CN101232372A - Authentication method, authentication system and authentication device - Google Patents

Abstract

The invention provides an authentication method, which comprises the following steps that: an authentication requester firstly sends an authentication request to an authenticator who provides access service; the authenticator forwards the sending first-time authentication request to an authentication server which storages the information of the authentication requester; the authentication server informs the authenticator about the authentication information of the authentication requester after the successful authentication of the first-time authentication request; when the authentication requester sends the authentication request again, the authenticator utilizes the authentication information to carry out the local authentication of the authentication requester. The invention further provides an authentication system and an authentication device.

Description

Authentication method, authentication system and authentication device

technical field

The present invention relates to the communication field, and more specifically, to an authentication method, an authentication system and an authentication device.

Background technique

With the rapid development of the Internet (Internet), broadband access technologies emerge in an endless stream, among which Ethernet gradually occupies most of the broadband access market because of its high performance-cost ratio. A personal computer can be connected to an Ethernet switch through a wired method, or connected to a wireless access point (Access Point, referred to as AP) through a wireless method, and then connected to a core network through an Ethernet line, such as an enterprise LAN or a metropolitan area network, etc. However, the traditional Ethernet access method lacks manageability and cannot implement functions such as user authentication, authorization, and accounting. Operators can only use monthly subscriptions to bill users, which is unfair to both users and operators to a certain extent. Several common Ethernet access methods appeared later, one of which was the 802.1x protocol developed by the IEEE (Institute of Electrical and Electronics Engineers, Institute of Electrical and Electronics Engineers) 802 working group. In the network, a Remote Authentication Dialin User service (RADIUS for short) authentication server is usually set up to verify the legitimacy of the identity of the computer user. In actual networking, a personal computer can be directly connected to an Ethernet switch, or can be connected to an Ethernet switch through a hub or an Ethernet switching device, or through an Asymmetric Digital Subscriber Line (ADSL for short). ) and DSLAM equipment (Digital Subscriber Line Access Multiplexer, Digital Subscriber Line Access Multiplexer) are connected, and the message in Ethernet format is transmitted in the ADSL line. In the wireless local area network, IEEE 802.11, 802.11a, 802.11b, 802.11g and other wireless Ethernet protocols can be used to connect personal computers and wireless network access points.

Extensible Authentication Protocol (EAP) authentication is a new authentication framework designed for Point-to-Point Protocol (PPP), which can include multiple authentication methods, such as the commonly used EAP- MD5 (Message Digest 5, Message Digest 5, an encryption algorithm), EAP-TLS (Transport Layer Security, Transport Layer Security), LEAP (Lightweight Extensible Authentication Protocol, Lightweight Extensible Authentication Protocol), OTP (oneTime Password, one time password), SIM (Subscriber Identification Module, user identification card) and so on. However, currently known specific authentication methods developed under the authentication framework of EAP often differ in security and complexity. The greater the complexity, the more resources will be consumed, and the more cumbersome and complicated the authentication process will be, and the higher the security will be, and vice versa.

The 802.1x protocol is called a port-based access control protocol. It is an authentication protocol based on Ethernet technology. 802.1x is characterized by its protocol security and simple implementation. , wireless local area network (Wireless Local Area Network, referred to as WLAN) and other broadband access methods provide users with authentication methods. 802.1x provides the encapsulation of EAPOL (EAP over LAN, LAN carrying EAP protocol), and the framework supporting EAP authentication.

An application architecture 100 of the 802.1x protocol is shown in FIG. 1 , including: an authentication requester 10 , an authenticator 20 and an authentication server 30 .

The authentication requester is generally a user terminal system, which can be an entity located at one end of a point-to-point link in a local area network or a wireless local area network. Usually, the authentication requester software needs to be installed, and the user initiates the authentication process of the 802.1x protocol by starting the authentication requester software. In order to support port-based access control, the authentication requester needs to support the EAPOL protocol.

The authenticator is usually a network device supporting the 802.1x protocol, and may be an entity at the other end of a point-to-point link on a local area network or a wireless local area network. The authentication requester accesses the network access port of the local area network through the authenticator. The network access port can be the physical port of the authenticator or the Media Access Control (MAC) address of the authentication requester. The network access port is divided into two virtual ports: a controlled port 22 and an uncontrolled port 24 (the controlled port is the one that is opened, and the uncontrolled port is the one that is closed). The uncontrolled port is always in the state of two-way connection, and is mainly used to transmit EAPOL authentication packets to ensure that the authentication requester can always send or accept authentication. The controlled port is used to transmit business packets, which is blocked in the unauthorized state and connected in the authorized state. In order to adapt to different application environments, the operation control direction of the controlled port can be configured as two-way control and one-way control. In Figure 1, the controlled port of the authenticator is in an unauthenticated and unauthorized state, so the authentication requester cannot access the services provided by the authenticator.

