A method, device, equipment and medium for authenticating access equipment

Abstract

The embodiments of the present specification disclose an authentication method, apparatus, device and medium for an access device, including: when authenticating a designated access device, sending an identity request message to the designated access device; generating a corresponding identity response message through the designated access device, and sending the identity response message to an authentication processing module; parsing configuration information corresponding to the identity response message through the authentication processing module, and sending the configuration information to a whitelist information module; receiving configuration command information of a command line module through the whitelist information module, and verifying the configuration information according to the configuration command information, and completing the authentication of the designated access device after the verification passes.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an authentication method, device, equipment and medium for access equipment. Background Art

[0002] With the advancement of information network technology, Ethernet network technology and related products and systems have been rapidly and extensively applied to all walks of life and have become the infrastructure of the information society. However, various network security risks have become increasingly prominent, the most prominent of which is the access authentication problem of access devices to Ethernet ports. Summary of the invention

[0003] One or more embodiments of the present specification provide an authentication method, apparatus, device and medium for an access device, which are used to solve the technical problems raised by the background technology.

[0004] One or more embodiments of this specification adopt the following technical solutions:

[0005] One or more embodiments of this specification provide an authentication method for an access device, including:

[0006] When authenticating a designated access device, sending an identity request message to the designated access device;

[0007] Generate a corresponding identity response message through the designated access device, and send the identity response message to the authentication processing module;

[0008] Parsing the configuration information corresponding to the identity response message through the authentication processing module, and sending the configuration information to the whitelist information module;

[0009] The configuration command information of the command line module is received through the whitelist information module, and the configuration information is verified according to the configuration command information, and the authentication of the designated access device is completed after the verification is passed.

[0010] One or more embodiments of this specification provide an authentication device for an access device, the device comprising:

[0011] A sending unit, which sends an identity request message to the designated access device when authenticating the designated access device;

[0012] A generating unit, generating a corresponding identity response message through the designated access device, and sending the identity response message to the authentication processing module;

[0013] A parsing unit, which parses the configuration information corresponding to the identity response message through the authentication processing module, and sends the configuration information to the whitelist information module;

[0014] The authentication unit receives the configuration command information of the command line module through the whitelist information module, verifies the configuration information according to the configuration command information, and completes the authentication of the designated access device after the verification is passed.

[0015] One or more embodiments of this specification provide an authentication device for an access device, including:

[0016] at least one processor; and,

[0017] a memory communicatively connected to the at least one processor; wherein,

[0018] The memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to:

[0019] When authenticating a designated access device, sending an identity request message to the designated access device;

[0020] Generate a corresponding identity response message through the designated access device, and send the identity response message to the authentication processing module;

[0021] Parsing the configuration information corresponding to the identity response message through the authentication processing module, and sending the configuration information to the whitelist information module;

[0022] The configuration command information of the command line module is received through the whitelist information module, and the configuration information is verified according to the configuration command information, and the authentication of the designated access device is completed after the verification is passed.

[0023] One or more embodiments of this specification provide a non-volatile computer storage medium storing computer executable instructions, wherein the computer executable instructions are configured to:

[0024] When authenticating a designated access device, sending an identity request message to the designated access device;

[0025] Generate a corresponding identity response message through the designated access device, and send the identity response message to the authentication processing module;

[0026] Parsing the configuration information corresponding to the identity response message through the authentication processing module, and sending the configuration information to the whitelist information module;

[0027] The configuration command information of the command line module is received through the whitelist information module, and the configuration information is verified according to the configuration command information, and the authentication of the designated access device is completed after the verification is passed.

