Method, device and storage medium for secure network device authentication

Abstract

The application discloses a kind of safe network equipment authentication method, device and storage medium, the method includes the following steps: device end sends authentication request message to client, wherein the authentication request message includes first device end authentication parameter and custom authentication mode;The device end parses the authentication response message returned by the client, and verifies whether the first device end authentication parameter and client authentication information obtained are correct;If yes, the device end sends authentication discrimination response message to server end;And the device end parses the authentication discrimination result message returned by the server end, and determines the authentication result of the client by verifying the client authentication response, device end authentication response and server end authentication information obtained, determines the authentication result of the client.The method can effectively improve the security of authentication, and provide support for the safe access of network resources.

Description

Technical Field

[0001] This invention relates to the field of network communication, and in particular to a method, apparatus, and storage medium for secure network device authentication. Background Technology

[0002] In existing technologies, the traditional 802.1x authentication process generally uses EAP relay or EAP termination methods for authentication.

[0003] For EAP relay mode, the network access device directly encapsulates the 802.1X user's authentication information and EAP message into the attribute field of the RADIUS message and sends it to the RADIUS server. The challenge word used to encrypt the user's password is generated by the authentication server. The device is only responsible for encapsulating the EAP message in the RADIUS message and passing it to the authentication server. The entire authentication process is completed by the authentication server.

[0004] For EAP termination, the EAP message is terminated on the device side and re-encapsulated into a RADIUS message, using the standard RADIUS protocol to complete authentication, authorization, and accounting. The MD5 Challenge used to encrypt the user's password information is generated on the device side. The device side sends the username, MD5 Challenge, and the client's encrypted password information together to the RADIUS server for authentication.

[0005] Authentication based on the traditional 802.1x authentication protocol only encapsulates the username and password as authentication information into the EAP attribute of the authentication message, and only encrypts the password information, which is easy to crack or spoof, resulting in low network security during the authentication process.

[0006] The information disclosed in this background section is intended only to enhance the understanding of the overall background of the invention and should not be construed as an admission or in any way implying that the information constitutes prior art known to those skilled in the art. Summary of the Invention

[0007] The purpose of this invention is to provide a secure method, apparatus, and storage medium for network device authentication, which can improve the security of authentication and provide support for secure access to network resources.

[0008] To achieve the above objectives, embodiments of the present invention provide a secure method for network device authentication.

[0009] In one or more embodiments of the present invention, the device sends an authentication request message to the client, wherein the authentication request message includes a first device authentication parameter and a custom authentication method; the device parses the authentication response message returned by the client and verifies whether the obtained first device authentication parameter and client authentication information are correct, wherein the client authentication information is generated by the client based on the custom authentication method using a custom encryption method on the first device authentication parameter and client authentication parameter, and the authentication response message encapsulates data in TLV format into the EAP data portion of the message; if correct, the device sends an authentication authentication response message to the server, wherein the authentication authentication response message includes the client authentication information, client authentication parameters, first device authentication parameter, second device authentication parameter, and the authentication method used by the device to authenticate the client authentication information and second device authentication parameter. The device authentication parameters, the first device authentication parameters, and the second device authentication parameters are generated using a custom encryption method to form device authentication information. The authentication and authentication response message encapsulates data in TLV format into the EAP data portion of the message. The device parses the authentication and authentication result message returned by the server and determines the client's authentication result by verifying the obtained client authentication response, device authentication response, and server authentication information. The client authentication response and device authentication response are generated by the server based on the custom authentication method using the authentication results of the client authentication information, device authentication parameters, the first device authentication parameters, the second device authentication parameters, and the device authentication information in the authentication and authentication response message. The server authentication information is generated by the server based on the custom authentication method using the custom encryption method to process the client authentication response and the device authentication response.

[0010] The first device authentication parameters, the second device authentication parameters, the client authentication parameters, the custom authentication method, the custom encryption method, the client authentication information, the device authentication information, and the server authentication information are pre-shared by the device, the client, and the server.

[0011] In one or more embodiments of the present invention, the method further includes: the device receiving an identification response message sent by the client, generating a RADIUS request and sending it to the server, wherein the identification response message includes the host identifier of the client; the device receiving a custom authentication method returned by the server, and storing the custom authentication method and the first device authentication parameters in the authentication request message.

