received RADIUS Access-Challenge packet from the authentication server in the EAP-Request/MD5-Challenge packet and sends it to the client.

The authentication system sends the Challenge, encrypted password and user name received from the client to the authentication server through the RADIUS Access-Request packet, and the authentication server performs authentication.

The authentication system receives a RADIUS Access-Accept message from the authentication server. If the authentication succeeds, the EAP-Success message is sent to the client, and the port is changed to the authorization state, allowing the user to access the network through the port. Otherwise, the EAP-Failure packet is sent to the client, and the user is prohibited from accessing the network through the port.

In the embodiment of the present invention, an authentication device for providing a differentiated service for a user is also provided, including:

The 802.1X authentication mode configuration module is configured to set the 802.1X authentication mode on the authentication system and record the type of the configuration mode.

The local user configuration module (the same as the recording module 62 described above) is configured to set the user information of the legal user in the local authentication or the combined authentication mode on the authentication system, and record the configured user information in the user name table of the database;

The packet sending and receiving module is configured to receive or send an EAPOL packet from the client or a RADIUS packet of the authentication server on the physical port of the authentication system.

The authentication mode control module is configured to configure the 802.1X authentication mode configured by the module according to the 802.1X authentication mode, and the control module packet processing module performs a corresponding protocol interaction process.

The combination authentication control module (the same as the above-mentioned judging module 44) is configured to determine whether the received user name is in the user name table of the local user configuration module database, and control the message processing module to perform a corresponding protocol interaction process according to the judgment result. ;

The packet processing module is configured to process the EAPOL packet and the RADIUS packet received by the packet receiving and receiving module. The module in turn includes three sub-modules, ie

The user name processing sub-module is configured to process the EAPoL-Start message and the EAP-Response/Identity message from the client by the authentication system;

The local password processing sub-module (same as the second processing module 52 described above) is configured to process the password of the user locally to complete the authentication;

The remote password processing sub-module (same as the first processing module 46 described above) is configured to be a relay system, so that the user's password is processed on the remote RADIUS server to complete the authentication.

In the embodiment of the present invention, the information of the high-end VIP user is configured on the authentication system, and the information of all legal users is configured on the RADIUS authentication server. When the user initiates the authentication, the authentication system first performs the process of processing the username, if the user is in the database of the authentication system. In the user name table, the process proceeds to the local password processing. Otherwise, if the user is not in the user name table of the database of the authentication system, the process proceeds to the remote password processing. The method effectively saves the storage resources of the authentication system, and fully utilizes the advantages of the large storage capacity of the RADIUS authentication server, and provides double guarantee for the successful authentication of high-end VIP users, and provides authentication services for ordinary users, and the overall implementation is Different users provide differentiated services and the user experience is better.

FIG. 9 is a schematic flowchart of an authentication method for providing a differentiated service for a user according to an embodiment of the present invention. As shown in FIG. 9, the method includes the following steps:

Step S902: Configure the 802.1X authentication mode as the combined authentication mode on the authentication system, and record the mode type of the configuration.

The 802.1X authentication mode that can be set includes the local authentication, the RADIUS authentication, and the combined authentication mode in the embodiment of the present invention.

Step S904, configuring information of the high-end VIP user on the authentication system, and recording the configured user information in the user name table of the database.

You can set the user name and password of the authorized user, the port where the user goes online, the virtual local area network (VLAN) that the user goes online, and the media access control used by the user. User information such as Access Control, referred to as MAC address.

Step S906, configuring information of all legitimate users on the authentication server.

The information of all legal users may include information of high-end VIP users and ordinary legitimate users.

Step S908, the authentication system receives a LAN-based Extended Authentication Protocol-Start (EAPoL-Start) message from the client.

In step S910, the authentication system sends an extended authentication protocol-request/recognition (EAP-Request/Identity) message to the client, and the client is required to send the username.

Step S912: The authentication system receives an extended authentication protocol-response/identity (EAP-Response/Identity) message from the client, where the message includes the user name.

In step S914, the authentication system reads the 802.1X authentication mode configuration.

Step S916: If the 802.1X authentication mode is configured as the combined authentication mode, the authentication system performs step S918; otherwise, if it is local authentication, the authentication system performs step S922; otherwise, if it is RADIUS authentication, the authentication system performs step S924.

Step S918, the authentication system searches for the received user name in the username table in the database.