The authentication server is usually a RADIUS server, which is used to store information about the authentication requester, such as the user name and password of the authentication requester, and the rights parameters of the authentication requester, such as Committed Access Rate (CAR) parameters, priority levels, access control lists for authentication requestors, and so on. When the authentication server authenticates the authentication requester through a certain authentication method, the authentication server will pass the relevant information of the authentication requester to the authenticator, and the authenticator will build a dynamic access control list, and the subsequent traffic of the authentication requester will accept the above parameters. Regulation and Control.

The port authentication entity of the authenticator communicates with the authentication requester port authentication entity through an uncontrolled port, and the EAPOL protocol is run between the two; the EAP protocol is run between the authenticator port authentication entity and the authentication server. If the authenticator and the authentication server are integrated in the same system, the communication between the two may not use the EAP protocol. As for which specific authentication method to use under the EAP architecture, it can be selected according to security and user needs. The EAP authentication method is used in the 802.1x protocol. The user provides authentication information such as user name and user password, and through a certain EAP authentication method included in the 802.1x protocol, the authenticator conducts authentication of user identity validity. After receiving the user's authentication information, the authenticator can authenticate to the corresponding authentication server through the EAP (EAP over RADIUS, EAPOR) protocol carried on the RADIUS protocol.

The following uses EAP-MD5 as an example to describe the 802.1x authentication method. In actual use, all EAP authentication methods can be used. Fig. 2 is a schematic diagram of an EAP-MD5 authentication method according to the prior art. The specific process is as follows:

1) After the physical connection is established between the user and the authenticator, the user authentication requester sends an EAPOL start message whose destination address is the multicast address 01-80-C2-00-00-03 to the authenticator, and starts 802.1x access;

2) The authenticator sends an EAP request message whose destination address is the address of the authentication requester to the authentication requester, and requires the authentication requester to report the user name;

3) The authentication requester responds with an EAP response message to the authenticator's request, including the username;

4) The authenticator sends an access request message to the RADIUS authentication server in the message format of EAP Over RADIUS, which contains the EAP response message with the user name sent by the authentication requester to the authenticator, and submits the user name to the RADIUS authentication server ;

5) The RADIUS authentication server generates a 128bit challenge word;

6) The RADIUS authentication server responds to the authenticator with an access challenge message, which contains an EAP challenge request message, and sends the corresponding challenge word to the authenticator user;

7) The authenticator sends the challenge word to the authentication requester through the EAP request message with the challenge word;

8) After the authentication requester receives the EAP request message with the challenge word, it generates the challenge word with the password after performing the MD5 algorithm on the password and the challenge word, and includes the challenge word with the password in the EAP response message and puts it in the Send it to the authenticator in the response;

9) The authenticator sends the challenge word with the password to the RADIUS user authentication server through the access request message, and is authenticated by the RADIUS authentication server;

10) The RADIUS user authentication server judges whether the user is legal according to the user information, and then responds with an authentication success/failure message to the authenticator; if successful, it carries the negotiation parameters and the relevant business attributes of the user to authorize the user;

11) The authenticator responds to the user with an EAP authentication success/failure message according to the authentication result, and notifies the user of the authentication result; if the authentication fails, the process ends here; if it succeeds, subsequent authorization, billing and other processes can be performed.

After the authentication requester successfully passes the 802.1x authentication, the user enjoys the rights he should enjoy, for example, he can access the campus LAN or MAN, and then access the Internet. When the user does not want to continue to enjoy the right, the authentication requester sends an offline message to notify the authenticator, and the authenticator closes the controlled port after receiving the message to terminate the user's right, and notifies the authentication server that the user requests to log off After the authentication server receives the offline message forwarded by the authenticator, it cooperates with the DHCP (Dynamic Host Configuration Protocol, Dynamic Host Configuration Protocol) server and billing center to complete the recovery of IP addresses and the termination of billing.

However, when the authentication requester, such as a personal computer, suddenly goes offline due to a crash or power failure, it is too late to send an offline message to the authenticator, so that the authenticator and the authentication server cannot know that the user has gone offline, and thus cannot Inform the DHCP server and the billing center to recycle the IP address and terminate the billing of the user, which will bring losses to the operator and the user. In order to solve this problem, the following solutions are provided in related technologies:

Related solution one:

At present, most manufacturers in practical applications use a query/response mechanism to detect when a user suddenly goes offline without sending a logout message. There are several methods for specific implementation, mainly divided into two cases: the authenticator actively sends the query message and the authentication requester actively sends the online message.

1) The authenticator actively sends a query message: the authenticator sends a query message periodically to ask whether a specific user is online, and the interval can be set by software, usually 30 seconds; the authentication requester receives the query message from the authenticator After receiving the authentication requester's response message, the authenticator will reset the death timer for the authentication requester to zero. In order to avoid that the authenticator may not receive the response message sent by the authentication requester due to some unknown factors, generally speaking, the time of the death timer is three times the time of sending the query message, that is to say, the authenticator sends three If no response message is received from the authentication requester after two query messages, the authenticator considers the authentication requester to be offline, closes the controlled port to terminate the user's rights, and notifies the authentication server to take back the IP address and terminate the user. billing.