[0012] In one or more embodiments of the present invention, the custom encryption method includes a first encryption algorithm and a second encryption algorithm. The first device-side authentication parameters and client-side authentication parameters are encrypted M times by the client based on the first encryption algorithm. The client-side authentication information is generated by the client encrypting the first device-side authentication parameters and client-side authentication parameters N times using the second encryption algorithm based on the custom encryption method. The device-side parses the authentication response message returned by the client and verifies whether the obtained first device-side authentication parameters and client-side authentication information are correct. Specifically, this includes: the device-side parses the authentication response message and decrypts the first device-side authentication parameters and client-side authentication parameters M times based on the first encryption algorithm; the device-side encrypts the decrypted first device-side authentication parameters and client-side authentication parameters N times based on the second encryption algorithm to obtain a first encrypted value; the device-side compares the first encrypted value with the client-side authentication information and compares the decrypted first device-side authentication parameters with the local first device-side authentication parameters; if the comparison results are consistent, the device-side verifies that the obtained first device-side authentication parameters and client-side authentication information are correct and sends the authentication and verification response message to the server.

[0013] In one or more embodiments of the present invention, the device sending an authentication response message to the server specifically includes: the device encrypting the client authentication information, client authentication parameters, first device authentication parameters, second device authentication parameters, and device authentication information M times based on the first encryption algorithm; the device encrypting the client authentication information, client authentication parameters, first device authentication parameters, and second device authentication parameters N times based on the second encryption algorithm to generate the device authentication information; and encapsulating the encrypted client authentication information, client authentication parameters, first device authentication parameters, second device authentication parameters, and device authentication information in TLV format into the EAP attribute of the authentication response message.

[0014] In one or more embodiments of the present invention, the first encryption algorithm includes a reversible encryption algorithm, and the second encryption algorithm includes an irreversible encryption algorithm.

[0015] In one or more embodiments of the present invention, the method further includes: if the comparison results are inconsistent, the first device authentication parameters and client authentication information obtained by the device verification are incorrect, and the authentication response message is ignored.

[0016] In one or more embodiments of the present invention, determining the authentication result of the client specifically includes: the device parsing the authentication result message returned by the server, verifying the validity of the server's authentication information, and verifying whether the client's authentication response and the device's authentication response pass; if both verifications are successful, the device sends an authentication success message to the client.

[0017] In another aspect of the invention, a secure network device authentication apparatus is provided, comprising a first sending module, a verification module, a second sending module, and a determination module.

[0018] The first sending module is used to send an authentication request message from the device to the client, wherein the authentication request message includes the first device authentication parameters and a custom authentication method.

[0019] The verification module is used to parse the authentication response message returned by the client on the device side and verify whether the obtained first device authentication parameters and client authentication information are correct, wherein the client authentication information is generated by the client based on the custom authentication method using a custom encryption method on the first device authentication parameters and client authentication parameters.

[0020] The second sending module is used to send an authentication response message from the device to the server, wherein the authentication response message includes the client authentication information, client authentication parameters, first device authentication parameters, second device authentication parameters, and device authentication information generated by the device based on the custom authentication method using a custom encryption method for the client authentication information, second device authentication parameters, first device authentication parameters, and second device authentication parameters.

[0021] The determination module is used to parse the authentication result message returned by the server on the device side, and determine the authentication result of the client by verifying the obtained client authentication response, device authentication response and server authentication information. The client authentication response and device authentication response are generated by the server side based on the authentication result of the client authentication information, device authentication parameters, first device authentication parameters, second device authentication parameters and device authentication information in the authentication response message based on the custom authentication method. The server authentication information is generated by the server side based on the custom authentication method using the custom encryption method to encrypt the client authentication response and device authentication response.

[0022] The first device authentication parameters, the second device authentication parameters, the client authentication parameters, the custom authentication method, the custom encryption method, the client authentication information, the device authentication information, and the server authentication information are pre-shared by the device, the client, and the server.

[0023] In one or more embodiments of the present invention, the first sending module is further configured to: receive an identification response message sent by the client, generate a RADIUS request and send it to the server, wherein the identification response message includes the host identifier of the client; receive a custom authentication method returned by the server, and store the custom authentication method and the first device authentication parameters in the authentication request message.

[0024] In one or more embodiments of the present invention, the verification module is further configured to: parse the authentication response message returned by the client on the device side, and verify whether the obtained first device side authentication parameters and client authentication information are correct, specifically including: the device side parses the authentication response message, decrypts the first device side authentication parameters and client authentication parameters M times based on the first encryption algorithm; the device side encrypts the decrypted first device side authentication parameters and client authentication parameters N times based on the second encryption algorithm to obtain a first encrypted value; the device side compares the first encrypted value with the client authentication information, and compares the decrypted first device side authentication parameters with the local first device side authentication parameters; if the comparison results are consistent, the device side verifies that the obtained first device side authentication parameters and client authentication information are correct, and sends the authentication and verification response message to the server side.

