A method for user access authentication

Abstract

The utility model relates to a method for user access verifying, which comprises: during the access verifying process, the user sends a request to the network, which sends a random number back to the user; the user adopts the random number and the user password to perform the encryption calculating and transmits the encryption result to the network; the network adopts the random number and the stored user password to perform the same encryption calculating to verify the user; if the verification is passed, the user is accessed into the network through the IP address distributed by the DHCP server. The utility model has the advantages that the password transmission is safer, the waste of the IP address is avoided and the attack from the illegal user is also effectively avoided.

Description

technical field [0001] The invention relates to network security authentication technology, in particular to a user access authentication method. Background technique [0002] Dynamic Host Configuration Protocol (DHCP: Dynamic Host Configuration Protocol) is based on the client-server model, which can dynamically assign IP addresses and other configuration information to hosts on the network. Figure 1 details the process of the DHCP server dynamically assigning IP addresses to DHCP clients: [0003] (1) Discovery stage: the stage where the DHCP client (Client) searches for the DHCP server (Server). [0004] When the DHCP client logs into the network for the first time, it will broadcast a DHCP discovery (Discover) message to the network. [0005] (2) Provisioning stage: the stage in which the DHCP server provides an IP address. [0006] Each DHCP server with a free address sends a DHCP Offer (Offer) message in response to the DHCP Discover message. [0007] (3) Selection...

AI Technical Summary

Problems solved by technology

[0017] (1) In PPPoE authentication, the authentication system must disassemble each packet to judge and identify whether the user is legal. Once the number of users or data packets increases, the encapsulation speed will inevitably fail to keep up and become a network bottleneck;

[0018] (2) After the PPPoE authentication is completed, the business data flow must also pass through the Broadband Access Server (BAS) device, which is likely to cause single-point bottlenecks and failures, and the device is usually very expensive;

[0019] (3) It is difficult to develop multicast services, and most video services are based on multicast;

[0020] (4) Operators are required to provide client terminal software, and the maintenance workload is too large

[0024] (1) Web is hosted on the application layer, which requires high equipment and high network construction costs;

[0025] (2) The user connectivity is poor, it is not easy to detect that the user is offline, and it is difficult to implement time-based billing;

[0026] (3) The ease of use is not good enough. Before accessing the network, whether it is Telnet, Ftp or other services, the user must use a browser for Web authentication;

[0027] (4) IP address distribution is before user authentication, if the user is not an Internet user, it will cause waste of addresses, and it is not convenient for the support of multiple ISPs (Internet Service Providers);

[0028] (5)DHCP+Web currently has no uniform standard

The disadvantages of this authentication method are:

[0031] (1) Specific client software is required: since there is no standard client for 802.1X at present, the client programs of different manufacturers are different, and the maintenance workload is relatively large;

[0032] (2) IP address allocation and network security issues: 802.1X protocol is a layer 2 protocol, which is only responsible for completing the authentication control of user ports. After completing port authentication, users need to continue to resolve user IP addresses after entering the layer 3 IP network. Therefore, relying solely on Ethernet switches + 802.1X cannot fully solve the problems of operability, manageability, and access security of Ethernet access in the metropolitan area network;

[0033] (3) 802.1X is weak in user control ability, and can only control port / bandwidth;

[0039] This technology is used by the client to select the session parameters used to generate the certificate (credential). This method cannot effectively prevent retransmission attacks.

Images