2) The authentication requester actively sends online messages: the authentication requester regularly sends online messages to inform the authenticator that he is still online, and the interval can be set by software, usually 30 seconds; the authenticator receives the online message from the authentication requester. After the packet is sent, the death timer for the authentication requester is reset to zero. In order to avoid that the online message sent by the authentication requester may not be received by the authenticator due to some unknown factors, generally speaking, the time of the death timer is three times that of the online message sent by the authentication requester. When the dead time is At zero time, the authenticator thinks that the authentication requester has gone offline, closes the controlled port to terminate the user's rights, and notifies the authentication server to take back the IP address and terminate the user's billing.

The defect of related solution 1 is that the real-time performance is not strong, and the response message or online message is not authenticated, which may cause security problems. For example, when a user is authenticated, the switch or AP connected to it opens the controlled port, and when the user suddenly drops out, another illegal user on the same network or listening on the side can The user's MAC address and forged response message or online message to achieve fraudulent use of the original user and enjoy all the rights of the original user.

In view of the shortcomings of related solutions that a pair of response messages or online messages are not authenticated and the real-time performance is not strong, the following solutions 2 and 3 are proposed in related technologies.

Related solution two:

Since no authentication is performed on the response message or the online message, the most thorough method for authenticating the response message or the online message in this scheme is to periodically re-authenticate the authentication requester. In this way, firstly, it can be guaranteed that the passed users are legal, and secondly, it can be determined that the legal users are online. Generally, re-authentication is initiated by the authenticator, so a timer for initiating the re-authentication process needs to be defined in the authenticator; of course, the re-authentication process can also be initiated by the authentication requester. FIG. 3 shows the re-authentication process according to the second related solution. Since this process is basically the same as the initial authentication process, it will not be described in detail here.

However, the re-authentication process of Scheme 2 is the same as the first-time authentication process, which leads to the following problems: first, it increases the burden on the authentication requester; second, the large number of messages and frequent interactions increase the burden on the network; third, 1. The number of messages is large and the number of interactions is frequent, resulting in a long re-authentication time; Fourth, the burden on the authentication server is increased. Generally speaking, the authentication server manages a large number of users at the same time. Originally, it was only when users went online and offline. The participation of the authentication server is required when re-authentication is adopted, assuming that the re-authentication timer is 30 seconds, then the user needs to be authenticated every 30 seconds, and the authentication server may be overwhelmed.

Related solution three:

In view of the lack of practicability, a related technology provides a method for real-time notification of a user's sudden offline.

As shown in Figure 4, the authentication requester (personal computer) 12 is connected to the authenticator 16 through the IP PHONE 18 (also can be other intermediate devices, such as a hub or a switch), and enjoys access rights through the authentication of the authentication server 20 , when the authentication requester 12 or the link 22 break down, the authenticator 16 cannot detect (if the above-mentioned scheme one scheme two is not used, only 802.1x is undetectable), this scheme provides a method through IP PHONE ( IP Phone) 18 to detect the authentication requester 12 mechanism to go offline. When IP PHONE 18 found that authentication requester 12 or link 22 broke down, IP PHONE 18 sent a false message to authenticator 16 that it was an offline message sent by authentication requester 12 (forgery can send a source MAC message through IP PHONE 18 The address is the offline message packet of the authentication requester 12) to announce its own offline, and then the authenticator 16 informs the authentication server 20 to recycle the IP address and terminate the billing.

The above-mentioned solution has not been applied on a large scale at present, and it requires upgrading all devices between the authenticator and the authentication requester, so it is not practical and feasible.

Related solution four:

Aiming at the disadvantage of increasing the burden on the authentication server in the second solution, a related technology provides an authentication server proxy method to reduce the burden on the authentication server.

As shown in Figure 6, a Radius agent is introduced between the AP and the Radius server. The agent is a Radius server for the AP point and an AP point for the Radius server. Listen, and record the authentication key material sent by the Radius server to the AP. When the location of the mobile terminal changes, send a re-authentication request to another AP, and the other AP forwards the request to the Radius server to the Radius agent. , the Radius agent searches its own database to see if there is the authentication key material of the mobile terminal, if yes, it acts as the Radius server to send the authentication key material to the AP, if not, forwards the re-authentication request of the mobile terminal to the Radius server.

In this solution, a device authentication server agent is added. Adding a device in the network increases the complexity of the network, and also reduces the security. When the authentication server agent is connected to multiple APs or authenticators, the same will happen. Causes the authentication server proxy to be overloaded.

