Network access method and device, electronic device, and computer-readable medium

Abstract

The present disclosure provides a network access method, comprising: obtaining a terminal identity; and checking and controlling messages sent by the terminal based on the terminal identity. The present disclosure also provides a network access device, an electronic device, and a computer-readable medium.

Description

Technical Field

[0001] The embodiments of the present disclosure relate to the field of communication network technology, and in particular to a network access method and apparatus, an electronic device, and a computer-readable medium. Background Art

[0002] With the continuous progress of society and economic development, the Internet has become an indispensable part of people's daily lives. The advancement of network technology, the evolution of network cloudification and ubiquity, and the convergence of 2B (Business-to-Business) and 2C (Business-to-Customer) services have led to an increasing number of network exposures, further blurring the boundaries of network security. At the same time, cyberattack methods continue to escalate, further threatening network security.

[0003] The traditional "patch-style" security design model has problems such as rigid structure, belated awareness, and lack of coordination. Its stacked and reinforced security architecture relies on a passive protection model based on prior knowledge, which makes it difficult to meet the new network security protection needs.

[0004] Therefore, it is necessary to break through the traditional design model, inject more powerful security genes into the network, and conduct network security design from the aspects of identity, data, network and other needs. For example, network access is based on the access terminal. By verifying the access terminal, the identity of the terminal can be ensured to be credible, and the security management and traceability of the terminal can be achieved. Summary of the Invention

[0005] Embodiments of the present disclosure provide a network access method and apparatus, an electronic device, and a computer-readable medium.

[0006] In a first aspect, an embodiment of the present disclosure provides a network access method, comprising:

[0007] Obtain the terminal's identity;

[0008] Check and control the messages sent by the terminal based on the identity identifier of the terminal.

[0009] In some embodiments, obtaining the terminal's identity includes: performing network access authentication on the terminal in response to an authentication request sent by the terminal, the authentication request including the terminal's identity; and saving the terminal's identity if the terminal's network access authentication passes.

[0010] In some embodiments, the network access authentication is 802.1x authentication.

[0011] In some embodiments, performing network access authentication on the terminal in response to an authentication request sent by the terminal includes: performing Transport Layer Security (TLS) authentication on the terminal according to an identity identifier of the terminal in response to an authentication request sent by the terminal.

[0012] In some embodiments, between the storing of the identity of the terminal and the checking and controlling of the messages sent by the terminal based on the identity of the terminal, it also includes: in response to an address application request sent by the terminal, allocating an Internet Protocol IP address to the terminal, so that the terminal uses the IP address to access the network.

[0013] In some embodiments, allocating an IP address to the terminal in response to an address application request sent by the terminal includes: allocating an original IP address to the terminal in response to the address application request sent by the terminal; placing the terminal's identity identifier into the original IP address to generate a complete IP address, and allocating the complete IP address to the terminal.

[0014] In some embodiments, when the network access authentication of the terminal is passed, saving the identity of the terminal includes: when the network access authentication of the terminal is passed, saving the identity of the terminal and the MAC address of the terminal; the address application request includes the MAC address of the terminal, and before putting the identity of the terminal into the original IP address, it also includes: obtaining the identity of the terminal based on the MAC address query of the terminal.

[0015] In some embodiments, assigning the complete IP address to the terminal includes: sending a first message to the terminal, the first message including the complete IP address and the MAC address of the terminal; responding to a second message from the terminal, the second message including the complete IP address and the MAC address of the terminal, and when the first message and the second message are consistent, sending a confirmation message including the complete IP address and the MAC address of the terminal.

[0016] In some embodiments, obtaining the identity of the terminal based on the MAC address query of the terminal includes: sending a first message to the terminal, the first message including the original IP address and the MAC address of the terminal; responding to a second message from the terminal, the second message including the original IP address and the MAC address of the terminal, and when the first message and the second message are consistent, obtaining the identity of the terminal based on the MAC address query of the terminal.

[0017] In some embodiments, when the network access authentication of the terminal is passed, saving the identity of the terminal includes: when the network access authentication of the terminal is passed, saving the identity of the terminal and the MAC address of the terminal; the address application request includes the MAC address of the terminal and / or the identity of the terminal, and in response to the address application request sent by the terminal, allocating an IP address to the terminal includes: judging whether the terminal has passed the network access authentication based on the MAC address of the terminal or the identity of the terminal; when the terminal passes the network access authentication, allocating an IP address to the terminal.

[0018] In some embodiments, the checking and controlling of the message sent by the terminal based on the identity of the terminal includes: obtaining the identity of the terminal sending the data message in response to the data message; checking whether the terminal sending the data message has passed the network access authentication based on the identity of the terminal sending the data message; and forwarding the data message if the terminal sending the data message has passed the network access authentication.

[0019] In a second aspect, an embodiment of the present disclosure provides a network access device, comprising:

[0020] Authentication module, used to obtain the identity of the terminal;

[0021] A control module is used to check and control the message sent by the terminal based on the identity identification of the terminal.

[0022] In a third aspect, an embodiment of the present disclosure provides an electronic device, comprising:

[0023] one or more processors;

[0024] a memory storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any one of the above-mentioned network access methods;

[0025] One or more I / O interfaces are connected between the processor and the memory, and are used to implement information exchange between the processor and the memory.

[0026] In a fourth aspect, an embodiment of the present disclosure provides a computer-readable medium having a computer program stored thereon, wherein the program implements any one of the above-mentioned network access methods when executed by a processor.

[0027] In the network access method and device, electronic device, and computer-readable medium of the embodiments of the present disclosure, messages sent by the terminal are checked and controlled based on the terminal's identity identification, and messages sent by terminals that have not passed the network access authentication (whether legal or illegal terminals) can be filtered, thereby improving the security of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In the accompanying drawings of the embodiments of the present disclosure:

[0029] Figure 1 A flowchart of a network access method provided by an embodiment of the present disclosure;

[0030] Figure 2 A flowchart of some steps of another network access method provided by an embodiment of the present disclosure;

[0031] Figure 3 A flowchart of some steps of another network access method provided by an embodiment of the present disclosure;

[0032] Figure 4 A flowchart of a specific embodiment of some steps of another network access method provided by an embodiment of the present disclosure;

[0033] Figure 5 A flowchart of some steps of another network access method provided by an embodiment of the present disclosure;

[0034] Figure 6 A flowchart of some steps of another network access method provided by an embodiment of the present disclosure;

[0035] Figure 7 A flowchart of some steps of another network access method provided by an embodiment of the present disclosure;

[0036] Figure 8 A flowchart of some steps of another network access method provided by an embodiment of the present disclosure;

[0037] Figure 9 A flowchart of a specific embodiment of some steps of another network access method provided by an embodiment of the present disclosure;

[0038] Figure 10 A flowchart of some steps of another network access method provided by an embodiment of the present disclosure;

[0039] Figure 11 A flowchart of a specific embodiment of some steps of another network access method provided by an embodiment of the present disclosure;

[0040] Figure 12 A flowchart of a specific embodiment of some steps of another network access method provided by an embodiment of the present disclosure;

