CN1416241A - Authentication method for supporting network switching in based on different devices at same time - Google Patents

Abstract

The invention relates to a method for simultaneously supporting network access authentication based on different devices. The method is: in a network adopting the authentication method based on the access point device, the authentication message based on the authentication method of the access control device is transmitted between the user and the access control device through an uncontrolled port of the access point device , to authenticate the user to access the network; and after the user passes the authentication, open the controlled port of the access point device. The present invention realizes that in the process of network access, the user can choose the authentication method based on the access point device, such as 802.1x authentication, etc.; also can choose the authentication method based on the access control device, such as the WEB authentication method; so that the user The authentication method can be dynamically and freely selected according to the needs, which is convenient for users to access the network in many public places.

Description

At the same time, it supports the method of network access authentication based on different devices

technical field

The invention relates to the technical field of network communication, in particular to a method for simultaneously supporting network access authentication based on different devices.

Background technique

The currently commonly used Ethernet networking method is shown in Figure 1. One LANSwitch (Ethernet switch) can be connected to multiple PCs (computers), and the LANSwitch is connected to the access control device through an Ethernet line. For wireless local area network technology, the wireless network card of the computer is connected to the wireless access point, and one access point can be connected to multiple computers, and the wireless access point is connected to the access control device through an Ethernet line. The access control device may be a LANSwitch or a router with user management functions, or an Ethernet user access management device with similar functions.

In the actual networking, the PC can be directly connected to the access point device, or can be connected to the access point device through the HUB (network hub), LanSwitch and other devices under the access point device. The VDSL Switch (VDSL switch) is connected, and the packets in the Ethernet format are transmitted in the VDSL line. In a wireless local area network, wireless Ethernet protocols such as 802.11, 802.11a, 802.11b, 802.11g, etc. can be used, but not limited to, to connect PCs and access points. At the same time, a RADIUS authentication server needs to be placed in the network to authenticate the legality of user identities, realize network access control, and facilitate network operators to manage network access users.

At present, network access control methods adopted by network operators include WEB authentication, 802.1x authentication and other widely used authentication methods. 802.1x, namely IEEE 802.1x, is a port-based access control protocol and an authentication protocol based on Ethernet technology. At present, 802.1x, with its protocol security and simple implementation, together with other authentication protocols, provides broadband access methods such as ADSL (Asymmetric Digital Subscriber Line), VDSL (Very High Speed Digital Subscriber Line), and LAN (Local Area Network). The user provides a new authentication method; 802.1x authentication is usually implemented on the device closest to the user, so 802.1x authentication is to implement the access authentication process on the access point device, such as LANSwitch (Ethernet switch) and wireless access entry point). Another widely used WEB authentication method is usually implemented on an Ethernet access control device. When a user performs WEB authentication, an authentication message needs to be sent to the access control device via the access point device for authentication.

However, due to the 802.1x protocol, the only uncontrolled port on the access point device that is mainly used to transmit EAPOL (Extensible Authentication Protocol on LAN) authentication packets is always in a bidirectional connection state, ensuring that the client can always send or receive Authentication; while other messages are transmitted through the controlled port of the access point device, but the controlled port is in a blocked state when it is not authorized, and cannot transmit messages. Service packets can be delivered only after the 802.1x authentication is passed and the authorized controlled port is opened.

Therefore, when the user needs to use the WEB authentication method, or use the 802.1x authentication method to authenticate and open the uncontrolled port of the access point, or configure the uncontrolled port for the user on the access point, so that the user can perform WEB authentication. Authentication, otherwise, the user cannot dynamically choose the authentication method freely, but can only use a certain authentication method to access the network, which limits the user's authentication options.

In many public places, even if a user only uses one authentication method, the network cannot obtain user information before the user accesses the network, so the corresponding authentication method cannot be configured for the user in advance. This will inevitably restrict the normal access of some users who do not use the default authentication method of the network to access the network, which brings inconvenience to the normal use of the network by users.

Therefore, the existing technology cannot meet the requirement that the user wishes to arbitrarily select one of multiple authentication methods for network access authentication.

Contents of the invention

The purpose of the present invention is to provide a method that supports network access authentication based on different devices at the same time, so that the user can choose the authentication method based on the access point device or the authentication method based on the access control device when accessing the network. way to access the network.

The object of the present invention is achieved by: simultaneously supporting the method for network access authentication based on different devices, characterized in that: in a network using the authentication method based on the access point device, the authentication method based on the authentication method of the access control device The message is transmitted between the user and the access control device through the uncontrolled port of the access point device to authenticate the user's access to the network; and after the user passes the authentication, the controlled port of the access point device is opened.