Therefore, it is necessary to develop a technical solution to solve the offline problem that reduces the burden on the authentication server.

Contents of the invention

Considering the above disadvantages of the prior art, the present invention provides an authentication method, system and device which utilize authenticators to perform local authentication to reduce the burden on the authentication server and speed up re-authentication.

In an embodiment of the present invention, an authentication method is provided, comprising the following steps: an authentication requester initiates an authentication request to an authenticator providing an access service for the first time; information of the authentication server; after the authentication server successfully authenticates the first authentication request, it informs the authenticator of the authentication information of the authentication requester; and when the authentication requester initiates an authentication request to the authenticator again, the authenticator uses the authentication information to verify the The supplicant performs local authentication.

In the above authentication method, the authenticator uses the authentication information to locally authenticate the authentication requester, including the following steps: the authenticator saves the authentication information notified by the authentication server locally, and the authentication information includes the identity of the authentication requester; when the authentication requester When initiating an authentication request to the authenticator again, the authenticator uses the identifier to retrieve the authentication information locally and authenticate the authentication requester.

In the above authentication method, the authentication information includes the password of the authentication requester and the authentication mode adopted by the authentication server and the authentication requester.

In the above-mentioned authentication method, the authenticator retrieves the authentication information locally by using the identification, and authenticating the authentication requester includes the following steps: the authenticator uses the authentication method to verify the information of the re-authentication request and the password of the authentication requester stored locally. Compare verification.

In the above authentication method, the authentication method includes the authentication method specified in the extended authentication protocol.

In the above authentication method, the authentication server includes a remote user dial-in authentication service authentication server, and the re-authentication request is used to detect whether the authentication requester is online.

In the above authentication method, the communication between the authenticator and the authentication server adopts the 802.1x protocol, the authenticator includes multiple wireless access points, and the re-authentication request is used to switch the authentication requester among multiple authenticators.

In the above-mentioned authentication method, the following steps are also included: when the authenticator receives the authentication request from the authentication requester, he searches in his own database, and if there is, it is determined that the authentication request is not the first authentication request, otherwise it is determined that the authentication request is the first authentication request .

In the above-mentioned authentication method, the following steps are also included: in the authentication request initiated by the authentication requester, information about which authenticator the authentication requester was previously authenticated on; and the authenticator receives the authentication request from the authentication requester , use the information to judge whether the authentication request is the first authentication request.

In an embodiment of the present invention, an authentication system is also provided, including: an authentication requester, used to initiate an authentication request; an authenticator, used to provide access services to the authentication requester, if the authentication requester initiated The request is the first authentication request, forwarded to the authentication server that stores information about the authentication requester for processing, if it is a re-authentication request, it will be processed locally; the authentication server is used to authenticate the first authentication request, and after the authentication is successful, the authentication The requester's authentication information is notified to the authenticator.

In the above authentication system, the authenticator includes: a memory for storing the authentication information notified by the authentication server, the authentication information including the identity of the authentication requester; and an authentication module for when the authentication requester initiates an authentication request to the authenticator again , use the ID to retrieve the authentication information from the local, and authenticate the authentication requester.

In the above authentication system, the authentication information includes the password of the authentication requester and the authentication mode adopted by the authentication server and the authentication requester.

In the above authentication system, the authentication module compares and verifies the information of the re-authentication request and the password of the authentication requester stored locally by using the authentication method.

In the above authentication system, the authentication method includes the authentication method specified by the extended authentication protocol.

In the above authentication system, the authentication server includes a remote user dial-in authentication service authentication server, the authenticator includes multiple wireless access points, and the re-authentication request is used to detect whether the authentication requester is online.

In the above-mentioned authentication system, the communication between the authentication requester, the authenticator and the authentication server adopts the 802.1x protocol, and the re-authentication request is used to switch the authentication requester among multiple authenticators.

In the embodiment of the present invention, there is also provided an authentication device, which is used to provide access services to the authentication requester, and if the authentication request initiated by the authentication requester is the first authentication request, it is forwarded to store information about the authentication requester If it is a re-authentication request, it will be processed locally.

In the above authentication device, it includes: a memory for storing the authentication information notified by the authentication server, the authentication information including the identity of the authentication requester; and an authentication module for when the authentication requester initiates an authentication request to the authentication device again, The authentication requester is authenticated by using the identification to retrieve the authentication information from the local.

In the above authentication device, the authentication information includes the password of the authentication requester and the authentication mode adopted by the authentication server and the authentication requester.

In the above authentication device, the authentication module compares and verifies the information of the re-authentication request and the password of the authentication requester stored locally by using the authentication method.

In the above authentication device, the authentication method includes the authentication method specified by the extended authentication protocol.

The above-mentioned embodiments of the present invention provide an authentication method, system and device for fast re-authentication by reducing the burden on the authentication server. Meanwhile, the above-mentioned embodiments can also realize fast re-authentication when switching between different APs in a WLAN.

