CN1223155C - Method for realizing 802.1 X communication based on group management - Google Patents

Abstract

The invention discloses a method for implementing 802.1X communication based on cluster management. The 802.1X client communicates with the 802.1X authentication server through the 802.1X device end. The key lies in: dividing multiple 802.1X device ends into a cluster in advance, Set one 802.1X device in the cluster as the command switch of the cluster, and the other 802.1X devices are member switches; when the 802.1X client communicates with the 802.1X authentication server, the 802.1X client first sends the message to the member switch connected to it, and the member switch sends the information to the 802.1X authentication server through the command switch; the return message processed by the 802.1X authentication server is also sent to the Destination 802.1X client. The method can centrally manage the 802.1X equipment side of the RADIUS client, expand the access number of the 802.1X client, and save public network IP address resources.

Description

A Realization Method of 802.1X Communication Based on Cluster Management

technical field

The present invention relates to 802.1X communication technology, in particular to a method for realizing 802.1X communication based on cluster management.

Background technique

At present, in the wired broadband access environment, 802.1X authentication is usually performed between the access device and the authentication server. The ingress device is a RADIUS client (Client).

The so-called 802.1X protocol is a port-based network access control protocol officially approved by the Institute of Electrical and Electronics Engineers (IEEE) standardization organization in June 2001. IEEE 802.1X defines a port-based network access control protocol, where a port can be a physical port or a logical port. Typical application methods are: a physical port of an Ethernet switch is connected to a client computer.

Port-based network access control is to authenticate and control the access client at the physical access level of the network device. The physical access level here refers to the port of the Ethernet switching or broadband access device. If the user equipment on the class port can pass the authentication, it can access the resources in the network; if it cannot pass the authentication, it cannot access the resources in the network.

IEEE 802.11, also known as IEEE 802 LAN, defines the wireless local area network access method, which does not provide access authentication. Generally speaking, as long as the user can access the LAN control device, such as LanSwitch, the user can access the LAN A device or resource in . However, for applications such as telecommunication access, office buildings, local area networks, and mobile offices, equipment providers hope to control and configure user access, which creates the need for 802.1X access control.

The architecture of IEEE 802.1X is shown in Figure 1. The 802.1X system has three entities: client system (Supplicant System), device side (Authenticator System), and authentication server system (Authentication Server System). The client further includes the client port state entity (PAE), the device side further includes the service provided by the device end system and the device end port state entity, and the authentication server system further includes an authentication server; the authentication server and the port state of the device end The entities are connected, and the authentication information between the device and the authentication server is exchanged through the Extensible Authentication Protocol (EAP). Port) and uncontrolled ports are connected to the LAN, and the client and the device communicate through the authentication protocol (EAPOL) between the client and the device. Among them, Controlled Port is responsible for controlling access to network resources and services.

Generally, the device at the user access layer needs to implement the 802.1X device end system (Authenticator System); the 802.1X client system is installed in the user PC; the 802.1X authentication server system resides in the AAA center of the operator, and the AAA is Refers to accounting (Account), authentication (Authentication) and authorization (Authorization).

As shown in Figure 1, there are controlled ports (Controlled Port) and uncontrolled ports (Uncontrolled Port) inside the equipment end system. Receive and send EAPOL protocol frames at any time; and the controlled port is only opened when the authentication is passed, and is used to transfer network resources and services, that is, the controlled port is an unauthorized port when the authentication fails, and the controlled The port can be configured as two-way controlled and input-only controlled to meet the needs of different application environments.

Using the 802.1X protocol in the Ethernet can provide the function that the ports that have not passed the user authentication cannot be used, and the authenticated ports can automatically and dynamically configure and access network resources, so as to be different from the characteristics of traditional Ethernet switches.

