CN1309213C - Network access anthentication method for improving network management performance - Google Patents

Abstract

The invention relates to a network access authentication method for improving network management performance. The method is as follows: the network access device automatically determines the user account and the corresponding password according to the physical location information of the user access, and replaces the user according to the determined account and password. Initiate the authentication process to the authenticator to authenticate the user. Therefore, the implementation of the present invention can make the user not need to participate in the authentication process, that is, the user does not need to input the user name and password, and does not need the user to use the auxiliary client authentication terminal, and also incorporates these users into the category of manageable users, thereby facilitating Identity authentication of servers, dumb terminals, and users who do not limit network usage rights, and at the same time facilitates the management of network access users by network operators.

Description

Network Access Authentication Method for Improving Network Management Performance

technical field

The invention relates to the technical field of network communication, in particular to a network access authentication method for improving network management performance.

Background technique

With the development of broadband network technology, network operators provide increasingly diversified services through the network. In order to ensure their operating interests, network operators usually need to control the network usage rights of users accessing the network, that is, requiring access to the network Users must pass identity authentication before they can use the network normally and obtain various services provided by network operators.

Currently adopted authentication methods mainly include WEB (World Wide Web) authentication method, 802.1 authentication method and so on. Among them, the user identity authentication technology based on WEB portal pages is adopted by more and more network operators, and gradually becomes the main authentication method in broadband access. WEB authentication is a browser-based authentication method. In the WEB authentication method, a user submits user identity information (user account number and password) through a web browser for identity authentication.

Taking WEB authentication as an example, the user first obtains an IP address through the DHCP (Dynamic Host Configuration Protocol) process. At this time, the user has only limited network usage rights and can access some limited sites, such as PORTAL SERVER (portal server) and some advertising pages etc.; then, the user can access the PORTAL SERVER through a browser, and enter the user account (ie user name) and password on the portal webpage for identity authentication to obtain greater network usage rights. After the user has passed the identity authentication, PORTAL SERVER will send a page to the user, prompting the user for information such as online time, sending and receiving bytes, and the user has also obtained the corresponding permissions.

Other authentication methods also have similar characteristics to WEB authentication, requiring users to perform manual operations, input user account and password on WEB pages or other auxiliary clients, and initiate the authentication process on their own initiative.

However, in the actual network environment, there are still some special users accessing the network, including servers, dumb terminals, and privileged users. Among them, the server usually has certain access/access rights by default, and the server should not need human intervention during the restart process; while the dumb terminal itself has only limited processing capabilities, although it can obtain an IP address through the DHCP protocol , but does not support initiating the authentication process through browsers or other terminal software; privileged users refer to certain users in specific physical locations, who have access to some or all of the network without initiating the authentication process after obtaining the IP address authority.

It can be seen from the above description that authentication methods such as WEB authentication cannot be applied to special users such as servers, dumb terminals, and privileged users. However, if these special users are not authenticated and authorized to access the network, these users cannot be effectively controlled and managed, which reduces the manageability and maintainability of the network. The ideas of network manageability and maintainability go against each other.

Contents of the invention

The purpose of the present invention is to provide a network access authentication method that improves network management performance, so as to facilitate identity authentication for servers, dumb terminals and privileged users, thereby improving network management performance.

The purpose of the present invention is achieved like this:

A network access authentication method for improving network management performance includes:

The network access device determines the user accessing the network, and obtains the access information of the accessing user;

Determine the user's account and password according to the obtained user's access information;

The network access device initiates an authentication process for the user according to the user's account number and password, and controls the user's authority according to the authentication result.

The network access authentication method for improving network management performance also includes:

Configure in the network access device the user information of the user who needs to be replaced by the network access device to initiate the authentication process, and the user information includes: the user's access port information, VLANID (virtual local area network identification);

Configure rules for generating corresponding user accounts and passwords based on user access information on the network access device.

The network access device determining the user accessing the network, and obtaining the access information of the accessing user further includes:

After the user accesses the network, the IP (Internet Protocol) address is obtained through the DHCP (Dynamic Host Configuration Protocol) process or manual configuration;

Determine that the user is replaced by the network access device as the user who initiates the authentication process;

The network access device obtains the access information of the access user.

The acquisition of the access information of the access user is: the network access device obtains the access information of the access user according to the physical location information of the access user.

The access information is: one or more of the access user's slot, access port, access VLAN ID, MAC (Media Access Control) address, IP address, and user identification information carried in the user message.