[0041] Figure 13 A flowchart of a specific embodiment of some steps of another network access method provided by an embodiment of the present disclosure;

[0042] Figure 14 A flowchart of some steps of another network access method provided by an embodiment of the present disclosure;

[0043] Figure 15 A flowchart of a specific embodiment of some steps of another network access method provided by an embodiment of the present disclosure;

[0044] Figure 16 A flowchart of some steps of another network access method provided by an embodiment of the present disclosure;

[0045] Figure 17 A flowchart of some steps of another network access method provided by an embodiment of the present disclosure;

[0046] Figure 18 A flowchart of a specific embodiment of some steps of another network access method provided by an embodiment of the present disclosure;

[0047] Figure 19 A block diagram of a network access device provided in an embodiment of the present disclosure;

[0048] Figure 20 A block diagram of an electronic device according to an embodiment of the present disclosure;

[0049] Figure 21 A block diagram of the composition of a computer-readable medium provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0050] To enable those skilled in the art to better understand the technical solutions of the embodiments of the present disclosure, the network access method and apparatus, electronic device, and computer-readable medium provided by the embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0051] The embodiments of the present disclosure will be described more fully below with reference to the accompanying drawings, but the illustrated embodiments may be embodied in different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete and will fully enable those skilled in the art to understand the scope of this disclosure.

[0052] The accompanying drawings of the embodiments of the present disclosure are used to provide a further understanding of the embodiments of the present disclosure and constitute a part of the specification. Together with the embodiments of the present disclosure, they are used to explain the present disclosure and do not constitute a limitation of the present disclosure. By describing the detailed exemplary embodiments with reference to the accompanying drawings, the above and other features and advantages will become more apparent to those skilled in the art.

[0053] The embodiments of the present disclosure may be described with reference to plan views and / or cross-sectional views by way of ideal schematic views of the present disclosure. Therefore, the exemplary illustrations may be modified according to manufacturing techniques and / or tolerances.

[0054] In the absence of conflict, the various embodiments of the present disclosure and the various features therein may be combined with each other.

[0055] The terms used in this disclosure are only used to describe specific embodiments and are not intended to limit the disclosure. As used in this disclosure, the term "and / or" includes any and all combinations of one or more related enumerated items. As used in this disclosure, the singular forms "a" and "the" are also intended to include plural forms, unless the context clearly indicates otherwise. As used in this disclosure, the terms "comprising" and "made of" specify the presence of the features, wholes, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or groups thereof.

[0056] Unless otherwise defined, all terms (including technical and scientific terms) used in this disclosure have the same meanings as those commonly understood by those skilled in the art. It will also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant art and this disclosure, and will not be interpreted as having an idealized or overly formal meaning unless expressly defined in this disclosure.

[0057] The embodiments of the present disclosure are not limited to the embodiments shown in the drawings, but include modifications of the configurations formed based on the manufacturing process. Therefore, the regions illustrated in the drawings are schematic in nature, and the shapes of the regions shown in the drawings illustrate the specific shapes of the regions of the elements, but are not intended to be limiting.

[0058] In some related technologies, 802.1x (Access Control and Authentication Protocol) is used as a network access method. As a port-based terminal access control security mechanism, 802.1x has been widely supported and recognized by equipment manufacturers, major network operators and end users due to its low cost, good business continuity and scalability, high security and flexibility, and its universality for all local area networks that comply with the IEEE (Institute of Electrical and Electronics Engineers) 802 standard.

[0059] 802.1x uses ports as the authentication granularity. If a legitimate terminal passes 802.1x authentication and the switch port is opened, the terminal can access the network through this port. However, since the switch port remains open after it is opened, other user terminals (whether legitimate or illegitimate) can access the network and access network resources through this port without authentication, which brings potential security risks to the network.

[0060] First, refer to Figure 1 , an embodiment of the present disclosure provides a network access method, which includes:

[0061] S101: Obtain the terminal's identity.

[0062] The switch / authentication system (after the terminal passes the network access authentication) obtains the terminal's identity.

[0063] The process of the switch / authentication system obtaining the terminal's identity can be specifically as follows:

[0064] The terminal initiates network access authentication to the authentication system by sending an authentication request carrying the terminal's identity identifier to the authentication system. In response to the terminal's authentication request, the authentication system sends an authentication message carrying the terminal's identity identifier to the authentication server for authentication. The authentication server performs network access authentication on the terminal based on the terminal's identity identifier and determines whether the terminal is legal (that is, whether the terminal is a legal terminal).

[0065] When the authentication server determines that the terminal corresponding to the identity identifier has passed authentication (ie, the terminal's network access authentication has passed), the authentication server sends a message requesting the terminal to pass network access to the authentication system, and the switch / authentication system saves the terminal's identity identifier.

[0066] The switch / authentication system may also obtain the terminal's identity by configuring the switch, that is, configuring the identity of the terminal that has passed the network access authentication on the switch, and the switch / authentication system obtains the terminal's identity by reading the configuration information.

[0067] S102: Check and control the message sent by the terminal based on the identity of the terminal.

[0068] Since the switch stores the identity identifiers of terminals that have passed network access authentication, after receiving a message, the switch can obtain the identity identifier of the terminal sending the message and compare it with the stored identity identifiers of terminals that have passed network access authentication to determine whether the terminal sending the message has passed network access authentication. If the terminal sending the message has passed network access authentication, the switch forwards the message; if the terminal sending the message has not passed network access authentication, the switch refuses to forward the message.

[0069] It should be emphasized that the authentication system and the authentication server can be two independent devices deployed on the server side, or different components of a device deployed on the server side.

[0070] Similarly, the authentication system and the switch can be two independent devices or the same device, that is, one device acts as both a switch and an authentication system. The authentication system and the switch communicate with each other, and this information interaction process is omitted in the embodiments of this article.

[0071] In the network access method of this embodiment, the switch checks and controls the messages sent by the terminal based on the identity of the terminal, and can filter the messages sent by the terminal that has not passed the network access authentication (whether it is a legal terminal or an illegal terminal), thereby preventing the terminal that has not passed the network access authentication from accessing the network through the switch, thereby improving the security of the network.

[0072] In some embodiments, reference Figure 2 , obtaining the identity of the terminal (step S101) includes:

[0073] S201: In response to an authentication request sent by a terminal, perform network access authentication on the terminal, where the authentication request includes an identity identifier of the terminal.

[0074] The terminal initiates network access authentication to the authentication system by sending an authentication request carrying the terminal's identity identifier to the authentication system. In response to the terminal's authentication request, the authentication system sends an authentication message carrying the terminal's identity identifier to the authentication server for authentication. The authentication server performs network access authentication on the terminal based on the terminal's identity identifier and determines whether the terminal is legal (that is, whether the terminal is a legal terminal).

[0075] The authentication request sent by the terminal may include not only the terminal's identity but also the terminal's MAC (Media Access Control) address. The terminal's identity is the terminal's unique identifier for the entire network, which is different from other terminals and does not overlap with other terminals.

[0076] S202: When the network access authentication of the terminal is passed, obtain the identity of the terminal.