However, in the existing access environment, the 802.1X authentication system has the following problems:

1) An access device serving as an authentication access unit (Authenticator) is a RADIUS client (Client) for a remote authentication dial-in user service (RADIUS) server. Due to its low network location, a large number of access nodes, and too scattered, operators need to record the management Internet Protocol (IP) address and Media Access Control (MAC) address of each device for management, so the management is very inconvenient , At the same time, the workload of on-site maintenance and upgrading equipment is too large.

2) Many Layer 2 access devices do not have public IP addresses, so they cannot serve as RADIUS clients of the RADIUS server.

3) Since many RADIUS servers have restrictions on the number of RADIUS Client accesses, for small-capacity access devices, it is impossible to complete large-capacity user access when the stand-alone capacity is small and the number of devices is limited. It brings great limitations to the small-capacity, decentralized access model.

Contents of the invention

In view of this, the main purpose of the present invention is to provide a method for implementing 802.1X communication based on cluster management, so that it can perform centralized management on the 802.1X device side of the RADIUS Client, and expand the number of accesses of the 802.1X client, saving public traffic. Network IP address resource.

In order to achieve the above object, technical solution of the present invention is achieved in that way:

An 802.1X communication implementation method based on cluster management. The 802.1X client communicates with the 802.1X authentication server through the 802.1X device. Any 802.1X device end in the divided cluster is the only command switch in the cluster that communicates with the 802.1X authentication server, and the remaining 802.1X device ends in the cluster are set to be connected between the 802.1X client and the command switch. member switch;

When the 802.1X client communicates with the 802.1X authentication server, the 802.1X client first sends the message to the member switch connected to it, and the member switch sends the information to the 802.1X authentication server through the command switch of the cluster to which it belongs. Server; the return message processed by the 802.1X authentication server is also sent to the destination 802.1X client through the command switch of the cluster to which the destination 802.1X client is connected and the member switch to which the destination 802.1X client is connected.

The communication between the 802.1X client and the 802.1X authentication server further includes 802.1X authentication, and the authentication process at least includes:

a1.802.1X client sends the message for authentication to the member switch connected to it, and the member switch then sends the authentication message to the command switch of the cluster to which it belongs for processing, and the command switch will receive the The message is identified and converted, and then sent to the 802.1X authentication server for authentication;

The message returned by the b1.802.1X authentication server first arrives at the command switch, and after the command switch identifies and converts the message, it is distributed to the corresponding destination member switch, and the destination member switch returns the authentication result Corresponding purpose 802.1X client.

Wherein, step a1 further includes:

The 802.1X client first sends a start message to the member switch connected to it, and the member switch sends a request message with an identifier to the 802.1X client after receiving it, and the 802.1X client responds with a response message; The 802.1X client sends a request message with an encrypted challenge value, and the 802.1X client responds with a response message; after the member switch authenticates the 802.1X client, it sends an authentication request message to the command switch of the cluster to which it belongs, including the Authenticated message, ID, MD5-challenge value and MD5 password. After the authentication is successful, the method further includes setting the current port state as authorized state.

The communication between the 802.1X client and the 802.1X authentication server further includes 802.1X communication charging, and the charging process includes:

a2. The member switch to be billed sends a billing start message to the command switch of the cluster to which it belongs, and the command switch processes it after receiving it, and then sends it to the 802.1X authentication server;

After the b2.802.1X authentication server receives the accounting request message sent by the command switch, it sends an accounting start response message to the command switch;

c2. After the command switch receives the accounting request response message sent by the 802.1X authentication server, it performs identification and conversion processing and determines the destination member switch, and then sends it to the destination member switch;

d2. After receiving the charging request response message forwarded by the command switch, the destination member switch sends an intermediate charging message to the command switch at a fixed time interval, and the command switch receives the intermediate charging request message After the document is processed, and then sent to the 802.1X authentication server;

After receiving the intermediate accounting message from the command switch, the e2.802.1X authentication server sends an intermediate accounting response message to the command switch;

f2. Repeat step d2 and step e2 after each fixed time interval.

