CN1235382C - A client authentication method based on 802.1X protocol - Google Patents

Abstract

The invention discloses a client authentication method based on the 802.1X protocol. According to the method, according to the transparently transmitted message of the network access device, the 802.1X device end is allowed to be used as the trigger message for triggering the 802.1X protocol authentication. When the client When the terminal starts network access, use the above trigger message to trigger the 802.1X device to authenticate the client. During the online process of the user network, the 802.1X device completes the periodic or aperiodic re-authentication of the user according to the trigger conditions; the above The solution can effectively solve the problem that users with static addresses and other users cannot use EAPoL-Start packets for authentication, and network access devices do not support the 802.1X protocol or cannot transparently transmit EAPoL-Start packets. Under any networking conditions, the user's requirements for 802.1X authentication can be met.

Description

A Client Authentication Method Based on 802.1X Protocol

technical field

The invention relates to a client authentication method in network access, in particular to an authentication method based on 802.1X protocol.

Background technique

The IEEE 802.1X protocol widely used in local area networks is a port-based network access control protocol, which is used to authenticate and control access clients at the physical access level of network devices. Refer to Figure 1 for the architecture of the 802.1X protocol. There are three entities: 802.1X client, 802.1X device, and authentication. Extensible Authentication Protocol (EAP) is used to exchange authentication information between the 802.1X device end and the authentication server at the authentication end. EAPoL is an authentication protocol between an 802.1X client and an 802.1X device. Usually, the device at the access layer of the network needs to implement the device side part of 802.1X; the 802.1X client is installed in the user PC; the 802.1X authentication server system generally resides in the AAA (accounting, authentication and authorization) of the operator )center. There are controlled ports (Controlled Port) and uncontrolled ports (Uncontrolled Port) inside the 802.1X device side. The uncontrolled port is always in the state of two-way connection, mainly used to transmit EAPoL protocol frame, which can guarantee to receive and send EAPoL protocol frame at any time. The controlled port is opened only when the authentication is passed, and is used to transfer network resources and services. The controlled port can be configured as two-way controlled and one-way controlled to adapt to different application environments. Under the above architecture, if the user equipment connected to the port of the Ethernet switch or broadband access equipment can pass the authentication, it can access the resources in the network; if it cannot pass the authentication, it cannot access the resources in the network. Currently, the 802.1X device based on the architecture shown in FIG. 1 triggers 802.1X authentication by using the received EAPoL-Start message initiated by the user side according to the 802.1X standard.

However, some switches on the network between the 802.1X client and the 802.1X device do not support the 802.1X protocol, and cannot transparently transmit the 802.1X start packet EAPoL-Start sent by the 802.1X client, so it cannot trigger The certification of 802.1X has caused a serious obstacle to the widespread application of 802.1X. In order to solve the above problems, and considering that some users in the network use Dynamic Host Configuration Protocol (DHCP) to dynamically obtain addresses, some 802.1X devices currently use DHCP packets to trigger authentication of 802.1X clients. Even so, many users using legal static addresses in the network still cannot use the DHCP protocol to trigger the 802.1X device side to authenticate these users. It can be seen that under the 802.1X architecture, its application is still subject to some restrictions.

Contents of the invention

The purpose of the present invention is to provide a client authentication method based on the 802.1X protocol which is beneficial to the wide application of the 802.1X protocol. Using the method, the 802.1X device side can complete the authentication of the user using the static address.

In order to achieve the above object, a kind of client authentication method based on 802.1X protocol provided by the present invention comprises:

Step 1: According to the packets that can be transparently transmitted by the network access device, set the permission on the 802.1X device side as the trigger message that triggers the 802.1X protocol authentication;

Step 2: When the client starts to access the network, use the above trigger message to trigger the authentication of the client by the 802.1X device.

The method further includes: setting a condition for triggering message triggering 802.1X protocol authentication in step 1, and during the online process of the user network, the 802.1X device side completes periodic or aperiodic authentication for the user according to the condition.

Said step 2 further comprises:

The client sends a trigger message to the network access device, and the network access device transparently transmits the above trigger message to the 802.1X device, and the 802.1X device receives the above trigger message and converts the message into the 802.1X protocol specification The start authentication message (EAPoL-Start) triggers the authentication process of the 802.1X protocol.

The step 2 may further include the following content: the 802.1X device sends a trigger request message to the client, the client receives the request message and responds with a trigger message, and the network access device sends the trigger message of the above response The text is transparently transmitted to the 802.1X device side, and the 802.1X device side receives the above-mentioned trigger message, and converts the message into an EAPoL-Start message specified in the 802.1X protocol to trigger the authentication process of the 802.1X protocol.