Additional features and advantages of the invention will be set forth in the description which follows, and in part will be apparent from the description, or may be learned by practice of the invention. The objectives and other advantages of the invention may be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.

Description of drawings

The accompanying drawings described here are used to provide a further understanding of the present invention and constitute a part of the application. The schematic embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations to the present invention. In the attached picture:

Figure 1 shows the application architecture according to the 802.1x protocol;

FIG. 2 is a schematic diagram of an EAP-MD5 authentication method according to the prior art;

Figure 3 shows the re-authentication process according to related solution two;

FIG. 4 shows a schematic diagram of a network system according to related solution three;

Fig. 5 shows a schematic diagram of an authentication system according to an embodiment of the present invention;

Fig. 6 shows a flowchart of an authentication method according to an embodiment of the present invention;

Fig. 7 shows the signaling flowchart of the authentication method of the embodiment shown in Fig. 6;

Figure 8 shows a schematic diagram of an authentication system when the authenticator is an AP according to an embodiment of the present invention; and

FIG. 9 shows a signaling flowchart of the authentication method in the embodiment shown in FIG. 8 .

Detailed ways

The present invention will be described in detail below with reference to the accompanying drawings and in combination with embodiments.

5 shows a schematic diagram of an authentication system according to an embodiment of the present invention, including: an authentication requester 10, configured to initiate an authentication request; an authenticator 20, configured to provide an access service to an authentication requester, if the authentication requester initiates The authentication request is the first authentication request, which is forwarded to the authentication server that stores information about the authentication requester for processing, and if it is a re-authentication request, it is processed locally; the authentication server 30 is used to authenticate the first authentication request, and after the authentication is successful , inform the authenticator of the authentication information of the authentication requester.

Figure 6 shows a flow chart of an authentication method according to an embodiment of the present invention, including the following steps:

Step S10, the authentication requester initiates an authentication request to the authenticator providing the access service for the first time;

Step S20, the authenticator forwards the initial authentication request initiated by the authenticator to the authentication server that stores information about the authentication requester. The authentication information may include the password of the authentication requester and the authentication method adopted by the authentication server and the authentication requester;

Step S30, after the authentication server successfully authenticates the first authentication request, it notifies the authenticator of the authentication requester's authentication information; and

Step S40, when the authentication requester initiates an authentication request to the authenticator again, the authenticator uses the authentication information to perform local authentication on the authentication requester, and the authenticator's local authentication may include the following steps: the authenticator saves the authentication information notified by the authentication server Locally, the authentication information includes the identity of the authentication requester; when the authentication requester initiates an authentication request to the authenticator again, the authenticator uses the identity to retrieve the authentication information from the local, and authenticates the authentication requester.

The authenticator uses the identification to retrieve the authentication information locally, and authenticating the authentication requester may include the following steps: the authenticator uses the authentication method to compare and verify the information of the re-authentication request with the password of the authentication requester stored locally.

An authentication system is also provided in an embodiment of the present invention, including: an authentication requester, used to initiate an authentication request; an authenticator, used to provide access services to the authentication requester, if the authentication request initiated by the authentication requester is the first The authentication request is forwarded to the authentication server that stores information about the authentication requester for processing, and if it is a re-authentication request, it is processed locally; the authentication server is used to authenticate the first authentication request, and after the authentication is successful, the authentication requester's The authentication information is notified to the authenticator.

In the above authentication system, the authenticator may include: a memory for saving the authentication information notified by the authentication server, the authentication information including the identity of the authentication requester; and an authentication module for when the authentication requester initiates authentication to the authenticator again When requesting, use the identification to retrieve the authentication information from the local, and authenticate the authentication requester.

The authentication information may include the password of the authentication requester and the authentication mode adopted by the authentication server and the authentication requester. The authentication module uses the authentication method to compare and verify the information of the re-authentication request and the password of the authentication requester stored locally.

In a specific practice, the authentication server may be a remote user dial-in authentication service authentication server, and the re-authentication request is used to detect whether the authentication requester is online.

In addition, the communication between the authenticator and the authentication server can adopt the 802.1x protocol, the authenticator includes multiple APs, and the re-authentication request is used to switch the authentication requester between multiple authenticators. Figure 8 shows this situation.

In order to judge whether the authentication request is the first time, the authenticator can search in its own database when receiving the authentication request from the authentication requester, and if there is, it is determined that the authentication request is not the first authentication request, otherwise it is determined that the authentication request is the first authentication request . Or the authentication request initiated by the authentication requester can include information about which authenticator the authentication requester was originally authenticated on; and when the authenticator receives the authentication request from the authentication requester, use the information to determine whether the authentication request is the first time Authentication request.

