CN1842000A - Method for realizing access authentication of WLAN - Google Patents

Abstract

The invention discloses a method for realizing wireless local area network access authentication, which mainly includes the following steps: A. A user terminal establishes a physical connection with an authentication point; B. The authentication point obtains the MAC address of the user terminal; C. Passes through the authentication point to The MAC address performs access authentication for the user terminal. The present invention performs access authentication based on the MAC address of the user terminal equipment. For a legal MAC address, the user can access the WLAN network without inputting a user name/password after turning on the machine. For an illegal MAC address, the user is prohibited from accessing the WLAN network. The user accesses the WLAN network, so that the user can access the WLAN network safely and conveniently; in addition, the present invention also solves the access authentication of the WLAN network when some user terminal equipment has no interface to input the user name/password.

Description

Method for Realizing WLAN Access Authentication

technical field

The present invention relates to the technical field of wireless local area network, and more specifically, the present invention relates to a method for access authentication in a wireless local area network.

Background technique

As users have higher and higher requirements for wireless access rate, Wireless Local Area Network (WLAN, Wireless Local Area Network) emerges at the historic moment, which can provide high-speed wireless data access in a small range. Wireless local area network includes a variety of different technologies. A technical standard that is widely used at present is IEEE802.11b, which uses the 2.4GHz frequency band, and the maximum data transmission rate can reach 11Mbps. IEEE 802.11g and Bluetooth (Bluetooth) technology are also used in this frequency band. , Among them, the highest data transmission rate of 802.11g can reach 54Mbps. Other new technologies such as IEEE 802.11a and ETSI BRAN Hiperlan2 use the 5GHz frequency band, and the highest transmission rate can reach 54Mbps.

At present, the most commonly used method for access authentication of WLAN networks is authentication based on user name/password. Account, get a username and password. For example, a common user name: wlan@163.com; password: 12345. When a user needs to access the WLAN network, he needs to enter his user name and password, and then the authentication point AP transmits the user name and password to the authentication server through the RADIUS authentication protocol, and the authentication server performs user name and password authentication.

Specific reference is shown in Figure 1, which is a processing flow chart of performing 802.1X access authentication based on user name and password in the prior art, mainly including the following steps:

1. Before accessing the WLAN network, the user needs to open an account in the authentication server (usually the AAA server) to obtain his user name and password. Both AAA and the user terminal STA save the user's user name and password. The username is assumed to be wlan@163.com; the password is assumed to be 12345;

2. A physical connection is established between the user terminal STA and the authentication point AP;

3. The user terminal STA sends an EAPoL-Start message to the authentication point AP to start the 802.1x process;

4. The authentication point AP sends an EAP-Request/Identity message to the user terminal STA, requesting the user terminal STA to send the user identity;

5. The user terminal STA sends its own user identity to the authentication point AP through the EAP-Response/Identity message, which contains the user name wlan@163.com obtained by the user opening an account in the AAA server;

6. The authentication point AP randomly generates a 16-byte random number Challenge1;

7. The authentication point AP sends an EAP-Request/MD5-Challenge message to the user terminal STA, carrying the generated random number Challenge1;

8. After the user terminal STA receives the EAP-Request/MD5-Challenge message, it parses out the random number Challenge1 in it, and then encrypts it together with the password. After obtaining the new password Key1, the user terminal STA sends an EAP to the authentication point AP. -Response/MD5-Challenge message, which contains the encrypted password Key1;

9. The authentication point AP initiates an authentication request to the authentication server (AAA server) through the Access-Request message of the Radius protocol; the message contains the random number Challenge1 and the encrypted password Key1;

10. After the authentication server receives the Access-Request message sent by the AP, it parses out the random number Challenge1 and the password Key1 carried in it; the authentication server uses the same method as the user terminal STA to obtain the Challenge1 and the user's own saved Encrypt the password to obtain the encrypted password Key2; then compare Key1 and Key2, if they are consistent, the authentication passes, and the authentication server sends an Access-Accept message to the authentication point AP; Point AP to send Access-Reject message;

11. If the authentication point AP receives the Access-Accept message, it sends an EAP-Success message to the user terminal STA to notify the user terminal STA of successful authentication; if it receives an Access-Reject message, it sends an EAP-Success message to the user terminal STA. Failure message, notifying the user terminal STA of authentication failure.

Although the above-mentioned existing access authentication method based on user name/password can realize the access authentication to the user, since the user needs to input his user name/password every time he accesses the WLAN network, the operation is cumbersome and the user It is inconvenient to use; in addition, this method cannot realize access authentication for some user terminals that do not have an interface to input user names and passwords.