[0028] At least one of the above technical solutions adopted in the embodiments of this specification can achieve the following beneficial effects:

[0029] The embodiments of this specification can bypass the restrictions of the RADIUS server, authenticate the access device through the whitelist information module, control whether the traffic is passed, and better implement network management in more extreme environments. Reducing direct operations on the RADIUS server can also reduce the network burden of the RADIUS server to a certain extent. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the technical solutions in the embodiments of this specification or the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art description. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. In the drawings:

[0031] Figure 1 A flowchart of an authentication method for an access device provided in one or more embodiments of this specification;

[0032] Figure 2 A schematic diagram of the structure of an access device authentication system provided for one or more embodiments of this specification;

[0033] Figure 3 A schematic diagram of a networking environment provided for one or more embodiments of this specification;

[0034] Figure 4 A flow chart of a whitelist free of authentication provided for one or more embodiments of this specification;

[0035] Figure 5 A schematic diagram of a structure of an authentication device for an access device provided in one or more embodiments of this specification

[0036] Figure 6 A schematic diagram of the structure of an authentication device for an access device provided in one or more embodiments of this specification. DETAILED DESCRIPTION

[0037] The embodiments of this specification provide an authentication method, apparatus, device and medium for an access device.

[0038] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments of this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0039] Figure 1 A schematic diagram of a flow chart of an access device authentication method provided in one or more embodiments of this specification, which can be executed by an access device authentication system. Certain input parameters or intermediate results in the flow chart allow manual intervention and adjustment to help improve accuracy.

[0040] The method steps of the embodiment of this specification are as follows:

[0041] S102: When authenticating a designated access device, sending an identity request message to the designated access device.

[0042] In the embodiments of this specification, the designated access device may be a network access device such as a printer, a voice phone, etc. The designated access device here does not support the 802.1x protocol and cannot be authenticated alone, so subsequent steps are required to authenticate the designated access device.

[0043] S104: Generate a corresponding identity response message through the designated access device, and send the identity response message to the authentication processing module.

[0044] In the embodiment of the present specification, when the identity response message is sent to the authentication processing module, the message receiving module can receive the restriction command information of the command line module, and the message receiving module can be restricted to receive the specified type of message according to the restriction command information, and the specified type of message can be an EAPOL message; if the identity response message is the specified type of message, the identity response message is sent to the authentication processing module through the message receiving module, and if the identity response message is not the specified type of message, the identity response message will be blocked and cannot be sent to the authentication processing module. EAPOL can be (EAP OVER LAN) an extended authentication protocol based on a local area network. EAPOL is developed based on 802.1X network access authentication technology.

[0045] S106: The authentication processing module parses the configuration information corresponding to the identity response message, and sends the configuration information to the whitelist information module.

[0046] In an embodiment of the present specification, when the configuration information corresponding to the identity response message is parsed by the authentication processing module, the user name, MAC address and VLAN information of the designated access device corresponding to the identity response message can be parsed by the authentication processing module. The VLAN information can be the VLAN tag carried by the EAPOL message.

[0047] S108, receiving configuration command information of the command line module through the whitelist information module, and verifying the configuration information according to the configuration command information, and completing the authentication of the designated access device after the verification passes.

[0048] In an embodiment of the present specification, the configuration command information is a message of the MAC address or VLAN information of the designated access device. When the configuration information is verified according to the configuration command information, the configuration information can be verified through the whitelist information module to see whether it is a message of the MAC address or VLAN information of the designated access device. After determining that it is a message of the MAC address or VLAN information of the designated access device, the authentication of the designated access device is completed, and the traffic of the designated access device can be sent to the controlled delivery module.

[0049] In an embodiment of the present specification, the configuration command information is a user name of the designated access device that can be authenticated. When the configuration information is verified according to the configuration command information, a challenge request message can be sent to the designated access device through the whitelist information module to obtain the password of the designated access device, and the password of the designated access device can be verified. After the verification is passed, the authentication of the designated access device is completed, and the traffic of the designated access device can be sent to the controlled delivery module.

[0050] Furthermore, in an embodiment of the present specification, after sending a challenge request message to the designated access device through the whitelist information module, the password of the designated access device is sent to the authentication processing module through a challenge response message; and the password of the designated access device is parsed by the authentication processing module.

[0051] Further, in an embodiment of the present specification, when the message receiving module receives restriction command information of the command line module and restricts the message receiving module from receiving messages of a specified type according to the restriction command information, the message receiving module can receive restriction command information based on the 802.1x protocol of the command line module and restrict the message receiving module from receiving EAPOL protocol messages according to the restriction command information.