[0077] When the authentication server determines that the terminal corresponding to the identity identifier has passed authentication (ie, the terminal's network access authentication has passed), the authentication server sends a message requesting the terminal to pass network access to the authentication system, and the switch / authentication system saves the terminal's identity identifier.

[0078] It should be emphasized that the authentication system and the authentication server can be two independent devices deployed on the server side, or different components of a device deployed on the server side.

[0079] Similarly, the authentication system and the switch can be two independent devices, or they can be the same device, that is, one device acts as both a switch and an authentication system.

[0080] In the network access method of this embodiment, the authentication request sent by the terminal includes the identity identifier of the terminal. The authentication system and the authentication server can perform network access authentication on the terminal based on the identity identifier of the terminal. That is, the network access authentication of the terminal in the network access method of this embodiment is based on the terminal as the authentication granularity. Compared with the prior art that uses the port as the authentication granularity, the network access method of this embodiment has finer authentication granularity and higher security.

[0081] In some embodiments, the network access authentication is 802.1x authentication, that is, the network access authentication initiated by the terminal is 802.1x authentication.

[0082] As a port-based terminal access control security mechanism, 802.1x has been widely supported and recognized by equipment manufacturers, major network operators, and end users due to its low cost, good business continuity and scalability, high security and flexibility, and its universal applicability to all local area networks that comply with the IEEE (Institute of Electrical and Electronics Engineers) 802 standard.

[0083] Reference Figure 3 The network access authentication is 802.1x authentication. In response to the authentication request sent by the terminal, performing network access authentication on the terminal (step S201) includes:

[0084] S301: In response to an authentication request sent by a terminal, perform TLS authentication on the terminal according to the terminal's identity.

[0085] The terminal initiates 802.1x authentication to the authentication system by sending an authentication request carrying the terminal's identity identifier to the authentication system. In response to the terminal's authentication request, the authentication system sends an authentication message carrying the terminal's identity identifier to the authentication server for authentication. The authentication server performs 802.1 authentication on the terminal based on the terminal's identity identifier to determine whether the terminal is legal (that is, whether the terminal is a legal terminal).

[0086] When the authentication server receives the terminal's identity during 802.1x authentication, it can determine whether TLS (Transport Layer Security) authentication is required for the terminal based on the terminal's identity. If the authentication server determines that TLS authentication is required for the terminal, the authentication server performs TLS authentication on the terminal based on the terminal's identity.

[0087] By performing TLS authentication on the terminal, a session key recognized by both the terminal and the authentication server can be generated. The generated session key can be used to protect the confidentiality and integrity of the terminal's messages.

[0088] Figure 4 This is a flowchart of a specific embodiment of the 802.1x authentication step for a terminal in the network access method of the embodiment of the present disclosure, with reference to Figure 4 802.1x authentication for a terminal may include:

[0089] S401. The switch is pre-configured to allow only 802.1x packets to pass through the enabled port, and to deny other types of packets.

[0090] S402: The terminal sends an EAPOL_Start message to the authentication system to initiate 802.1x authentication.

[0091] S403: The authentication system sends an EAP Request / Identity message to the terminal, inquiring the terminal for its identity.

[0092] S404: The terminal sends an EAP Response / Identity message to the authentication system, and replies with the terminal identity.

[0093] S405 : The authentication system encapsulates the EAP Response / Identity message into a Radius-access-request message format and sends it to the authentication server, that is, sends the authentication request carrying the terminal identity to the authentication server.

[0094] S406: The authentication server determines whether TLS authentication is required for the terminal based on the terminal identity identifier. If TLS authentication is required for the terminal, the TLS authentication process is started.

[0095] S407: The authentication server encapsulates the TLS authentication start message in a Radius-access-challenge message and sends it to the authentication system.

[0096] S408: The authentication system decapsulates the EAP-Request / EAP-TLS / TLS-Start message and forwards it to the terminal, informing the terminal to start TLS authentication.

[0097] S409: The terminal sends an EAP-Request / EAP-TLS / Client-Hello message to the authentication system. The message includes: a list of algorithms supported by the terminal and a randomly generated random number A.

[0098] S410: The authentication system converts the received EAP-Request / EAP-TLS / Client-Hello message into a Radius-access-request message format, and sends the converted message to the authentication server.

[0099] S411. The authentication server replies with a Radius-access-challenge message to the authentication system. The message includes: the algorithm confirmed by the authentication server from the algorithms supported by the terminal, the authentication server certificate, and a randomly generated random number B.

[0100] S412. The authentication system receives the Radius-access-challenge message and decapsulates it, obtains the EAP-Request / EAP-TLS / Server-Hello message from the decapsulated message, and sends the algorithm confirmed by the authentication server, the authentication server certificate, and the random number B to the terminal.

[0101] S413. The terminal verifies the authentication server certificate. If the authentication server certificate is valid, the terminal sends an EAP-Response / EAP-TLS / Client-Cert message to the authentication system. The message includes the terminal certificate and a random number C encrypted with the authentication server public key (the random number C is also randomly generated).

[0102] S414: The authentication system converts the received EAP-Response / EAP-TLS / Client-Cert message into a Radius-access-request message format, and sends the converted message to the authentication server.

[0103] S415: After receiving the Radius-access-request message, the authentication server verifies the terminal's certificate and decrypts it using the authentication server's private key to obtain a random number C.

[0104] S416: If the terminal certificate is valid, the authentication server sends a Radius-access-challenge message to the authentication system to notify the terminal that authentication is complete.

[0105] S417 , the authentication system decapsulates the received Radius-access-challenge message, obtains the EAP-Response / EAP-TLS / ChangeCipher message from the decapsulated message, and forwards it to the terminal, notifying the terminal that authentication is complete.

[0106] S418: The terminal uses the random numbers A, B, and C and the algorithm confirmed by the authentication server to derive a session key.

[0107] S419: The authentication server uses the random numbers A, B, and C and the algorithm confirmed by the authentication server to derive the session key.

[0108] S420: The authentication server sends a Radius-access-accept (EAP-Success) message to the authentication system, where the message includes a session key.

[0109] S421. The authentication system saves the terminal identity, terminal MAC address, and session key.

[0110] S422: The authentication system sends an EAP-Success message to the terminal, notifying the terminal that 802.1x authentication is successful.

[0111] S423. The terminal 802.1x authentication succeeds, and the switch opens the port, allowing non-802.1x packets to pass through the port.

[0112] Optionally, during the above authentication process, the terminal may send the MAC address to the authentication server via the authentication system.

[0113] In some embodiments, reference Figure 5 When the network access authentication of the terminal is passed, the steps between saving the identity of the terminal (step S101) and checking and controlling the message sent by the terminal based on the identity of the terminal (step S102) further include:

[0114] S501: In response to an address application request sent by a terminal, allocate an IP address to the terminal, so that the terminal can access a network using the IP address.

[0115] When the authentication server determines that the terminal authentication is successful, the switch also opens the port. The terminal can send an address application request to the network device (such as a DHCP server) through this port. After receiving the address application request sent by the terminal, the DHCP server assigns an IP (Internet Protocol) address to the terminal, and the terminal uses this IP address to access the network.

