An authentication method and system based on the 802.1X protocol

Abstract

This application discloses an authentication method and system based on the 802.1X protocol. The method includes: after receiving a user's connection establishment request, if the current connection between the client and the access device is a secure connection, then notifying the access device of an authentication operation based on the 802.1X protocol by sending a user authentication message, wherein the user authentication message carries the user's username.

Description

Technical Field

[0001] This application relates to the field of network communication, and more particularly to an authentication method and system for the 802.1X protocol. Background Technology

[0002] The 802.1X protocol is a port-based network access control protocol. Port-based network access control refers to the authentication and control of access clients at the physical access level of network devices, which are the ports of Ethernet switching devices or broadband access devices. Client devices connected to this type of port can access network resources if they can be authenticated; otherwise, they cannot access network resources.

[0003] Figure 1 This is a schematic diagram of the 802.1X system. Figure 1 As shown, an 802.1X system comprises three entities: a client (Supplicant System), an access device (Authenticator System), and an authentication server (AuthenticationServer System). The access device and authentication server exchange authentication information using the Expanded Authentication Protocol (EAP), which is used by both the client and the access device.

[0004] The EAP protocol messages between the client and the access device use the EAPoL (EAP over LANs) encapsulation format and are directly carried in the LAN environment. The access device internally has controlled ports and uncontrolled ports. Uncontrolled ports are used to transmit EAPOL protocol frames and are always in a bidirectional connected state, ensuring that EAPOL protocol frames can be received and sent at any time. Controlled ports are used to transmit network resources and data, and are in an unconnected state by default; only after EAPOL authentication is successful will the controlled port become connected and used to transmit network resources and data.

[0005] Between the access device and the authentication server, the authentication method used—either EAP relay or EAP termination—can be determined based on client support and network security requirements.

[0006] EAP relay encapsulates EAP messages directly into RADIUS messages (EAP over RADIUS, EAPoR) to traverse complex networks and reach the RADIUS server used for authentication.

[0007] Figure 2This is a flowchart for 802.1X authentication via EAP relay. (Example) Figure 2 As shown, the following example illustrates how authentication is triggered by the client sending an EAPoL-Start message:

[0008] ① When a user needs to access an external network, they open the 802.1X client, enter the username and password they have already applied for and registered, and initiate a connection request. At this time, the client will send an authentication request message (EAPoL-Start) to the access device to start an authentication process.

[0009] ② After receiving the authentication request message, the access device will send an Identity type request message (EAP-Request / Identity) to request the user's client program to send the entered username.

[0010] ③ The client program responds to the request sent by the access device and sends the username information to the access device through an Identity type response message (EAP-Response / Identity).

[0011] ④ The access device encapsulates the EAP message in the response message sent by the client into a RADIUS message (RADIUSAccess-Request) and sends it to the authentication server for processing.

[0012] ⑤ After receiving the username forwarded by the access device, the RADIUS server compares the username with the username list in the database, finds the password information corresponding to the username, encrypts the password with a randomly generated MD5 Challenge, and sends this MD5 Challenge to the access device through a RADIUS Access-Challenge message.

[0013] ⑥ The access device forwards the MD5 Challenge sent by the RADIUS server to the client. 。

[0014] ⑦ After receiving the MD5 Challenge from the access device, the client uses the MD5 Challenge to encrypt the password, generates an EAP-Response / MD5 Challenge message, and sends it to the access device.

[0015] ⑧ The access device encapsulates this EAP-Response / MD5 Challenge message in a RADIUS message (RADIUSAccess-Request) and sends it to the RADIUS server.

[0016] ⑨ The RADIUS server compares the received encrypted password with the locally encrypted password. If they match, the server considers the user to be a legitimate user and sends an authentication pass message (RADIUS Access-Accept) to the access device.

[0017] (⑩0 After receiving the authentication message, the access device sends an authentication success message (EAP-Success) to the client and changes the port status to authorized status, allowing the user to access the network through the port.

[0018] While a user is online, the access device monitors the user's online status by periodically sending handshake messages to the client.