[0052] It should be noted that the existing technology mainly relies on modifying the configuration on the RADIUS server to control whether the user's access device can be successfully authenticated. When the server is unreachable or the RADIUS server configuration is not allowed to be modified, there is a lack of means to temporarily release some traffic. At the same time, when other port information such as VLAN forwarding mode is not allowed to be modified, there is a lack of means to release the terminal's VLAN tagged traffic. In addition, there is a lack of backdoor means to pass traffic, such as administrator accounts, etc., which facilitates administrators to troubleshoot network problems or manage traffic when the server is abnormal. Finally, dumb terminals lack active authentication means, and a method is needed to release dumb terminal traffic to facilitate other terminals in the network to communicate with it.

[0053] In response to the above problems, the 802.1X protocol is widely used in Ethernet as a common access control mechanism for LANs, mainly to solve the authentication and security issues in Ethernet. The 802.1X protocol is a port-based network access control protocol, that is, the connected device is authenticated on the port of the LAN access device in order to control the user device's access to network resources. However, the access network devices are diverse, and some devices, such as printers and voice phones, do not support the 802.1X protocol and cannot be authenticated. Therefore, other solutions need to be sought, such as MAC address authentication or MAB authentication.

[0054] Among them: MAC authentication refers to the terminal network access control device automatically obtaining the terminal's MAC address, and sending it to the RADIUS server for verification as a credential for accessing the network. MAC authentication is an authentication method that controls the user's network access rights based on the interface and MAC address. It does not require the user to install any client software. After the device detects the user's MAC address for the first time on the interface where MAC authentication is enabled, it starts the authentication operation for the user. During the authentication process, there is no need to install an authentication client on the terminal, nor is there a need for the user to manually enter a username or password. Authentication is performed automatically;

[0055] MAB authentication, also known as MAC bypass authentication, refers to the situation in which a terminal does not respond to the 802.1X authentication request from the access control device after accessing the network in an 802.1X authentication environment. In order to facilitate the terminal to access the network, the access control device automatically obtains the MAC address of the terminal and sends it to the RADIUS server for verification as the access credential.

[0056] The prior art only has a whitelist for MAC address authentication, which can only allow the corresponding MAC address to pass through, but cannot be configured to allow the second-layer message containing the VLAN tag to pass through; it cannot allow a specific user to pass through; and normal authentication requires an authentication server. The embodiments of this specification can allow the configured MAC address whitelist traffic to pass smoothly; the configured VLAN whitelist allows the second-layer traffic with the VLAN tag to pass through; the configured 802.1x account, when a terminal uses the account to initiate authentication and the password also matches the configuration, the terminal's traffic is released.

[0057] Furthermore, the embodiments of this specification are described by the following specific contents:

[0058] Figure 2 A schematic diagram of the structure of the access device authentication system provided in the embodiment of this specification, wherein:

[0059] 1. Message receiving module. Responsible for receiving traffic to the switch and controlling the traffic according to the port traffic forwarding rules or port traffic control rules. Because the switch service port needs to receive access terminal message information, the port traffic control in the 802.1x protocol standard is applied to block all types of messages, except EAPOL protocol messages. When the 802.1x protocol authentication is initiated, the access terminal and the switch need to interact using EAPOL messages. When the switch service port receives the EAPOL message sent by the terminal, it will send the message to the authentication processing module.

[0060] 2. Authentication processing module. Responsible for processing port authentication information, the message receiving module parses the message to obtain the following information: user name, encrypted user password, access terminal MAC address, VLAN tag carried by EAPOL protocol message.

[0061] 3. Whitelist information module. This module is located between the authentication processing module and the controlled delivery module. The whitelist items in the module are directly configured by the switch command line. According to the configuration content, the whitelist information module will implement corresponding traffic control through the controlled delivery module.