[0116] In some embodiments, reference Figure 6 In response to the address application request sent by the terminal, an IP address is allocated to the terminal so that the terminal can access the network using the IP address (step S501), including:

[0117] S601: In response to an address application request sent by a terminal, allocate an original IP address to the terminal.

[0118] When the authentication server determines that the terminal has passed authentication, the switch also opens a new port. The terminal can send an address request to the DHCP server through this port. After receiving the address request sent by the terminal, the DHCP server assigns an original IP address to the terminal.

[0119] S602: Put the terminal's identity into the original IP address to generate a complete IP address, and allocate the complete IP address to the terminal.

[0120] The DHCP server obtains the terminal's identity, adds the terminal's identity to the generated original IP address, generates a complete IP address, and allocates the complete IP address to the terminal, so that the terminal can access the network using the complete IP address.

[0121] Among them, the DHCP server can put the terminal's identity identifier at the end of the original IP address, that is, use the original IP address as the prefix of the complete IP address and the terminal identity identifier as the end of the complete IP address to generate a complete IP address. In this way, after the switch receives the message sent by the terminal, the end that obtains the IP address can obtain the terminal identity identifier.

[0122] Of course, the terminal identity can also be placed in the original IP address or elsewhere in the network layer. However, the terminal identity placed in the complete IP address composed of the original IP address must comply with the IP address composition rules and the switch must be able to distinguish the terminal identity from the complete IP address. If the terminal identity is placed elsewhere in the message network layer, the switch can distinguish the terminal identity from the network layer.

[0123] Since the terminal uses a full IP address to access the network, the switch can obtain the terminal's identifier based on the full IP address used by the terminal after receiving the message, and further determine the authenticity of the terminal's identity and whether the terminal has passed network access authentication based on the terminal's identifier.

[0124] Compared with the prior art in which the port is used as the authentication granularity, a legitimate terminal passes the network access authentication, the switch port is opened, and remains in the open state after being opened. When other users' terminals (whether legitimate or illegal) access the network through the port, they can access the network and access network resources without authentication. The network access method of this embodiment uses the terminal as the authentication granularity, and puts the terminal identifier into the IP address assigned to the terminal, so that after receiving the message, the switch can obtain the terminal identifier according to the IP address of the terminal sending the message, and further judge the authenticity of the terminal identity and whether the terminal has passed the network access authentication based on the terminal identifier. In this way, when other users' terminals (whether legitimate or illegal) access the network through the port, the switch will determine that these terminals have not passed the network access authentication, and then deny these terminals access to the network and access network resources, thereby improving the security of the network.

[0125] In some embodiments, the address request sent by the terminal includes the MAC address of the terminal. Figure 7 In the case where the address application request sent by the terminal includes the MAC address of the terminal, before the step of placing the terminal's identity into the original IP address (step S602), the method further includes:

[0126] S701: Obtain the terminal's identity based on the terminal's MAC address.

[0127] During the process of performing network access authentication on a terminal, the authentication system and the authentication server not only save the terminal's identity, but also the terminal's MAC address. When the authentication system and the authentication server save the terminal's MAC address, the DHCP server generates an original IP address for the terminal after receiving the address application request sent by the terminal. It can query the authentication system or the authentication server based on the MAC address in the address application request to obtain the terminal's identity, and after obtaining the terminal's identity, put the terminal's identity into the generated original IP address to generate a complete IP address, and then assign the complete IP address to the terminal so that the terminal can use the complete IP address to access the network. Specifically, the DHCP server can assign the complete IP address to the terminal by sending the complete IP address to the terminal, or by having the terminal generate the complete IP address based on its own identity in a manner agreed upon with the DHCP server, or by constructing a message containing the identity to assign the complete IP address to the terminal.

[0128] Further, in some embodiments, referring to Figure 8 The step of allocating a complete IP address to the terminal in step S602 may include:

[0129] S801. Send a first message to a terminal, where the first message includes a complete IP address and a MAC address of the terminal.

[0130] S802. In response to the second message from the terminal, if the first message and the second message are consistent, send a confirmation message, where the second message includes the complete IP address and the MAC address of the terminal, and the confirmation message includes the complete IP address and the MAC address of the terminal.

[0131] After generating the complete IP address, the DHCP server sends a first message (such as a DHCP offer message) to the terminal. The message includes the complete IP address and the terminal MAC address.

[0132] After receiving the first message, the terminal broadcasts a second message (such as a DHCP request formal request message), which includes the complete IP address received by the terminal and the MAC address of the terminal.

[0133] The DHCP server receives the second message and determines whether the full IP address and terminal MAC address in the second message are consistent with the full IP address it generates and the recorded terminal MAC address (that is, the full IP address and terminal MAC address in the first message). If they are consistent, it means that the full IP address received by the terminal is the correct full IP address. The DHCP server then sends a confirmation message to confirm that the full IP address received by the terminal is correct and the terminal can use the IP address to access the network.

[0134] Figure 9 This is a flowchart of a specific embodiment of the step of allocating an IP address to a terminal in response to an application address request sent by the terminal in the network access method of this embodiment, so that the terminal can access the network using the IP address, when the application address request sent by the terminal includes the MAC address of the terminal. Figure 9 In response to the address application request sent by the terminal, allocating an IP address to the terminal so that the terminal can access the network using the IP address may include:

[0135] S901: The terminal broadcasts a DHCP discover message (ie, an address request), which includes the terminal MAC address.

[0136] In the case of IPv6, the DHCP discover message needs to be replaced with a DHCPv6 solicit message.

[0137] S902: The DHCP server queries the authentication system for the terminal's identity through the terminal's MAC address.

[0138] S903: The authentication system sends the retrieved terminal identity to the DHCP server.

[0139] S904: The DHCP server adds the terminal identity to the original IP address allocated to the terminal to generate a complete IP address.

[0140] S905: The DHCP server sends a DHCP offer message to the terminal. The message includes: a complete IP address, a terminal MAC address, an IP address of the DHCP server, a lease period, etc.

[0141] In the case of IPv6, the DHCP offer message needs to be replaced with a DHCPv6 Advertise message.

[0142] S906: The terminal broadcasts a DHCP request formal request message, which includes the complete IP address, the terminal MAC address, the IP address of the DHCP server, etc.

[0143] S907: The DHCP server checks the address allocation information. If the received complete IP address, terminal MAC address, and DHCP server IP address match the address allocation result in the DHCP server, the process proceeds to step S708; otherwise, the message is discarded.

[0144] S908. The DHCP server sends a DHCPACK message, which includes: the complete IP address, the terminal MAC address, the IP address of the DHCP server, the lease period, etc., and the process of the DHCP server allocating an IP address to the terminal is completed.

[0145] In the case of IPv6, the DHCPACK message needs to be replaced with a DHCPv6 reply message.

[0146] Of course, the DHCP server can also send the original IP address assigned to the terminal to the terminal. After verifying that the original IP address received by the terminal is correct, the DHCP server obtains the terminal's identity based on the terminal's MAC address, and the DHCP server puts the terminal's identity into the original IP address to generate a complete IP address.