The said determination of the user's account number and password according to the obtained user's access information includes:

In the network access device, generate the user's account according to the user's access information and the rules for generating user accounts configured in the network access device;

Search and determine the user password corresponding to the user account in the network access device according to the generated user account.

The said determining the user's account number and password according to the obtained user's access information includes: in the network access device, automatically generating according to the user's access information and the rules for generating the user account and password configured in the network access device The user's account and password.

The network access device initiates an authentication process for the user according to the user's account number and password, and controlling the user's authority according to the authentication result further includes:

The network access device requests authentication from the authentication terminal according to the account number and password of the user in the pre-connection state, that is, the unauthenticated network access user. If the authentication is passed, the user obtains the specified network use authority, otherwise, the user connects The status remains in the pre-connected state, and the user cannot use the network normally.

The authentication terminal is: a local authentication terminal or a RADIUS (remote) authentication server.

The network access authentication method for improving network management performance further includes: the network access device periodically initiates an authentication process automatically according to the user account and password of the user in the pre-connection state.

It can be seen from the above technical solution that the method provided by the present invention enables the network access device to automatically generate a user account according to the physical location information of the user access and obtain the corresponding password according to the configuration, and then initiate the authentication process. The entire authentication process is controlled by The network access device completes instead of the user, without the user's participation. In this way, manual authentication is not required for servers, dumb terminals, and privileged users, but these users are also included in the category of manageable users, which greatly facilitates the authentication of servers, dumb terminals, and privileged users. Authorization and management.

In the method provided by the present invention, whether the network access device initiates the authentication process for the user, and the password required for the network access device to participate in user identity authentication can be flexibly configured through the command line. Network users perform identity authentication to manage access users, thereby improving the manageability and maintainability of network access.

Description of drawings

Fig. 1 is a flowchart of a specific embodiment of the present invention.

Detailed ways

In the present invention, the user does not need to log in to the portal website for authentication, nor does it need to be authenticated through other auxiliary clients. Instead, after the user obtains the IP address, the network access device uses the physical location information of the user to access the network, Including but not limited to slot number, port number, VLANID (virtual local area network identifier), etc. to automatically generate the user account and password of the user, and the network access device replaces the user to initiate authentication to the RADIUS (remote) authentication server or local authentication terminal, etc. process, and perform identity authentication, so as to realize network access authentication for special users such as servers, dumb terminals, and privileged users.

The specific implementation of the network access authentication method for improving network management performance of the present invention is shown in Figure 1, including the following steps:

Step 100: When a user accesses the network, determine that the user accessing the network in the pre-connected state needs to initiate an authentication process through the network access device;

The user in the pre-connection state is: in the network access device, the access user who obtains the IP address through the DHCP process or manual configuration, but has not passed identity authentication; for the user who obtains the IP address and related network parameters through DHCP , because the network access device participates in the user's DHCP process, so when it is found that the user has completed the DHCP process and obtained an IP address, it is determined that the user has connected to the network. If the user has not been authenticated to obtain the corresponding network usage Authorization, the network access device determines that the user is in a pre-connected state at this time; for users with manually configured IP addresses and related network parameters, the network access device needs to detect whether the configured user is connected to the network, When it is detected that the user has already connected to the network, if the user has not passed the authentication and obtained the corresponding network usage authority, then the user's state is set to the pre-connection state;

Usually, in the network, there are not only users who need to enter the user account and password by themselves and initiate the authentication process, but also special users such as servers, dumb terminals, and privileged users who need to initiate the authentication process through network access devices. Therefore, When a user accesses the network, it is first necessary to determine that the access user is the user who needs to initiate the authentication process through the network access device. If the user is logged in, the original authentication process is still used for authentication;

In order to realize the present invention, it is necessary to pre-configure which users need to be authenticated by the network access device in the network access device, so as to determine whether the user is a member of the network according to the user information of the access user, such as the port accessed or the VLAN to which the user belongs. The user whose access device initiates the authentication process.

Step 101: The network access device determines the access information of the user according to the physical location information of the user accessing the network. The access information includes but not limited to: the slot of the access user, the access port, and the access VLAN ID , MAC (Media Access Control) address, IP address, and identification information carried by user packets, etc.;

The content of user access information that the network access device needs to obtain is also pre-configured in the network access device. For example, it can be configured to obtain the access port and VLAN ID of the access user, or to obtain the MAC address of the access user.