Contents of the invention

The technical problem to be solved by the invention is to provide an access authentication method that is convenient for users to access the wireless local area network, so as to simplify the user's input operation.

In order to solve the above-mentioned problems, the present invention realizes the method for wireless local area network access authentication, and described wireless local area network comprises user terminal, authentication point and authentication server, comprises the following steps:

A. The user terminal establishes a physical connection with the authentication point;

B. The authentication point obtains the MAC address of the user terminal;

C. Perform access authentication on the user terminal with the MAC address through the authentication point.

Optionally, the authentication point is configured with the MAC address of each user terminal, and step C includes:

The authentication point performs authentication according to the acquired MAC address of the user terminal, and if the MAC address is valid, the user terminal is authenticated.

Optionally, the authentication server is configured with the MAC address of the user terminal, and step C includes:

C1. The authentication point sends an access request message including the MAC address of the user terminal to the authentication server to initiate access authentication;

C2. The authentication server parses out the MAC address and performs authentication according to the MAC address. If the MAC address is valid, the user terminal is authenticated and returns an access acceptance message to the authentication point.

Optionally, a network service identifier SSID is used to identify the user terminal to perform access authentication with a MAC address, and before step C1, it also includes:

The authentication point judges whether to perform access authentication on the user terminal with the MAC address according to the SSID, and if the SSID is detected, the judgment is yes, and step C1 is executed after the judgment is yes.

Optionally, using the domain to identify the user terminal belonging to the domain to perform access authentication with the MAC address, before step C2 also includes:

The authentication server judges according to the domain of the user terminal whether to perform access authentication on the user terminal with the MAC address. Then execute step C2.

Optionally, the user name and password for the user terminal access authentication are preset, and the first access authentication of the user terminal also includes before performing step C1:

The user terminal initiates user name and password authentication, and the authentication server obtains and configures the MAC address of the user terminal after passing the authentication.

Wherein, step A includes:

The user terminal sends a probe request message to the authentication point;

The authentication point returns a probe response message to the user terminal;

The user terminal sends an authentication request message to the authentication point;

The authentication point returns an authentication response message to the user terminal;

The user terminal sends a connection request message to the authentication point;

The authentication point establishes a physical connection with the user terminal, and returns a connection response message to the user terminal.

Wherein, the authentication server is an authentication, authorization, and accounting server

Compared with the prior art, the present invention has the following advantages:

First of all, the present invention performs access authentication based on the MAC address of the user terminal device. For a legal MAC address, the user can access the WLAN network without the user inputting a user name/password after turning on the machine. For an illegal MAC address, the user can access the WLAN network. The user is prohibited from accessing the WLAN network, so that the user can access the WLAN network safely and conveniently;

Secondly, the present invention also solves the access authentication of the WLAN network when some user terminal equipment does not have an interface to input the user name/password, such as a WLAN mobile phone does not have an interface to input the user name/password. The authentication can well ensure that the user accesses the WLAN network.

Description of drawings

Fig. 1 is the processing flow diagram of performing WLAN access authentication based on username and password in the prior art;

Fig. 2 is a schematic diagram of a network environment in which the wireless local area network access authentication method of the present invention is applied;

Fig. 3 is a processing flow chart of the first embodiment of the wireless local area network access authentication method of the present invention;

Fig. 4 is a processing flowchart of the second embodiment of the wireless local area network access authentication method of the present invention;

Fig. 5 is a processing flowchart of the third embodiment of the wireless local area network access authentication method of the present invention.

Detailed ways

The core of the present invention is to perform access authentication based on the MAC address of the user terminal equipment. The MAC address is a 48-bit unique address, which is similar to the ID card of the equipment in the network environment. Generally, MAC addresses are also called physical addresses, hardware addresses or link addresses, and are written inside the hardware when produced by network equipment manufacturers. The MAC address is expressed in 48-bit binary in the computer. The length of the MAC address is 48 bits (6 bytes), usually expressed as 12 hexadecimal numbers, and between each 2 hexadecimal numbers. Separated by colons, such as: 08:00:20:0A:8C:6D is a MAC address, in which the first 6 digits of hexadecimal number 08:00:20 represent the serial number of the network hardware manufacturer, which is established by IEEE (Electrical and Electronics Institute of Engineers), and the last three hexadecimal numbers 0A:8C:6D represent the serial number of a network product (such as a network card) manufactured by the manufacturer. As long as the MAC address of the user terminal equipment is not changed, the MAC address of the user terminal equipment is unique in the world.