In an embodiment of the present invention, there is also provided an authentication device for realizing the authenticator function in the authentication system of the above embodiment, for providing access services to the authentication requester, if the authentication request initiated by the authentication requester If it is the first authentication request, it will be forwarded to the authentication server that stores the information about the authentication requester for processing; if it is a re-authentication request, it will be processed locally. Since the implementation of the authenticator has been described in detail above, the implementation of the authentication device will not be repeated here.

The first authentication in the above embodiment is not much different from the first authentication of the above-mentioned related technologies. The function that needs to be added is that after the authentication is successful, the authentication server will not only send the user name of the authentication requester, the rights parameters of the authentication requester, etc., such as commitment The access rate (Committed Access Rate, referred to as CAR) parameters, priority, authentication requester's access control list and other parameters are sent to the authenticator, and the password of the authentication requester needs to be told to the authenticator, and the authenticator is informed at the same time. Which EAP authentication method is used between the authentication requester and the authentication server. The purpose of doing this is to implement re-authentication without the participation of the authentication server in the re-authentication process.

FIG. 7 shows a signaling flowchart of the authentication method in the embodiment shown in FIG. 6 .

As shown in Figure 7, after the first authentication is successful, the authentication server informs the authenticator of the authentication requester's user name, password and other information, and then in the re-authentication process, the authentication process only occurs between the authentication requester and the authenticator. , without the participation of the authentication server.

The specific process is as follows:

1. After the physical connection is established between the user and the authenticator, the user authentication requester sends an EAPOL start packet whose destination address is the multicast address 01-80-C2-00-00-03 to the authenticator, and starts 802.1x access;

2. The authenticator sends an EAP request message whose destination address is the address of the authentication requester to the authentication requester, and requires the authentication requester to report the user name;

3. The authentication requester responds with an EAP response message to the authenticator's request, which includes the username. The authenticator checks whether the local database has the user's information, and if so, uses a certain EAP method registered in the database to authenticate the user, and transfers to step 7, if there is no information about the user in the local database, proceed to step 4 operate;

4. The authenticator sends an access request message to the RADIUS authentication server in the message format of EAP Over RADIUS, which contains the EAP response message with the user name sent by the authentication requester to the authenticator, and submits the user name to the RADIUS authentication server ;

5. The RADIUS authentication server generates a 128bit challenge word;

6. The RADIUS authentication server responds to the authenticator with an access challenge message, which contains the EAP challenge request message, and sends the corresponding challenge word to the authenticator user;

7. The authenticator sends the challenge word to the authentication requester through the EAP request message with the challenge word;

8. After the authentication requester receives the EAP request message with the challenge word, it will generate the challenge word with the password after performing the MD5 algorithm on the password and the challenge word, and include the challenge word with the password in the EAP response message and place it in the Send it to the authenticator in the response;

9. The authenticator sends the challenge word with the password to the RADIUS user authentication server through the access request message, and the RADIUS authentication server performs authentication;

10. The RADIUS user authentication server judges whether the user is legal according to the user information, and then responds with an authentication success/failure message to the authenticator. If successful, carry the negotiation parameters and the relevant business attributes of the user to authorize the user;

11. The authenticator responds to the user with an EAP authentication success/failure message according to the authentication result, and notifies the user of the authentication result. If authentication fails, the process ends here. If successful, follow-up procedures such as authorization and billing can be carried out;

12. The authenticator sends a request message to the authentication server (it can use a defined message format, such as an EAP message, or a custom message; it can be carried on the RADIUS protocol, or it can be a custom private agreement), carrying the user name of the authentication requester, requesting the corresponding information and parameters of the authentication requester to the authentication server, and the authentication server sends the corresponding information of the authentication requester, such as user name, password, committed access rate parameters, priority The authentication level, the access control list of the authentication requester, and the authentication method using EAP are sent to the authenticator. The authenticator saves this information in its own database. Of course, the authenticator can also only keep the user name, password and EAP authentication method, because other parameters are useless in the re-authentication process;

13. The re-authentication timer triggers re-authentication (re-authentication can be initiated by the authentication requester or the authenticator, here we take the authenticator as an example), and the authenticator sends the authentication requester the destination address is the address of the authentication requester. EAP request message, requiring the authentication requester to report the user name;

14. The authentication requester responds with an EAP response message to the authenticator's request, including the username;

15. The authenticator searches the local database for the user's information, finds that the user's information exists in the local database, and can obtain the EAP authentication method used for the user's information, taking MD5 as an example;

16. The authenticator generates a 128bit challenge word;

17. The authenticator sends the challenge word to the authentication requester through the EAP request message with the challenge word;

18. After the authentication requester receives the EAP request message with the challenge word, it will generate the challenge word with the password after performing the MD5 algorithm on the password and the challenge word, and include the challenge word with the password in the EAP response message and place it in the Send it to the authenticator in the response;

19. The authentication server judges whether the user is legal according to the user information, and if it is legal, execute step 20, and if not, execute step 21;

20. Reset the re-authentication timer to prepare for the next re-authentication, keep the controlled port connection status to provide services to the authentication requester; you can notify the authentication server that the authentication requester is still online and legal as needed (you can re-authenticate each time) Success is notified once, or after each re-authentication succeeds several times, or not after re-authentication is successful);

21. If the authentication is unsuccessful, then disconnect the controlled port to terminate the continued service provided to the authentication requester, and notify the authentication server that the authentication requester is offline or illegal, so as to terminate the DHCP address recovery and billing.