The communication between the 802.1X client and the 802.1X authentication server further includes the 802.1X client going offline, and the going offline process includes the following steps:

a3.802.1X client sends an offline message to the connected member switch, and the member switch sends an accounting stop message to the command switch of the cluster to which it belongs after receiving it;

b3. the command switch receives the billing stop message sent by the member switch, and sends it to the 802.1X authentication server after processing; after the 802.1X authentication server receives the billing stop message sent by the command switch, it sends The command switch sends a charging stop response message;

c3. After the command switch receives the accounting stop response message sent by the 802.1X authentication server, it performs identification and conversion processing and determines the destination member switch, and then sends it to the destination member switch;

d3. After receiving the accounting stop response message forwarded by the command switch, the destination member switch sets the state of the port to an unauthorized state through the 802.1X protocol.

As can be seen from the above scheme, the key of the present invention is: in the 802.1X authentication system, a group of switches are classified into a cluster by using the cluster management protocol, the command switch in the cluster is used as an 802.1X proxy, and the member switches are used as 802.1 The X device communicates with the remote RADIUS server through the command switch as an 802.1X proxy, thereby reducing the number of RADIUSClients on the RADIUS server and increasing the number of users that the RADIUS server can access.

Therefore, the 802.1X communication implementation method based on cluster management provided by the present invention realizes the 802.1X proxy based on cluster management in the 802.1X communication system, which has the following advantages and characteristics:

1) Due to the division of clusters, each cluster has one 802.1X device as the command switch in the cluster, acting as a proxy for the communication between all other 802.1X devices and the 802.1X authentication server. Therefore, only a few 802.1X devices are external Contact, only occupy a small number of public network IP addresses, thus saving the IP address resources of the public network.

2) For a layer-2 device without a public IP address, the cluster management protocol can be applied, and it can be used as a member switch of the command switch, and its command switch can be used as the RADIUS Client of the authentication server.

3) Because in the whole 802.1X communication process, when the 802.1X device as the command switch communicates with the 802.1X authentication server, it is the RADIUS client as the RADIUS server, so it facilitates the maintenance of the network and reduces the maintenance. As a RADIUS The workload of the client's 802.1X device.

4) Although only the command switch is directly connected to the RADIUS server, in fact, several 802.1X device terminals as member switches can be connected under the command switch, thereby expanding the number of clients of the RADIUS server with limited access to RADIUS clients. The actual access number of the terminal.

5) The specific application and implementation are loosely coupled, and the management device does not need to know the implementation details of the specific managed device. Moreover, it is possible to collect topology structures under any networking.

Description of drawings

Figure 1 is a schematic diagram of the architecture of IEEE 802.1X;

Figure 2 is the actual application topology network diagram of the cluster;

Fig. 3 is a schematic diagram of the composition structure of cluster members;

Fig. 4 is a schematic diagram of the network structure realized by the 802.1X proxy method based on cluster management in the present invention;

FIG. 5 is a message flow chart of the implementation of the 802.1X proxy method based on cluster management in the present invention.

Detailed ways

The present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments.

In some local area networks, there are usually a large number of network devices but a small number of public IP addresses. In order to facilitate the unified management of network devices and reduce the resource occupation of IP addresses, a cluster management method is currently proposed. The purpose is mainly It manages a large number of low-end devices with fewer public network IP addresses, and provides users with a unified network management interface to facilitate unified management and maintenance of devices.

As shown in Figure 2, the main content of the cluster management solution is to gather some devices together to form a logical cluster, and then complete the management of other devices through a control point in the cluster, that is, a device in the cluster Centralized management of flow and partial business control flow. Among them, the management flow includes at least SNMP network management, loading, log alarm, command line, WEB network management, etc., and the service control flow refers to the RADIUS authentication protocol, etc.

Figure 3 shows the roles played by each component in the cluster. As shown in Figure 3, each cluster includes at least four types of switches:

Command switch: The command switch is designated by the operator and acts as the only node for external management in the cluster to complete the aggregation and distribution of various control flows.

