CN1315285C - Method for Authentication Server to Detect Abnormal Restart of Access Device - Google Patents

Abstract

The present invention discloses a method for detecting the restarting of access equipment by an authentication server due to exception. In the method, the starting mark of access equipment is added in an authentication request message transmitted by an authentication server; the starting mark saved by the access equipment on the authentication server is compared with the starting mark in the authentication request message, if the starting marks are the same, the access equipment is normal, and a request user is authenticated; otherwise, the access equipment is restarted after confirmed to have an exception, users relevant to the access equipment are repositioned, the starting mark in the authentication request message is used for updating the starting mark saved on the authentication server, and then the request user is authenticated.

Description

Method for Authentication Server to Detect Abnormal Restart of Access Device

technical field

The invention relates to an access device in a communication network, in particular to a method for detecting the activation of the access device.

Background technique

With the development of network technology, the Internet network is getting bigger and bigger, and there are more and more users. Most of the users connect to the access device through various access methods, and the users can really access the Internet only after being authenticated and authorized by the authentication, authentication, and accounting server (AAA server). The access device and the AAA server also retain the online status information of the user, which is used for billing the user. When the device restarts abnormally, all the status information of the user on the access device is lost, but the AAA server does not know the status of the device, and still saves the online information of these users, resulting in the AAA server and the user on the access device Inconsistent state. After the device is started, when the user uses the network again, since the access device does not have the user's information, the user's identity needs to be verified by the AAA server. However, the AAA server thinks that the user is still online, and generally (except in the case of multiple uses of one card) will refuse the user's login. It can be seen that if the device is abnormal and restarts, because the AAA server does not know the situation, a large number of users with legal identities will not be able to access the Internet, which will cause user complaints.

The processing to the above-mentioned problem in the prior art mainly contains the following two schemes:

Technical solution 1: The AAA server does not perform any detection of abnormal conditions of the access device. When the device restarts abnormally, it will notify the network administrator after detection by the network management, and the network administrator will notify the administrator of the AAA server. The AAA server management The administrator then handles the users accessing from the device according to the abnormal device. This approach has the following disadvantages:

1. There are many processing links and the response is very slow. It is likely that the network administrator has received a large number of complaints before notifying the administrator of the AAA server.

2. The operation is troublesome and error-prone. The network administrator needs to carefully check the abnormal access device and the AAA server corresponding to the device, and then notify the corresponding AAA server administrator; the AAA server administrator needs to reset the corresponding user according to the access device. Once a problem occurs in a certain link and some normal users are reset by mistake, it will cause losses to the operator.

3. The maintenance workload is heavy and the cost is high. This solution additionally increases the workload of the system administrator, especially handling a large number of complaints will greatly increase the cost of the operator.

Technical solution 2: When the access device restarts abnormally, it sends a start message to the AAA server to notify the AAA server that the device has an abnormality. After receiving the message, the AAA server will send a response message to the access device, and at the same time consider that the device is abnormal, and reset the user related to the user. If the access device receives the start response message, it enters the normal state. Otherwise, it will resend the start message if it does not receive the response message for a period of time. If it has not received it after resending several times, it will not send it again. Although this solution can actively report to the AAA server when the access device restarts abnormally, it has the following disadvantages:

1. The implementation configuration is complicated and the cost is high. Because packets need to be sent and a retransmission mechanism needs to be implemented, the device needs to maintain the session state, and also needs to wait for response timeout, retransmission times and other configurations, which increases the cost of development, testing and maintenance. In some Layer 3 switches, this function is almost impossible to realize due to the performance limitation of the processing chip.

2. The reliability is not high. Because when the startup message is lost, the AAA server will not be able to obtain the abnormality information of the device. Although the message has a retransmission mechanism, it is not guaranteed that the AAA server will receive it. At the same time, before the device receives the startup response message, if a user logs in, the user may be denied access or reset by the AAA server after access.

Contents of the invention

The purpose of the present invention is to provide a method for an authentication server to detect an abnormal restart of an access device, so as to solve the problem of complex and unreliable detection of an abnormal restart of the access device in the prior art.

Realize the technical scheme of the present invention:

A method for an authentication server to detect an abnormal restart of an access device, wherein a user terminal is connected to a network through the access device, and the authentication server performs access authentication for the user terminal; the method includes the steps of:

A. Add the activation identifier of the access device in the authentication request message sent to the authentication server;

B. Compare the startup identifier saved by the access device on the authentication server with the startup identifier in the authentication request message, if they are the same, confirm that the access device is normal, and proceed to step D; otherwise, confirm that the access device is an occurrence Restart after exception, go to step C;

C. At least perform reset processing on the relevant users of the access device, and update the activation identifier stored on the authentication server with the activation identifier in the authentication request message;

D. Perform authentication processing on the requesting user.

in:

The startup identifier is the startup time of the access device; when the access device is started, the current system time of the device is obtained as the startup identifier and saved.

The activation identifier is a random number generated when the access device is activated.

The present invention has the following beneficial effects:

1. High reliability. Since each authentication request packet includes the start time of the access device, the AAA server can obtain the restart information of the access device as long as it receives a packet.