The above process can also be applied to fast re-authentication when a mobile terminal switches between different AP access points in a WLAN (another embodiment), as shown in FIG. 8 . In FIG. 8, the authentication requester is a mobile terminal, and the authenticator is an AP. When a mobile terminal moves from the upper position in Figure 8 to the lower position, re-authentication is required to allow the lower AP access point to open a controlled port to provide services to the mobile terminal. The existing technology is through an authentication server or an authentication control point. (similar to a device of the authentication server proxy of related technology solution 4) re-authentication, which may also bring too much burden to the authentication server and authentication control point, use the above-mentioned method when performing re-authentication between AP switching , can significantly reduce the burden of authentication server and authentication control point and bring faster authentication speed.

The first authentication process is consistent with the above process. When the mobile terminal switches to the following AP, it sends an EAPOL start message to start the re-authentication process. The specific process is as follows (Figure 9):

1. After the physical connection is established between the user and the authenticator, the user authentication requester sends an EAPOL start packet whose destination address is the multicast address 01-80-C2-00-00-03 to the authenticator AP2, and starts 802.1 x access. The difference from the above is that this EAPOL message needs to carry the address of the authenticator AP1 that the mobile terminal has previously authenticated. Of course, this difference can also be placed in the EAP response message;

2. The authenticator sends an EAP request message whose destination address is the address of the authentication requester to the authentication requester, and requires the authentication requester to report the user name;

3. The authentication requester responds with an EAP response message to the authenticator's request, which includes the username. If the address of the original authenticator AP1 is not included in the EAP start message, the address of the AP1 can be included in this message;

4. The authenticator AP2 sends a request message with the username of the authentication requester to the original authenticator AP1;

5. The original authenticator AP1 searches the local database, and if there is user information of the authentication requester, it sends the user's information, such as user name, password, promised access rate parameters, priority, access control list of the authentication requester, and EAP The information such as the authentication method is sent to the authenticator AP2. The authenticator AP2 saves these information in its own database. Of course, the authenticator AP2 can also only keep the user name, password and EAP authentication method, because other parameters are useless in the re-authentication process. If AP1 cannot find the information of the authentication requester, it will return an authentication failure message and end this authentication;

6. The authenticator AP2 generates a 128-bit challenge word;

7. The authenticator AP2 sends the challenge word to the authentication requester through the EAP request message with the challenge word;

8. After the authentication requester receives the EAP request message with the challenge word, it will generate the challenge word with the password after performing the MD5 algorithm on the password and the challenge word, and include the challenge word with the password in the EAP response message and place it in the Send it to the authenticator AP2 in the response;

9. Authenticator AP2 judges whether the user is legal according to the challenge word information sent by the user. If it is legal, go to step 10; if not, go to step 11;

10. AP2 sends an authentication success message to the mobile terminal, opens the controlled port to provide services to the authentication requester, and sends a user information deletion message to AP1 to notify AP1 to delete the message of the authentication requester to release space;

11. If the re-authentication is unsuccessful, send an authentication failure message to the mobile terminal, do not open the controlled port, and send the authentication requester’s authentication failure message to AP1 at the same time, and AP1 decides whether to re-authenticate or prompt the authentication requester for the authentication request Or he may be under attack.

The flow charts of the embodiments listed above are all described in the relatively simple EAP authentication mode of EAP-MD5. Currently, there are more than a dozen authentication methods of EAP. For those skilled in the art, it is obvious that the above-mentioned embodiments can be applied to these authentication methods of EAP.

It can be seen that the above-mentioned embodiment is an improvement on the second related technical solution, and provides a method for reducing the burden on the authentication server and quickly performing re-authentication. Toggle fast reauthentication.