[0147] That is, in some embodiments, reference Figure 10 The step of obtaining the terminal's identity according to the terminal's MAC address query (step S701) may include:

[0148] S1001. Send a first message to a terminal, where the first message includes an original IP address and a MAC address of the terminal.

[0149] S1002: In response to a second message from the terminal, the second message includes an original IP address and a MAC address of the terminal. When the first message and the second message are consistent, obtain an identity of the terminal based on the MAC address of the terminal.

[0150] After allocating an original IP address to the terminal, the DHCP server sends a first message (such as a DHCP offer message) to the terminal. The message includes the original IP address and the terminal MAC address.

[0151] After receiving the first message, the terminal broadcasts a second message (such as a DHCP request formal request message), which includes the original IP address received by the terminal and the MAC address of the terminal.

[0152] The DHCP server receives the second message and determines whether the original IP address and terminal MAC address in the second message are consistent with the original IP address it generated and the recorded terminal MAC address (that is, the original IP address and terminal MAC address in the first message). If they are consistent, it means that the original IP address received by the terminal is the correct original IP address. The DHCP server then obtains the terminal's identity through the terminal's MAC address query and sends a confirmation message to confirm that the original IP address received by the terminal is correct. The confirmation message includes the complete IP address, and the terminal can use the complete IP address to access the network.

[0153] Figure 11 This is a flowchart of a specific embodiment of the step of allocating an IP address to a terminal in response to an address application request sent by the terminal, so that the terminal can access the network using the IP address, when the address application request sent by the terminal includes the MAC address of the terminal and the original IP address is sent to the terminal. Figure 11 In response to the address application request sent by the terminal, allocating an IP address to the terminal so that the terminal can access the network using the IP address may include:

[0154] S1101: The terminal broadcasts a DHCP discover message, which includes the terminal MAC address.

[0155] In the case of IPv6, the DHCP discover message needs to be replaced with a DHCPv6 solicit message.

[0156] S1102: The DHCP server allocates an original IP address to the terminal and sends a DHCP offer message to the terminal. The message includes: the original IP address, the terminal MAC address, the IP address of the DHCP server, the lease period, etc.

[0157] In the case of IPv6, the DHCP offer message needs to be replaced with a DHCPv6 Advertise message.

[0158] S1103: The terminal broadcasts a DHCP request formal request message, which includes the original IP address, the terminal MAC address, the IP address of the DHCP server, etc.

[0159] S1104: The DHCP server checks the address allocation information. If the received original IP address, terminal MAC address, and DHCP server IP address match the allocation result in the DHCP server, step S905 is performed; otherwise, the message is discarded.

[0160] S1105: The DHCP server queries the authentication system for the terminal's identity through the terminal's MAC address.

[0161] S1106: The authentication system sends the retrieved terminal identity to the DHCP server.

[0162] S1107: The DHCP server adds the terminal identity identifier to the original IP address allocated to the terminal to generate a complete IP address.

[0163] The DHCP server may place the terminal's identity identifier after the original IP address, that is, generate a complete IP address using the original IP address as a prefix of the complete IP address.

[0164] S1108. The DHCP server sends a DHCPACK message, which includes: the complete IP address, the terminal MAC address, the IP address of the DHCP server, the lease period, etc., and the DHCP server completes the process of allocating an IP address to the terminal.

[0165] In the case of IPv6, the DHCPACK message needs to be replaced with a DHCPv6 reply message.

[0166] Figure 12 This is a flowchart of another specific embodiment of the step of allocating an IP address to the terminal in response to the address application request sent by the terminal in the network access method of this embodiment, so that the terminal can access the network using the IP address, when the address application request sent by the terminal includes the MAC address of the terminal and the original IP address is sent to the terminal. Figure 12In response to the address application request sent by the terminal, allocating an IP address to the terminal so that the terminal can access the network using the IP address may include:

[0167] S1201: The terminal broadcasts a DHCP discover message, which includes the terminal MAC address.

[0168] In the case of IPv6, the DHCP discover message needs to be replaced with a DHCPv6 solicit message.

[0169] S1202: The DHCP server allocates an original IP address to the terminal and sends a DHCP offer message to the terminal. The message includes: the original IP address, the terminal MAC address, the IP address of the DHCP server, the lease period, etc.

[0170] In the case of IPv6, the DHCP offer message needs to be replaced with a DHCPv6 Advertise message.

[0171] S1203: The terminal broadcasts a DHCP request message, which includes the original IP address, the terminal MAC address, the IP address of the DHCP server, etc.

[0172] S1204: The DHCP server checks the address allocation information. If the received original IP address, terminal MAC address, and DHCP server IP address match the allocation result in the DHCP server, the process proceeds to step S1005; otherwise, the message is discarded.

[0173] S1205: The DHCP server queries the authentication server for the terminal's identity through the terminal's MAC address.

[0174] This step may occur after receiving the DHCP discover message (ie, between step S1201 and step S1202 ), or after receiving the DHCP request message (ie, there is no particular order between this step and step S1204 ).

[0175] and Figure 11 Unlike the corresponding specific embodiment, in this specific embodiment, the DHCP server queries the authentication server for the terminal's identity. During the terminal authentication process, the authentication system will always store the correspondence between the terminal's MAC address and the terminal's identity, but the authentication server may not necessarily store the correspondence between the terminal's MAC address and the terminal's identity. If the authentication server stores the correspondence between the terminal's MAC address and the terminal's identity, the authentication server can be queried for the terminal's identity.

[0176] S1206: The authentication server sends the retrieved terminal identity to the DHCP server.

[0177] S1207: The DHCP server adds the terminal identity to the original IP address allocated to the terminal to generate a complete IP address.

[0178] S1208. The DHCP server sends a DHCPACK message, which includes: the complete IP address, the terminal MAC address, the IP address of the DHCP server, the lease period, etc., and the DHCP server completes the process of allocating an IP address to the terminal.

[0179] In the case of IPv6, the DHCPACK message needs to be replaced with a DHCPv6 reply message.

[0180] In some embodiments, although the address application request sent by the terminal only includes the MAC address of the terminal, after receiving the address application request sent by the terminal, the authentication system actively queries and obtains the terminal's identity based on the terminal's MAC address, and then puts the terminal's identity into the address application request, and sends the address application request with the terminal's identity to the DHCP server. The DHCP server can then obtain the terminal's MAC address and the terminal's identity at one time.

[0181] Figure 13 In the case where the authentication system actively queries and obtains the identity of the terminal according to the terminal MAC address in the application address request, the network access method of this embodiment responds to the application address request sent by the terminal and allocates an IP address to the terminal so that the terminal can access the network using the IP address. Figure 13 In response to the address application request sent by the terminal, allocating an IP address to the terminal so that the terminal can access the network using the IP address may include:

[0182] S1301: The terminal broadcasts a DHCP discover message, which includes the terminal MAC address.

[0183] In the case of IPv6, the DHCP discover message needs to be replaced with a DHCPv6 solicit message.

[0184] S1302: The authentication system obtains the terminal's identity based on the terminal's MAC address, and puts the terminal's identity into a DHCP discover message.

