A method, apparatus, and medium for instruction authorization based on the RADIUS protocol.

Abstract

This application discloses a command authorization method, device, and medium based on the RADIUS protocol, relating to the field of network technology. The method includes: assembling authorization commands conforming to legality rules into RADIUS request messages based on a preset message structure to obtain RADIUS request messages corresponding to the authorization commands; sending the RADIUS request messages to a RADIUS server; extracting the authorization commands from the RADIUS request messages through the RADIUS server; judging the authorization commands according to the configuration command set; assembling the judgment results into a result message and returning it; receiving the result message; and determining whether the authorization command should be executed based on the result message. Sending the authorization messages to the RADIUS server and processing the request messages through the RADIUS server enables centralized management of the authentication, authorization, and accounting processes of network devices through the RADIUS protocol, making the management of device accounts and permissions more efficient and consistent.

Description

Technical Field

[0001] This application relates to the field of network technology, specifically to a method, device, and medium for instruction authorization based on the RADIUS protocol. Background Technology

[0002] AAA (Authentication, Authorization, and Accounting) is a network security protocol used for network authentication, authorization, and accounting. The authorization and accounting process can be further divided into command authorization accounting and user authorization accounting. AAA protocols include RADIUS and TACACS. In TACACS, the transmission of authorization messages requires establishing a connection, which consumes significant network bandwidth and does not well support data expansion, making it difficult to carry more information in authorization messages. RADIUS, on the other hand, uses UDP transmission, requires fewer exchanged messages, and has a smaller impact on network bandwidth. Therefore, RADIUS is a better choice for network authorization.

[0003] However, the RADIUS protocol's authentication and authorization processes are implemented together. RADIUS authorization information is often sent along with the Access Request, i.e., the authentication request message. Since the user authentication process only involves one RADIUS request message exchange from start to finish, this process is suitable for both user authentication and authorization. Command authorization requires each command to have a separate message exchange to verify its executableness with the server. RADIUS authentication and authorization cannot be separated, lacking a separate authorization process design. Summary of the Invention

[0004] To address the aforementioned issues, this application proposes an instruction granting method based on the RADIUS protocol, comprising:

[0005] Based on the preset message structure, the authorization instructions that conform to the legality rules are assembled into RADIUS request messages to obtain the RADIUS request message corresponding to the authorization instructions;

[0006] The RADIUS request message is sent to the RADIUS server. The RADIUS server extracts the authorization instruction from the RADIUS request message, judges the authorization instruction according to the configuration command set, and assembles the judgment result into a result message and returns it.

[0007] Receive the result message, and determine whether the authorization instruction should be executed based on the result message.

[0008] On the other hand, this application also proposes an instruction licensing device based on the RADIUS protocol, comprising:

[0009] At least one processor; and,

[0010] A memory communicatively connected to the at least one processor; wherein,

[0011] The memory stores instructions executable by the at least one processor, which, when executed by the at least one processor, enable the at least one processor to perform actions such as:

[0012] Based on the preset message structure, the authorization instructions that conform to the legality rules are assembled into RADIUS request messages to obtain the RADIUS request message corresponding to the authorization instructions;

[0013] The RADIUS request message is sent to the RADIUS server. The RADIUS server extracts the authorization instruction from the RADIUS request message, judges the authorization instruction according to the configuration command set, and assembles the judgment result into a result message and returns it.

[0014] Receive the result message, and determine whether the authorization instruction should be executed based on the result message.

[0015] On the other hand, this application also proposes a non-volatile computer storage medium storing computer-executable instructions, wherein the computer-executable instructions are configured as follows:

[0016] Based on the preset message structure, the authorization instructions that conform to the legality rules are assembled into RADIUS request messages to obtain the RADIUS request message corresponding to the authorization instructions;

[0017] The RADIUS request message is sent to the RADIUS server. The RADIUS server extracts the authorization instruction from the RADIUS request message, judges the authorization instruction according to the configuration command set, and assembles the judgment result into a result message and returns it.

[0018] Receive the result message, and determine whether the authorization instruction should be executed based on the result message.

[0019] The instruction authorization method based on the RADIUS protocol proposed in this application can bring the following beneficial effects:

[0020] By pre-setting the message structure and mimicking the message type fields for authentication and accounting in the RADIUS protocol, the authorization command is assembled into an authorization message recognizable by the RADIUS protocol. The authorization message is then sent to the RADIUS server, which processes the request message for authorization. This enables centralized management of the authentication, authorization, and accounting processes of network devices through the RADIUS protocol. This makes the management of device accounts and permissions more efficient and consistent, improves the security of the device authentication process, and reduces the risk of sensitive data being stolen on the network. Attached Figure Description

[0021] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0022] Figure 1 This is a flowchart illustrating an instruction authorization method based on the RADIUS protocol in an embodiment of this application.