[0062] In order to flexibly respond to the deployment requirements of the network environment and to cope with the situation where the authentication server cannot be controlled, the whitelist information module of this specification embodiment designs three different whitelist instructions to provide to the switch command line to cope with different usage scenarios:

[0063] a) Specify a VLAN. After successful configuration, traffic with the VLAN tag can pass directly through the port;

[0064] b) Specify a MAC address. After successful configuration, traffic with the same source MAC address as the configuration can pass through the port;

[0065] c) Specify a user name and password. After successful configuration, when a user with the same configured user name performs 802.1X authentication, the switch checks whether the password is consistent with the configuration. If they are consistent, the switch directly sends EAPOL-Success and passes the user's traffic.

[0066] 4. Controlled delivery module. In the normal authentication process, certain changes need to be made to the authentication port whether the user authentication fails or succeeds. If the authentication fails, the module needs to deliver traffic discarding rules to temporarily discard the traffic from the terminal MAC address, preventing users who have failed the authentication from re-authenticating in a short period of time to prevent malicious attacks; for users who have successfully authenticated, it is necessary to release the traffic blocking of the port, or only release the traffic blocking of the terminal MAC, and then apply the access control list or VLAN to the port according to the information carried in the successful authentication message.

[0067] 5. Command line module. The command line module can directly control the message receiving module and the whitelist information module. After the port 802.1X authentication function is configured, the message receiving module will block all traffic except EAPOL. Similarly, after the whitelist command line is configured, the whitelist module can release the corresponding traffic through the controlled delivery module, and can also match the username and password configured in the command line when checking user authentication information.

[0068] In addition, the message receiving module also needs to receive the RADIUS message sent by the RADIUS authentication server, parse the information to obtain the user's final authentication result. When the authentication is successful, the message will be accompanied by user authentication information, such as VLAN or access control list (ACL).

[0069] Furthermore, in the embodiment of this specification, a whitelist information module is designed between the authentication processing module and the controlled delivery module to complete the method for 802.1X protocol authentication whitelist. The method flow steps of the embodiment of this specification are as follows. The network environment diagram is as follows: Figure 3 Said:

[0070] The method enables the 802.1X function of the port through command line configuration. The command line module sends a message of changing the port control to the controlled sending module. At this time, the port only allows EAPOL messages to pass through, and other traffic is blocked.

[0071] The free authentication whitelist flow chart of the embodiment of this specification is as follows Figure 4 As shown, there are three ways to initiate authentication:

[0072] a) The terminal actively sends an EAPOL-Start message to the switch. The source address of the message is the terminal MAC address, and the destination address is the protocol multicast MAC address 0180.c200.0003. This process can be implemented by some authentication client software on the terminal. After the switch receives EAPOL-Start, it will send an identity request message EAP-Request-Identity with the terminal MAC address as the destination MAC;

[0073] b) The switch periodically sends an identity request message EAP-Request-Identity to the 802.1X protocol multicast MAC address;

[0074] c) The switch port needs to enable 802.1X unicast, or eap unicast function. After the function is enabled, the switch will detect the layer 2 message on the port and send an identity request message EAP-Request-Identity with the MAC address of the layer 2 message as the destination MAC;

[0075] After receiving the identity request message EAP-Request-Identity, the terminal encapsulates its own user name into an identity response message EAP-Response-Identity and replies, which is obtained by the message receiving module of the method and sent to the authentication processing module;

[0076] The authentication processing module verifies the format of the received EAP-Response-Identity message, parses the message type, and parses it according to the different message types defined in the 802.1X protocol specification. After obtaining the user name, MAC address and other information, it is handed over to the whitelist information module for processing;

[0077] The whitelist information module of the embodiment of this specification needs to be configured in the command line to enable its function, and the command line module checks the legality of the command and sends it to the whitelist information module. If the command specifies that the traffic of a certain MAC address or VLAN can pass, the whitelist information module is completed through the controlled sending module.