[0025] In one or more embodiments of the present invention, the second sending module is further configured to: encrypt the client authentication information, client authentication parameters, first device authentication parameters, second device authentication parameters, and device authentication information M times based on the first encryption algorithm; encrypt the client authentication information, client authentication parameters, first device authentication parameters, and second device authentication parameters N times based on the second encryption algorithm to generate the device authentication information; and encapsulate the encrypted client authentication information, client authentication parameters, first device authentication parameters, second device authentication parameters, and device authentication information in TLV format into the EAP attribute of the authentication and authentication response message.

[0026] In one or more embodiments of the present invention, the determining module is further configured to: parse the authentication result message returned by the server, verify the validity of the server-side authentication information, and verify whether the client authentication response and the device-side authentication response pass; if both verifications are successful, the device sends an authentication success message to the client.

[0027] In one or more embodiments of the present invention, the verification module is further configured to: if the comparison results are inconsistent, the first device authentication parameters and client authentication information obtained by the device-side verification are incorrect, and ignore the authentication response message.

[0028] In another aspect of the invention, a computing device is provided, comprising: at least one processor; and a memory storing instructions that, when executed by the at least one processor, cause the at least one processor to perform the secure network device authentication method as described above.

[0029] In another aspect of the invention, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the steps of the secure network device authentication method as described above.

[0030] Compared with the prior art, the secure network device authentication method according to the present invention can pre-share custom authentication parameters, custom authentication methods, and custom encryption methods among clients, devices, and servers within the same network environment, thereby enabling the privatization of pre-shared custom extended attributes and ensuring the security of the authentication network environment.

[0031] On the other hand, by encrypting the pre-shared custom authentication parameters using a pre-shared custom encryption method and encapsulating the message into the corresponding EAP attribute using the TLV method, the security of authentication can be enhanced. Attached Figure Description

[0032] Figure 1 It is a RADIUS message format;

[0033] Figure 2 It is the EAPOL message structure;

[0034] Figure 3 It is EAP data format;

[0035] Figure 4 This is a flowchart of a secure network device authentication method according to an embodiment of the present invention;

[0036] Figure 5This is a structural flowchart of a secure network device authentication method according to an embodiment of the present invention;

[0037] Figure 6 This is a structural diagram of a secure network device authentication device according to an embodiment of the present invention;

[0038] Figure 7 This is a hardware structure diagram of a computing device for secure network device authentication according to an embodiment of the present invention. Detailed Implementation

[0039] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings, but it should be understood that the scope of protection of the present invention is not limited to the specific embodiments.

[0040] Unless otherwise expressly stated, throughout the specification and claims, the term "comprising" or its variations such as "including" or "comprises" shall be understood to include the stated elements or components without excluding other elements or other components.

[0041] Before providing a further detailed description of the embodiments of this application, the nouns and terms involved in the embodiments of this application will be explained, and the nouns and terms involved in the embodiments of this application shall be interpreted as follows.

[0042] 802.1x: A typical Client / Server architecture, comprising three entities: the client, the device, and the server. The client is an entity located at one end of the local area network (LAN) segment, authenticated by the access device. The device authenticates the connected client and provides it with a port to access the LAN; it is typically a switch that supports the 802.1x protocol. The server can be an authentication server, providing authentication services to the access control device; it is usually a RADIUS server, used for user authentication, authorization, and accounting.

[0043] For 802.1x authentication, a custom EAP protocol is used to complete the identity authentication process. The protocol data exchange between the client and the device uses the EAPOL message encapsulation format, while the protocol data exchange between the device and the server uses RADIUS protocol packet encapsulation of EAP packets.

[0044] EAP (Extensible Authentication Protocol) provides a general authentication framework that can carry multiple authentication protocols for transmitting authentication messages, offering excellent scalability and adaptability. It can run on various underlying layers, including the data link layer and upper-layer protocols such as UDP and TCP, and does not require an IP address. 802.1x authentication using EAP offers significant flexibility.

[0045] like Figure 1 The image shows a RADIUS message format. To support EAP attributes, RADIUS adds two TLV attributes: EAP-Message and Message-Authenticator. The EAP-Message attribute encapsulates the EAP message, while the Message-Authenticator attribute authenticates and verifies the message, preventing spoofing by unauthorized messages. This extended RADIUS message is called an EAPoR message.