Set whether to allow trigger messages to trigger 802.1X protocol authentication in the 802.1X device. When the trigger message is not an 802.1X start authentication message (EAPoL-Start) specified in the 802.1X protocol, turn on the switch, otherwise turn off the switch .

Since the present invention sets permission on the 802.1X device side as a trigger message to trigger 802.1X protocol authentication according to the message that the network access device can transparently transmit, in this way, the above trigger message can be used when the client starts network access Trigger the authentication of the client by the 802.1X device side; since the trigger message is a message that the network access device can transparently transmit, as long as the client supports the use of the message, no matter what the nature of the message or the message of the protocol is , can trigger the 802.1X device to authenticate the user, which effectively solves the problem that the user with a static address cannot use the EAPoL-Start message for authentication, and also solves the problem that the network access device does not support the 802.1X protocol or cannot transparently The user cannot be authenticated due to the transmission of the EAPoL-Start message. Therefore, the present invention can meet the user's requirement of passing 802.1X authentication under any networking conditions, and is beneficial to the wide application of the 802.1X protocol.

Description of drawings

Figure 1 is a structural diagram of the 802.1X protocol;

Fig. 2 is the flow chart of the first embodiment of the method of the present invention;

Fig. 3 is a flow chart of the second embodiment of the method of the present invention.

Detailed ways

The present invention will be described in further detail below in conjunction with the accompanying drawings.

First, referring to Figure 1, according to the 802.1X protocol, there are controlled ports (Controlled Port) and uncontrolled ports (Uncontrolled Port) inside the 802.1X device. The uncontrolled port is always in the state of two-way connection, mainly used to transmit EAPoL protocol frame, which can guarantee to receive and send EAPOL protocol frame at any time. The controlled port is opened only when the authentication is passed, and is used to transfer network resources and services. The controlled port can be configured as two-way controlled and one-way controlled to adapt to different application environments. In the system shown in Figure 1, if the network access device cannot transparently transmit EAPoL-Start packets, or the user cannot send EAPoL-Start packets through the 802.1X client, the user cannot be authenticated. In fact, in some cases, such as configuring the user controlled port as one-way controlled mode, 802.1X devices or various other servers, hosts, etc. will actively send some packets to the user host, and the user host will respond accordingly some messages. In addition, if the user host sends a message to the network access server through the 802.1X client, as long as the network access server can transparently transmit the message, it can transmit the message to the 802.1X device, thereby triggering the 802.1X The protocol authenticates the user.

Therefore, the present invention firstly determines the message that can be transparently transmitted according to the communication protocol supported by the network access device, and then sets permission on the 802.1X device side as a trigger message for triggering 802.1X protocol authentication. For example, if the network access device supports DHCP protocol, ARP protocol and Simple Network Management Protocol (SNMP), it can be set on the 802.1X device side to allow the message of the above protocol as the trigger message for triggering 802.1X protocol authentication. In this way, when the user When the host sends the above message to the network access device, it will be transparently transmitted to the 802.1X device. If the above message triggers the successful authentication of the 802.1X device to the client, the controlled port of the 802.1X device can be set as single direction controlled or bi-directional controlled.

In practice, even if the network access device supports the 802.1X protocol, some users' hosts, such as hosts with static network addresses, cannot use the EAPoL-Start message to trigger the authentication of the 802.1X protocol, but it may send other protocols Network messages; and hosts using dynamic network addresses must use messages similar to the DHCP protocol to obtain IP addresses. Therefore, the above trigger message settings are necessary. Because after passing the above settings, when the client starts to access the network, it can use any one of the above-mentioned trigger packets to trigger the authentication of the 802.1X device to the client. Through the above settings, the client is not limited to the 802.1X client, but can be any client that supports the trigger message.

It should be pointed out that the above settings are flexible. For example, according to the actual networking, for users who configure static addresses, only allow ARP packets as 802.1X authentication trigger packets on the 802.1X device side. In order to make the actual setting more flexible, you can set whether the trigger message is allowed to trigger the 802.1X protocol authentication switch in the 802.1X device. When it is an authentication start message (EAPoL-Start) not specified in the 802.1X protocol, turn on this switch, otherwise turn off this switch. Of course, the switch can be set as a general switch for all trigger messages, or can be set separately for a single trigger message, so that the trigger message can be selected more flexibly according to the specific network environment, so that the resources on the 802.1X device end be effectively utilized. For example, assuming that the client is an 802.1X client, when the network access device between the 802.1X device and the 802.1X client cannot transparently transmit EAPoL-Start packets, but the network access device supports If the 802.1X device end allows the ARP packet to be used as an 802.1X authentication trigger message; when the network device between the 802.1X device end and the 802.1X client can transparently transmit the EAPoL-Start message, Disable ARP packets as 802.1X authentication trigger packets on the 802.1X device to reduce the load on the 802.1X device.