Refer to FIG. 2 , which is a diagram of a network environment for realizing WLAN access authentication in the present invention. The WLAN applied in the present invention includes:

The user terminal (Supplicant) 1, the entity (Entity) at the end of the LAN connection, initiates a request to the authentication point (Authenticator) as an authentication requester, and checks the legitimacy of its identity;

Authentication point 2, which responds to the authentication request of user terminal 1, includes two logical ports: controlled port (Controlled Port) 21 and uncontrolled port (Uncontrolled Port) 22;

The authentication server 3 refers to judging whether the requester has the right to use the network service provided by the authentication point 2 by checking the identity sent by the user terminal 1 .

Usually, to access the LAN/MAN 4, the user terminal 1 first initiates an authentication request to the authentication point 2, and the uncontrolled port 22 is always in a two-way connection state, which is mainly used to transmit EAPoL protocol frames, which can ensure that the user terminal 1 can always Sending or accepting; when the authentication is authorized, the controlled port 21 of the authentication point 2 is connected to transfer network resources and services.

Referring to FIG. 3 , this figure is a schematic diagram of a first embodiment of the present invention for realizing WLAN access authentication.

In this embodiment, the MAC address table of each user terminal device is statically configured on the AP of the WLAN network. When the user terminal and the AP perform an 802.11b/g/a connection, the AP will obtain the MAC address of the user terminal device. To find the configured MAC address table, if the MAC address is found, the user terminal is considered legal, the authentication is passed, the control of the user terminal is opened, and the user terminal is allowed to perform subsequent processes, such as applying for an IP address and surfing the Internet. If it does not exist, then keep the control on the user terminal; in this case, if the user terminal wants to use the WLAN network, it can use other authentication methods, such as the access authentication method based on username/password, which will not be repeated here.

The specific processing flow is as follows:

Step s10, the user terminal sends a probe request message to the authentication point;

Step s11, the authentication point returns a probe response message to the user terminal;

Step s12, the user terminal sends an authentication request message to the authentication point;

Step s13, the authentication point returns an authentication response message to the user terminal;

Step s14, the user terminal sends a connection request message to the authentication point;

Step s15, the authentication point establishes a physical connection with the user terminal, and returns a connection response message to the user terminal;

Step s16, the authentication point obtains the MAC address of the user terminal, and performs authentication according to the MAC address. If the configured MAC address table is found to be found to exist, the user is considered legal, the user terminal is authenticated, and subsequent processes such as DHCP can be continued. Otherwise, If the authentication fails, use other authentication methods or terminate the authentication directly.

Referring to FIG. 4 , this figure is a schematic diagram of a second embodiment of the present invention for realizing WLAN access authentication.

The statically configured MAC address table in the first embodiment above is implemented on the AP. In actual use, due to the limitation of the storage capacity of the AP, the data configured on the AP is generally small, and operation is difficult. For this reason, the MAC address table data configured in this embodiment is implemented on the authentication server (AAA server), that is, the MAC address table of each user terminal is configured on the authentication server (AAA server), and the MAC address of the user terminal is reported by the AP to the authentication server. The server (AAA server) is searched and compared by the authentication server (AAA server).

The specific processing flow is as follows:

In step s20-step s25 are the same as steps s10-s15 in the first embodiment, an 802.11 physical connection is established between the user terminal STA and the authentication point AP.

In step s26, the authentication point AP obtains the MAC address of the user terminal STA. At the same time, the AP judges whether the user belongs to MAC address authentication according to certain rules. The SSID is used to identify the access authentication of the user terminal with the MAC address. If it belongs to the access authentication with the MAC address, the AP constructs an Access-Request authentication request message of the RADIUS protocol to the authentication server (AAA server), and the user in the message The name contains the MAC address of the user terminal (for example, the format of the user name can be MAC@DOMAIN).

In step s27, after the authentication server (AAA server) receives the authentication request message of the user terminal, it resolves the user name, and judges whether the user terminal belongs to authenticating with the MAC address according to certain rules, for example, it can be judged according to the domain (DOMINA), Configure the relationship between DOMAIN and authentication in the authentication server, and use a specific DOMAIN to indicate that the user terminals belonging to this DOMAIN are all authenticated by MAC address. If the access authentication is based on the MAC address, the authentication server searches the database according to the MAC address of the user terminal, compares it, searches for a matching MAC address, and judges whether the MAC address is legal. If a matching MAC address is found, the MAC address is legal and the authentication is passed, the user terminal is allowed to access the WLAN network, and an Access-Accept authentication success message is sent to the AP; otherwise, an Access-Reject authentication rejection message is sent to the AP.