[0046] like Figure 2 The image shows an EAPOL message format. To enable EAP messages to be directly carried in a LAN environment, 802.1x defines a message encapsulation format called EAPOL. EAPOL is a data link layer protocol used by 802.1x, which encapsulates EAP messages to enable EAP transmission over Ethernet and facilitate user authentication.

[0047] like Figure 3 The image shows an EAP data packet format. The EAP data portion can carry data of any type.

[0048] The technical solutions provided by the various embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0049] like Figures 4 to 5 As shown, a secure network device authentication method is described in one embodiment of the present invention, the method comprising the following steps.

[0050] In step S401, the device sends an authentication request message to the client, wherein the authentication request message includes the first device authentication parameters and the custom authentication method.

[0051] In this embodiment, clients, devices, and servers within the same network pre-share and customize authentication and encryption methods. During authentication, the data field of the EAP attribute of the message can encapsulate any type of data, such as custom authentication parameters in TLV format. In this embodiment, the custom authentication parameters include first device authentication parameters, second device authentication parameters, client authentication parameters, custom authentication method, client authentication information, and device authentication information.

[0052] Refer to Table 1 for an example of a custom authentication parameter table. An example of a custom authentication parameter table that supports inputting EAP data fields is shown below, containing various parameter types such as identity ID, random number, and hardware identifier.

[0053] Table 1 Custom Authentication Parameters

[0054] 1 0x00 reserve 1 0x01 IDa Client Identity ID 2 0x02 IDb Device Identity ID 3 0x03 Rb Random numbers generated by the device 4 0x04 Ra random numbers generated by the client 5 0x05 Ha Client hardware identifier 6 0x06 Hb Hardware identifier on the device side 7 0x07 RSTa Authentication result for the client 8 0x08 RSTb Authentication results from the device side 9 0x09 SECa Ciphertext generated by the client 10 0x0a SECb Ciphertext generated by the device 11 0x0b SECc Ciphertext generated by the authentication server 12 0x0c SEC-EAP The authentication server type has a value of 36.

[0055] Specifically, before authentication is successful, the physical port of the device in the initial state is in an unauthorized state, in which only authentication messages can pass. At this time, the client is also in the initial state.

[0056] After the physical port link is up, the client will send an authentication trigger message to the device. If authentication is not performed within a certain period after the physical port link is up, the client will enter a listening state, waiting to receive an authentication request message from the device.

[0057] The device is currently in a listening state. Upon receiving the authentication trigger message from the client, it begins authentication and sends an identification request to the client.

[0058] After receiving the identification request from the device, the client sends an identification response message to the device, which includes the client's host ID. Based on EAP relay encapsulation, the device generates a RADIUS request and sends it to the server, where the RADIUS request includes the client's host ID. The server performs an Init initialization operation and returns the custom authentication method SEC_EAP to the device.

[0059] After receiving the authentication request message returned by the server, the device generates the first device authentication parameter, which can be a random number Rb generated by the device, and sends an authentication request message to the client. The authentication request message includes the first device authentication parameter and the custom authentication method SEC_EAP received from the server.

[0060] Optionally, the device can start a timeout timer to wait for the authentication response message. If no message is received within the timeout period, the authentication process will be interrupted and the device will return to the initial authentication state.

[0061] In step S402, the device parses the authentication response message returned by the client and verifies whether the obtained first device authentication parameters and client authentication information are correct.

[0062] The first device-side authentication parameter can be a random number Rb generated by the device, and the client authentication information can be ciphertext SECa generated by the client. The client authentication parameters can include the random number Ra generated by the client, the client identity IDa, and the client's hardware identifier Ha. The client authentication information is generated by the client using a custom encryption method based on the received custom authentication method, combining the first device-side authentication parameter and the client authentication parameter.

[0063] Specifically, custom encryption methods can include a first encryption algorithm and a second encryption algorithm.

[0064] By way of example, the first encryption algorithm can be a reversible encryption algorithm, such as the DES algorithm (symmetric encryption algorithm), and the second encryption algorithm can be an irreversible encryption algorithm, such as the SHA-256 algorithm (Secure Hash Algorithm). Based on the example in Table 1, the encryption method can be SEC-EAP, with a value of 36.

