CN1303790C - Method for retransmiting and discarding data packet of authentication service protocol for dialed from remote user - Google Patents

Abstract

The invention belongs to the technical field of computer network application, and relates to a method for retransmitting and abandoning data packets of a remote user dial-up authentication service protocol. It is characterized in that the respective response time thresholds T and retransmission times N of the authentication data packet, accounting start data packet, accounting update data packet and accounting end data packet of RADIUS are set; when the response time is greater than T, the NAS The end will give up waiting for the response of the data packet sent this time, and resend it. If it resends more than N times, it will abandon this data packet; for the authentication data packet and the accounting end data packet, if it abandons this data packet, it will stop or reject Provide services; for the billing start data packet, the billing end data packet still needs to be sent after discarding this data packet; for the billing update data packet, discarding this data packet will not affect the continued service. The present invention can adopt different retransmission and abandonment strategies according to different data packet types, and can greatly enhance the stability, accuracy and completeness of authentication and charging.

Description

The method of retransmission and abandonment of remote user dial-up authentication service protocol packet

Technical Field The present invention belongs to the field of computer network application technology, and in particular relates to the AAA protocol and protocol data transmission method.

Background Art The development of network technology makes the wide application of the Internet possible, and at the same time, the openness of the Internet makes its application requirements increase day by day. However, the purpose of network operators to build networks is to make profits, and it is impossible to expand the bandwidth unlimitedly beyond the profitability, and it is impossible to provide free services to users. Therefore, reasonable utilization of network resources (including bandwidth, IP addresses, content services, application services, etc.) and effective management of users must be considered during network construction.

Authentication, Authorization, Accounting (AAA) is a management method developed to meet the needs of commercial networks. It identifies commercial users, assigns permissions to legitimate users, records operating information in various networks, and calculate cost.

At present, the relatively mature and most widely used AAA protocol is Remote Authentication Dial In User Service (RADIUS). The purpose of the RADIUS protocol is to provide authentication, authorization and accounting issues related to the network access server (NAS) and the PPP dial-in server. RADIUS works in Client/Server mode and defines a protocol for transmitting authentication, authorization and configuration information between a Network Access Server (NAS for short) and a RADIUS server that centrally stores authentication information. It has good security and flexible expansion , easy to manage, and strong accounting functions.

In the process of providing services to users, the NAS will need to perform authentication and accounting for the user's information, and the steps are:

1. First, the NAS sends a RADIUS authentication packet to the authentication server, and submits the user information to the RADIUS server for authentication;

2. Start accounting for authenticated users, send a RADIUS accounting start packet to the authentication server, and submit an accounting start request to the RADIUS server;

3. While providing services to users, send a RADIUS accounting update packet to the RADIUS server, and send the change of status information to the RADIUS server as an accounting update;

4. After providing the service to the user, the accounting end data packet is sent to the RADIUS server.

From the above steps, it can be seen that there are many different types of RADIUS protocol data packets, and the consequences caused by different types of packets that the NAS does not receive a reply are also different. Table 1 analyzes in detail the occurrence of "NAS not received The possible consequences of responding incorrectly.

Table 1: RADIUS packet description and analysis: RADIUS packet type The urgency of this type of package The server's normal processing of the packet Consequences caused by the "NAS did not receive a reply" error for this type of packet certified ordinary Return authentication success or authentication rejection packet User login failed Billing starts urgent return response The billing cannot be performed, and the NAS is frozen; if it is lost during the return process, the billing cannot be completed, and the user is billed incorrectly, causing the user's loss billing update ordinary return response There is an error in the billing of the user; but the user's loss is not large when the service status changes little Billing ends urgent return response Billing error; if it is lost, the billing cannot be ended, and the user is billed incorrectly, causing the user's loss

The first column in the table shows the four commonly used RADIUS protocol data packet types, the second column shows the different importance of the four types in practical applications; the third column shows that the RADIUS server under normal conditions processing; the last column indicates the possible consequences if the NAS does not receive the returned result.

RADIUS is an upper-layer protocol based on the User Datagram Protocol (UDP). It does not specify the transmission protocol data itself, but uses the UDP transmission mechanism: best-effort delivery. At the same time, if the RADIUS protocol receives an unidentifiable data packet, it is simply discarded. Since the UDP protocol does not specify a retransmission mechanism, this reduces the reliability of the protocol itself in applications.