[0023] Figure 2 This is a schematic diagram illustrating the specific process of an instruction authorization method based on the RADIUS protocol in an embodiment of this application.

[0024] Figure 3 This is a schematic diagram of an example RADIUS request message in the embodiments of this application;

[0025] Figure 4 This is a schematic diagram of an instruction authorization device based on the RADIUS protocol in an embodiment of this application. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0027] The technical solutions provided by the various embodiments of this application are described in detail below with reference to the accompanying drawings.

[0028] It's important to note that AAA (Authentication, Authorization, and Accounting) protocols are network security protocols used for network authentication, authorization, and accounting. These include RADIUS (Remote Authentication DialIn User Service), TACACS (Terminal Access Controller Access-Control System), and RESTCONF (Representational State Transfer Configuration) network management protocols. TACACS is a widely used protocol for network device authentication and access control, helping network administrators manage user identities and permissions and improve network security and compliance. RESTCONF is a network management protocol based on the REST architectural style, used for configuring and managing network devices. RESTCONF provides a lightweight, web-based management interface, making it easy to integrate with modern web development technologies and tools.

[0029] However, TACACS messages use the TCP protocol for transmission, which requires establishing a connection and consumes a significant amount of network bandwidth. Furthermore, the TACACS protocol does not adequately support TLV extensions, making it difficult to carry more information in authorization messages. Restconf uses a web-based management interface instead of the traditional CLI for issuing commands. While this allows for restrictions on executable commands via the web interface, network devices need to be specially adapted for Restconf commands. This includes parsing HTTP-style requests and sending the results in JSON format, increasing the workload of adapting new commands. Moreover, Restconf itself does not provide a method interface for command authorization, requiring additional adaptation for command restrictions.

[0030] like Figure 1 As shown, this application provides an instruction authorization method based on the RADIUS protocol, including:

[0031] S101: Based on the preset message structure, the authorization instructions that conform to the legality rules are assembled into RADIUS request messages to obtain the RADIUS request message corresponding to the authorization instructions.

[0032] Specifically, network devices pre-configure the default message structure for authorization commands based on the message type fields for authentication and accounting in the RADIUS protocol. This default message structure includes message type, required fields, and extended fields. Message types include request message type, acceptance message type, and rejection message type, with corresponding fields such as Authorization-Command-Accept, Authorization-Command-Access, and Authorization-Command-Reject. Required fields include Authorize-command, Username, Service-Type, and Message-Authenticator. Authorize-command stores the authorization command information required by the network device; Username is the username initiating the authorization request; Service-Type is the service type, typically specified as Authorize-Only; and Message-Authenticator is a message verification code, composed of encrypted RADIUS server keys and other information, used to enhance message security.

[0033] Furthermore, such as Figure 2 As shown, the authorization command input by the user is obtained, and a preliminary check is performed on the authorization command based on preset legality rules to verify whether the authorization command is legal.

[0034] Specifically, the authorization command is decomposed, the command name is extracted, and the command name is queried in a preset command set. If it exists, the length and parameters of the authorization command are obtained, and the length and parameters are checked based on command line syntax rules. The command line syntax rules include whether the command format and syntax are correct, whether the information contained in the command is complete and valid, and whether the command meets specific security policies, such as password complexity requirements and IP address range restrictions.

[0035] Furthermore, after the authorization command passes the initial check, it is parsed to determine the parameter names, required field parameters, and extended field parameters. A message checksum is added to the extended field, and a key is added to the authorization command using the message checksum. Based on the request message type, the authorization command is assembled to obtain the RADIUS request message.

[0036] It should be noted that the authorization request message is sent by the network device and received by the RADIUS server. It is used to request RADIUS authorization from the server. If the server verifies the message and authorizes it according to the instruction, it replies with an acceptance message. If the server considers the authorization message to be invalid or the instruction to be invalid, it replies with a rejection message to indicate that the authorization process has failed.

[0037] For example, such as Figure 3 The image shows a RADIUS request message corresponding to an authorization command under a preset message format. Here, AVP-type is the type in the RADIUS attribute, i.e., the Authorize-command defined earlier; AVP-len is the length in the RADIUS attribute, indicating the field length, including the 2 bytes of the header; arg-cnt indicates the number of parameters in the command, which is the value of N in arg_N_len and arg_N, ranging from 1 to 255; arg_N_len indicates the length of each parameter, arranged in the order of parameter input, with the number equal to arg-cnt, and each length ranging from 1 to 255; arg_N represents the parameter string, a complete network device command, which can often be split into several strings of alphanumeric characters by spaces, with each parameter string ranging from 1 to 255 in length.