[0065] After receiving the authentication request message sent by the client device, the client parses it to obtain the first device authentication parameters and the custom authentication method. A first encryption algorithm is used to encrypt each parameter in both the first device authentication parameters and the client authentication parameters individually M times; a second encryption algorithm is used to encrypt the plaintext combination of the first device authentication parameters and the client authentication parameters N times to generate the client authentication information.

[0066] The client adds the encrypted parameters to the EAP attribute of the authentication response message to be sent in TLV format, encapsulates it, and sends it to the device. The authentication response message can be an EAPOL message, including the EAP data portion. Optionally, after sending, the client starts a timeout timer to wait for the authentication response message from the device. If no message is received within the timeout period, the authentication process is interrupted, and the client returns to the initial authentication state.

[0067] Specifically, the device parses the authentication response message received from the client to obtain the encrypted parameters. Based on a first encryption algorithm, the device authentication parameters and client authentication parameters are decrypted M times to obtain the decrypted parameters. The decrypted parameters can be a random number Rb generated by the device, a random number Ra generated by the client, the client's identity IDa, and the client's hardware identifier Ha. Based on a second encryption algorithm, the decrypted device authentication parameters and client authentication parameters are then encrypted N times to obtain the first encrypted value.

[0068] The device compares the first encrypted value with the client authentication information in the authentication response message, and compares the first device authentication parameters obtained after decryption with the local first device authentication parameters.

[0069] If the comparison results are consistent, the device side verifies that the first device side authentication parameters and client authentication information obtained are correct, and sends an authentication and identification response message to the server side.

[0070] If the comparison results are inconsistent, the first device authentication parameters and client authentication information obtained by the device verification are incorrect, and the authentication response message is ignored.

[0071] Furthermore, the device employs a first encryption algorithm to encrypt each parameter in the client authentication information, client authentication parameters, first device authentication parameters, second device authentication parameters, and device authentication information individually M times; and employs a second encryption algorithm to encrypt the client authentication information, client authentication parameters, first device authentication parameters, and second device authentication parameters N times to generate device authentication information.

[0072] The client authentication information can be ciphertext SECa generated by the client, and the client authentication parameters can include a random number Ra generated by the client, the client identity IDa, and the client hardware identifier Ha. The first device authentication parameter can be a random number Rb generated by the device, and the second device authentication parameter can include the device identity IDb and the device hardware identifier Hb. The device authentication information can be ciphertext SECb generated by the device.

[0073] The device encapsulates the encrypted client authentication information, client authentication parameters, first device authentication parameters, second device authentication parameters, and device authentication information in TLV format into the EAP attribute of the authentication response message. The authentication response message can be a RADIUS message, including the EAP data portion.

[0074] In step S403, the device sends an authentication response message to the server.

[0075] The authentication response message includes client authentication information, client authentication parameters, first device authentication parameters, second device authentication parameters, and device authentication information generated by the device using a custom encryption method based on a custom authentication method.

[0076] Optionally, when sending the authentication response message to the server, the device starts a timeout timer to wait for the authentication result message. If no response is received within the timeout period, the authentication response message is retransmitted. After a preset finite number of timeouts, the authentication process is interrupted, and the device returns to the initial authentication state.

[0077] In this embodiment, the server receives the authentication response message and parses it to obtain the encrypted parameters. Using a first encryption algorithm, the client authentication information, client authentication parameters, first device authentication parameters, and second device authentication parameters are decrypted M times to obtain the decrypted parameters. Using a second encryption algorithm, the plaintext of the decrypted client authentication information, client authentication parameters, first device authentication parameters, and second device authentication parameters is encrypted N times to obtain the second encrypted value.

[0078] The server compares the second encrypted value with the device authentication information in the authentication response message to confirm the validity of the device authentication information, and also confirms the validity of the client authentication parameters obtained after decryption and the second device authentication parameters.

[0079] Based on the validity verification result, the server sends an authentication result message to the device. The authentication result message includes the client authentication response, the device authentication response, and the server authentication information. The client authentication response can be the authentication result RSTA for the client, and the device authentication response can be the authentication result RSTb for the device.

[0080] In step S404, the device parses the authentication result message returned by the server and determines the client's authentication result by verifying the obtained client authentication response, device authentication response, and server authentication information.

[0081] The client authentication response and the device authentication response are generated by the server based on the authentication result of the client authentication information, device authentication parameters, first device authentication parameters, second device authentication parameters and device authentication information in the authentication and authentication response message according to the custom authentication method. The server authentication information is generated by the server based on the custom authentication method using a custom encryption method for the client authentication response and the device authentication response.