[0185] S1303: The authentication system sends the modified DHCP discover message to the DHCP server.

[0186] S1304: The DHCP server adds the terminal identity identifier to the original IP address allocated to the terminal to generate a complete IP address.

[0187] S1305: The DHCP server sends a DHCP offer message to the terminal. The message includes: the complete IP address, the terminal MAC address, the IP address of the DHCP server, the lease period, etc.

[0188] In the case of IPv6, the DHCP offer message needs to be replaced with a DHCPv6 Advertise message.

[0189] S1306: The terminal broadcasts a DHCP request formal request message, which includes the complete IP address, the terminal MAC address, the IP address of the DHCP server, etc.

[0190] S1307: The DHCP server checks the address allocation information. If the received complete IP address, terminal MAC address, and DHCP server IP address match the address allocation result in the DHCP server, the process proceeds to step S1108; otherwise, the message is discarded.

[0191] S1308: The DHCP server sends a DHCPACK message, which includes: the complete IP address, the terminal MAC address, the IP address of the DHCP server, the lease period, etc., and the DHCP server completes the process of allocating an IP address to the terminal.

[0192] In the case of IPv6, the DHCPACK message needs to be replaced with a DHCPv6 reply message.

[0193] Different from other specific embodiments, in this specific embodiment, the authentication system sends the identity of the terminal to the DHCP server, and the DHCP server constructs a complete IP address based on the identity of the terminal.

[0194] In some embodiments, the address application request sent by the terminal includes the terminal's identity. Figure 14 In the case where the address application request sent by the terminal includes the MAC address of the terminal and the terminal identity, the terminal identity is added to the original IP address to generate a complete IP address. The step of allocating the complete IP address to the terminal (step S602) includes:

[0195] S1401: Add the terminal identity in the address application request to the original IP address to generate a complete IP address.

[0196] S1402: Send a first message to the terminal, where the first message includes a complete IP address and a MAC address of the terminal.

[0197] S1403: In response to the second message from the terminal, the second message includes the complete IP address and the MAC address of the terminal. If the first message and the second message are consistent, send a confirmation message including the complete IP address and the MAC address of the terminal.

[0198] The DHCP server obtains the terminal's identity according to the address application request, and adds the terminal's identity to the generated original IP address to generate a complete IP address. After generating the complete IP address, it sends a first message (such as a DHCP offer message) to the terminal, which includes the complete IP address and the terminal's MAC address.

[0199] After receiving the first message, the terminal broadcasts a second message (such as a DHCP request formal request message), which includes the complete IP address received by the terminal and the MAC address of the terminal.

[0200] The DHCP server receives the second message and determines whether the full IP address and terminal MAC address in the second message are consistent with the full IP address it generates and the recorded terminal MAC address (that is, the full IP address and terminal MAC address in the first message). If they are consistent, it means that the full IP address received by the terminal is the correct full IP address. The DHCP server then sends a confirmation message to confirm that the full IP address received by the terminal is correct and the terminal can use the IP address to access the network.

[0201] Figure 15 This is a flowchart of a specific embodiment of the step of allocating an IP address to a terminal in response to an application address request sent by the terminal in the network access method of this embodiment, so that the terminal can access the network using the IP address. Figure 15 In response to the address application request sent by the terminal, allocating an IP address to the terminal so that the terminal can access the network using the IP address may include:

[0202] S1501: The terminal broadcasts a DHCP discover message, which includes the terminal MAC address and the terminal identity encrypted with a session key.

[0203] DHCP discover messages are broadcast by terminals. Multiple devices on the network can receive DHCP discover messages sent by terminals. The terminal's identity is encrypted using a session key. Even if other devices on the network receive the DHCP discover message, they cannot obtain the terminal's identity because they do not have the session key, thereby increasing security.

[0204] In the case of IPv6, the DHCP discover message needs to be replaced with a DHCPv6 solicit message.

[0205] S1502: The authentication system searches for the session key corresponding to the terminal MAC address and uses the session key to decrypt the session key to obtain the terminal's identity.

[0206] S1503: The authentication system sends the DHCP discover message decrypted by the session key to the DHCP server, which carries the terminal's identity.

[0207] S1504: The DHCP server puts the terminal identity into the generated original IP address to generate a complete IP address.

[0208] S1505. The DHCP server sends a DHCP offer message to the terminal. The message includes: a complete IP address, a terminal MAC address, an IP address of the DHCP server, a lease period, etc.

[0209] In the case of IPv6, the DHCP offer message needs to be replaced with a DHCPv6 Advertise message.

[0210] S1506: The terminal broadcasts a DHCP request formal request message, which includes the complete IP address, the terminal MAC address, the IP address of the DHCP server, etc.

[0211] S1507: The DHCP server checks the address allocation information. If the received complete IP address, terminal MAC address, and DHCP server IP address match the address allocation result in the server, the process proceeds to step S1308; otherwise, the message is discarded.

[0212] S1508. The DHCP server sends a DHCPACK message, which includes: the complete IP address, the terminal MAC address, the IP address of the DHCP server, the lease period, etc., and the DHCP server completes the process of allocating an IP address to the terminal.

[0213] In the case of IPv6, the DHCPACK message needs to be replaced with a DHCPv6 reply message.

[0214] In some embodiments, reference Figure 16 After allocating the complete IP address to the terminal (step S602), the method further includes:

[0215] S1601. Record the correspondence between the complete IP address of the terminal, the terminal identity, and the terminal MAC address.

[0216] Network devices (such as switches) record the terminal's identity, full IP address, terminal MAC address, and the switch port number corresponding to the terminal, as well as their corresponding relationship. If the terminal IP contains the terminal's identity, there is no need to record the terminal's identity separately.

[0217] The terminal uses a complete IP address to access the network. After receiving the data message, the switch will check and control the message based on the terminal's identity. For details, refer to Figure 16 , checking and controlling the messages sent by the terminal based on the terminal's identity includes:

[0218] S1602: In response to the data message, obtain the identity of the terminal that sends the data message.

[0219] S1603: Check whether the terminal sending the data message has passed the network access authentication according to the identity identifier of the terminal sending the data message.

[0220] S1604: When the terminal sending the data message passes the network access authentication, the data message is forwarded.

[0221] After receiving the data message, the switch obtains the identity of the terminal sending the data message based on the IP address of the data message, and checks whether the terminal sending the data message matches the switch's record based on the identity of the terminal sending the data message, that is, whether the terminal sending the data message has passed the network access authentication.

[0222] Specifically, based on the obtained terminal identity identifier, it is determined whether the identity authenticity of the terminal sending the data message, whether the terminal has passed the network access authentication, whether the switch port corresponding to the terminal is consistent with the port assigned to the terminal by the switch, whether the IP address assigned to the terminal is consistent with the IP address used by the terminal, etc. Only after the identity authenticity judgment, network access authentication and port consistency authentication have been passed, the switch forwards the data message and allows the terminal to access the network through the port and access network resources.

