CN101370018A - A DHCP authentication method, device and system - Google Patents

Abstract

The invention discloses a DHCP authentication method, device and system. The method includes: receiving a message indicating an authentication method sent by a DHCP client; sending an authentication request message to the DHCP client according to the authentication method; receiving the DHCP An authentication reply message from the client to the authentication request message; sending a message carrying an authentication result obtained after authenticating the authentication reply message to the DHCP client. In the embodiment of the present invention, the authentication request message and the authentication reply message are interacted according to the authentication method supported by the DHCP client, and the type of the authentication message is expanded to improve authentication reliability and security.

Description

A DHCP authentication method, device and system

technical field

The present invention relates to the communication field, in particular to a DHCP authentication method, device and system.

Background technique

In the past mobile network applications, the IP addresses of network elements such as base station BS (Base Station) and some communication entities when they access the network, such as the IP addresses of gateways (Gateway, GW), are determined by the on-site Operators configure manually, which requires on-site operators to have certain professional and technical knowledge.

With the development and expansion of mobile networks, BS equipment has also developed from traditional macro base stations to micro base stations and home base stations. Therefore, the demand for such BS equipment has become an increasing trend of hundreds, and customers or users require to buy back This type of equipment can be plug-and-play, so the traditional method of manually configuring IP addresses by field technicians can no longer meet market demand. In order to save operator labor costs and simplify management, DHCP (Dynamic Host Configuration Protocol, Dynamic Host Configuration Protocol, etc.) ) is applied to application scenarios such as IP address allocation of such mobile network devices, so as to realize automatic allocation and acquisition of IP addresses of such devices.

Due to historical reasons, the DHCP protocol is a protocol that does not require identity authentication and has no security at all, which easily brings serious security risks to the operating network. for example:

The attacker constantly changes the physical address, tries to apply for all addresses in a DHCP domain, exhausts the addresses in the DHCP Server (server) address pool, and causes other normal users to be unable to obtain addresses;

DHCP is a protocol that does not require authentication. When the leased user or the device logged in by the user accesses the network, the user or device does not need to provide a trust certificate to obtain the lease period. Therefore, any DHCP Client (client) can request the DHCP Server Obtain the use lease of the IP address, so that malicious users can initiate a DoS attack to the DHCP Server to exhaust the IP address lease of the DHCP Server and reject the lease request of legitimate users;

Unauthorized DHCP Server is also easy to deploy. Since the DHCP request message is sent in the form of broadcast, DHCP Server counterfeiters can intercept and respond to wrong gateways, DNS, and IP addresses, such as copies of IP addresses, incorrect Routing information, such as illegal routers, obtaining legal DHCP Client information, etc.

In order to improve the security of DHCP, the RFC (Request for Comments) 3118 standard defines the DHCP message authentication option: DHCP Option 90, which points out that two functions can be provided: one is to authenticate the identity of the DHCP peer; the other is to verify A single DHCP message, that is, to perform integrity check on the DHCP message. The RFC3118 standard gives the content format definition of this option as shown in Table 1:

Table 1

The detailed description of each content field in Table 1 is shown in Table 2:

Table 2

In the prior art, a method of "Configuration Token" and "Delayed Authentication" is defined, because both of them use Option90 to carry the authentication message, so the delayed authentication method is used as an example below to describe.

This method of delayed authentication requires the value of the Protocol field in Table 1 to be 1, and the value of the corresponding algorithm Algorithm to be 1. This method requires the format defined in Table 1 to be in DHCPDISCOVER (DHCP discovery message) and DHCPINFORM (DHCP notification message). The content is shown in Table 3:

table 3

In these two messages, the content of DHCP Option 90 requires the value of the Protocol field to be 1, and the Authentication Information (authentication information) field is empty, that is, there is no such field.

This method also requires that the content defined in Table 1 in the format in DHCPOFFER (DHCP offer message), DHCPREQUEST (DHCP request message) and DHCPACK (DHCP acknowledge message) is as shown in Table 4:

Table 4

Among the above three messages, the Authentication Information field of the content of DHCP Option 90 contains a Secret ID (secret identification number) used to uniquely specify the shared key and the message calculated by using the shared key to perform a message digest on the DHCP message Authentication code field HMAC-MD5.

The method of "delayed authentication" needs to be equipped with a shared key for each DHCP client of each DHCP server, and each shared key must be associated with a unique identification ID. This shared key needs to be distributed to each DHCP client and server in advance through an out-of-band mechanism, and stored locally for subsequent use.