[0038] S102: The RADIUS request message is sent to the RADIUS server. The RADIUS server extracts the authorization instruction from the RADIUS request message, judges the authorization instruction according to the configuration command set, and assembles the judgment result into a result message for return.

[0039] Specifically, after assembling the authorization instructions, the network device obtains a RADIUS request message and sends it to the RADIUS server over the network. The RADIUS server parses the RADIUS request message, extracts the authorization instructions from it, judges the authorization instructions according to the configuration command set, determines whether the authorization instructions are valid, and assembles the judgment result into a result message and returns it to the network device.

[0040] More specifically, to ensure that the RADIUS request message is not tampered with during transmission, the key in the RADIUS request message is obtained and verified by the RADIUS server.

[0041] Furthermore, after successful verification, the command name in the authorization instruction is determined, the configuration command set is invoked, and a fuzzy search is performed in the configuration command set using the command name as the query condition to determine whether the command name exists in the configuration command set. If it does, an approval result is generated. Based on the accepted message type, the approval result is assembled into a RADIUS accept message, such as an Authorization-Command-Accept message, and the RADIUS accept message is returned. If not, an error message is output. Based on the rejection message type, the error message is assembled into a RADIUS rejection message, such as an Authorization-Command-Reject message, and the RADIUS rejection message is returned.

[0042] It should be noted that the RADIUS server is pre-configured with a set of configuration commands. The configuration command set defines user permissions, as well as access conditions and restrictions. The RADIUS server uses the configuration command set to verify the user's identity, check whether the user has the right to access the requested service, and assess the user's access duration or bandwidth limits, etc.

[0043] S103: Receive the result message and determine whether the authorization instruction should be executed based on the result message.

[0044] Specifically, the network device receives a result message from the RADIUS server. When the result message is a RADIUS accept message, the authorization instruction is executed. When the result message is a RADIUS reject message, the authorization instruction is determined to have failed. The error information in the RADIUS reject message is extracted and returned to the device's front-end interface.

[0045] It should be noted that when a network device sends a RADIUS request message to the RADIUS server, the network device is in a waiting state. During the waiting period for the RADIUS server's reply, the network device remains in a waiting state and is not allowed to issue any other commands until the command receives a definite authorization result or the server's reply times out. After the network device receives the result message, regardless of the type of reply message received, the network device needs to stop waiting and take corresponding actions on the result message.

[0046] It's worth noting that compared to TACACS, RADIUS, due to its earlier deployment in various network environments, has better versatility. Furthermore, the RADIUS protocol not only includes attribute extension fields but also vendor-specific fields, offering a richer range of field types compared to TACACS, enabling it to carry more useful information for interaction. Compared to RESTconf, the RADIUS protocol is more user-friendly for network devices, eliminating the need for RESTful interface development. Commands can be directly encapsulated in messages for authorization, and there's no need to push execution results. This requires less adaptation and offers greater flexibility for developers.

[0047] By pre-setting the message structure and mimicking the message type fields for authentication and accounting in the RADIUS protocol, the authorization command is assembled into an authorization message recognizable by the RADIUS protocol. The authorization message is then sent to the RADIUS server, which processes the request message for authorization. This enables centralized management of the authentication, authorization, and accounting processes of network devices through the RADIUS protocol. This makes the management of device accounts and permissions more efficient and consistent, improves the security of the device authentication process, and reduces the risk of sensitive data being stolen on the network.

[0048] like Figure 4 As shown in the embodiments of this application, an instruction authorization device based on the RADIUS protocol is also proposed, including:

[0049] At least one processor; and,

[0050] A memory communicatively connected to the at least one processor; wherein,

[0051] The memory stores instructions that can be executed by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform an instruction authorization method based on the RADIUS protocol as described in any of the above embodiments.

[0052] This application also provides a non-volatile computer storage medium storing computer-executable instructions, wherein the computer-executable instructions are configured as: an instruction authorization method based on the RADIUS protocol as described in any of the above embodiments.

[0053] The various embodiments in this application are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the device and medium embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the description of the method embodiments.

[0054] The devices and media provided in this application are one-to-one with the methods. Therefore, the devices and media also have similar beneficial technical effects as their corresponding methods. Since the beneficial technical effects of the methods have been described in detail above, the beneficial technical effects of the devices and media will not be repeated here.