[0082] Specifically, the server uses a second encryption algorithm to encrypt the client authentication response and the device authentication response N times to obtain the server-side authentication information.

[0083] In this embodiment, the device parses the authentication result message returned by the server to obtain the client authentication response, the device authentication response, and the server authentication information, verifies the validity of the server authentication information, and verifies whether the client authentication response and the device authentication response pass.

[0084] If all verifications are successful, the device sends an authentication success message to the client and transitions to the authentication success status.

[0085] If verification fails, the device sends an authentication failure message to the client, interrupting the authentication process and returning to the initial authentication state.

[0086] Furthermore, when the client receives the authentication success message, it transitions to the authentication success status.

[0087] When both the device and the client are successfully authenticated, the device opens the network port, the client joins the network, and the device sends a network access confirmation message to the server, which then starts the billing service.

[0088] The secure network device authentication method according to embodiments of the present invention enables pre-sharing of custom authentication parameters, custom authentication methods, and custom encryption methods among clients, devices, and servers within the same network environment. This allows for the privatization of pre-shared custom extended attributes, ensuring the security of the authentication network environment.

[0089] On the other hand, by encrypting the pre-shared custom authentication parameters using a pre-shared custom encryption method and encapsulating the message into the corresponding EAP attribute using the TLV method, the security of authentication can be enhanced.

[0090] like Figure 6 As shown, an apparatus for secure network device authentication according to a specific embodiment of the present invention is described.

[0091] In an embodiment of the present invention, the secure network device authentication apparatus includes a first sending module 601, a verification module 602, a second sending module 603, and a determination module 604.

[0092] The first sending module 601 is used to send an authentication request message from the device to the client, wherein the authentication request message includes the first device authentication parameters and a custom authentication method.

[0093] The verification module 602 is used to parse the authentication response message returned by the client on the device side and verify whether the obtained first device side authentication parameters and client authentication information are correct, wherein the client authentication information is generated by the client based on the custom authentication method using a custom encryption method on the first device side authentication parameters and client authentication parameters.

[0094] The second sending module 603 is used to send an authentication response message from the device to the server, wherein the authentication response message includes the client authentication information, client authentication parameters, first device authentication parameters, second device authentication parameters, and device authentication information generated by the device based on the custom authentication method using a custom encryption method for the client authentication information, second device authentication parameters, first device authentication parameters, and second device authentication parameters.

[0095] The determination module 604 is used to parse the authentication result message returned by the server on the device side, and determine the authentication result of the client by verifying the obtained client authentication response, device authentication response and server authentication information. The client authentication response and device authentication response are generated by the server side based on the authentication result of the client authentication information, device authentication parameters, first device authentication parameters, second device authentication parameters and device authentication information in the authentication response message based on the custom authentication method. The server authentication information is generated by the server side based on the custom authentication method using the custom encryption method to encrypt the client authentication response and device authentication response.

[0096] The first device authentication parameters, the second device authentication parameters, the client authentication parameters, the custom authentication method, the custom encryption method, the client authentication information, the device authentication information, and the server authentication information are pre-shared by the device, the client, and the server.

[0097] The first sending module 601 is further configured to: receive an identification response message sent by the client, generate a RADIUS request and send it to the server, wherein the identification response message includes the host identifier of the client; receive a custom authentication method returned by the server and store the custom authentication method and the first device authentication parameters in the authentication request message.

[0098] The verification module 602 is further configured to: parse the authentication response message returned by the client on the device side, and verify whether the obtained first device side authentication parameters and client authentication information are correct, specifically including: the device side parses the authentication response message, decrypts the first device side authentication parameters and client authentication parameters M times based on the first encryption algorithm; the device side encrypts the decrypted first device side authentication parameters and client authentication parameters N times based on the second encryption algorithm to obtain a first encrypted value; the device side compares the first encrypted value with the client authentication information, and compares the decrypted first device side authentication parameters with the local first device side authentication parameters; if the comparison results are consistent, the device side verifies that the obtained first device side authentication parameters and client authentication information are correct, and sends the authentication and verification response message to the server side.

[0099] The second sending module 603 is further configured to: encrypt the client authentication information, client authentication parameters, first device authentication parameters, second device authentication parameters, and device authentication information M times based on the first encryption algorithm; encrypt the client authentication information, client authentication parameters, first device authentication parameters, and second device authentication parameters N times based on the second encryption algorithm to generate the device authentication information; and encapsulate the encrypted client authentication information, client authentication parameters, first device authentication parameters, second device authentication parameters, and device authentication information in TLV format into the EAP attribute of the authentication and authentication response message.