The normal communication process of the method of "delayed authentication" is shown in Figure 1, including:

Step s101, the DHCP client carries Option 90 in DHCPDISCOVER to notify the server that authentication is required, and also carries the identification option Option 61 that can uniquely identify the identity of the client, and then broadcasts the message to find an available server;

Step s102, after the DHCP server (possibly more than one) on the network receives the message, if it judges that it can provide the service, it searches the database according to the identification option Option 61 of the client, and obtains what is used to calculate the session key K of the client Key materials such as two-tuple (client identifier, subnet address), and calculate the session key K, or look up the session key K according to the Secret ID in Option 90, and then use the session key K to calculate the message authentication code, fill in the Option 90 option, and construct a DHCPOFFER message;

Step s103, the DHCP server sends the DHCPOFFER message to the DHCP client;

Step s104, after the DHCP client receives the DHCPOFFER message, it uses its locally stored session key K to verify whether the Authentication Information in Option 90 is correct as required, and if the verification fails, perform corresponding processing according to its local security policy , otherwise select a DHCP server to interact: construct a DHCPREQUEST message, and use the session key K to calculate the authentication code of the message, and fill in the Option 90 option;

Step s105, the DHCP client sends a DHCPREQUEST message to the selected DHCP server to request a service;

Step s106, the DHCP server receives the DHCPREQUEST message, and then uses the key K to verify the message. If the verification fails, the message is directly discarded and the DHCPNAK message is replied, otherwise a DHCPACK message is constructed; both DHCPNAK and DHCPACK must carry Option 90, And populate it according to the requirements of the RFC3118 standard.

In step s107, the DHCP server sends a DHCPACK/DHCPNAK message to the DHCP client.

In step s108, after receiving the DHCPACK/DHCPNAK message, the DHCP client verifies the message according to the processing method in step s104. After the verification is completed, the authentication is ended.

The inventor finds that there are at least the following problems in the prior art:

The centralized authentication server cannot be used for DHCP client and server identity authentication, and the scalability is poor; the DHCP interaction process is simple, and an authentication technology with high security strength and reliability cannot be realized.

Contents of the invention

Embodiments of the present invention provide a DHCP authentication method, device and system to enhance the reliability and security of DHCP authentication by adding authentication request messages and authentication reply messages.

The embodiment of the present invention provides a kind of DHCP authentication method, comprising:

Receive the message indicating the authentication method sent by the DHCP client;

sending an authentication request message to the DHCP client according to the authentication method;

receiving an authentication reply message from the DHCP client to the authentication request message;

Sending a message carrying an authentication result obtained after authenticating the authentication reply message to the DHCP client.

Embodiments of the present invention provide a DHCP authentication device, comprising:

A method receiving unit, configured to receive a message indicating an authentication method sent by a DHCP client;

an authentication request unit, configured to send an authentication request message to the DHCP client according to the authentication method;

an authentication reply unit, configured to receive an authentication reply message from the DHCP client to the authentication request message;

A result sending unit, configured to send a message carrying an authentication result obtained after authenticating the authentication reply message to the DHCP client.

An embodiment of the present invention provides a DHCP authentication system, including a DHCP client and a DHCP authentication device;

The DHCP client is configured to send a message to the DHCP authentication device, the message indicates an authentication method, receive an authentication request message sent by the DHCP authentication device according to the authentication method, and send the authentication request message to the The DHCP authentication device sends an authentication reply message;

The DHCP authentication device is configured to receive a message indicating an authentication method sent by the DHCP client; send an authentication request message to the DHCP client according to the authentication method; receive the authentication request message from the DHCP client an authentication reply message, and send a message carrying an authentication result obtained after authenticating the authentication reply message to the DHCP client.

Compared with the prior art, the embodiments of the present invention have at least the following advantages:

According to the authentication methods supported by the DHCP client, the authentication request message and the authentication reply message are exchanged, and the types of authentication messages are expanded to improve authentication reliability and security.