Before the authentication of the user, it also includes: assigning an IP address to the user through the DHCP process.

When the authentication method based on the access control device is the WEB (World Wide Web) authentication method, the authentication message includes: a message based on DHCP (Dynamic Host Configuration Protocol) and a message based on HTTP (Hypertext Transfer Protocol) message, and DNS (Domain Name Service) message.

When the authentication method based on the access point device is the 802.1x authentication method, the specific authentication process includes:

a. The user sends an authentication start message to the access point device, and sends the user's identity information to the access point device according to the user identity request message sent by the access point device;

b. The access point device sends the user's identity information to the authentication server, and the authentication server generates a CHALLENGE (challenge code) for it and returns it to the access point device;

c. The access point device sends the CHALLENGE to the user, and the user encrypts it with the MD5 encryption algorithm, and the encrypted CHALLENGE is sent to the authentication server through the access point device;

d. The authentication server receives the encrypted CHALLENGE and authenticates it;

e. Send the authentication result to the user through the access point device.

For the user who has been assigned an IP address through the DHCP process before authentication, the step e further includes: for the user who has passed the authentication, if the IP address needs to be changed, then re-allocate a new IP address to it through the DHCP process.

The described authentication process on the access control device includes:

f. The user sends the HTTP request message to the access control device through the uncontrolled port of the access point device, and forces it to the Portal server;

g. The identity authentication information of the user obtained by the Portal server, and the CHALLENGE generated by the access control device for the user;

h. The Portal server encrypts the CHALLENGE with the MD5 encryption algorithm and sends it to the access control device together with the user identity;

i. The access control device sends the above information to the RADIUS authentication server for user authentication;

g. Send the authentication result to the access control device through the Portal server, and notify the access point device to open the controlled port corresponding to the user for the user who passes the authentication.

The step f further includes: the user transmits a DHCP message between the user and the access control device through the uncontrolled port of the access point device, so as to assign an IP address to the user.

The step g further includes: for the authenticated user, if a new IP address needs to be assigned to the user, re-assigning the IP address through the DHCP process.

It can be seen from the above technical solution that the present invention realizes that in the process of network access, the user can choose the authentication method based on the access point device, such as 802.1x authentication, etc.; or the authentication method based on the access control device, Such as WEB authentication method, etc. Multiple authentication methods based on different devices are supported at the same time, so that users can dynamically and freely choose authentication methods according to their needs, so that when users access the network in many public places, they do not need to configure corresponding authentication methods in advance, which facilitates user access. network, improving the service quality of network operators.

Description of drawings

Fig. 1 is the network environment schematic diagram of application of the present invention;

Fig. 2 is the specific implementation flowchart of WEB authentication described in the present invention;

FIG. 3 is a flow chart of the specific implementation of 802.1x authentication described in the present invention.

Detailed ways

The current LAN networking structure is shown in FIG. 1 . A PC (personal computer) accesses the network through an access point (AP) device, and the access point device is connected to an access control device. The realization of the present invention enables the user not only to use the authentication process based on the access point device for identity authentication, such as 802.1x authentication, but also to use the authentication process based on the access control device for identity authentication, such as WEB authentication.

Concrete implementation process of the present invention is as shown in Figure 2 and Figure 3:

Step 1: The user obtains the corresponding IP address from the access control device through a standard DHCP (Dynamic Host Configuration Protocol) process. At this time, the access point device allows the DHCP protocol to flow away from the uncontrolled port, so the DHCP protocol flow can pass through the access point device;

If the user configures the IP address manually, omit step 1;

After the user obtains the corresponding IP address, he can choose the authentication method according to his needs, that is, the authentication method based on the access point device or the authentication method based on the access control device. If the user chooses the authentication method based on the access control device In the WEB authentication mode, you can perform steps 2 to 14 to authenticate users accessing the network, as shown in Figure 2:

Step 2: The user selects WEB authentication. At this time, the user opens IE and visits a certain website. The user initiates an HTTP (Hypertext Transfer Protocol) request by sending an "HTTP Request user-url" message to the access control device;

The access point device allows WEB-authenticated HTTP/HTTPs to flow through uncontrolled ports, so the HTTP/HTTPs flow can pass through the access point device; if mandatory Portal (entry) is allowed, the user may access the website from any IP address at this time. Therefore, all HTTP/HTTPs streams should be allowed to pass through at this time; if forced Portal is not allowed, only HTTP/HTTPs streams to the specified Portal server for WEB authentication are allowed to pass through the access point device; in particular, before the HTTP request, there may be There is DNS (Domain Name Service) message interaction. At this time, the specified or arbitrary URL (Uniform Resource Locator, which is what we often call WWW URL) DNS requests should be allowed to pass;