[0019] After receiving the handshake message, the client sends a response message to the access device, indicating that the user is still online. By default, if the access device does not receive a response from the client for either of the two handshake request messages sent, the access device will disconnect the user to prevent the device from being unaware of the user's disconnection due to abnormal reasons.

[0020] The client can send an EAPoL-Logoff message to the access device to actively request to go offline.

[0021] The access device changes the port status from authorized to unauthorized and sends an EAP-Failure message to the client.

[0022] (2) EAP termination method: The EAP message is terminated at the access device and re-encapsulated into a RADIUS message, and authentication, authorization and accounting are completed using the standard RADIUS protocol.

[0023] Figure 3 This is a flowchart of 802.1X authentication for EAP termination. Figure 3 As shown, the existing technology uses the client sending an EAPoL-Start message to trigger authentication as an example. Compared to the EAP relay authentication process, the EAP termination authentication process differs in that the MD5 Challenge used to encrypt the password is generated by the access device. The access device then sends the username, MD5 Challenge, and the client's encrypted password information to the RADIUS server for authentication. In contrast, in the EAP relay method, the MD5 Challenge used to encrypt the user password is generated by the authentication server. The access device is only responsible for encapsulating the EAP message in a RADIUS message and transmitting it to the authentication server; the entire authentication process is handled by the authentication server.

[0024] As can be seen from the above 802.1X authentication process, whether it is the EAP relay method or the EAP termination method, there are many communication messages between the client, the access device and the authentication server during the authentication process. In particular, the access device needs to process a large number of protocol messages, which puts a lot of message pressure on the access device. If the number of clients connected to the access device is large, it may even bring instability to the network environment. Summary of the Invention

[0025] To address any of the aforementioned technical problems, embodiments of this application provide an authentication method and system based on the 802.1X protocol.

[0026] To achieve the objectives of this application's embodiments, this application provides an 802.1X protocol authentication method, including:

[0027] After receiving a user's connection establishment request, if the current connection between the client and the access device is a secure connection, the client notifies the access device of the authentication operation based on the 802.1X protocol by sending a user authentication message, wherein the user authentication message carries the user's username.

[0028] An authentication system based on the 802.1X protocol, comprising:

[0029] The client is used to implement the methods described above;

[0030] The access device is used to receive a notification message to initiate 802.1X authentication and to perform 802.1X authentication service operations using the username.

[0031] One of the above technical solutions has the following advantages or beneficial effects:

[0032] When the client notifies the access device to initiate 802.1X protocol authentication, if the current connection between the client and the access device is secure, the username is reported directly. This reduces the number of message exchanges between the client and the access device, thereby reducing the probability of problems occurring during message exchanges and the number of messages processed by the device, thus reducing the network message exchange pressure.

[0033] Other features and advantages of the embodiments of this application will be set forth in the following description, and will be apparent in part from the description, or may be learned by practicing the embodiments of this application. The objects and other advantages of the embodiments of this application may be realized and obtained by means of the structures particularly pointed out in the description, claims and drawings. Attached Figure Description

[0034] The accompanying drawings are used to provide a further understanding of the technical solutions of the embodiments of this application and constitute a part of the specification. They are used together with the embodiments of this application to explain the technical solutions of the embodiments of this application and do not constitute a limitation on the technical solutions of the embodiments of this application.

[0035] Figure 1 This is a schematic diagram of the 802.1X system.

[0036] Figure 2 A flowchart for 802.1X authentication via EAP relay;

[0037] Figure 3 A flowchart for 802.1X authentication for EAP termination;

[0038] Figure 4 A flowchart illustrating the 802.1X protocol authentication method provided in this application embodiment;

[0039] Figure 5 An interactive schematic diagram illustrating the method for determining the connection method provided in an embodiment of this application;

[0040] Figure 6 An interactive schematic diagram of the 802.1X protocol authentication method provided in the embodiments of this application;

[0041] Figure 7 This is a schematic diagram of a user authentication message provided in an embodiment of this application. Detailed Implementation

[0042] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the embodiments of this application will be described in detail below with reference to the accompanying drawings. It should be noted that, unless otherwise specified, the embodiments and features in the embodiments of this application can be arbitrarily combined with each other.