Description of drawings

Fig. 1 is the flow chart of the DHCP authentication method of prior art;

FIG. 2 is a flowchart of an authentication method provided by an embodiment of the present invention;

Fig. 3 is a flowchart of an authentication method provided by another embodiment of the present invention;

FIG. 4 is a flowchart of an authentication method provided by another embodiment of the present invention;

FIG. 5 is a flowchart of an authentication method provided by another embodiment of the present invention;

FIG. 6 is a flowchart of an authentication method provided by another embodiment of the present invention;

Fig. 7 is a flowchart of an authentication method provided by another embodiment of the present invention;

Fig. 8 is a flowchart of an authentication method provided by another embodiment of the present invention;

FIG. 9 is a schematic structural diagram of an authentication device provided by an embodiment of the present invention;

Fig. 10 is a schematic structural diagram of an authentication device provided by another embodiment of the present invention;

Fig. 11 is a schematic structural diagram of an authentication device provided by another embodiment of the present invention;

FIG. 12 is a schematic structural diagram of an authentication system provided by an embodiment of the present invention;

Fig. 13 is a schematic structural diagram of an authentication system provided by another embodiment of the present invention.

Detailed ways

The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments.

The embodiment of the present invention provides a kind of DHCP authentication method, as shown in Figure 2, comprises the following steps:

Step s201, receiving a message indicating an authentication method sent by a DHCP client;

Step s202, sending an authentication request message to the DHCP client according to the above-mentioned authentication method;

Step s203, receiving an authentication reply message from the DHCP client to the authentication request message;

Step s204, sending a message carrying an authentication result obtained after authenticating the authentication reply message to the DHCP client.

By adopting the method provided by the embodiment of the present invention, the authentication request message and the authentication reply message are interacted according to the authentication method supported by the DHCP client, and the types of authentication messages are expanded to improve authentication reliability and security.

The embodiment of the present invention provides a kind of DHCP authentication method, as shown in Figure 3, comprises the following steps:

Step s301, receiving a message carrying an authentication option, where the authentication option indicates an identity authentication method supported by the DHCP client;

Step s302, sending an authentication request message AUTHREQ to the DHCP client according to the identity authentication method;

The authentication request message AUTHREQ is an extended DHCP message type in this embodiment, and the extended message type also includes an authentication reply message AUTHRSP.

Step s303, receiving the authentication reply message AUTHRSP sent by the DHCP client;

Step s304, forwarding the authentication reply message AUTHRSP to the centralized authentication server;

Step s305, receiving the message sent by the centralized authentication server, encapsulating it into AUTHRSP and sending it to the DHCP client;

Step s306, forwarding the AUTHRSP sent by the DHCP client to the centralized authentication server;

Step s307, receiving the authentication result sent by the centralized authentication server, and sending a message carrying the authentication result.

By adopting the method provided by the embodiment of the present invention, the types of authentication messages are expanded, and the reliability and security of DHCP authentication are improved.

In the following, the present invention will be further introduced in detail in conjunction with specific application scenarios, and the implementation of the above process will be described by taking EAP-TLS defined in the RFC2716 standard as an example.

The embodiment of the present invention provides a kind of DHCP authentication method, as shown in Figure 4, comprises the following steps:

In step s401, the DHCP client broadcasts a DHCP DISCOVER message, which includes AUTH, that is, the authentication option Option 90, indicating that the client supports EAP (Extensible Authentication Protocol, Extensible Authentication Protocol) for identity authentication.

The required DHCP Option option AUTH in the embodiment of the present invention, and the definition of AUTH-MSG, AUTH-Success that occurs later, has two kinds of modes:

A. Reassign and define the authentication option DHCP Option 90 defined in the RFC3118 standard;

B. Redefine a new DHCP Option option to carry the authentication data in the authentication process.

The embodiment of the present invention is illustrated with mode A, and the format of the DHCP Option 90 option is as shown in Table 5. In this embodiment, the content that needs to be redefined includes three domains of Protocol, Algorithm and Authentication Information:

table 5

The content of AUTH in the DHCP Discover message is shown in Table 6:

Table 6

In the DHCPDISCOVER message, through the Protocol and Algorithm fields, instruct the DHCP server to use EAP for identity authentication.

The RFC3748 standard defines the authentication method of EAP, and the format of the EAP message defined by it is shown in Table 7:

Table 7

Among them, the Code field is used to specify the type of EAP packet. Currently, only 4 types of data packets are defined, and other types of packets are invalidated and discarded directly:

A. Request

B. Response

C. Success

D. Failure

The Identifier field is used to match requests and replies.

Length is used to indicate the length of the packet, including the lengths of the three fields Code, Identifer, and Length.