[0055] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0056] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0057] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0058] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0059] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0060] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0061] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0062] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0063] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for instruction authorization based on the RADIUS protocol, characterized in that, include: Based on the preset message structure, the authorization instructions that conform to the legality rules are assembled into RADIUS request messages to obtain the RADIUS request message corresponding to the authorization instructions; The RADIUS request message is sent to the RADIUS server. The RADIUS server extracts the authorization instruction from the RADIUS request message, judges the authorization instruction according to the configuration command set, and assembles the judgment result into a result message and returns it. Receive the result message, and determine whether the authorization instruction should be executed based on the result message.

2. The instruction authorization method based on the RADIUS protocol according to claim 1, characterized in that, Before assembling the authorization instructions that conform to the legality rules into a RADIUS request message based on the preset message structure, the method further includes: Obtain the authorization command input by the user, and perform a preliminary check on the authorization command based on preset legality rules to verify whether the authorization command is legal.

3. The instruction authorization method based on the RADIUS protocol according to claim 2, characterized in that, The preliminary check of the authorization instruction based on preset legality rules specifically includes: The authorization instruction is decomposed, and the command name is extracted from the authorization instruction; The command name is queried in the preset command set. If it exists, the length and parameters of the authorized instruction are obtained, and the length and parameters are checked based on the command line syntax rules.

4. The instruction authorization method based on the RADIUS protocol according to claim 1, characterized in that, The preset message structure includes message type, required fields, and extended fields; the message type includes request message type, accept message type, and reject message type. The assembly of authorization instructions conforming to the legality rules into RADIUS request messages based on a preset message structure specifically includes: Obtain an authorization instruction that conforms to the legality rules, parse the authorization instruction, and determine the parameter names, parameters corresponding to required fields, and parameters corresponding to extended fields in the authorization instruction; Based on the request message type, the authorization instruction is assembled to obtain a RADIUS request message.

5. The instruction authorization method based on the RADIUS protocol according to claim 4, characterized in that, The step of judging the authorization command according to the configuration command set and assembling the judgment result into a result message for return specifically includes: Determine the command name in the authorization instruction, invoke the configuration command set, perform a fuzzy search in the configuration command set using the command name as the query condition, and determine whether the command name exists in the configuration command set; If so, a pass result is generated, and based on the received message type, the pass result is assembled into a RADIUS receive message, and the RADIUS receive message is returned. If not, an error message is output. Based on the rejection message type, the error message is assembled into a RADIUS rejection message, and the RADIUS rejection message is returned.

6. The instruction authorization method based on the RADIUS protocol according to claim 5, characterized in that, The step of determining whether the authorization instruction should be executed based on the result message specifically includes: When the result message is a RADIUS accept message, the authorization instruction is executed; When the result message is a RADIUS rejection message, it is determined that the authorization instruction failed. The error information in the RADIUS rejection message is extracted and returned to the device front-end interface.

7. The instruction authorization method based on the RADIUS protocol according to claim 4, characterized in that, Before assembling the authorization instruction based on the request message type, the method further includes: A message verification code is added to the extended field, and a key is added to the authorization instruction using the message verification code.

8. The instruction authorization method based on the RADIUS protocol according to claim 7, characterized in that, Before retrieving the authorization instruction from the RADIUS request message via the RADIUS server, the method further includes: Obtain the key from the RADIUS request message and verify the key through the RADIUS server.

9. A command authorization device based on the RADIUS protocol, characterized in that, include: At least one processor; as well as, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, which, when executed by the at least one processor, enable the at least one processor to perform actions such as: Based on the preset message structure, the authorization instructions that conform to the legality rules are assembled into RADIUS request messages to obtain the RADIUS request message corresponding to the authorization instructions; The RADIUS request message is sent to the RADIUS server. The RADIUS server extracts the authorization instruction from the RADIUS request message, judges the authorization instruction according to the configuration command set, and assembles the judgment result into a result message and returns it. Receive the result message, and determine whether the authorization instruction should be executed based on the result message.

10. A non-volatile computer storage medium storing computer-executable instructions, characterized in that, The computer-executable instructions are set as follows: Based on the preset message structure, the authorization instructions that conform to the legality rules are assembled into RADIUS request messages to obtain the RADIUS request message corresponding to the authorization instructions; The RADIUS request message is sent to the RADIUS server. The RADIUS server extracts the authorization instruction from the RADIUS request message, judges the authorization instruction according to the configuration command set, and assembles the judgment result into a result message and returns it. Receive the result message, and determine whether the authorization instruction should be executed based on the result message.

Images