[0043] Figure 4 A flowchart illustrating the 802.1X protocol authentication method provided in this application embodiment. Figure 4 As shown, the method includes:

[0044] Step 101: Receive the user's connection establishment request;

[0045] Step 102: If the current connection between the client and the access device is a secure connection, then notify the access device of the authentication operation based on the 802.1X protocol by sending a user authentication message, wherein the user authentication message carries the user's username.

[0046] The method provided in this application embodiment, when the client notifies the access device to start 802.1X protocol authentication, if the current connection between the client and the access device is a secure connection, directly reports the username, reducing the number of message exchanges with the access device, thereby reducing the probability of problems occurring during message exchanges and the number of messages processed by the device, and achieving the purpose of reducing network message exchange pressure.

[0047] To enable the client to implement the 802.1X authentication method, in this embodiment, the connection method between the client and the access device, as well as the security of the link between the client and the access device, are pre-recorded locally on the client, wherein:

[0048] The connection method between the client and the access device is usually direct connection, bridging, or unknown;

[0049] The security of the link can indicate whether the current connection between this client and the access device is a secure connection. The security of the link is determined by the link security identifier, which can be secure, uncertain, or insecure.

[0050] For each client, before a connection is established, the default value for the connection method between the client and the access device is unknown, and the default value for the link security identifier is insecure.

[0051] The value of the aforementioned link security identifier can be obtained in the following way:

[0052] (1) By manual input.

[0053] Specifically, the connection methods and link security between each client and access device are known through the network topology and configuration during network planning. For example, when the access device and the client are directly connected, the link security identifier is considered secure; when the client and the access device are connected via a private network, if the connection method is a bridging connection, the link security identifier is also considered secure.

[0054] (2) The link security value is determined by automatic acquisition.

[0055] In the initial state, the client obtains the domain name or IP address of the access device and sequentially sends detection packets for tracing the domain name or IP address of the access device. These detection packets include an incrementing TTL (Time To Live) value to obtain information about each hop in the path until the final replay packet returned by the access device is obtained.

[0056] After receiving the last response message from the access device, the connection method between the client and the access device is determined based on the TTL value in the last sent detection message, including:

[0057] If the TTL is 1 in the final response message, then the connection method between the updated client and the access device is changed to direct connection;

[0058] If the TTL in the final response message is a definite value greater than 1, then the connection method between the updated client and the access device is a bridging connection.

[0059] If the TTL is an indeterminate value, then the connection method between the client and the access device is unknown.

[0060] Figure 5 This is an interactive schematic diagram illustrating the method for determining the connection method provided in an embodiment of this application. For example... Figure 5 As shown, the method includes:

[0061] Step S1: The client sends a detection message for routing tracking domain names. The detection message includes the source address and the domain name of the access device, wherein the TTL is set to 1.

[0062] Step S2: After receiving a detection packet with a TTL of 1, the first router, acting as the first hop, decrements the TTL by 1, making the TTL 0. The first router then discards the detection packet and sends back an ICMP (Internet Control Message Protocol) time-exceeded message. This ICMP time-exceeded message includes the domain name of the first router and the source address of the detection packet.

[0063] Step S2: After receiving the ICMP time exceeded message sent by the first router, the client records the current path of the device that is the first hop. Since the domain name in the ICMP time exceeded message returned by the device that is the first hop is different from the domain name of the access device, the client continues to send a detection message for route tracing domain name. The detection message includes: source address and domain name of access device, where TTL is set to 2.

[0064] Step S3: After the detection packet passes through the first router, the TTL in the detection packet is decremented by 1. Therefore, when the second router, which is the second hop, receives the detection packet, the TTL is decremented by 1. At this time, the TTL is 0. The second router no longer sends the detection packet to the next hop, discards the detection packet, and returns an ICMP time exceeded message. The ICMP time exceeded message includes: the source address of the detection packet and the domain name of the second router.