The Data field is used to carry data packets required by the EAP protocol. Its format is determined by the Code field. When the Code field is 1 and 2, that is, Request and Response, its format is: Type, Type-Data.

Among them, Type is used to specify the type of data packet carried, and the format of Type-Data depends on the value of Type. When the values of the Code field are 3 and 4, the Data field is empty.

In step s402, after receiving the DHCP DISCOVER message, the DHCP server judges that the client supports using EAP for identity authentication, and then sends an authentication request message DHCPAUTHREQ to the DHCP client.

The authentication request message DHCPAUTHREQ includes Option 90 option AUTH-MSG, and the content of AUTH-MSG includes EAP-Request/Identity message.

The Option 90 option in the DHCP AUTHREQ message and the DHCPAUTHRSP message that appears later, that is, the content of the AUTH-MSG is shown in Table 8:

Table 8

In step s403, after receiving the EAP identity request message, the DHCP client replies a DHCP AUTHRSP/AUTH-MSG message to the DHCP server, and the message includes the client's identity information EAP-Response/Identity/NAI. After receiving the message, the DHCP server sends a request to the AAA server, and forwards the identity information of the client to the AAA server.

In step s404, after receiving the request, the AAA server determines the identity authentication method used by the client according to the identity information of the client. Here, it is assumed that EAP-TLS is used for identity authentication.

In step s405, the AAA server sends an EAP-Request/TLS/Start message to the DHCP server, indicating that the authentication starts.

In step s406, after receiving the message, the DHCP server encapsulates it into a DHCPAUTHREQ/AUTH-MSG message and forwards it to the DHCP client.

In step s407, the DHCP client receives the DHCPAUTHREQ/AUTH-MSG message and judges that it is a TLS/Start message, and then sends a DHCPAUTHRSP/AUTH-MSG message to the DHCP server, including EAP-Response/TLS/ClientHello.

In step s408, the DHCP server forwards the reception to the AAA server.

In step s409, after receiving the message, the AAA server replies EAP-Request/TLS/ServerHello, Certificate, ServerKeyRequest, CertificateRequest, ServerHelloDone message to the DHCP server.

In step s410, the DHCP server encapsulates these contents into a DHCPAUTHREQ/AUTH-MSG message and forwards it to the DHCP client.

In step s411, the DHCP client performs corresponding processing after receiving the message. If the identity verification is passed, a DHCPAUTHRSP/AUTH-MSG message is sent to the DHCP server, and the content includes EAP-Response/TLS/Certificate, ClientKeyExchange, CertificateVerify, ChangeCipherSpec, Finished .

In step s412, the DHCP server forwards the DHCP AUTHRSP/AUTH-MSG message to the AAA server after receiving the message.

In step s413, the AAA server performs corresponding processing after receiving the message, and sends EAP-Request/TLS/ChangeCipherSpec, Finished to the DHCP server if the authentication passes.

In step s414, the DHCP server encapsulates these contents into a DHCPAUTHREQ/AUTH-MSG message and forwards it to the DHCP client.

In step s415, the DHCP client receives the message and replies with an acknowledgment message DHCPAUTHRSP/AUTH-MSG, which includes EAP-Response/TLS/NoData, and calculates a master key MSK for subsequent DHCP message authentication.

In step s416, the DHCP server forwards the confirmation message to the AAA server after receiving the confirmation message.

In step s417, after receiving the confirmation message, the AAA server also calculates a master key MSK, and then sends an EAP-Request/TLS/Success message to the DHCP server.

Step s418, after the DHCP server receives the message, it determines that the identity authentication of the DHCP client is passed, and then sends a DHCPOFFER/AUTH-Success message to the client, and at the same time, the DHCP server obtains the shared key MSK from the AAA server for subsequent DHCP message authentication .

The Option 90 option in the DHCP OFFER message, that is, the content of AUTH-Success is shown in Table 9:

Table 9

In step s419, after receiving the DHCPOFFER/AUTH-Success message, the DHCP client sends a DHCPREQUEST message to the DHCP server, and the message includes the authentication message AUTH generated by MSK, and the authentication option can use the authentication option Option90 defined in the RFC3118 standard.

Step s420, after the DHCP server receives the request, it verifies the authentication option in the message, if the verification is passed, it replies with DHCPACK, otherwise it replies with DHCPNAK, both messages must carry the authentication option AUTH generated by MSK, the DHCP client When these two messages are received, they also need to be verified.