In step S920, if the authentication system is found, step S922 is performed, otherwise step S924 is performed.

In step S922, the authentication system performs local password processing on the user.

Step S924, the authentication system performs remote password processing on the user.

10 is a flowchart of local cryptographic processing according to an embodiment of the present invention, and FIG. 10 is a flowchart of a detailed method for local cryptographic processing in step S922 of FIG. 9. The flow includes:

Step S1002: The authentication system is a Challenge randomly generated by the user, and the Challenge is sent to the client by using an Extended Authentication Protocol-Request/Random Number (EAP-Request/Challenge) message.

Step S1004: The authentication system receives an extended authentication protocol-response/message digest algorithm (AAP-Response/MD5-Challenge) packet from the client, where the packet includes the Challenge and the client that the client will receive. The password used by the terminal is the encrypted password after the MD5 algorithm.

Step S1006: The authentication system searches for the user name of the user in the user name table in the database, extracts the configured password of the user from the matched entry, and the Challenge generated in step S1002, and performs the MD5 algorithm with the password and Challenge to generate the encryption. password.

Step S1008, the authentication system compares the encrypted password generated by the calculation with the encrypted password received from the client. Determine the comparison result.

In step S1010, if the comparison is the same, the authentication system considers that the user is a legitimate user, and the authentication succeeds. The extended authentication protocol-success (EAP-Success) message is sent to the client, and the port is changed to the authorization state, and the user is allowed to pass the port. Access the network.

In step S1012, if the comparison is different, the authentication system considers the user to be an illegal user, and the authentication fails. The extended authentication protocol-failure (EAP-Failure) message is sent to the client, and the user is prohibited from accessing the network through the port.

11 is a flowchart of remote cryptographic processing according to an embodiment of the present invention, and FIG. 11 is a flowchart of a detailed method for remote cryptographic processing in step S924 in FIG. 9, the flow includes:

Step S1102: The authentication system encapsulates the received extended authentication protocol-response/identity (EAP-Response/Identity) packet from the client into a remote authentication dial-up authentication service access-request (RADIUS Access-Request) packet, and sends the packet. Give the authentication server.

Step S1104: The authentication system receives a RADIUS Access-Challenge message from the authentication server, and the message includes a Challenge randomly generated by the authentication server.

Step S1106: The authentication system encapsulates the received remote authentication dialing authentication service access-private number (RADIUS Access-Challenge) packet from the authentication server in the extended authentication protocol-request/message digest algorithm fifth board-random number (EAP) -Request/MD5-Challenge) The message is sent to the client.

Step S1108: The authentication system receives an extended authentication protocol-response/message digest algorithm (AAP-Response/MD5-Challenge) packet from the client, where the packet includes the Challenge and the client that the client will receive. The password used by the terminal is the encrypted password after the MD5 algorithm.

In step S1110, the authentication system sends the Challenge, the encrypted password and the user name to the authentication server through the remote authentication dial-up authentication service RADIUS Access-Request packet, and the authentication server performs authentication.

In step S1112, the authentication system receives a RADIUS Access-Accept message from the authentication server.

In step S1114, the authentication system determines the RADIUS Access-Accept packet type of the remote authentication dial-up authentication service.

In step S1116, if the RADIUS Access-Accept packet is a successful authentication packet, the authentication system sends an extended authentication protocol-eever (EAP-Success) packet to the client, and the port is Changed to the authorization state, allowing users to access the network through the port.

Step S1118, if the remote authentication dial-up authentication service access-accept (RADIUS Access-Accept) If the packet is an authentication failure packet, the authentication system sends an extended authentication protocol-failure (EAP-Failure) packet to the client and prohibits the user from accessing the network through the port.

In order to implement the above method, a network device is further provided in the embodiment of the present invention. FIG. 12 is a schematic structural diagram of a network device according to an embodiment of the present invention. As shown in FIG. 12, the device includes the following modules:

The 802.1X authentication mode configuration module 1202 is configured to set the 802.1X authentication mode on the authentication system, and record the mode type of the configuration.

The local user configuration module 1204 is configured to set user information of a legitimate user in a local authentication or a combined authentication mode on the authentication system, and record the configured user information in a username list of the database.

You can set the user name, password, port where the user is online, the VLAN where the user goes online, and the MAC address used by the user.

The packet sending and receiving module 1206 is configured to receive or send an EAPOL packet from the client or a RADIUS packet of the authentication server on the physical port of the authentication system.