[0078] If the command specifies that a certain 802.1X account can pass the authentication, it is necessary to continue to send the challenge request message EAP-Request-MD5-Challenge to the terminal to obtain the terminal's password. The terminal packages the user password and sends it to the message receiving module through the challenge response message Response-MD5-Challenge, which is then parsed by the authentication processing module and sent to the whitelist information module for comparison. If the user name and password are verified to be correct, the user's traffic is released through the controlled delivery module.

[0079] It should be noted that the embodiments of this specification can bypass the restrictions of the RADIUS server, and the switch can directly control whether the traffic is passed, which can better implement network management in more extreme environments. Reducing direct operations on the RADIUS server can also reduce the network burden of the RADIUS server to a certain extent.

[0080] At the same time, the embodiments of this specification can provide a special solution for other port configuration restrictions. For example, when the VLAN forwarding of the port is restricted, the tagged traffic can be directly released through the whitelist.

[0081] In addition, the embodiments of this specification can configure an 802.1X account whitelist to allow network administrators to access the destination network even when the MAC address is changed, making management more convenient.

[0082] Finally, the embodiments of this specification can also provide a means for dumb terminals to pass traffic, and the configuration is simple, and there is still no need to interact with the RADIUS server, and there is no need to modify any server settings.

[0083] It should be noted that the embodiments of this specification can provide a method for the 802.1X protocol authentication-free whitelist. The 802.1X protocol bypasses the RADIUS server to complete the authentication through the whitelist information module, and the terminal traffic is released through the controlled delivery module. In addition, the embodiments of this specification can release the source MAC address and traffic with VLAN tags through the whitelist information module, which is suitable for terminals that do not support the 802.1X protocol, such as dumb terminals.

[0084] Figure 5 A schematic diagram of the structure of an authentication device for an access device provided in one or more embodiments of this specification, the device includes: a sending unit 502, a generating unit 504, a parsing unit 506 and an authentication unit 508.

[0085] The sending unit 502 sends an identity request message to the designated access device when authenticating the designated access device;

[0086] The generating unit 504 generates a corresponding identity response message through the designated access device, and sends the identity response message to the authentication processing module;

[0087] The parsing unit 506 parses the configuration information corresponding to the identity response message through the authentication processing module, and sends the configuration information to the whitelist information module;

[0088] The authentication unit 508 receives the configuration command information of the command line module through the whitelist information module, verifies the configuration information according to the configuration command information, and completes the authentication of the designated access device after the verification is passed.

[0089] Figure 6 A schematic diagram of a structure of an authentication device for an access device provided for one or more embodiments of this specification includes:

[0090] at least one processor; and,

[0091] a memory communicatively connected to the at least one processor; wherein,

[0092] The memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to:

[0093] When authenticating a designated access device, sending an identity request message to the designated access device;

[0094] Generate a corresponding identity response message through the designated access device, and send the identity response message to the authentication processing module;

[0095] Parsing the configuration information corresponding to the identity response message through the authentication processing module, and sending the configuration information to the whitelist information module;

[0096] The configuration command information of the command line module is received through the whitelist information module, and the configuration information is verified according to the configuration command information, and the authentication of the designated access device is completed after the verification is passed.

[0097] One or more embodiments of this specification provide a non-volatile computer storage medium storing computer executable instructions, wherein the computer executable instructions are configured to:

[0098] When authenticating a designated access device, sending an identity request message to the designated access device;

[0099] Generate a corresponding identity response message through the designated access device, and send the identity response message to the authentication processing module;

[0100] Parsing the configuration information corresponding to the identity response message through the authentication processing module, and sending the configuration information to the whitelist information module;

[0101] The configuration command information of the command line module is received through the whitelist information module, and the configuration information is verified according to the configuration command information, and the authentication of the designated access device is completed after the verification is passed.

[0102] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device, equipment, and non-volatile computer storage medium embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0103] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0104] The above description is only one or more embodiments of this specification and is not intended to limit this specification. For those skilled in the art, one or more embodiments of this specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of one or more embodiments of this specification shall be included in the scope of the claims of this specification.