By adopting the method provided by the embodiment of the present invention, the types of authentication messages are increased, and the reliability and security of DHCP authentication are improved; centralized authentication is conveniently performed or the centralized authentication server deployed in the existing network is fully utilized to share network resources.

Yet another embodiment of the present invention also provides a kind of DHCP authentication method, as shown in Figure 5, comprises the following steps:

In step s501, the DHCP client sends DHCP DISCOVER to notify the server that authentication is required, and also carries the identification option Option 61 that can uniquely identify the identity of the client, and then broadcasts the message to find an available server.

In step s502, after receiving the message, the DHCP server constructs a DHCP OFFER message and sends it to the DHCP client.

In step s503, after the DHCP client receives the DHCP OFFER message, it verifies the message, and if the verification passes, it sends a DHCP REQUEST message to the DHCP server, which carries authentication options and indicates the authentication methods supported by the client.

Step s504, after receiving the message, the DHCP server sends an authentication request message AUTHREQ to the DHCP client according to the above identity authentication method.

In step s505, the DHCP client receives the DHCP AUTHREQ, processes its content, and then sends a DHCP authentication reply message AUTHRSP to the DHCP server.

In step s506, after receiving the AUTHRSP from the client, the DHCP server forwards it to the centralized authentication server for identity verification.

Step s507, after receiving the message, the centralized authentication server performs identity authentication, and repeats the following steps: the DHCP server forwards the DHCP authentication request message AUTHREQ sent by the centralized authentication server to the client, forwards the DHCP authentication reply message sent by the DHCP client AUTHRSP to the centralized authentication server; until the authentication is completed.

Step s508, if the authentication is passed, the DHCP server sends a DHCPACK to the client, otherwise sends a DHCPNAK to the client.

By adopting the method provided by the embodiment of the present invention, the types of authentication messages are increased, and the reliability and security of DHCP authentication are improved; centralized authentication is conveniently performed or the centralized authentication server deployed in the existing network is fully utilized to share network resources.

Yet another embodiment of the present invention also provides a kind of DHCP authentication method, as shown in Figure 6, comprises the following steps:

In step s601, the DHCP client sends a DHCP DISCOVER message carrying authentication options to the DHCP relay agent, indicating the identity authentication methods supported by the client.

In step s602, the DHCP relay agent forwards the message to the DHCP server.

In step s603, the DHCP server sends a DHCP OFFER to the DHCP relay agent.

In step s604, the DHCP relay agent sends a DHCP authentication request message AUTHREQ to the DHCP client according to the identity authentication methods supported by the client.

In step s605, the DHCP client receives the DHCP AUTHREQ, processes its content, and then sends a DHCP authentication reply message AUTHRSP to the DHCP relay agent.

In step s606, after receiving the AUTHRSP of the client, the DHCP relay agent forwards it to the centralized authentication server for identity verification.

Step s607, after receiving the message, the centralized authentication server performs identity authentication, and repeats the following steps: the DHCP relay agent forwards the DHCP authentication request message AUTHREQ sent by the centralized authentication server to the client, and forwards the DHCP authentication reply sent by the DHCP client Message AUTHRSP to the centralized authentication server; until the authentication is completed.

In step s608, the DHCP relay agent sends a DHCP OFFER to the DHCP client. If the authentication is passed, it indicates that the authentication is successful in the authentication option of the message, otherwise it directly returns a rejection message DHCPNAK and indicates that the authentication failed.

Step s609, if the authentication is passed, the DHCP client sends a DHCP REQUEST to the DHCP relay agent, and the message needs to carry the authentication option Option 90.

Step s610, after the DHCP relay agent receives the DHCP REQUEST, forwards the message to the DHCP server to verify the authentication option Option90, if the verification is passed, then forwards the DHCPACK sent by the DHCP server to the client, otherwise sends the DHCPNAK to the client .

By adopting the method provided by the embodiment of the present invention, the types of authentication messages are increased, and the reliability and security of DHCP authentication are improved; centralized authentication is conveniently performed or the centralized authentication server deployed in the existing network is fully utilized to share network resources.

Another embodiment of the present invention provides a DHCP authentication method, as shown in Figure 7, comprising the following steps:

In step s701, the DHCP client sends DHCP DISCOVER to notify the server that authentication is required, and also carries the identification option Option 61 that can uniquely identify the identity of the client, and then broadcasts the message to find an available server.