Backup switch: The backup switch is used as the backup of the command switch. When the command switch fails, it is automatically upgraded to become a new command switch in the cluster.

Candidate switch: The candidate switch is relative to the cluster, and refers to the switch that has not yet joined the cluster. The initial identity of all switches is the candidate switch.

Member switch: A member switch refers to a switch that has joined a cluster, and a candidate switch becomes a member switch after joining a cluster. In a cluster, a member switch can be directly connected to the command switch, or cascaded to other member switches, and communicate with the command switch through the upper-level member switch.

The implementation of various management and maintenance applications provided by the cluster, including SNMP network management, command line, loading of programs and data, logs, and alarm reporting, etc., requires the command switch to forward the application protocol packets to the member switches. The proxy forwarding of these application protocols in the cluster management is realized through network address translation (NAT). Compared with the method of separately acting as a proxy for each application, the development workload of this method is small, and standard NAT is conducive to realizing forwarding through hardware. processing to alleviate the processing overhead of the command switch.

Because the cluster has a mature composition structure and management protocol, the present invention adopts the idea of cluster management, as shown in Figure 4, divides a part of the switches at the 802.1X device end into a group, that is, forms a cluster, and in this group of 802.1X device ends Apply the cluster management protocol on it. In this cluster, designate an 802.1X device end as a command switch, as an 802.1X proxy, the command switch is connected to the 802.1X authentication server through the IP network; at the same time, other 802.1X device ends in the group are designated as member switches, These member switches use the command switch as an 802.1X authentication server, and all member switches are connected to multiple 802.1X clients.

Based on the above networking structure, the process of authentication from the 802.1X client to the 802.1X authentication server becomes: the 802.1X client sends the packet for authentication to the member switch connected to it; the member switch sends the authentication packet Send it to the command switch for processing; the command switch processes and converts the received message, and then sends it to the authentication server for authentication. The message returned by the authentication server first reaches the command switch, and then the command switch identifies and converts the message and distributes it to the corresponding destination member switch, and the member switch returns the authentication result to the corresponding destination 802.1X client.

In the above process, the authentication server seen by the command switch itself is the real external authentication server, while the authentication server seen by the member switches is a virtual authentication server, which is actually an 802.1X device designated as the command switch end. After grouping a group of switches into a cluster, for the authentication server, its RADIUS Client is only the command switch. In this way, the problem of resource consumption of the client side of the RADIUS server by small-capacity and distributed multi-point access is solved.

For a candidate switch that has not become a member switch in the cluster, the authentication server it sees is still a real external authentication server, which can perform normal 802.1X authentication, but it must exist as a client of the RADIUS server. When the candidate switch joins the cluster and becomes a member switch, the authentication server it sees is switched from the original external authentication server to the command switch. Similarly, when the member switch exits the cluster, the authentication server it sees also changes from the original Command the switch to switch to the real external authentication server. Whether the switch joins the cluster does not affect the enabling and disabling of 802.1X authentication.

In the 802.1X network structure shown in Figure 4, the detailed communication process between the 802.1X client and the 802.1X authentication server is shown in Figure 5, including the following steps:

1) First, set an 802.1X device end as a command switch, as an 802.1X agent, to connect the 802.1X authentication server and all member switches, that is, other 802.1X device ends.

2) The 802.1X client is sending the authentication message to the 802.1X device. Since the 802.1X device is also a member switch in the cluster, according to the cluster management scheme, the 802.1X device will send the message to the command Switch up to deal with.

Specifically as shown in Figure 5, the 802.1X client first sends the EAPOL-start (Start) message to the member switch connected to it, and the member switch sends the request message EAPOL-request/identification ( Request/Identity), the 802.1X client responds with a response message EAPOL-response/identity (Response/Identity); after receiving it, the member switch sends a request message with an encrypted challenge value to the 802.1X client EAPOL-request/challenge value (Request /MD5 Challenge), the 802.1X client responds to the response message EAPOL-response/challenge value (Response/MD5 Challenge). After authenticating the 802.1X client, the 802.1X device side, that is, the member switch, sends an authentication request message to the command switch, that is, the 802.1X agent, which includes the message to be authenticated, the identifier, the MD5-challenge value, and the MD5 password.