Claims

1. A method for authenticating an access device, characterized in that: The method comprises: When authenticating a designated access device, sending an identity request message to the designated access device; Generating a corresponding identity response message through the designated access device and sending the identity response message to the authentication processing module specifically includes: Receiving restriction command information of a command line module through a message receiving module, and restricting the message receiving module from receiving messages of a specified type according to the restriction command information; If the identity response message is a message of the specified type, sending the identity response message to the authentication processing module through the message receiving module; If the identity response message is not of the specified type, the identity response message will be blocked and cannot be sent to the authentication processing module; Parsing the configuration information corresponding to the identity response message through the authentication processing module, and sending the configuration information to the whitelist information module; Receiving configuration command information of the command line module through the whitelist information module, and verifying the configuration information according to the configuration command information, and completing the authentication of the designated access device after the verification is passed; The step of parsing the configuration information corresponding to the identity response message through the authentication processing module specifically includes: Parsing the user name, MAC address and VLAN information of the designated access device corresponding to the identity response message through the authentication processing module; When the configuration command information is a message of the MAC address or VLAN information of the designated access device, the verifying the configuration information according to the configuration command information specifically includes: Verify the configuration information by the whitelist information module to see if it is a message of the MAC address or VLAN information of the designated access device; When the configuration command information is a user name of the designated access device that can be authenticated, the verifying the configuration information according to the configuration command information specifically includes: Sending a challenge request message to the designated access device through the whitelist information module to obtain the password of the designated access device and verifying the password of the designated access device; After sending the challenge request message to the designated access device through the whitelist information module, the method further includes: Sending the password of the designated access device to the authentication processing module via a challenge response message; Parsing the password of the designated access device through the authentication processing module; The receiving the restriction command information of the command line module through the message receiving module, and restricting the message receiving module to receive messages of a specified type according to the restriction command information, specifically includes: The message receiving module receives the restriction command information based on the 802.1x protocol from the command line module, and restricts the message receiving module from receiving EAPOL protocol messages according to the restriction command information.

2. An authentication device for access equipment, characterized in that: The device comprises: A sending unit, which sends an identity request message to the designated access device when authenticating the designated access device; A generating unit generates a corresponding identity response message through the designated access device, and sends the identity response message to the authentication processing module, specifically comprising: receiving restriction command information of the command line module through the message receiving module, and limiting the message receiving module to receive messages of a specified type according to the restriction command information; if the identity response message is a message of the specified type, sending the identity response message to the authentication processing module through the message receiving module; if the identity response message is not a message of the specified type, the identity response message will be blocked and cannot be sent to the authentication processing module; A parsing unit, which parses the configuration information corresponding to the identity response message through the authentication processing module, and sends the configuration information to the whitelist information module; an authentication unit, receiving the configuration command information of the command line module through the whitelist information module, and verifying the configuration information according to the configuration command information, and completing the authentication of the designated access device after the verification is passed; The configuration information corresponding to the identity response message is parsed by the authentication processing module, specifically used for: Parsing the user name, MAC address and VLAN information of the designated access device corresponding to the identity response message through the authentication processing module; When the configuration command information is a message of the MAC address or VLAN information of the designated access device, the configuration information is verified according to the configuration command information, specifically for: Verify the configuration information by the whitelist information module to see if it is a message of the MAC address or VLAN information of the designated access device; When the configuration command information is a user name of the designated access device that can be authenticated, the configuration information is verified according to the configuration command information, specifically for: Sending a challenge request message to the designated access device through the whitelist information module to obtain the password of the designated access device and verifying the password of the designated access device; After sending the challenge request message to the designated access device through the whitelist information module, the device further includes: Sending the password of the designated access device to the authentication processing module via a challenge response message; Parsing the password of the designated access device through the authentication processing module; The receiving the restriction command information of the command line module through the message receiving module, and restricting the message receiving module to receive messages of a specified type according to the restriction command information, specifically includes: The message receiving module receives the restriction command information based on the 802.1x protocol from the command line module, and restricts the message receiving module from receiving EAPOL protocol messages according to the restriction command information.