[0065] Step S4: After receiving the ICMP time exceeded message sent by the second router, the client records the current path of the device that is the second hop. Since the domain name in the ICMP time exceeded message returned by the device that is the second hop is different from the domain name of the access device, the client continues to send a detection message for route tracing domain name. The detection message includes: source address and domain name of access device, where TTL is set to 3.

[0066] Step S5: Since the TTL is decremented by 1 after the detection packet passes through the first router and the second router in sequence, when the access device as the third hop receives the detection packet, the TTL is decremented by 1 again, and the TTL is 0 at this time; Since the domain name of the access device carried in the detection packet is the same as the local domain name, an ICMP Destination Unreachable message containing the local domain name is returned to the client.

[0067] Step S6: After receiving the ICMP Destination Unreachable message, the client records the current path of the device that is the third hop. When the domain name in the ICMP time exceeded message returned by the device that is the second hop is the same as the domain name of the access device's host, the client determines that the device that is the third hop is the access device and determines that the connection method between the client and the access device is a bridging connection.

[0068] In the above method, if the returned message corresponding to the detection message does not carry the domain name, the TTL value is updated and the detection message is sent again.

[0069] Furthermore, the device acting as the third hop is identified as the access device, including:

[0070] The client continuously sends detection messages to the access device a set number of times, typically three times. If the client receives a set number of ICMP Destination Unreachable messages within a set time, it considers the data transmission between the access device and the client to be stable and there is no packet loss or connection interruption. Therefore, the current connection between the client and the access device is recorded as a secure connection. Otherwise, the security of the current connection between the client and the access device is recorded as uncertain.

[0071] The above method is illustrated using the domain name of the access device carried in the detection message as an example. Similarly, the interaction method is similar when the IP address of the access device is carried in the detection message, which will not be described in detail here.

[0072] One additional point to clarify here: the aforementioned detection message can be a traceroute detection of a domain name or an IP address. Those skilled in the art can determine one based on the information entered on the client in the initial state, or those skilled in the art can use either the domain name or IP address of the access device as the criterion for traceroute detection.

[0073] Figure 6 This is a schematic diagram illustrating the interaction of the 802.1X protocol authentication method provided in an embodiment of this application. For example... Figure 6 As shown, the method includes:

[0074] Step 201: Upon receiving a user's request to access the external network, obtain the username that requires 802.1X authentication;

[0075] Step 202: Determine whether the local system records the link security between this client and the access device. If the current connection between this client and the access device is secure, proceed to step 203; otherwise, proceed according to the existing authentication method.

[0076] In this step, the method by which the client initiates authentication with the access device is selected based on whether the current connection between the client and the access device is secure; authentication is only initiated using existing technologies when the current connection is not secure.

[0077] Step 203: The client sends a user authentication message based on the 802.1X protocol to the access device, wherein the user authentication message directly encapsulates the user's username to achieve subsequent authentication.

[0078] Figure 7 This is a schematic diagram of a user authentication message provided in an embodiment of this application. Figure 7As shown, the user authentication message adopts the Ethernet frame format, wherein:

[0079] Preamble indicates a preamble: set to a fixed value, for example: 10101010;

[0080] DA represents the destination address, which is fixed as the 802.1X certified multicast MAC address;

[0081] SA represents the source address, and its value is the client's MAC address;

[0082] The TAG field is filled with the value of the Virtual Local Area Network (VLAN);

[0083] PAE Ethernet Type indicates the protocol type. Here, it matches the protocol type of EAPOL, which is 0x888E.

[0084] Authentication represents authentication information, including:

[0085] Version indicates the version number: it represents the EAPOL protocol version number of the EAPOL data frames that the client can send;

[0086] Type indicates the message type; a set value indicates that the data frame is a user authentication message.

[0087] Length indicates the length, including the length of the Authentication field;

[0088] Identity indicates identity and carries the username of the 802.1X authenticated user.