Referring to FIG. 5 , this figure is a schematic diagram of a third embodiment of the present invention for implementing WLAN access authentication.

In the above-mentioned second embodiment, although the configuration of the MAC address is placed in the authentication server (AAA server) for configuration, in actual operation, the user's MAC address may change, and at this time it needs to be configured in the authentication server (AAA server) The operation of adding, deleting, and modifying increases the difficulty of operation. For this reason, this embodiment is further improved to realize that the authentication server (AAA server) can automatically learn the MAC address of the user terminal.

The specific processing flow is as follows:

First, the user opens an account in the authentication server (AAA server), obtains a user name and password, and then starts access authentication. Steps s30-36 of the access process are as described in steps 1-7 of the prior art in the background, and are not described here. To repeat, in the authentication request message of step s37, the AP will send the MAC address of the user terminal STA to the authentication server (AAA server);

In step s38, the authentication server (AAA server) judges whether the user name and password of the user are legal, and if legal, then the authentication passes, and the authentication server (AAA server) will automatically pass the MAC address of the user terminal carried in this authentication of the user Add it to its own database, and send the authentication success message Access-Accept to the authentication point AP, and then in step s39, the authentication point AP notifies the user terminal STA that the authentication is successful.

It should be noted that when the user accesses the WLAN network next time in this embodiment, since the user's MAC address has already been stored in the authentication server (AAA server), the authentication process at this time is the same as that in the second embodiment , the authentication server uses the MAC address to perform access authentication on the user terminal, which will not be repeated here.

In addition, if the user changes the STA, its MAC address should also change, the MAC address authentication will fail when the user accesses for the first time, the user can pass the username/password authentication successfully, and update the authentication server (AAA server) at the same time The MAC address saved in , you can use the MAC address for access authentication the next time you access.

The above descriptions are only preferred embodiments of the present invention, and do not constitute a limitation to the protection scope of the present invention. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present invention shall be included within the protection scope of the claims of the present invention.

Claims (8)

1, a kind of method that realizes access authentication of WLAN, described WLAN (wireless local area network) comprises user terminal, authentication points and certificate server, it is characterized in that, comprising:

A, user terminal and authentication points are set up physical connection;

B, authentication points obtain the MAC Address of user terminal;

C, with described MAC Address described user terminal is carried out access authentication by described authentication points.

2, the method for realization access authentication of WLAN according to claim 1 is characterized in that, authentication points disposes the MAC Address of each user terminal, and step C comprises:

Authentication points authenticates according to the MAC Address of the described user terminal that obtains, if described MAC Address is legal, then user end certification passes through.

3, the method for realization access authentication of WLAN according to claim 1 is characterized in that, certificate server disposes the MAC Address of user terminal, and step C comprises:

C1, authentication points send the access request message that comprises the user terminal MAC Address to certificate server and initiate access authentication;

C2, certificate server parse described MAC Address and authenticate according to described MAC Address, if described MAC Address is legal, then user end certification passes through, and return to authentication points and accept message.

4, the method for realization access authentication of WLAN according to claim 3 is characterized in that, carries out access authentication with a network services identification SSID identifying subscriber terminal with MAC Address, also comprises before the step C1:

Authentication points judges whether described user terminal is carried out access authentication with MAC Address according to SSID, if detect described SSID, then is judged as and is, and be back execution in step C1 being judged as.

5, the method for realization access authentication of WLAN according to claim 3 is characterized in that, the user terminal that belongs to this territory with domain identifier carries out access authentication with MAC Address, also comprises before the step C2:

Certificate server judges whether described user terminal is carried out access authentication with MAC Address according to the territory of user terminal, carries out the territory of access authentication if user terminal belongs to described with MAC Address, then is judged as to be, and is back execution in step C2 being judged as.

6, according to the method for claim 3,4 or 5 each described realization access authentication of WLAN, it is characterized in that, the username and password of default subscriber terminal access authentication, user terminal access authentication first also comprised before execution in step C1:

User terminal is initiated the username and password authentication, and the MAC Address of described user terminal is obtained and disposed in authentication by the back certificate server.

7, the method for realization access authentication of WLAN according to claim 6 is characterized in that, steps A comprises:

User terminal sends probe request message to authentication points;

Authentication points returns probe response message to user terminal;

User terminal sends authentication request message to authentication points;

Authentication points is to user terminal return authentication response message;

User terminal sends connection request message to authentication points;

Authentication points and user terminal are set up physical connection, return connection response message to user terminal.

8, the method for realization access authentication of WLAN according to claim 7 is characterized in that, described certificate server is an authentication, authorization and accounting server.

Images