Step 3: The access control device intercepts the user's HTTP request, and since the user has not been authenticated, it is forced to the Portal server, that is, sends an "HTTP Requestportal-url" message to the mandatory Portal server, requesting the corresponding authentication WEB page;

Step 4: The Portal server pushes the WEB authentication page to the user terminal by sending the "HTTP Responseportal-url" message according to the received message;

Step 5: The user fills in the user name, password and other information on the WEB authentication page and submits it to the Portal server, that is, the user sends an "HTTPs POST portal-url" message to the Portal server, and the message carries the username username and password pwd;

Step 6: After receiving user information, the Portal server must request Challenge from the access control device according to the CHAP (Challenge Handshake Authentication Protocol) process;

Step 7: The access control device generates a Challenge for the user, including ChallengeID (challenge code identification) and Challenge, and returns it to the user;

Step 8: The Porta server submits the password, Challenge ID and Challenge-Password (challenge code password) after the MD5 algorithm, together with the user name, to the access control device through the "REQAUTH" message, and initiates the authentication process;

Step 9: the access control device sends user information such as Challenge ID (i.e. chaID), Challenge, Challenge-Password (i.e. Pwd) and user name (i.e. usemame) to the RADIUS (remote) authentication server through an "Access-Request" message, Authenticated by the RADIUS authentication server;

Step 10: The RADIUS authentication server judges whether the user is legal according to the above user information, and then sends the authentication success/failure "Access-Accept/Access-Reject" message to the access control device; if successful, it carries the negotiation parameters and the user's relevant information. Business attributes authorize users;

Step 11: The access control device sends the authentication result to the Portal server by sending an "ACK AUTH" message, which also includes relevant service attributes, such as the service opened by the user, the billing status of the user, etc.;

Step 12: The Portal server sends the "HTTP Response portal-url" message to the user according to the authentication result, and pushes the authentication result page;

Step 13: At the same time, the Portal server also responds to the access control device receiving the authentication result message by sending an "AFF ACK AUTH" message;

Step 14: After the user authentication is successful, notify the access point device to open the user's controlled port, and the user can access the corresponding network through the opened controlled port; if the authentication fails, the process ends here, and the user is notified that the network cannot be accessed. access.

For users who are successfully authenticated, the access control device also needs to perform subsequent procedures such as authorization and accounting. Since the IP address has been allocated, the user can directly use the original IP address for network access at this time; if the ISP (Internet Service Provider) requires the user to change the IP address after the authentication is successful, the user obtains the IP address through the DHCP process again.

If the user selects the 802.1x authentication method based on the access point device, the authentication of the user's access to the network can be performed by performing steps 15 to 25, as shown in Figure 3:

Step 15: The user selects 802.1x authentication. Taking EAP-MD5 (Extensible Authentication Protocol based on MD5) as an example, the user sends an "EAPoL-Start" message to the access point device to start the 802.1x access authentication process;

Step 16: The access point device sends an "EAP-Request/Identity" (identity request) message to the user, requesting the user to send the username;

Step 17: After receiving the identity request message, the user responds with an "EAP-Response/Identity" message to the access point device, and sends the user's username to the access point device;

Step 18: The access point device sends an "Access-Request" (access request) message to the RADIUS authentication server in the message format of EAP Over RADIUS (EAP based on RADIUS protocol). Point the device's EAP-Message (EAP authentication information), "EAP-Response/Identity" (EAP authentication identity response) message, and submit the user name to the RADIUS authentication server;

Step 19: The access point device generates a 128bit Challenge for the user, and the RADIUS authentication server responds to the access point device with an "Access-Challenge" (access challenge code) message, including EAP-Message and "EAP-Request/ MD5-Challenge" message, "EAP-Request/MD5-Challenge" message needs to be sent to the Challenge corresponding to the user in the access point device;

Step 20: The access point device sends an "EAP-Request/MD5-Challenge" message to the user, requesting the user to process the Challenge using the MD5 algorithm;

Step 21: After receiving the "EAP-Request/MD5-Challenge" message, the user performs MD5 algorithm on the Challenge to generate a Challenge-Password (challenge code password), and sends it to the "EAP-Response/MD5-Challenge" message. sent to the access point device;