3) After the command switch receives the authentication request message sent by the member switch, it performs processing such as network address translation in the RADIUS module of the command switch, and then sends the authentication request message to the RADIUS server, including the message to be authenticated , ID, MD5-challenge value, and MD5 password.

4) The RADIUS server receives the authentication message sent by the command switch, and after passing the verification, sends an authentication response message to the command switch, which includes authorization information of successful authentication or authentication failure information. The command switch here acts as a RADIUS client for the RADIUS server.

5) After the command switch receives the authentication response message sent by the RADIUS server, it identifies and converts it in its RADIUS module, and after determining which member switch it should send to, it sends the authentication success or failure message to the destination member switch, wherein May include authorization information.

6) After receiving the authentication response message forwarded by the command switch, the destination member switch sends it to the 802.1X protocol control module through the RADIUS module, and sends the EAPoL message to the 802.1X client, which includes success or failure information. At the same time, set the port status to Authorized.

So far, a complete 802.1X authentication process based on cluster management is over. In this process, the 802.1X device end is set as a command switch and a member switch, and the command switch in the cluster is used as an 802.1X proxy to complete the authentication operation between the 802.1X client and the 802.1X authentication server.

After the 802.1X authentication process is over, the 802.1X client starts the normal communication process. During the entire communication process, the member switch, command switch and RADIUS server also need to complete the accounting operation. The process is basically the same as the existing technology, except that the A layer of 802.1X proxy is added between the 802.1X device and the RADIUS server. Its implementation process is shown in Figure 5:

1) The 802.1X device side to be charged, that is, the member switch sends an accounting start message to the 802.1X agent, that is, the command switch, and the command switch performs network address translation in the RADIUS module after receiving the charging request message. After processing, send it to the RADIUS server.

2) After receiving the accounting request message from the command switch, the RADIUS server sends an accounting start response message to the command switch. The command switch here acts as a RADIUS client for the RADIUS server.

3) After the command switch receives the accounting request response message sent by the RADIUS server, it performs identification and conversion processing in the RADIUS module, determines which member switch it should send to, and then sends it to the destination member switch.

4) After the corresponding destination member switch receives the accounting request response message forwarded by the command switch, it sends an intermediate accounting message to the command switch at intervals. After the command switch receives the accounting request message, it The module performs processing such as network address translation and sends it to the RADIUS server.

5) After receiving the intermediate accounting message from the command switch, the RADIUS server sends an intermediate accounting response message to the command switch. The command switch here acts as a RADIUS client for the RADIUS server.

6) After a certain period of time, repeat steps 10) and 11).

When the 802.1X client user goes offline, the 802.1X communication process includes the following steps:

1) The 802.1X client sends an offline message EAPoL-Logoff to the member switch connected to it. After receiving the EAPoL-Logoff message from the 802.1X client, the member switch sends an accounting stop message to the command switch. message.

2) After the command switch receives the accounting stop request message sent by the member switch, it processes it in the RADIUS module and sends it to the RADIUS server; after the RADIUS server receives the accounting stop message sent by the command switch, it sends it to the command switch Send an accounting stop response message.

3) After the command switch receives the accounting stop response message sent by the RADIUS server, it performs identification and conversion processing in the RADIUS module, determines which member switch it should send to, and then sends it to the destination member switch.

4) After the corresponding destination member switch receives the accounting stop response message forwarded by the command switch, it controls through the 802.1X protocol and sets the state of the port as Unauthorized (Unauthorized).

In a word, the above descriptions are only preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention.