Obviously, those skilled in the art should understand that each module or each step of the above-mentioned present invention can be realized by a general-purpose computing device, and they can be concentrated on a single computing device, or distributed in a network formed by multiple computing devices Optionally, they can be implemented with program codes executable by a computing device, so that they can be stored in a storage device and executed by a computing device, or they can be made into individual integrated circuit modules, or they can be integrated into Multiple modules or steps are fabricated into a single integrated circuit module to realize. As such, the present invention is not limited to any specific combination of hardware and software. It should be understood that changes in these specific implementations are obvious to those skilled in the art and do not depart from the spirit protection scope of the present invention.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and changes. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims (21)

1. An authentication method, characterized in that, comprising the following steps: The authentication requester initiates an authentication request to the authenticator providing the access service for the first time; The authenticator forwards the initial authentication request initiated by the authenticator to an authentication server storing information about the authentication requester; After the authentication server successfully authenticates the first authentication request, it notifies the authenticator of the authentication requester's authentication information; and When the authentication requester initiates an authentication request to the authenticator again, the authenticator uses the authentication information to perform local authentication on the authentication requester. 2. The authentication method according to claim 1, wherein said authenticator utilizes said authentication information to perform local authentication on said authentication requester comprising the following steps: The authenticator locally saves the authentication information notified by the authentication server, and the authentication information includes the identity of the authentication requester; When the authentication requester initiates an authentication request to the authenticator again, the authenticator retrieves the authentication information locally by using the identifier, and authenticates the authentication requester. 3. The authentication method according to claim 2, wherein the authentication information includes the password of the authentication requester and the authentication mode adopted by the authentication server and the authentication requester. 4. The authentication method according to claim 3, wherein the authenticator utilizes the identification to retrieve the authentication information locally, and authenticating the authentication requester comprises the following steps: The authenticator uses the authentication method to compare and verify the information of the re-authentication request with the password of the authentication requester stored locally. 5. The authentication method according to claim 4, wherein the authentication method includes an authentication method stipulated in an extended authentication protocol. 6. The authentication method according to claim 5, wherein the authentication server comprises a remote user dial-in authentication service authentication server, and the re-authentication request is used to detect whether the authentication requester is online. 7. The authentication method according to claim 5, wherein the communication between the authenticator and the authentication server adopts the 802.1x protocol, the authenticator includes a plurality of wireless access points, and the re-authentication The request is used to switch the authentication requester among multiple authenticators. 8. The authentication method according to claim 1, further comprising the following steps: When the authenticator receives the authentication request from the authentication requester, he searches in his own database, and if there is, it determines that the authentication request is not the first authentication request; otherwise, it determines that the authentication request is the first authentication request. 9. The authentication method according to claim 1, further comprising the following steps: including information about which authenticator the authentication requestor was previously authenticated in the authentication request initiated by the authentication requestor; and When the authenticator receives the authentication request from the authentication requester, he uses the information to judge whether the authentication request is the first authentication request. 10. An authentication system, characterized in that it comprises: An authentication requester, used to initiate an authentication request; An authenticator, which is used to provide access services to the authentication requester. If the authentication request initiated by the authentication requester is the first authentication request, it will be forwarded to the authentication server that stores information about the authentication requester. If If it is a re-authentication request, it will be processed locally; The authentication server is configured to authenticate the first authentication request, and after successful authentication, notify the authenticator of the authentication requester's authentication information. 11. The authentication system according to claim 10, wherein the authenticator comprises: a memory, configured to store the authentication information notified by the authentication server, the authentication information including the identity of the authentication requester; and An authentication module, configured to use the identification to retrieve the authentication information locally when the authentication requester initiates an authentication request to the authenticator again, and authenticate the authentication requester. 12. The authentication system according to claim 11, wherein the authentication information includes the password of the authentication requester and the authentication mode adopted by the authentication server and the authentication requester. 13. The authentication system according to claim 12, wherein the authentication module uses the authentication method to compare and verify the information of the re-authentication request with the password of the authentication requester stored locally. 14. The authentication system according to claim 13, wherein the authentication method includes an authentication method specified in an extended authentication protocol. 15. The authentication system according to claim 14, wherein the authentication server includes a remote user dial-in authentication service authentication server, the authenticator includes a plurality of wireless access points, and the re-authentication request is used for Detect whether the authentication requester is online. 16. The authentication system according to claim 14, wherein the communication between the authentication requester, the authenticator and the authentication server adopts the 802.1x protocol, and the re-authentication request is used for the authentication The supplicant switches between multiple said authenticators. 17. An authentication device, characterized in that it is used to provide an access service to an authentication requester, and if the authentication request initiated by the authentication requester is the first authentication request, it is forwarded to the server that stores the information about the authentication requester It is processed by the authentication server, and if it is a re-authentication request, it is processed locally. 18. The authentication device according to claim 17, characterized in that it comprises: a memory, configured to store the authentication information notified by the authentication server, the authentication information including the identity of the authentication requester; and An authentication module, configured to use the identification to retrieve the authentication information locally when the authentication requester initiates an authentication request to the authentication device again, and authenticate the authentication requester. 19. The authentication device according to claim 18, wherein the authentication information includes the password of the authentication requester and the authentication mode adopted by the authentication server and the authentication requester. 20. The authentication device according to claim 19, wherein the authentication module uses the authentication method to compare and verify the information of the re-authentication request with the password of the authentication requester stored locally. 21. The authentication device according to claim 20, wherein the authentication method includes an authentication method specified in an extended authentication protocol.

Images