[0100] The determining module 604 is further configured to: parse the authentication result message returned by the server, verify the validity of the server's authentication information, and verify whether the client's authentication response and the device's authentication response are successful; if both verifications are successful, the device sends an authentication success message to the client.

[0101] The verification module 602 is further configured to: if the comparison results are inconsistent, and the first device authentication parameters and client authentication information obtained by the device verification are incorrect, ignore the authentication response message.

[0102] Figure 7 A hardware structure diagram of a computing device 70 for secure network device authentication according to an embodiment of this specification is shown. Figure 7 As shown, the computing device 70 may include at least one processor 701, a memory 702 (e.g., non-volatile memory), a main memory 703, and a communication interface 704, and the at least one processor 701, memory 702, main memory 703, and communication interface 704 are connected together via a bus 705. At least one processor 701 executes at least one computer-readable instruction stored or encoded in the memory 702.

[0103] It should be understood that the computer-executable instructions stored in memory 702, when executed, cause at least one processor 701 to perform the above-described combinations in the various embodiments of this specification. Figure 1-5 The description includes various operations and functions.

[0104] In the embodiments of this specification, computing device 70 may include, but is not limited to: personal computer, server computer, workstation, desktop computer, laptop computer, notebook computer, mobile computing device, smartphone, tablet computer, cellular phone, personal digital assistant (PDA), handheld device, messaging device, wearable computing device, consumer electronic device, etc.

[0105] According to one embodiment, a program product, such as a machine-readable medium, is provided. The machine-readable medium may have instructions (i.e., the elements implemented in software as described above), which, when executed by a machine, cause the machine to perform the above-described combinations of the various embodiments of this specification. Figure 1-5 The various operations and functions described. Specifically, a system or apparatus equipped with a readable storage medium storing software program code that implements the functions of any of the embodiments described above, and enabling the computer or processor of the system or apparatus to read and execute the instructions stored in the readable storage medium.

[0106] The secure network device authentication method according to embodiments of the present invention enables pre-sharing of custom authentication parameters, custom authentication methods, and custom encryption methods among clients, devices, and servers within the same network environment. This allows for the privatization of pre-shared custom extended attributes, ensuring the security of the authentication network environment.

[0107] On the other hand, by encrypting the pre-shared custom authentication parameters using a pre-shared custom encryption method and encapsulating the message into the corresponding EAP attribute using the TLV method, the security of authentication can be enhanced.

[0108] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0109] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0110] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0111] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0112] The foregoing description of specific exemplary embodiments of the invention is for illustrative and explanatory purposes. These descriptions are not intended to limit the invention to the precise forms disclosed, and it will be apparent that many changes and variations can be made in accordance with the foregoing teachings. The exemplary embodiments were chosen and described in order to explain the specific principles of the invention and its practical application, thereby enabling those skilled in the art to implement and utilize various different exemplary embodiments of the invention, as well as various different choices and variations. The scope of the invention is intended to be defined by the claims and their equivalents.

Claims

1. A secure method for authenticating network devices, characterized in that, The method includes: The device sends an authentication request message to the client, wherein the authentication request message includes first device authentication parameters and a custom authentication method; The device parses the authentication response message returned by the client and verifies whether the obtained first device authentication parameters and client authentication information are correct. The client authentication information is generated by the client using a custom encryption method based on the custom authentication method, and the authentication response message encapsulates data in TLV format into the EAP data portion of the message. If correct, The device sends an authentication response message to the server. This authentication response message includes the client authentication information, client authentication parameters, a first device authentication parameter, a second device authentication parameter, and device authentication information generated by the device using a custom encryption method based on the custom authentication method. The authentication response message encapsulates data in TLV format into the EAP data portion of the message. The device parses the authentication result message returned by the server and determines the client's authentication result by verifying the obtained client authentication response, device authentication response, and server authentication information. The client authentication response and device authentication response are generated by the server based on the authentication result of the client authentication information, device authentication parameters, first device authentication parameters, second device authentication parameters, and device authentication information in the authentication response message using the custom authentication method. The server authentication information is generated by the server based on the custom authentication method using the custom encryption method on the client authentication response and device authentication response. The first device authentication parameters, the second device authentication parameters, the client authentication parameters, the custom authentication method, the custom encryption method, the client authentication information, the device authentication information, and the server authentication information are pre-shared by the device, the client, and the server.