[0089] Step 204: After receiving the user authentication message, the access device determines that the PAE Ethernet Type field is 0x888E, which indicates that the message is consistent with the EAPOL protocol type. It further determines that the Type field identifies the message as a user authentication message, and then obtains the username of the 802.1X authenticated user from the "Extensible Authentication" field.

[0090] Step 205: The access device encapsulates the username into a RADIUS message (EAP-Response / identity) and sends it to the RADIUS server.

[0091] Step 206: After receiving the username, the RADIUS server compares the received username with the username list in the database, finds the password information corresponding to the username, encrypts the password with a randomly generated MD5 Challenge, and sends this MD5 Challenge to the access device through a RADIUS Access-Challenge message.

[0092] Step 207: After receiving the RADIUS Access-Challenge message, the access device performs decapsulation processing, extracts the MD5 Challenge, and forwards the MD5 Challenge sent by the RADIUS server to the client.

[0093] Step 208: After receiving the MD5 Challenge sent by the access device, the client uses this Challenge to encrypt the 802.1X authentication key, generates an EAP-Response / MD5Challenge message, and replies to the access device.

[0094] Step 209: The access device encapsulates this EAP-Response / MD5 Challenge message in a RADIUS message and sends it to the RADIUS server.

[0095] Step 210: The RADIUS server compares the received encrypted password information with the locally encrypted password information. If they match, the server considers the user to be a legitimate user and sends an authentication success message (RADIUS / EAP-Success) to the access device.

[0096] Step 211: The access device extracts the user authentication information from the received authentication success message, sends an authentication success frame (EAP-Success) to the client, and changes the port to authorized status to complete the authentication process, thereby allowing the user to access the network through the port.

[0097] As can be seen from the steps described above, when the client needs to perform 802.1X authentication, the client determines the authentication method based on whether the current connection between the client and the access device is a secure connection. When the current connection between the two is recorded locally as a secure connection, the client directly sends the user authentication message carrying the username to the access device. This allows the access device to directly obtain the username from the user authentication message and continue to initiate authentication with the server. This eliminates the interactive authentication process between the access device and the client every time the client initiates 802.1X protocol authentication (i.e., steps 1-3 in the prior art are directly replaced by step 203 in this application), reducing the message processing pressure on the access device. The effect is more obvious when multiple clients initiate authentication or multiple different usernames initiate authentication from the same client.

[0098] However, it should be noted that the above relies on... Figure 6 The 802.1X authentication method described in steps 200-211 essentially corresponds to the EPA relay authentication method in the prior art. In other implementations, it can also be an improvement on the EPA termination method in the prior art. Similarly, executing steps 200-204 allows the access device to obtain user information. Then, after generating an MD5 Challenge to encrypt the user's password information, the access device sends the username, MD5 Challenge, and the client's encrypted password information to the RADIUS server for relevant authentication processing. These steps will not be elaborated further here; typical steps can be found in [reference needed]. Figure 3 .

[0099] Furthermore, if the client and the access device successfully authenticate the connection using existing technologies, but the client's local record indicates that the security of the current connection between the client and the access device is unknown, the link security between the client and the access device is updated to secure.

[0100] Furthermore, when the security of the current connection between the client and the access device is unknown in the client's local record, but a user on the client has already initiated 802.1X authentication and successfully authenticated on the RADIUS authentication server using existing technology, the security of the link between the client and the access device recorded on the client is recorded as "secure" only for the username that has successfully logged in. This allows the user to directly use the method of this application when initiating 802.1X authentication using the client in the future.

[0101] In this embodiment of the application, when the client initiates 802.1X authentication to the access device, different initiation methods are selected according to the current connection method and link security between the client and the access device. When it is determined that the client and the access device are securely connected, the username is directly reported, which reduces the number of message exchanges with the access device, thereby reducing the probability of problems in the message exchange process and the number of messages processed by the device, and reducing the network message exchange pressure.

