AAA service implementation method and system

Abstract

The invention provides an AAA service implementation method and system. An AAA service is implemented by utilization of an AAA cluster. The method comprises the steps that: the AAA cluster performs configuration authentication according to a received user request and user configuration information read from a redis cluster; and accounting information generated by the AAA cluster is stored in a storage cluster. According to AAA service implementation in the invention, a fork model occupying a lot of system resources is not used; when an authentication, authorization and accounting packet sent by a device is received, an AAA processing server obtains configuration information from the redis cluster; the fact that all AAA clusters obtain data from one data source is ensured; and modificationof user, device and role information on a front end by a user can take effect instantly.

Description

technical field [0001] The present invention relates to communication technology, specifically a method and system for realizing AAA service. Background technique [0002] AAA is the abbreviation of Authentication, Authorization, and Accounting. It is a security management mechanism for access control in network security, and provides three security services of authentication, authorization, and accounting. [0003] The existing AAA service is mainly Cisco's open source TACACS+, but TACACS+ uses the fork model, which will generate many processes and occupy system overhead during centralized device authentication. A general server can only carry simultaneous authentication of hundreds of devices. Moreover, the more devices there are, the larger the configuration files will be. The configuration files between the active and standby servers need to be synchronized, and the configuration files need to be loaded after restarting, which cannot make timely modification and take ef...

AI Technical Summary

Problems solved by technology

[0006] In the existing technology, there is a solution on Github based on TACACS+, but the poll model (event-driven model) used cannot meet the authentication requirements of 5000+ in terms of performance.

And the loading and synchronization method of the configuration file has not been modified

The cost of transforming into epoll (improved event-driven model epoll) is too high and maintenance is inconvenient

Moreover, the accounting information is still written in the same file, and the file needs to be locked for each operation, which will further reduce service performance

When troubleshooting, if you turn on the debug mode, you need to print all request logs, which will affect the efficiency of the request. The troubleshooting function of a single device or account is not supported.

Images