In this regard, the RADIUS protocol puts forward simple suggestions about retransmission and abandonment. That is, the sender keeps sending data packets until it receives a response message; it gives up sending after a certain number of retries. However, the authentication and accounting system itself requires higher accuracy and security, and this method cannot meet the requirements for the more complex RADIUS protocol data packets. For example, one sending of the RADIUS protocol charging start packet is equivalent to the start of one charging, and the retransmission of this packet is likely to cause repeated charging and cause losses to the user, and the above method cannot deal with this situation .

SUMMARY OF THE INVENTION The purpose of the present invention is to overcome the inherent defect of the currently widely used RADIUS protocol: incorrect billing caused by the unreliability of transmitted data. An improved retransmission and abandonment method of Radius protocol data packets is proposed. According to different data packet types, different retransmission and abandonment strategies can be adopted, which can greatly enhance the stability, accuracy and integrity of authentication and accounting.

The retransmission and abandonment method of the remote user dial-up authentication service protocol data packet proposed by the present invention comprises the following steps:

First, the NAS sends an authentication packet to the RADIUS server and waits for the authentication to pass;

The NAS side sends an accounting start packet to the RADIUS server and waits for a response;

The NAS side provides streaming media services to users, and sends a billing update package to the RADIUS server when the service status (code rate, program, etc.) changes;

After the service ends, the NAS sends an accounting end packet to the RADIUS server;

In the above steps, the RADIUS server processes the RADIUS data packets in full compliance with the RADIUS protocol;

Simple discarding of unexpected data packets and unsuccessful accounting packets;

It is characterized in that the respective response time thresholds T and retransmission times N of the authentication data packet, accounting start data packet, accounting update data packet and accounting end data packet of RADIUS are set; when the response time is greater than T, the NAS The end then gives up waiting for the response of the data packet sent this time, and resends it. When it resends more than N times, it abandons this data packet; for the authentication data packet and accounting end data packet, the NAS end abandons this data packet Then stop or refuse to provide the service; for the accounting start data packet, the NAS end still needs to send the accounting end data packet after abandoning the data packet; for the accounting update data packet, the NAS end abandons the current data packet without affect the continuation of service.

The present invention sets N Accounting Start _{Packet=1 for the Accounting Start Packet} . This is to consider the timing issue. If there is a malicious attack, multiple billing start packets may mean multiple billing starts, resulting in user losses. The choice of N value of other data packets can be set according to specific application conditions, and generally can be selected: N _{billing end packet} ≥ N _{authentication packet} ≥ N _{billing update packet} ≥ _{N billing start packet} .

The choice of T should consider the flexible setting of specific services, and at the same time try not to affect the normal RADIUS packet flow. The general value range can be T _normal <T≤2T _max , T _normal is the normal response time of specific services, and T _max is the specific service Maximum response time. In order not to excessively increase the network load, the value range may be T _max < T ≤ 2T _max ; in addition, T may be appropriately increased and N may be decreased when the network load is too heavy.

Invention principle:

The RADIUS protocol is based on the UDP protocol, which makes the RADIUS protocol have an inevitable fatal flaw: unreliability. In order to make up for this defect, certain measures must be taken on the application layer to improve the authentication and billing system. By analyzing the urgency and processing characteristics of different RADIUS data packets, determine the retransmission and abandonment methods for different data packets, so that the charging process is as normal as possible. After the user starts charging, the charging process is guaranteed to be correct, and the user and Both service providers cause unnecessary losses and provide better services.

Advantages of the present invention:

1. Better complete the application without modifying the protocol;

2. According to the network conditions, the number and interval of retransmissions can be flexibly configured to reduce the additional load on the network.

3. Not limited to one kind of service provision, applicable to all AAA systems based on RADIUS protocol.

Description of drawings:

FIG. 1 is a flowchart of an embodiment of a method for processing RADIUS data packets at a NAS end of the present invention.

The specific embodiment A kind of RADIUS protocol data packet that the present invention proposes and the retransmission and abandoning method combine embodiment and accompanying drawing to describe in detail as follows:

This implementation case runs on the streaming media service system, and the specific configuration is as follows:

NAS server configuration:

CPU: Intel PIII 1GHz

Memory: 128M

Operating system: RedHat 8.0Linux Server

Streaming server: LSMP Streaming Server

Authentication server configuration:

CPU: Intel PIII 966MHz

Memory: 256M

Operating system: RedHat 8.0Linux Server

Accounting server configuration:

CPU: Intel PIII 966MHz

Memory: 256M

Operating system: RedHat 8.0 Linux Server

In this embodiment, the normal response time T _normal ≈50 milliseconds of each data packet, and the maximum response time T _max ≈50 seconds. Set the response time thresholds of RADIUS authentication packets, accounting start packets, accounting update packets, and accounting end packets to 60 seconds for T _{authentication packets} , 100 seconds for T _{accounting start packets} , and T _{count Fee update package} is 60 seconds, T _{accounting end} package is 60 seconds, and the number of retransmissions N _{authentication package} is 5 times, N _{accounting start package} is 1 time, N _{accounting update package} is 3 times, N _{accounting end package} 6 times;