Step s702, the DHCP relay agent receives the message, forwards it to the DHCP server, receives the DHCP OFFER sent by the DHCP server, and forwards the message to the DHCP client.

In step s703, the DHCP relay agent receives the REQUEST sent by the DHCP client, and the message carries authentication options, indicating the authentication methods supported by the client.

In step s704, the DHCP relay agent sends an authentication request message AUTHREQ to the DHCP client according to the above identity authentication method.

In step s705, the DHCP client receives the DHCP AUTHREQ, processes its content, and then sends a DHCP authentication reply message AUTHRSP to the DHCP server.

In step s706, after receiving the AUTHRSP of the client, the DHCP relay agent forwards it to the centralized authentication server for identity verification.

Step s707, after receiving the message, the centralized authentication server performs identity authentication, and repeats the following steps: the DHCP relay agent forwards the message AUTHREQ sent by the centralized authentication server to the client, forwards the DHCP authentication reply message AUTHRSP sent by the DHCP client to Centralize the authentication server; until the authentication is complete.

Step s708, if the authentication is passed, the DHCP server sends a DHCPACK to the client, otherwise sends a DHCPNAK to the client.

By adopting the method provided by the embodiment of the present invention, the types of authentication messages are increased, and the reliability and security of DHCP authentication are improved; centralized authentication is conveniently performed or the centralized authentication server deployed in the existing network is fully utilized to share network resources.

The embodiment of the present invention provides a kind of authentication method of DHCP agreement, as shown in Figure 8, comprises the following steps:

Step s801, receiving a message carrying an authentication option, where the authentication option indicates an identity authentication method supported by the DHCP client;

Step s802, sending an authentication request message AUTHREQ to the DHCP client according to the identity authentication method;

The authentication request message AUTHREQ is an extended DHCP message type in this embodiment, and the extended message type also includes an authentication reply message AUTHRSP.

Step s803, receiving the authentication reply message AUTHRSP sent by the DHCP client, and performing authentication;

Step s804, sending a message carrying the authentication result.

By adopting the method provided by the embodiment of the present invention, the authentication request message and the authentication reply message are interacted according to the authentication method supported by the DHCP client, and the types of authentication messages are expanded to improve authentication reliability and security.

Another embodiment of the present invention provides a DHCP authentication device, as shown in Figure 9, comprising:

A method receiving unit 91, configured to receive a message indicating an authentication method sent by a DHCP client;

An authentication request unit 92, configured to send an authentication request message to the DHCP client according to the authentication method in the message received by the method receiving unit 91;

An authentication reply unit 93, configured to receive an authentication reply message from the DHCP client to the authentication request message;

The result sending unit 94 is configured to send, to the DHCP client, a message carrying an authentication result obtained after authenticating the authentication reply message.

By adopting the device provided by the embodiment of the present invention, the interaction between the authentication request message and the authentication reply message is performed according to the authentication method supported by the DHCP client, and the types of authentication messages are expanded to improve authentication reliability and security.

The embodiment of the present invention provides a kind of DHCP authentication device, as shown in Figure 10, also includes:

The forwarding unit 95 is configured to forward the authentication reply message sent by the DHCP client to the centralized authentication server;

The receiving unit 96 is configured to receive an authentication result obtained after the centralized authentication server authenticates the authentication reply message.

By adopting the device provided by the embodiment of the present invention, the interaction between the authentication request message and the authentication reply message is performed according to the authentication method supported by the DHCP client, and the types of authentication messages are expanded to improve authentication reliability and security.

The embodiment of the present invention provides a kind of DHCP authentication device, as shown in Figure 11, also includes:

The authentication unit 95 is configured to authenticate the authentication reply message sent by the DHCP client and obtain an authentication result.

By adopting the device provided by the embodiment of the present invention, the interaction between the authentication request message and the authentication reply message is performed according to the authentication method supported by the DHCP client, and the types of authentication messages are expanded to improve authentication reliability and security.

The embodiment of the present invention also provides a DHCP authentication system, as shown in FIG. 12 , including a DHCP client 121 and a DHCP authentication device 122;

The DHCP client 121 is configured to send a message to the DHCP authentication device 122, the message specifies the authentication method, receives the authentication request message sent by the DHCP authentication device 122 according to the authentication method, and sends an authentication reply message to the DHCP authentication device 122 according to the authentication request message;

The DHCP authentication device 122 is used to receive the message indicating the authentication method sent by the DHCP client 121; send an authentication request message to the DHCP client 121 according to the authentication method; receive the authentication reply message of the authentication request message from the DHCP client 121, and send the authentication request message to the DHCP client 121. The DHCP client 121 sends a message carrying an authentication result obtained after authenticating the authentication reply message.