Step 102: The network access device automatically generates a user account and password corresponding to the user according to the determined access information and according to the set rules for automatically generating user stickers and passwords;

The rules for automatically generating user accounts and passwords are pre-set in the network access device according to needs; user accounts can be generated by configuring a prefix or suffix for the access information according to the rules, or one or more access information can be selected according to the rules Combined generation; the user's password can be generated at the same time as the user's account according to the access information, or it can be configured in the network access device in advance. Each user account that may be generated corresponds to a user password. Index and its corresponding user password.

Step 103: The network access device initiates an authentication process to the authenticator instead of the user, that is, sends an authentication request message to the authenticator, and the message carries the user's account number and password to perform identity authentication of the access user. Users in the pre-connected state obtain corresponding network usage rights;

The authentication end includes a local authentication end, a RADIUS authentication server or other authentication ends.

Step 104: Determine the access user's network usage authority according to the authentication result;

If the authentication is passed, the access user enters the service connection state and obtains the network usage authority configured for it;

If the authentication fails, the access user remains in the pre-connection state. The authentication failure may be due to the fact that the account information corresponding to the user is not configured on the authentication end, or the user password corresponding to the user on the network access device is incorrectly configured. wait.

In the present invention, in order to ensure that after the cause of the authentication failure is eliminated, the user can initiate the authentication process again and pass the identity authentication, the network access device needs to periodically initiate the authentication process for the user in the pre-connection state automatically. If the authentication is not passed, continue to wait for the authentication process initiated by the network access device for the user in the next cycle until the user passes the identity authentication.

It can be seen from the above description of the specific implementation of the present invention that the entire process of authenticating the corresponding access user using the present invention is transparent to the access user, and the user does not need to participate in the authentication process; when the user accesses the network, The network access device will automatically initiate the authentication process instead of the user, that is, after using the authentication method described in the present invention, the user's network usage authority is controlled by the network access device For the access network, the use of the present invention is more convenient for the network operator to manage and control the access users.

Claims (10)

1. A network access authentication method for improving network management performance, characterized in that it comprises: The network access device determines the user accessing the network, and obtains the access information of the accessing user; Determine the user's account and password according to the obtained user's access information; The network access device initiates an authentication process for the user according to the user's account number and password, and controls the user's authority according to the authentication result. 2. The network access authentication method for improving network management performance according to claim 1, characterized in that the method further comprises: Configure the user information of the user who needs to be replaced by the network access device to initiate the authentication process in the network access device, and the user information includes: the user's access port information, virtual local area network identification VLANID; Configure rules for generating corresponding user accounts and passwords based on user access information on the network access device. 3. The network access authentication method for improving network management performance according to claim 1 or 2, characterized in that the network access device determines the user accessing the network, and obtains the access information of the accessing user further include: After the user accesses the network, the IP address is obtained through the DHCP process of the dynamic host configuration protocol or manual configuration; Determine that the user is replaced by the network access device as the user who initiates the authentication process; The network access device obtains the access information of the access user. 4. The network access authentication method for improving network management performance according to claim 1, characterized in that said obtaining the access information of the access user is: the network access device obtains the access information according to the physical location information of the access user its access information. 5. The network access authentication method for improving network management performance according to claim 1 or 4, characterized in that said access information is: access user slot, access port, access VLANID, medium One or more of the access control MAC address, IP address, and user identification information carried by the user message. 6. The network access authentication method for improving network management performance according to claim 1 or 2, characterized in that determining the user's account number and password according to the obtained user's access information includes: In the network access device, generate the user's account according to the user's access information and the rules for generating user accounts configured in the network access device; Search and determine the user password corresponding to the user account in the network access device according to the generated user account. 7. The network access authentication method for improving network management performance according to claim 1, characterized in that determining the user's account number and password according to the obtained user access information includes: in the network access device, Automatically generate the user's account and password according to the user's access information and the rules for generating user account and password configured in the network access device. 8. The network access authentication method for improving network management performance according to claim 1, characterized in that said network access device initiates an authentication process for the user according to the user's account number and password, and performs an authentication process for the user according to the authentication result. The user's permissions are further controlled by: The network access device requests authentication from the authentication terminal according to the account number and password of the user in the pre-connection state, that is, the unauthenticated network access user. If the authentication is passed, the user obtains the specified network use authority, otherwise, the user connects The status remains in the pre-connected state, and the user cannot use the network normally. 9. The network access authentication method for improving network management performance according to claim 8, characterized in that said authentication end is: a local authentication end or a remote RADIUS authentication server. 10. The network access authentication method for improving network management performance according to claim 1 or 8, characterized in that the method further includes: the network access device periodically initiates authentication automatically according to the user account and password of the user in the pre-connection state process.