For another example, when using the client software provided by the WINDOWS XP operating system of Microsoft Corporation in the United States and implementing the IEEE 802.1X-2001 protocol to directly or indirectly interact with the 802.1X device, because the client will not send an EAPoL-Start message text, only ARP packets will be sent, so the switch to allow ARP packets to be used as 802.1X authentication trigger packets must be enabled on the 802.1X device to trigger 802.1X authentication.

The above mentioned is to realize the trigger authentication during the user's network access process through the client. In fact, the above method can also be used to realize the authentication during the online process of the user network. To complete this task, set the trigger during the initial setting. The message triggers the conditions of the 802.1X protocol authentication, so that the 802.1X device side can complete the periodic or aperiodic authentication of the user according to the conditions when the user network is online. For example, set the trigger packet interval to 500 seconds, and when the 802.1X device does not receive a trigger packet from the user for more than 500 seconds, it will automatically trigger the 802.1X protocol authentication for the user. Of course, the 500 seconds may also be such a time, using the first trigger message whose trigger message interval exceeds 500 seconds as a periodic trigger message for performing 802.1X protocol authentication on the user, and so on.

In the specific authentication operation, firstly, the client sends a trigger message to the network access device. The purpose of sending the trigger message may not be that the user needs authentication, but the network access device transparently transmits the above trigger message to the 802.1X device. The end, the 802.1X device end receives the above trigger message, and converts the message into an authentication start message (EAPoL-Start) specified in the 802.1X protocol to trigger the authentication process of the 802.1X protocol.

The specific authentication operation process can also be like this: the 802.1X device sends a trigger request message to the client, the client receives the above request message and responds with a trigger message, and the network access device transmits the trigger message of the above response. The 802.1X device receives the above-mentioned trigger message, converts the message into an EAPoL-Start message specified in the 802.1X protocol, and triggers the authentication process of the 802.1X protocol.

In the above two processes, whoever sends the message first, the client or the 802.1X device, triggers the authentication process of the user's 802.1X protocol, which is completely set according to the user's needs. Therefore, the trigger message can also be freely set according to the characteristics of the network access device, as long as the trigger message can be transparently transmitted to the 802.1X device end.

When various mainstream operating systems are currently running, all operating systems will send an ARP request to obtain the MAC address corresponding to the IP address of the destination user when sending an IP network packet. Using this feature, the ARP request message initiated by the client is used to trigger the 802.1X authentication process. In the following, the trigger message is an ARP message, and the authentication encryption algorithm is EAP-MD5 (MD5, a data encoding algorithm) as an example (but not limited to EAP-MD5, it is also applicable to other authentication methods used in all 802.1X authentication protocols ) describe the above two authentication processes.

Refer to Figure 2 for the first authentication process. After the user turns on the computer, the client sends an ARP request packet in step 1, and the packet is transparently transmitted to the 802.1X device by the network access device. Since the ARP request packet has been set in advance In order to trigger the trigger message of the 802.1X protocol authentication process, the 802.1X device side receives the ARP request message sent by the client in step 2, converts the message into an EAPoL-Start message, and triggers the 802.1X protocol authentication process. After receiving the converted EAPoL-Start message, the 802.1X device sends an EAP authentication request user identification (EAPoL-Request[Identity]) message to the client in step 3, requesting a user name. After the client receives the EAPoL-Request[Identity] message from the 802.1X device, in step 4, the user name passes the EAP authentication and returns the user ID (EAPoL-Response[Identity]) message to the 802.1X device. After receiving the EAPoL-Response[Identity] message from the client, the 802.1X device sends an EAP authentication request challenge code (EAPoL-Request[MD5Challenge]) message to the client in step 5, and performs MD5( An encryption algorithm) challenge. After receiving the EAPoL-Request[MD5Challenge] message from the 802.1X device, the client sends the encrypted password to the 802.1X device through EAP authentication and returns a challenge code (EAPoL-Response[MD5]) message in step 6 end. The 802.1X device side sends the user name and password to the remote authentication server for authentication through the Radius message, or performs local authentication on the network access device. If the authentication is successful, in step 7, the user authentication passing information is sent to the client through an EAP authentication success (EAPoL-Success) message. In the subsequent online process of the user network, when the trigger condition is satisfied, the authentication of the client user by the 802.1X device side is triggered again in step 8.

If the 802.1X device actively sends an ARP request packet to the user host, the user host will return an ARP reply packet according to the ARP process. Therefore, when the 802.1X device enables ARP packets to be used as 802.1X authentication trigger packets, it can be stipulated that the 802.1X authentication process will be triggered when the ARP reply packet returned by the user host is received.