As shown in Figure 13, the system provided by the embodiment of the present invention also includes a centralized authentication server 123, and the centralized authentication server 123 is used to receive the authentication reply message forwarded by the DHCP authentication device 122 to the DHCP client 121, and to authenticate the authentication reply message, The result of the authentication is sent to the DHCP authentication device 122 .

By adopting the system provided by the embodiment of the present invention, the interaction between the authentication request message and the authentication reply message is performed according to the authentication method supported by the DHCP client, and the types of authentication messages are expanded to improve authentication reliability and security.

Through the above description of the embodiments, those skilled in the art can clearly understand that the present invention can be realized by hardware, or by software plus a necessary general hardware platform. Based on this understanding, the technical solution of the present invention can be embodied in the form of software products, which can be stored in a non-volatile storage medium (which can be CD-ROM, U disk, mobile hard disk, etc.), including several The instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute the methods described in various embodiments of the present invention.

In a word, the above descriptions are only preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims (12)

1. a dynamic host configuration protocol DHCP authentication method is characterized in that, comprising:

Receive the message that indicates authentication method that dhcp client sends;

Send authentication request message according to described authentication method to described dhcp client;

Receive the authentication answer message of described dhcp client to described authentication request message;

Carry the message that described authentication answer message is authenticated the resulting authentication result in back to described dhcp client transmission.

2. the method for claim 1 is characterized in that, also comprises after the authentication answer message of described reception dhcp client to described authentication request message:

The authentication answer message of transmitting described dhcp client transmission is to the Collective qualification server;

Receive described Collective qualification server described authentication answer message is authenticated the resulting authentication result in back.

3. the method for claim 1 is characterized in that, also comprises after the authentication answer message of described reception dhcp client to described authentication request message:

Described authentication answer message is authenticated and the access authentication result.

4. the method for claim 1 is characterized in that, in the message that indicates authentication method that described dhcp client sends, indicates authentication method by entrained authentication option.

5. as claim 1 or 4 described methods, it is characterized in that the message that indicates authentication method that described dhcp client sends is specially DHCP DISCOVER or DHCP REQUEST.

6. method as claimed in claim 2 is characterized in that the message of described authentication result is specially DHCPOFFER.

7. the method for claim 1 is characterized in that, carries the authentication option of expansion in described authentication request message and the authentication answer message.

8. a DHCP authenticate device is characterized in that, comprising:

The method receiving element is used to receive the message that indicates authentication method that dhcp client sends;

The authentication request unit is used for sending authentication request message according to described authentication method to described dhcp client;

The authentication answer unit is used to receive the authentication answer message of described dhcp client to described authentication request message;

Transmitting element is used for carrying the message that described authentication answer message is authenticated the resulting authentication result in back to described dhcp client transmission as a result.

9. device as claimed in claim 8 is characterized in that, also comprises:

Retransmission unit is used to transmit the authentication answer message of described dhcp client transmission to the Collective qualification server;

Receiving element is used to receive described Collective qualification server described authentication answer message is authenticated the resulting authentication result in back.

10. device as claimed in claim 8 is characterized in that, also comprises:

Authentication ' unit is used for described authentication answer message is authenticated and the access authentication result.

11. a DHCP Verification System is characterized in that, comprises dhcp client, DHCP authenticate device;

Described dhcp client, be used for sending message to described DHCP authenticate device, described message indicates authentication method, receives the authentication request message that described DHCP authenticate device sends according to described authentication method, sends authentication answer message according to described authentication request message to described DHCP authenticate device;

Described DHCP authenticate device is used to receive the message that indicates authentication method that described dhcp client sends; Send authentication request message according to described authentication method to described dhcp client; Receive the authentication answer message of described dhcp client, send to described dhcp client and carry the message that described authentication answer message is authenticated the resulting authentication result in back described authentication request message.

12. system as claimed in claim 11, it is characterized in that, also comprise the Collective qualification server, described Collective qualification server, be used to receive the authentication answer message that described DHCP authenticate device is transmitted described dhcp client, described authentication answer message is authenticated, authentication result is sent to described DHCP authenticate device.

Images