In this embodiment, the RADIUS server processes the RADIUS packets completely according to the RADIUS protocol; the non-expected packets and unsuccessful billing packets are simply discarded;

The specific process is shown in Figure 1, including the following steps:

1. Send an authentication packet from the NAS to the RADIUS server, and wait for the response packet;

a) If the authentication success packet is received within 60 seconds, continue; if the authentication rejection packet is received, the service provision fails;

b) If no response packet is received within 60 seconds, the authentication packet will be resent;

c) repeat the above b) process 5 times;

d) If it exceeds 5 times, the user access will be rejected, and the service will fail to be provided;

2. If the authentication is passed, send an accounting start packet from the NAS to the RADIUS server, and wait for the response packet;

a) Continue the service if the response packet is received within 100 seconds;

b) If the response packet is not received within 100 seconds, the user access is rejected;

c) sending an accounting end packet;

d) Failure to provide this service, rejecting user access;

3. When the service status changes, send an accounting update packet from the NAS to the RADIUS server, and wait for the response packet;

a) Continue the service if the response packet is received within 60 seconds;

b) If the response packet is not received within 60 seconds, the charging update packet will be resent;

c) repeat the above b) process 3 times;

d) Continue to serve more than 3 times;

4. When the service needs to be stopped, send the accounting end packet from the RADIUS server on the NAS side, and wait for the response packet;

a) Continue the service if the response packet is received within 60 seconds;

b) If the response packet is not received within 60 seconds, the charging update packet will be resent;

c) repeat the above b) process 6 times;

d) Stop this service.

The method of the present invention and the method of not adopting retransmission and abandoning the pressure test are carried out, and the results are as follows:

1. The NAS sends 1000 service requests without time interval, and sends authentication and accounting packets to the RADIUS server:

Abandon without resend: successful and correct authentication and accounting: 890; incorrect authentication and accounting discarded: 13; accounting failure: 97;

After giving up using resend: authentication and accounting is successful and correct: 989; authentication and accounting is incorrect and discarded: 11; accounting failure: 0;

2. NAS sends authentication and accounting data packets at an average speed of 300 data packets per second, accumulatively 400,000 service requests:

Abandon without resend: authentication and accounting successful and correct: 210601;

After using resend to give up: authentication and accounting are successful and correct: 399967.

Claims (3)

1, a kind of repeating transmission of remote customer dialing authentication service agreement packet with abandon method, may further comprise the steps:

At first the network access server end sends authentication data packet to remote customer dialing authentication service agreement server, waits to be certified passing through;

The network access server end sends to charge to remote customer dialing authentication service agreement server and begins bag, wait acknowledge;

The network access server end provides streaming media service to the user, and sends the charging update package to remote customer dialing authentication service agreement server when service state changes;

Service finishes the network access server end and sends the charging end packet to remote customer dialing authentication service agreement server;

Above-mentioned steps medium-long range subscriber dialing authentication service protocol server carries out according to remote customer dialing authentication service agreement regulation fully to the processing of remote customer dialing authentication service agreement packet; The packet of non-expectation and the unsuccessful packet that charges are simply abandoned;

It is characterized in that, set the authentication data packet of remote customer dialing authentication service agreement, charge beginning packet, charge more new data packets and charging end data packet response time threshold values T separately, and retransmit times N; When response time greater than T, the network access server end abandons then waiting for that this sends replying of packet, and retransmits, and surpasses N time and then abandons this packet when retransmitting; For described authentication data packet and charging end data packet, the network access server end is abandoned this packet and is then stopped or refusing to provide service; Begin packet for described charging, the network access server end is abandoned still need sending charging end data packet behind this packet; For described charging new data packets more, the network access server end is abandoned this packet not to be influenced and continues service.

2, the repeating transmission of remote customer dialing authentication service agreement packet as claimed in claim 1 with abandon method, it is characterized in that, set N _{Charging begins bag}=1, the N value of other packet is N _{The charging end packet}〉=N _{The authentication bag}〉=N _{The charging update package}〉=N _{Charging begins bag}

3, the repeating transmission of remote customer dialing authentication service agreement packet as claimed in claim 1 with abandon method, it is characterized in that described T span is T _Normal＜T≤2T _Max, T _NormalBe the normal response time of concrete service, T _MaxMaximum response time for concrete service.

Images