2. The secure network device authentication method as described in claim 1, characterized in that, The method further includes: The device receives the identification response message sent by the client, generates a RADIUS request and sends it to the server, wherein the identification response message includes the host identifier of the client; The device receives the custom authentication method returned by the server and stores the custom authentication method and the first device authentication parameters in the authentication request message.

3. The secure network device authentication method as described in claim 1, characterized in that, The custom encryption method includes a first encryption algorithm and a second encryption algorithm. The first device authentication parameters and the client authentication parameters are encrypted M times by the client using the first encryption algorithm. The client authentication information is generated by the client encrypting the first device authentication parameters and the client authentication parameters N times using the second encryption algorithm based on the custom encryption method. The device parses the authentication response message returned by the client and verifies whether the obtained first device authentication parameters and client authentication information are correct, specifically including: The device parses the authentication response message and decrypts the first device authentication parameters and the client authentication parameters M times based on the first encryption algorithm. The device end encrypts the first device end authentication parameter and the client authentication parameter obtained after decryption N times based on the second encryption algorithm to obtain the first encrypted value; The device compares the first encrypted value with the client authentication information, and compares the first device authentication parameter obtained after decryption with the local first device authentication parameter. If the comparison results are consistent, the device verifies that the first device authentication parameters and client authentication information obtained are correct, and sends the authentication response message to the server.

4. The secure network device authentication method as described in claim 3, characterized in that, The device sends an authentication response message to the server, specifically including: The device encrypts the client authentication information, client authentication parameters, first device authentication parameters, second device authentication parameters, and device authentication information M times based on the first encryption algorithm. The device encrypts the client authentication information, client authentication parameters, first device authentication parameters, and second device authentication parameters N times based on the second encryption algorithm to generate the device authentication information. The encrypted client authentication information, client authentication parameters, first device authentication parameters, second device authentication parameters, and the device authentication information are encapsulated in TLV format into the EAP attribute of the authentication and identification response message.

5. The secure network device authentication method as described in claim 3, characterized in that, The first encryption algorithm includes a reversible encryption algorithm, and the second encryption algorithm includes an irreversible encryption algorithm.

6. The secure network device authentication method as described in claim 3, characterized in that, The method further includes: If the comparison results are inconsistent, the first device authentication parameters and client authentication information obtained by the device verification are incorrect, and the authentication response message is ignored.

7. The secure network device authentication method as described in claim 1, characterized in that, Determining the authentication result of the client specifically includes: The device parses the authentication result message returned by the server, verifies the validity of the server's authentication information, and verifies whether the client's authentication response and the device's authentication response pass. If all verifications are successful, the device sends an authentication success message to the client.

8. A secure network device authentication apparatus, characterized in that, The device includes: The first sending module is used to send an authentication request message from the device to the client, wherein the authentication request message includes the first device authentication parameters and a custom authentication method; The verification module is used to parse the authentication response message returned by the client on the device side and verify whether the obtained first device side authentication parameters and client authentication information are correct, wherein the client authentication information is generated by the client based on the custom authentication method using a custom encryption method on the first device side authentication parameters and client authentication parameters; The second sending module is used to send an authentication response message from the device to the server, wherein the authentication response message includes the client authentication information, client authentication parameters, first device authentication parameters, second device authentication parameters, and device authentication information generated by the device based on the custom authentication method using a custom encryption method for the client authentication information, second device authentication parameters, first device authentication parameters, and second device authentication parameters. The determination module is used to parse the authentication result message returned by the server on the device side, and determine the authentication result of the client by verifying the obtained client authentication response, device authentication response and server authentication information. The client authentication response and device authentication response are generated by the server side based on the authentication result of the client authentication information, device authentication parameters, first device authentication parameters, second device authentication parameters and device authentication information in the authentication response message based on the custom authentication method. The server authentication information is generated by the server side based on the custom authentication method using the custom encryption method to encrypt the client authentication response and device authentication response. The first device authentication parameters, the second device authentication parameters, the client authentication parameters, the custom authentication method, the custom encryption method, the client authentication information, the device authentication information, and the server authentication information are pre-shared by the device, the client, and the server.

9. A computing device, characterized in that, include: At least one processor; as well as A memory that stores instructions that, when executed by the at least one processor, cause the at least one processor to perform a method for secure network device authentication as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the secure network device authentication method as described in any one of claims 1 to 7.

Images