The authentication mode control module 1208 is configured to configure the 802.1X authentication mode configured by the module 1202 according to the 802.1X authentication mode, and the control packet processing module 1212 performs a corresponding protocol interaction process.

After the authentication system receives the extended authentication protocol-response/identity (EAP-Response/Identity) message from the client, the authentication mode control module 1208 reads from the 802.1X authentication mode configuration module 1202. If the authentication mode is local authentication, the sub-module local cipher processing sub-module 1304 of the packet processing module 1212 is triggered to work; if the authentication mode is RADIUS authentication, the packet processing module 1212 is triggered. The sub-module remote cryptographic processing sub-module 1306 operates; if the authentication mode is the combined authentication mode, the combined authentication control module 1210 is triggered to work.

The combined authentication control module 1210 is configured to determine whether the received user name is in the user name table of the database of the local user configuration module 1204, and control the message processing module 1212 to perform a corresponding protocol interaction process according to the determination result.

The authentication system extracts the user name of the user from the received extended authentication protocol-response/identity (EAP-Response/Identity) message from the client, and uses the keyword as the key in the local user configuration module 1204. In the user name table of the database, the user name is searched. If the user name exists, the sub-module local password processing sub-module 1304 of the message processing module 1212 is triggered to work; otherwise, if the user name does not exist, the child of the message processing module 1212 is triggered. The module remote cryptographic processing sub-module 1306 operates.

The packet processing module 1212 is configured to process the EAPOL packet and the RADIUS packet received by the packet sending and receiving module 1206.

The message processing module 1212 includes three sub-modules, as shown in FIG. 13 . FIG. 13 is a structural diagram of a message processing module 1212 according to an embodiment of the present invention, including:

The username processing sub-module 1302 is configured to process the LAN-based Extended Authentication Protocol-Start (EAPoL-Start) message and the Extended Authentication Protocol-Response/Identity (EAP-Response/Identity) message from the client.

If the authentication system receives the LAN-based Extended Authentication Protocol-Start (EAPoL-Start) message from the client, it sends an Extended Authentication Protocol-Request/Identity (EAP-Request/Identity) message to the client, requesting the client to The username is sent up.

If the authentication system receives an extended authentication protocol-response/identity (EAP-Response/Identity) message from the client, and the message includes the user name, the authentication mode control module 1208 is triggered to work.

The local password processing sub-module 1304 is configured to process the password of the user locally by the authentication system to complete the authentication.

If the authentication mode control module 1208 or the combination authentication control module 1210 triggers the message processing module 1212 to perform the local cryptographic processing sub-module 1304, the authentication system is a Challenge randomly generated by the current user, and the Challenge is extended by the authentication protocol-request. The EAP-Request/Challenge message is sent to the client.

If the authentication system receives the extended authentication protocol-response/message digest algorithm (EAP-Response/MD5-Challenge) message from the client, the packet contains the Challenge and client that the client will receive. The password is the encrypted password after the MD5 algorithm. The authentication system searches for the user name of the user in the user name table in the local database, extracts the configured password of the user from the matched entry, and the Challenge generated by the authentication system. The password and Challenge do the MD5 algorithm, generate an encrypted password, and compare it with the encrypted password received from the client. If the user is a valid user, the authentication is successful. The extended authentication protocol-success (EAP-Success) packet is sent to the client, and the port is changed to the authorization state. The user is allowed to access the network through the port. Otherwise, the user is considered to be an unauthorized user, and the authentication fails. The extended authentication protocol-failure (EAP-Failure) packet is sent to the client, and the user is prohibited from accessing the network through the port.

The remote password processing sub-module 1306 is configured to be a relay system, so that the user's password is processed on the remote RADIUS server to complete the authentication.

If the authentication mode control module 1208 or the combined authentication control module 1210 triggers the message processing module 1212 to perform the remote cryptographic processing sub-module 1306, the authentication system will receive the extension from the client. The authentication protocol-response/identity (EAP-Response/Identity) packet is encapsulated into a remote authentication dial-up authentication service RADIUS Access-Request packet and sent to the remote authentication server.

If the authentication system receives a RADIUS Access-Challenge packet from the authentication server, and the packet contains a Challenge randomly generated by the authentication server, the authentication system will receive the authentication server from the authentication server. The RADIUS Access-Challenge packet is encapsulated in the EAP-Request/MD5-Challenge packet of the extended authentication protocol-request/message digest algorithm. Client.