2. Timely response. The AAA server can obtain the restart information of the device after receiving the first authentication packet after restart, that is, the one that needs the service first will get the response first.

3. Simple implementation. The access device only needs to record the startup time, and does not need to consider the packet retransmission mechanism; the AAA server does not need to process additional packets.

Description of drawings

Figure 1 is a schematic diagram of logical networking;

Fig. 2 is a billing flowchart in the prior art;

Fig. 3 is a flowchart of the present invention.

Detailed ways

Referring to Figure 1, the user terminal accesses the network through an access device, and the access device, AAA server, and network management are connected through an IP backbone network. The access device communicates with the AAA server through the Radius protocol to implement user authentication and accounting.

Referring to shown in Figure 2, the general message flow of the Radius protocol is as follows (taking the narrowband dial-up user as an example):

1. The user enters the user name and password on the dial-up software, and then dials;

2. The user terminal establishes a connection with the access device through the PPP protocol;

3. The access device sends an authentication request (Access-Request) to the AAA server;

4. The AAA server authenticates the user;

4.1. If the authentication fails, the AAA server sends an authentication rejection response (Access-Reject) to the access device;

4.2. If the authentication is passed, the AAA server sends an authentication acceptance response (Access-Accept) to the access device;

5. After passing the authentication, the access device sends an accounting start message (Acct-Start-Request) to the AAA server;

6. After the AAA server performs accounting processing, it sends an accounting response (Acct-Update-Response) to the access device;

7. During the process of the user surfing the Internet, the access device regularly sends an accounting update message (Acct-Update-Request) to the AAA server;

8. The AAA server sends an accounting response (Acct-Update-Response) to the access device after accounting processing;

9. When the user clicks to disconnect on the dial-up software, the dial-up software sends PPPDisconnect to the access device;

10. The access device sends an accounting stop message (Acct-Stop-Request) to the AAA server;

11. The AAA server sends an accounting response (Acct-Stop-Response) to the access device after accounting processing;

The Radius protocol is an extensible protocol, which can add attributes and packets arbitrarily without affecting the original functions.

By extending the Radius protocol, the present invention adds an access device startup timestamp attribute to the authentication request message, and fills in the access device startup identifier in the timestamp attribute.

When the access device is started, it obtains the system time of the device at that time and saves it in the memory as the device's startup identifier, and fills the time in the device startup timestamp attribute in each subsequent authentication request message.

It is also possible to generate a random number when the access device is started and store it in the memory as the device's startup identifier, and fill in the random number in the device startup time stamp attribute in each subsequent authentication request message.

The AAA server first records the timestamp when it receives the authentication request message from the access device, and then compares each authentication request message received from the device with the saved timestamp to determine whether the access device is abnormal. restart. The AAA server distinguishes different access devices according to the IP address, and the startup time of the device corresponds to the corresponding device IP.

Referring to Fig. 3, taking the start-up time of the access device as the start-up mark as an example, the specific processing procedure of the present invention is described as follows:

Step 10: The user initiates an access request by entering a username and password;

Step 20: The access device fills in its startup time in the timestamp attribute of the authentication request message, and sends it to the AAA server;

Step 30: After receiving the authentication request message, the AAA service obtains the saved startup time of the access device according to the IP address of the access device, and compares the startup time with the startup time filled in the timestamp attribute of the access device, If the two startup times are the same, confirm that the access device is normal, and proceed to step D; otherwise, confirm that the access device restarts after an exception occurs, and proceed to step 40;

Step 40: Perform operations on the relevant user of the access device, such as reset processing, and update the startup time saved on the authentication server with the startup time in the timestamp attribute of the authentication request message;

Step 50: Process the authentication request according to the normal flow.

After the access device is abnormally restarted, the user needs to access the Internet by first initiating an access request, so it can ensure that the AAA server can detect the situation of the access device in time and deal with it accordingly, so as to avoid the situation that the user is legal but cannot access Network situation arises. Of course, if no authentication request is received, the AAA server does not need to obtain the information of restarting the device, because no user can access the Internet.

Claims (4)

1. A method for an authentication server to detect an abnormal restart of an access device, wherein the user terminal is connected to the network through the access device, and the authentication server performs access authentication for the user terminal; it is characterized in that the method includes the steps: A. Add the activation identifier of the access device in the authentication request message sent to the authentication server; B. Compare the startup identifier saved by the access device on the authentication server with the startup identifier in the authentication request message, if they are the same, confirm that the access device is normal, and proceed to step D; otherwise, confirm that the access device is an occurrence Restart after exception, go to step C; C. At least perform reset processing on the relevant users of the access device, and update the activation identifier stored on the authentication server with the activation identifier in the authentication request message; D. Perform authentication processing on the requesting user. 2. The method according to claim 1, wherein the activation identifier is the activation time of the access device. 3. The method according to claim 2, wherein when the access device is started, the current system time of the device is obtained as a start identifier and stored. 4. The method according to claim 1, wherein the activation identifier is a random number generated when the access device is activated.

Images