3. An authentication device for an access device, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to: When authenticating a designated access device, sending an identity request message to the designated access device; Generating a corresponding identity response message through the designated access device and sending the identity response message to the authentication processing module specifically includes: Receiving restriction command information of a command line module through a message receiving module, and restricting the message receiving module from receiving messages of a specified type according to the restriction command information; If the identity response message is a message of the specified type, sending the identity response message to the authentication processing module through the message receiving module; If the identity response message is not of the specified type, the identity response message will be blocked and cannot be sent to the authentication processing module; Parsing the configuration information corresponding to the identity response message through the authentication processing module, and sending the configuration information to the whitelist information module; Receiving configuration command information of the command line module through the whitelist information module, and verifying the configuration information according to the configuration command information, and completing the authentication of the designated access device after the verification is passed; The step of parsing the configuration information corresponding to the identity response message through the authentication processing module specifically includes: Parsing the user name, MAC address and VLAN information of the designated access device corresponding to the identity response message through the authentication processing module; When the configuration command information is a message of the MAC address or VLAN information of the designated access device, the verifying the configuration information according to the configuration command information specifically includes: Verify the configuration information by the whitelist information module to see if it is a message of the MAC address or VLAN information of the designated access device; When the configuration command information is a user name of the designated access device that can be authenticated, the verifying the configuration information according to the configuration command information specifically includes: Sending a challenge request message to the designated access device through the whitelist information module to obtain the password of the designated access device and verifying the password of the designated access device; After sending the challenge request message to the designated access device through the whitelist information module, the method further includes: Sending the password of the designated access device to the authentication processing module via a challenge response message; Parsing the password of the designated access device through the authentication processing module; The receiving the restriction command information of the command line module through the message receiving module, and restricting the message receiving module to receive messages of a specified type according to the restriction command information, specifically includes: The message receiving module receives the restriction command information based on the 802.1x protocol from the command line module, and restricts the message receiving module from receiving EAPOL protocol messages according to the restriction command information.

4. A non-volatile computer storage medium, characterized in that: A computer executable instruction is stored, wherein the computer executable instruction is configured to: When authenticating a designated access device, sending an identity request message to the designated access device; Generating a corresponding identity response message through the designated access device and sending the identity response message to the authentication processing module specifically includes: Receiving restriction command information of a command line module through a message receiving module, and restricting the message receiving module from receiving messages of a specified type according to the restriction command information; If the identity response message is a message of the specified type, sending the identity response message to the authentication processing module through the message receiving module; If the identity response message is not of the specified type, the identity response message will be blocked and cannot be sent to the authentication processing module; Parsing the configuration information corresponding to the identity response message through the authentication processing module, and sending the configuration information to the whitelist information module; Receiving configuration command information of the command line module through the whitelist information module, and verifying the configuration information according to the configuration command information, and completing the authentication of the designated access device after the verification is passed; The step of parsing the configuration information corresponding to the identity response message through the authentication processing module specifically includes: Parsing the user name, MAC address and VLAN information of the designated access device corresponding to the identity response message through the authentication processing module; When the configuration command information is a message of the MAC address or VLAN information of the designated access device, the verifying the configuration information according to the configuration command information specifically includes: Verify the configuration information by the whitelist information module to see if it is a message of the MAC address or VLAN information of the designated access device; When the configuration command information is a user name of the designated access device that can be authenticated, the verifying the configuration information according to the configuration command information specifically includes: Sending a challenge request message to the designated access device through the whitelist information module to obtain the password of the designated access device and verifying the password of the designated access device; After sending the challenge request message to the designated access device through the whitelist information module, the method further includes: Sending the password of the designated access device to the authentication processing module via a challenge response message; Parsing the password of the designated access device through the authentication processing module; The receiving the restriction command information of the command line module through the message receiving module, and restricting the message receiving module to receive messages of a specified type according to the restriction command information, specifically includes: The message receiving module receives the restriction command information based on the 802.1x protocol from the command line module, and restricts the message receiving module from receiving EAPOL protocol messages according to the restriction command information.

Images