[0102] This application also provides an 802.1X protocol authentication system, including:

[0103] The client is used to implement any of the methods described above;

[0104] The access device is used to receive a notification message to initiate 802.1X authentication and to perform 802.1X authentication service operations using the username.

[0105] Optionally, the access device is used to send the username to the authentication server to initiate authentication processing; or, generate a challenge code and then send the username, the client's encrypted password, and the challenge code to the authentication server for authentication processing.

[0106] It will be understood by those skilled in the art that all or some of the steps, systems, or apparatuses disclosed above, and their functional modules / units, can be implemented as software, firmware, hardware, or suitable combinations thereof. In hardware implementations, the division between functional modules / units mentioned above does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed collaboratively by several physical components. Some or all components may be implemented as software executed by a processor, such as a digital signal processor or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit (ASIC). Such software may be distributed on a computer-readable medium, which may include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

Claims

1. An authentication method based on the 802.1X protocol, characterized in that, include: After receiving a user's connection establishment request, if the current connection between the client and the access device is a secure connection, the client notifies the access device of the authentication operation based on the 802.1X protocol by sending a user authentication message, wherein the user authentication message carries the user's username. The determination of whether the current connection between the client and the access device is secure is made through the following methods: If the connection between the client and the access device is a direct connection, or a bridging connection within the same private network, then the current connection between the client and the access device is determined to be a secure connection. If the connection between the client and the access device is a bridging connection, and the client and the access device are not in the same private network, and the client and the access device successfully connect within a preset historical time period, if the security of the current connection between the client and the access device is unknown, the connection between the client and the access device is recorded as a secure connection.

2. The method according to claim 1, characterized in that: The username is located in the authorization information field of the user authentication message.

3. The method according to claim 1, characterized in that, The method further includes: If the current connection between the client and the access device is insecure, the client will send the username after receiving a control command from the access device instructing it to upload the username.

4. The method according to claim 1, characterized in that, The record of the connection between the client and the access device being a secure connection includes: Retrieve users who successfully connected to the access device through the client within the historical time period; The connection initiated by the user through the client with the access device is recorded as a secure connection.

5. The method according to claim 1, characterized in that, The connection method between the client and the access device is determined in the following ways: Send detection packets for routing and tracking the domain name or IP address of the access device, wherein each detection packet includes an incrementing time-to-live value, and the time-to-live value is different in different detection packets; The response message corresponding to each detection message is received, wherein the response message carries the domain name or IP address of the device with a time-to-live value of 0 in the detection message; If the domain name carried in the response message is the same as the domain name of the access device, or if the IP address carried in the response message is the same as the IP address of the access device, then it is determined that the response message returned by the access device has been received; otherwise, a new detection message is sent. After confirming that a response message has been received from the access device, the connection method between the client and the access device is determined based on the time-to-live value in the last sent detection message.

6. The method according to claim 5, characterized in that, The step of determining the connection method between the client and the access device based on the time-to-live value in the last sent detection message includes: If the time-to-live value is 1, then the connection method between the client and the access device is determined to be a direct connection; If the time-to-live value is a certain value greater than 1, then the connection method between the client and the access device is determined to be a bridging connection. If the time-to-live value is uncertain, then the connection method between the client and the access device is determined to be unknown.

7. The method according to claim 5, characterized in that, The method further includes: If the connection between the client and the access device is a bridging connection, after continuously sending a set number of detection messages to the access device within a set time, and continuously receiving the set number of response messages returned by the access device, it is determined that the current connection between the client and the access device is a secure connection; otherwise, it is determined that the security of the current connection between the client and the access device is unknown.

8. An authentication system based on the 802.1X protocol, characterized in that, include: A client for implementing the method as described in any one of claims 1 to 7; The access device is used to receive a notification message to initiate 802.1X authentication and to perform 802.1X authentication service operations using the username.

9. The system according to claim 8, characterized in that: The access device is used to send the username to the authentication server to initiate authentication; or, generate a challenge code and then send the username, the client's encrypted password, and the challenge code to the authentication server for authentication.

Images