[0223] Of course, when the terminal IP contains the terminal identity, and the switch records the terminal identity, complete IP address, terminal MAC address, the switch port number corresponding to the terminal, and their correspondence, the switch can only determine whether the terminal has passed the network access authentication and whether the switch port corresponding to the terminal is consistent with the port allocated by the switch to the terminal by whether the terminal IP, terminal MAC, and the switch port number to which the terminal is connected are consistent with its own records.

[0224] In some embodiments, the address application request sent by the terminal includes the MAC address of the terminal and / or the identity of the terminal. Figure 17In the case where the address application request sent by the terminal includes the MAC address of the terminal and / or the identity of the terminal, the step of allocating an IP address to the terminal in response to the address application request sent by the terminal (step S501) includes:

[0225] S1701: Determine whether the terminal passes the network access authentication based on the terminal's MAC address or the terminal's identity identifier.

[0226] S1702: When the terminal passes the network access authentication, an IP address is allocated to the terminal.

[0227] After receiving the address application request sent by the terminal, the switch determines whether the terminal has passed the network access authentication based on the MAC address of the terminal in the address application request, if the address application request includes the terminal's identity identifier. If the address application request includes the terminal's identity identifier and the terminal's MAC address, the switch determines whether the terminal has passed the network access authentication based on the terminal's identity identifier in the address application request, or determines whether the terminal has passed the network access authentication based on the terminal's MAC address in the address application request.

[0228] When the switch determines that the terminal has passed the network access authentication request, the switch forwards the address application request to the DHCP server. The DHCP server assigns an IP address to the terminal, and the terminal uses the IP address to access the network.

[0229] Further, refer to Figure 17 , after step S1702, further comprising:

[0230] S1703: Record the correspondence between the IP address, the terminal's identity identifier, and the terminal's MAC address.

[0231] The network device (such as a switch) records the terminal's identity, the IP address assigned to the terminal by the DHCP server, the terminal's MAC address, and their corresponding relationship.

[0232] S1704: In response to the data message, check whether the terminal sending the data message has passed the network access authentication according to the terminal identity identifier in the data message and the IP address of the data message.

[0233] S1705: When the terminal sending the data message passes the network access authentication, forward the data message.

[0234] When sending a message, the terminal can put the terminal's identity into the terminal's IP address. After receiving the data message, the switch will check and control the message based on the terminal's identity, terminal IP, terminal MAC and the switch port number to which the terminal is connected.

[0235] Specifically, the switch obtains the identity of the terminal sending the data message according to the IP address of the data message, and checks whether the terminal sending the data message matches the switch's record based on the identity of the terminal sending the data message, that is, whether the terminal sending the data message passes the network access authentication.

[0236] Specifically, the authenticity of the identity of the terminal sending the data message, whether the terminal has passed the network access authentication, whether the switch port corresponding to the terminal is consistent with the port allocated to the terminal by the switch, etc. are judged based on the obtained terminal identity identifier. Only when the identity authenticity judgment, network access authentication and port consistency authentication are passed, the switch forwards the data message and allows the terminal to access the network through the port and access network resources.

[0237] The terminal can also put the terminal's identity into the message (such as the reserved bit in the message header). After receiving the data message, the switch will check and control the message based on the terminal's identity, terminal IP, terminal MAC, and the switch port number to which the terminal is connected. The switch decapsulates the data message to obtain the identity of the terminal that sent the data message. It then determines the authenticity of the identity of the terminal that sent the data message, whether the terminal has passed network access authentication, whether the switch port corresponding to the terminal is consistent with the port assigned to the terminal by the switch, and whether the IP address assigned to the terminal is consistent with the IP address used by the terminal. Only after identity authenticity judgment, network access authentication, and port consistency authentication have been completed will the switch forward the data message and allow the terminal to access the network through the port and access network resources.

[0238] Of course, when the terminal IP contains the terminal identity, and the switch records the terminal identity, complete IP address, terminal MAC address, the switch port number corresponding to the terminal, and their correspondence, the switch can only determine whether the terminal has passed the network access authentication and whether the switch port corresponding to the terminal is consistent with the port allocated by the switch to the terminal by whether the terminal IP, terminal MAC, and the switch port number to which the terminal is connected are consistent with its own records.

[0239] Figure 18This is a flowchart of a specific embodiment of the step of allocating an IP address to a terminal in response to an application address request sent by the terminal in the network access method of this embodiment, when the application address request sent by the terminal includes the MAC address of the terminal or the identity identifier of the terminal, with reference to Figure 18 In response to the address application request sent by the terminal, the step of allocating an IP address to the terminal may include:

[0240] S1801: The terminal broadcasts a DHCP discover message, which includes the terminal MAC address or the terminal identity.

[0241] In the case of IPv6, the DHCP discover message needs to be replaced with a DHCPv6 solicit message.

[0242] S1802: The switch checks whether the terminal has passed the network access authentication based on the terminal MAC address or the terminal identity. If so, the switch forwards the DHCP discover message.

[0243] This specific embodiment uses a switch to check whether the terminal matches the recorded information based on the terminal MAC address, that is, whether it has passed the network access authentication. Since the terminal must access the network through the switch, the switch checks whether the terminal has been verified to have passed the network access authentication. In this way, the terminal access process can be completed through information exchange between the terminal, the DHCP server, and the switch, without the need for the participation of other network devices (such as the authentication system). On the one hand, it can reduce costs, and on the other hand, it can also increase security.

[0244] Of course, if the address application request sent by the terminal includes the terminal's identity, the switch can determine whether the terminal has passed the network access authentication based on the terminal's identity after receiving the address application request sent by the terminal.

[0245] S1803: The switch forwards the DHCP discover message to the DHCP server.

[0246] S1804: The DHCP server allocates an IP address to the terminal and replies with a DHCP offer message to the terminal. The message includes: the IP address allocated to the terminal, the terminal MAC address, the IP address of the DHCP server, the lease period, etc.

[0247] In the case of IPv6, the DHCP offer message needs to be replaced with a DHCPv6 Advertise message.

[0248] S1805: The terminal broadcasts a DHCP request formal request message, which includes the IP address received by the terminal, the terminal MAC address, the IP address of the DHCP server, etc.

[0249] S1806: The DHCP server checks the address allocation information. If the received IP address, terminal MAC address, and DHCP server IP address match the address allocation result in the DHCP server, the process proceeds to step S1607; otherwise, the message is discarded.

[0250] S1807: The DHCP server sends a DHCPACK message, which includes: the IP address allocated to the terminal, the terminal MAC address, the IP address of the DHCP server, the lease period, etc., and the DHCP server completes the process of allocating an IP address to the terminal.

[0251] The IP address may be just an address prefix.

[0252] In the case of IPv6, the DHCPACK message needs to be replaced with a DHCPv6 reply message.

[0253] S1808. Record the terminal IP address (ie, the IP address assigned to the terminal by the DHCP server), the terminal MAC address, and the switch port number corresponding to the terminal.

[0254] S1809: When sending a message, the terminal puts its own identity into the message IP address, or into the message (such as the message header, option header, etc.).

[0255] That is, the terminal generates a complete IP address based on its own identity, or constructs a message containing the identity. At this time, the network device (such as a switch) needs to record the terminal's identity, terminal MAC address and their corresponding relationship during or after terminal authentication.