If the authentication system receives the extended authentication protocol-response/message digest algorithm (EAP-Response/MD5-Challenge) message from the client, the packet contains the Challenge and client that the client will receive. The password is encrypted by the MD5 algorithm. The authentication system sends the Challenge, Request, and RADIUS Access-Request packets from the client to the authentication server. , authenticated by the authentication server.

If the authentication system receives the RADIUS Access-Accept packet from the authentication server and sends a RADIUS Access-Accept packet, if the authentication succeeds, the extended authentication protocol is sent to the client-Eucately (EAP-Success) The message is changed to the authorization state, allowing the user to access the network through the port. Otherwise, an extended authentication protocol-failure (EAP-Failure) message is sent to the client, and the user is prohibited from accessing the network through the port.

In the above embodiments of the present invention, the network user can be provided with a differentiated access authentication service by using a combination of local authentication and RADIUS authentication. That is, the information of the high-end VIP user is configured on the authentication system, and the information of all authorized users is configured on the RADIUS authentication server. When the user initiates the authentication, the authentication system first performs the process of processing the user name. If the user is in the user name table of the database of the authentication system. , then transfer to the process of local password processing, otherwise, it will transfer to the process of remote password processing. The method effectively saves the storage resources of the authentication system, and fully utilizes the advantages of the large storage capacity of the RADIUS authentication server, and provides double guarantee for the successful authentication of high-end VIP users, and provides authentication services for ordinary users, and the overall implementation is Different users provide differentiated services, which greatly enhances the user experience.

It will be apparent to those skilled in the art that the various modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein. The steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software.

The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. The present invention is susceptible to various modifications and changes. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Industrial applicability

As described above, an authentication method and apparatus provided by the embodiments of the present invention have the following beneficial effects: the problem that the user cannot provide a differentiated authentication service and the user experience is low, and the user is implemented as a different user. Provide different authentication services to improve the user experience.

Claims

An authentication method that includes:

Receiving a message including a username sent by the user terminal;

Determining whether to perform local authentication for the user terminal according to the received username;

In the case where the determination result is negative, the remote authentication process is performed on the user terminal.
The method according to claim 1, wherein after determining whether to perform local authentication for the user terminal according to the received username, the method further comprises:

In the case where the determination result is YES, the local authentication process is performed on the user terminal.
The method according to claim 1, wherein before determining whether to perform local authentication for the user terminal according to the received username, the method further comprises:

A user name of a user who satisfies a predetermined condition is recorded in a user name table of a database for performing local authentication on the user terminal.
The method according to claim 3, wherein determining whether to perform local authentication for the user terminal according to the received username includes:

Determining whether the user name matches information in a username list of the database;

In the case where the determination result is no, it is determined to abandon the execution of the local authentication for the user terminal.
The method of claim 1, wherein performing remote authentication processing on the user terminal comprises:

Determining whether the authentication mode for authenticating the user terminal is a combined authentication mode, where the combined authentication mode is to authenticate the user terminal by using local authentication and remote authentication;

In the case where the determination result is YES, the remote authentication process is performed on the user terminal.
An authentication device comprising:

a receiving module, configured to receive a message that is sent by the user terminal and includes a username;

a determining module, configured to determine, according to the received username, whether to perform local authentication for the user terminal;

The first processing module is configured to perform remote authentication processing on the user terminal if the determination result of the determination module is negative.
The apparatus of claim 6 further comprising:

The second processing module is configured to perform local authentication processing on the user terminal if the determination result of the determination module is YES.
The apparatus of claim 6 further comprising:

The recording module is configured to record a user name of the user who satisfies the predetermined condition in a username list of a database for performing local authentication on the user terminal.
The apparatus of claim 8 wherein said determining module comprises:

a first determining unit, configured to determine whether the user name matches information in a username list of the database;

The determining unit is configured to determine to abandon the local authentication for the user terminal if the determination result of the first determining unit is negative.
The apparatus of claim 6 wherein said first processing module comprises:

The second determining unit is configured to determine whether the authentication mode for authenticating the user terminal is a combined authentication mode, where the combined authentication mode is to authenticate the user terminal by using local authentication and remote authentication;

The processing unit is configured to perform remote authentication processing on the user terminal when the determination result is YES.