Claims (6)

1. A method for implementing 802.1X communication based on cluster management. The 802.1X client communicates with the 802.1X authentication server through the 802.1X device end. It is characterized in that: according to the cluster management protocol, more than one 802.1X device end is divided into a cluster , set any 802.1X device end in the divided cluster as the only command switch communicating with the 802.1X authentication server in the cluster, and set the remaining 802.1X device ends in the cluster to be connected to the 802.1X client and the command switch between member switches; When the 802.1X client communicates with the 802.1X authentication server, the 802.1X client first sends the message to the member switch connected to it, and the member switch sends the information to the 802.1X authentication server through the command switch of the cluster to which it belongs. Server; the return message processed by the 802.1X authentication server is also sent to the destination 802.1X client through the command switch of the cluster to which the destination 802.1X client is connected and the member switch to which the destination 802.1X client is connected. 2. The implementation method according to claim 1, characterized in that: the communication between the 802.1X client and the 802.1X authentication server further includes 802.1X authentication, and the authentication process at least includes: a1.802.1X client sends the message for authentication to the member switch connected to it, and the member switch then sends the authentication message to the command switch of the cluster to which it belongs for processing, and the command switch will receive the The message is identified and converted, and then sent to the 802.1X authentication server for authentication; The message returned by the b1.802.1X authentication server first arrives at the command switch, and after the command switch identifies and converts the message, it is distributed to the corresponding destination member switch, and the destination member switch returns the authentication result Corresponding purpose 802.1X client. 3. The implementation method according to claim 2, characterized in that step a1 further comprises: The 802.1X client first sends a start message to the member switch connected to it, and the member switch sends a request message with an identifier to the 802.1X client after receiving it, and the 802.1X client responds with a response message; The 802.1X client sends a request message with an encrypted challenge value, and the 802.1X client responds with a response message; after the member switch authenticates the 802.1X client, it sends an authentication request message to the command switch of the cluster to which it belongs, including the Authenticated message, ID, MD5-challenge value and MD5 password. 4. The implementation method according to claim 2, characterized in that: after the authentication is successful, the method further includes setting the current port status as an authorized status. 5. The implementation method according to claim 1, wherein the communication between the 802.1X client and the 802.1X authentication server further includes 802.1X communication charging, and the charging process includes: a2. The member switch to be billed sends a billing start message to the command switch of the cluster to which it belongs, and the command switch processes it after receiving it, and then sends it to the 802.1X authentication server; After the b2.802.1X authentication server receives the accounting request message sent by the command switch, it sends an accounting start response message to the command switch; c2. After the command switch receives the accounting request response message sent by the 802.1X authentication server, it performs identification and conversion processing and determines the destination member switch, and then sends it to the destination member switch; d2. After receiving the charging request response message forwarded by the command switch, the destination member switch sends an intermediate charging message to the command switch at a fixed time interval, and the command switch receives the intermediate charging request message After the document is processed, and then sent to the 802.1X authentication server; After receiving the intermediate accounting message from the command switch, the e2.802.1X authentication server sends an intermediate accounting response message to the command switch; f2. Repeat step d2 and step e2 after each fixed time interval. 6. The implementation method according to claim 1, characterized in that: the communication between the 802.1X client and the 802.1X authentication server further includes the 802.1X client going offline, and the offline process includes the following steps: a3.802.1X client sends an offline message to the connected member switch, and the member switch sends an accounting stop message to the command switch of the cluster to which it belongs after receiving it; b3. the command switch receives the billing stop message sent by the member switch, and sends it to the 802.1X authentication server after processing; after the 802.1X authentication server receives the billing stop message sent by the command switch, it sends The command switch sends a charging stop response message; c3. After the command switch receives the accounting stop response message sent by the 802.1X authentication server, it performs identification and conversion processing and determines the destination member switch, and then sends it to the destination member switch; d3. After receiving the accounting stop response message forwarded by the command switch, the destination member switch sets the state of the port to an unauthorized state through the 802.1X protocol.

Images