Step 22: The access point device sends the Challenge-Password, EAP-Message and EAP-Response to the RADIUS authentication server through the "Access-Request" message, and the RADIUS authentication server authenticates the user, and the RADIUS authentication server judges based on the user information Whether the user can be authenticated;

Step 23: The RADIUS authentication server sends an authentication success or authentication failure message to the access point device; if the user authentication is successful, the message carries negotiation parameters, such as authorization information, and user-related service attributes, such as prepaid information, subscription business, etc.;

If the authentication is successful, it is also necessary to notify the access point device to open the controlled port, and the user can perform corresponding network access through the opened controlled port;

Step 24: The access point device sends an "EAP-Success/EAP-Failure" (authentication success or authentication failure) message to the user according to the authentication result to notify the user of the authentication result; if the authentication fails, the process ends;

Step 25: Since the IP address has been allocated, the user can directly use the original IP address for network access at this time;

If the ISP (Internet Service Provider) requires the user to change the IP address after the authentication is successful, the user will obtain the IP address through the DHCP process again;

After the user obtains the corresponding IP address and accesses the network, subsequent procedures such as authorization and billing are required.

Because the 802.1x authentication information on the access point device passes through the access control device, the access control device can listen to the authentication information initiated by the access point device, such as RADIUS protocol packets, and obtain user authentication information from it. Manage and control users on the control device.

Claims (8)

1, a kind of method of supporting simultaneously based on the distinct device network access authentication, it is characterized in that: in the network of employing based on the authentication mode of access point apparatus, to transmit between user and access control equipment through the uncontrolled port of access point apparatus based on the message identifying of the authentication mode of access control equipment, carry out the authentication of user access network; And the user opens the controlled ports of access point apparatus by after authenticating.

2, the method for supporting simultaneously based on the distinct device network access authentication according to claim 1 is characterized in that the user also comprises before authenticating: be user's distributing IP (the Internet) address by dhcp process.

3, the method for supporting simultaneously based on the distinct device network access authentication according to claim 1, when it is characterized in that described authentication mode based on access control equipment is WEB (World Wide Web) authentication mode, described message identifying comprises: based on the message of DHCP (DHCP) with based on the message of HTTP (HTML (Hypertext Markup Language)), and DNS (domain name service) message.

4, the method for supporting simultaneously based on the distinct device network access authentication according to claim 1 and 2, when it is characterized in that described authentication mode based on access point apparatus is the 802.1x authentication mode, concrete verification process comprises:

A, user send authentication beginning message to access point apparatus, and the user identity request message of sending according to access point apparatus, and user's identity information is sent to access point apparatus;

B, access point apparatus send to certificate server with user's identity information, and return to access point apparatus by certificate server for it generates a CHALLENGE (challenge code);

C, access point apparatus send to the user with this CHALLENGE, adopt the md5 encryption algorithm that it is encrypted by the user, and the CHALLENGE after the encryption sends to certificate server by access point apparatus;

D, certificate server receive the CHALLENGE after encrypting, and it is authenticated;

E, authentication result is sent to the user by access point apparatus.

5, the method for supporting simultaneously based on the distinct device network access authentication according to claim 4, it is characterized in that for having distributed the IP address user by dhcp process before the authentication, described step e also comprises: the user who passes through for authentication, change the IP address if desired, then distribute new IP address by dhcp process for it again.

6, the method for supporting simultaneously based on the distinct device network access authentication according to claim 1 and 2 is characterized in that described its verification process in access control equipment comprises:

F, user send to access control equipment with the uncontrolled port of HTTP request message by access point apparatus, and are forced to Portal server;

The user's that g, Portal server obtain authentication information, and by the CHALLENGE of access control equipment for this user's generation;

H, Portal server send to access control equipment with user identity after CHALLENGE is utilized the md5 encryption algorithm for encryption;

I, access control equipment send to the RADIUS authentication server with above-mentioned information and carry out authentification of user;

G, authentication result is sent to access control equipment by Portal server, for the user that authentication is passed through, the notice access point apparatus is opened the controlled ports of this user's correspondence.

7, the method for supporting simultaneously based on the distinct device network access authentication according to claim 6, it is characterized in that described step f also comprises: the user carries out the transmission of DHCP message by the uncontrolled port of access point apparatus between user and access control equipment, thinks user's distributing IP address.

8, the method for supporting simultaneously based on the distinct device network access authentication according to claim 7, it is characterized in that described step g also comprises: the user who passes through for authentication, if desired for it distributes new IP address, be its distributing IP address again then by dhcp process.

Images