Refer to Figure 3 for the second authentication process. After the user turns on the device, the 802.1X device sends an ARP request message to the client user in step 11, and the user sends an ARP response message through the client terminal in step 12, and the message is transparently transmitted to the 802.1X device by the network access device Since the ARP request message has been set in advance as the trigger message to trigger the 802.1X protocol authentication process, the 802.1X device receives the ARP response message sent by the client in step 13, and converts the message into EAPoL -Start message, triggering the 802.1X protocol authentication process. After receiving the converted EAPoL-Start message, the 802.1X device sends an EAPoL-Request[Identity] message to the client in step 14, requesting a username. After receiving the EAPoL-Request[Identity] message from the 802.1X device, the client sends the user name to the 802.1X device through the EAPoL-Response[Identity] message in step 15. After receiving the EAPoL-Response[Identity] message from the client, the 802.1X device sends an EAPoL-Request[MD5Challenge] message to the client in step 16 to perform an MD5 challenge to the client. After receiving the EAPoL-Request[MD5Challenge] message from the 802.1X device, the client sends the encrypted password to the 802.1X device through the EAPoL-Response[MD5] message in step 17. The 802.1X device sends the user name and password to the remote authentication server for authentication through the Radius message, or performs local authentication on the network access device. Finally, in step 8, the authentication result to the user is sent to the client.

In short, in addition to the 802.1X authentication process triggered by EAPoL-Start specified in the 802.1X protocol, considering the 802.1X authentication of users who dynamically obtain addresses and users who configure static addresses, the corresponding inevitable DHCP and ARP protocol packets can also be used as triggers. packets, so as to provide solutions for 802.1X authentication for various users and network environments. It should also be pointed out that the trigger message can be a self-defined message, or other commonly used messages at present, such as the Internet Control Message Protocol (ICMP) message, the Point-to-Point Protocol (PPPoE) message running on Ethernet. text, Reverse Address Resolution Protocol (RARP) packets, and data packets such as Hypertext Transfer Protocol (HTTP) packets and File Transfer Protocol (FTP) packets used by users to access the Internet. A certain message, or any other control or data message, can be used as a trigger message to trigger the authentication process of the 802.1X protocol.

Claims (8)

1, a kind of client certificate method based on the 802.1X agreement comprises:

Step 1:, the triggering message that allows as triggering the 802.1X protocol authentication is set in the 802.1X equipment end according to the message of network access equipment energy transparent transmission;

Step 2: when client began network insertion, the 802.1X equipment end received above-mentioned triggering message, and this message was converted into the verification process of the beginning message identifying EAPoL-Start triggering 802.1X agreement of 802.1X agreement regulation.

2, the client certificate method based on the 802.1X agreement according to claim 1, it is characterized in that, described method also comprises: in step 1 condition that message triggers the 802.1X protocol authentication that triggers is set, in line process, periodicity or aperiodicity that the 802.1X equipment end is finished the user according to this condition authenticate at user network.

3, the client certificate method based on the 802.1X agreement according to claim 1 and 2 is characterized in that described step 2 further comprises:

Client is sent the triggering message to network access equipment, and to the 802.1X equipment end, the 802.1X equipment end receives above-mentioned triggering message to network access equipment with above-mentioned triggering message transmission.

4, the client certificate method based on the 802.1X agreement according to claim 1 and 2, it is characterized in that, described step 2 further comprises: the 802.1X equipment end sends the trigger request message to client, client receives that above-mentioned request message is to trigger message as replying, to the 802.1X equipment end, the 802.1X equipment end receives above-mentioned triggering message to network access equipment with above-mentioned triggering message transmission of replying.

5, the client certificate method based on the 802.1X agreement according to claim 3, it is characterized in that, in the 802.1X equipment end, be provided with and whether allow to trigger the switch that message triggers the 802.1X protocol authentication, when the triggering message is the beginning message identifying (EAPoL-Start) of non-802.1X agreement regulation, open this switch, otherwise close this switch.

6, the client certificate method based on the 802.1X agreement according to claim 4, it is characterized in that, in the 802.1X equipment end, be provided with and whether allow to trigger the switch that message triggers the 802.1X protocol authentication, when the triggering message is the beginning message identifying (EAPoL-Start) of non-802.1X agreement regulation, open this switch, otherwise close this switch.

7, the client certificate method based on the 802.1X agreement according to claim 5 is characterized in that, described triggering message is ARP(Address Resolution Protocol) message or DHCP (DHCP) message.

8, the client certificate method based on the 802.1X agreement according to claim 6 is characterized in that, described triggering message is ARP(Address Resolution Protocol) message or DHCP (DHCP) message.

Images