[0256] S1810. After receiving the message, the switch will check and control the message based on the terminal identity, terminal IP, terminal MAC and the switch port number to which the terminal is connected, obtain the terminal identity according to the message, and determine the authenticity of the terminal identity, whether the terminal has passed the network access authentication, and whether the port corresponding to the terminal is consistent with the port currently used by the terminal.

[0257] If the authentication is successful, the switch forwards the message, and the terminal accesses the network through the switch and accesses network resources.

[0258] Secondly, refer to Figure 19 , an embodiment of the present disclosure provides a network access device, comprising:

[0259] Authentication module, used to obtain the identity of the terminal;

[0260] The control module is used to check and control the messages sent by the terminal based on the identity identification of the terminal.

[0261] Thirdly, refer to Figure 20 , an embodiment of the present disclosure provides an electronic device, comprising:

[0262] one or more processors,

[0263] A memory having one or more programs stored thereon, wherein when the one or more programs are executed by one or more processors, the one or more processors implement any one of the above-mentioned network access methods;

[0264] One or more I / O interfaces are connected between the processor and the memory to implement information exchange between the processor and the memory.

[0265] Among them, the processor is a device with data processing capabilities, including but not limited to the central processing unit (CPU); the memory is a device with data storage capabilities, including but not limited to random access memory (RAM, more specifically such as SDRAM, DDR, etc.), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), and flash memory (FLASH); the I / O interface (read-write interface) is connected between the processor and the memory to realize information exchange between the memory and the processor, including but not limited to the data bus (Bus), etc.

[0266] Fourthly, refer to Figure 21 An embodiment of the present disclosure provides a computer-readable medium having a computer program stored thereon, which implements any of the above-mentioned network access methods when the program is executed by a processor.

[0267] Among them, the processor is a device with data processing capabilities, including but not limited to the central processing unit (CPU); the memory is a device with data storage capabilities, including but not limited to random access memory (RAM, more specifically such as SDRAM, DDR, etc.), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), and flash memory (FLASH); the I / O interface (read-write interface) is connected between the processor and the memory, which can realize information exchange between the memory and the processor, including but not limited to the data bus (Bus), etc.

[0268] Those skilled in the art will appreciate that all or some of the steps, systems, and functional modules / units in the apparatus disclosed above may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0269] In hardware implementations, the division between functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component may have multiple functions, or one function or step may be performed by several physical components in cooperation.

[0270] Some or all of the physical components may be implemented as software executed by a processor, such as a central processing unit (CPU), a digital signal processor, or a microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include computer storage media (or non-transitory media) and communication media (or temporary media). As is well known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, random access memory (RAM, more specifically SDRAM, DDR, etc.), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory (FLASH) or other disk storage; compact disc (CD-ROM), digital versatile disc (DVD) or other optical disc storage; magnetic cassettes, tapes, disk storage or other magnetic storage; any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, as is well known to those skilled in the art, communication media typically embodies computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0271] The present disclosure has disclosed example embodiments, and although specific terms are employed, they are used and should be interpreted only in a general illustrative sense and not for purposes of limitation. In some instances, it will be apparent to those skilled in the art that, unless otherwise expressly indicated, features, characteristics, and / or elements described in conjunction with a particular embodiment may be used alone or in combination with features, characteristics, and / or elements described in conjunction with other embodiments. Therefore, it will be understood by those skilled in the art that various changes in form and detail may be made without departing from the scope of the present disclosure as set forth in the appended claims.

Claims

1. A network access method, comprising: Performing network access authentication on the terminal in response to an authentication request sent by the terminal, the authentication request including an identity identifier of the terminal; The network access authentication is 802.1x authentication; If the network access authentication of the terminal is passed, saving the identity identifier of the terminal and the MAC address of the terminal; In response to the address application request sent by the terminal, allocating an original IP address to the terminal; The address application request includes the MAC address of the terminal; Obtaining the identity of the terminal according to the MAC address query of the terminal; Putting the identity of the terminal into the original IP address to generate a complete IP address, and allocating the complete IP address to the terminal; Check and control the messages sent by the terminal based on the identity identifier of the terminal.

2. The method according to claim 1, wherein The step of performing network access authentication on the terminal in response to the authentication request sent by the terminal includes: In response to the authentication request sent by the terminal, a Transport Security Layer protocol TLS authentication is performed on the terminal according to the identity identifier of the terminal.

3. The method according to claim 1, wherein Allocating the complete IP address to the terminal includes: Sending a first message to the terminal, where the first message includes the complete IP address and the MAC address of the terminal; In response to the second message from the terminal, the second message includes the complete IP address and the MAC address of the terminal. If the first message and the second message are consistent, a confirmation message is sent, and the confirmation message includes the complete IP address and the MAC address of the terminal.

4. The method according to claim 1, wherein The acquiring of the identity of the terminal according to the MAC address query of the terminal includes: Sending a first message to the terminal, where the first message includes the original IP address and the MAC address of the terminal; In response to a second message from the terminal, the second message includes the original IP address and the MAC address of the terminal. When the first message and the second message are consistent, the identity of the terminal is obtained by querying the MAC address of the terminal.

5. The method according to claim 1, wherein When the network access authentication of the terminal is passed, saving the identity of the terminal includes: If the network access authentication of the terminal is passed, saving the identity identifier of the terminal and the MAC address of the terminal; The address application request includes the MAC address of the terminal and / or the identity of the terminal, and the allocating an IP address to the terminal in response to the address application request sent by the terminal includes: Determining whether the terminal passes network access authentication according to the MAC address of the terminal or the identity identifier of the terminal; When the terminal passes the network access authentication, an IP address is allocated to the terminal.

6. The method according to claim 1, wherein The checking and controlling of the message sent by the terminal based on the identity identifier of the terminal includes: In response to the data message, obtaining an identity identifier of a terminal that sends the data message; Checking whether the terminal sending the data message has passed the network access authentication according to the identity identifier of the terminal sending the data message; When the terminal sending the data message passes the network access authentication, the data message is forwarded.

7. A network access device, comprising: an authentication module, configured to perform network access authentication on the terminal in response to an authentication request sent by the terminal, wherein the authentication request includes an identity identifier of the terminal; The network access authentication is 802.1x authentication; if the network access authentication of the terminal is passed, the identity identifier of the terminal and the MAC address of the terminal are saved; A control module, configured to check and control messages sent by the terminal based on the identity identifier of the terminal; The apparatus further comprises: an allocating module for allocating an original IP address to the terminal in response to an address application request sent by the terminal; The address application request includes the MAC address of the terminal; the identity of the terminal is obtained according to the MAC address query of the terminal; the identity of the terminal is placed in the original IP address to generate a complete IP address, and the complete IP address is allocated to the terminal.

8. An electronic device comprising: one or more processors; a memory having one or more programs stored thereon, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the network access method according to any one of claims 1 to 6; One or more I / O interfaces are connected between the processor and the memory, and are used to implement information exchange between the processor and the memory.

9. A computer-readable medium having a computer program stored thereon, wherein when the program is executed by a processor, the network access method according to any one of claims 1 to 6 is implemented.

Images