Dynamic isolation method and device based on controller

Abstract

The embodiment of the invention provides a dynamic isolation method and device based on a controller, the method is applied to network equipment, and the method comprises the following steps: configuring an access interface on the network equipment to only allow an authentication message to pass; receiving an authentication message which is sent by the terminal equipment and is used for carrying out an identity authentication request through the access interface; acquiring a terminal identity identifier of the terminal equipment based on the authentication message, so that the authentication server performs identity authentication on the terminal equipment based on the terminal identity identifier, and if the authentication is passed, configuring isolation information and interface permission for the terminal equipment through the controller; and authorizing the access interface based on the interface authority to allow the non-authentication message to pass, and generating an isolation flow table for the terminal equipment according to the configured isolation information. According to the invention, the problem that the flexibility and mobility of the terminal are limited by a static access mode in related technologies is solved, and the effect of dynamically isolating the terminal equipment is further achieved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the technical field of network communications, and in particular, to a controller-based dynamic isolation method and device. Background Art

[0002] In the field of network communication technology, VXLAN (Virtual eXtensible LAN) technology is widely used to achieve secure communication between virtual networks and physical networks. VXLAN is a Layer 2 VPN technology based on IP networks. By adopting the "MAC in UDP" encapsulation method, it expands the capabilities of large-scale virtual LANs on existing IP networks.

[0003] Typically, the configuration of VXLAN needs to be performed in advance on the access device (such as a switch) by the administrator or controller (such as an SDN controller). The administrator needs to configure the VXLAN information of the terminal on the access device to establish the corresponding relationship between the terminal and the virtual network. Generally, the "interface + VLAN" method is used to distinguish the relationship between traffic and VXLAN. This configuration method has some problems.

[0004] First, pre-configuring VXLAN information makes system management complex and inflexible. When you need to add, delete, or modify the VXLAN information of a terminal, you need to manually operate the access device to update the configuration, which is time-consuming and labor-intensive. Especially in large-scale network environments, this manual configuration method becomes very cumbersome and difficult.

[0005] Secondly, since VXLAN terminals can access the network without identity authentication, there is a risk of terminal impersonation. In traditional VXLAN configurations, any terminal with legitimate network access rights can access the network using pre-configured VXLAN information without identity authentication. This poses a potential threat to network security and may cause unauthorized terminals to enter the virtual network.

[0006] In addition, the way interfaces are bound to VXLAN limits the access methods of terminals and lacks dynamism. Once a terminal is bound to a specific interface, it can only access the network through the fixed interface. This static access method limits the flexibility and mobility of terminals and cannot dynamically adjust the access location of terminals according to actual needs and changes in network topology.

[0007] Therefore, in order to solve the above problems, a controller-based dynamic isolation method is needed. Summary of the invention

[0008] The embodiments of the present invention provide a controller-based dynamic isolation method and device to at least solve the problem that the static access method in the related art limits the flexibility and mobility of the terminal, and it is difficult to dynamically adjust the access location of the terminal according to actual needs and changes in network topology, as well as the problem of information security.

[0009] According to an embodiment of the present invention, a controller-based dynamic isolation method is provided, which is applied to a network device. The method includes:

[0010] Configuring the access interface on the network device to allow only authentication messages to pass;

[0011] Receiving, through the access interface, an authentication message sent by a terminal device for requesting identity authentication;

[0012] Acquire the terminal identity of the terminal device based on the authentication message, so that the authentication server performs identity authentication on the terminal device based on the terminal identity, and if the authentication is successful, configure isolation information and interface permissions for the terminal device through the controller;

[0013] The access interface is authorized based on the interface authority to allow non-authenticated messages to pass through, and an isolation flow table is generated for the terminal device according to the configured isolation information.

[0014] In an exemplary embodiment, obtaining a terminal identity of the terminal device based on the authentication message so that the authentication server performs identity authentication on the terminal device based on the terminal identity includes:

[0015] The network device sends the authentication message to the controller, so that the controller inquires the terminal device about the terminal identity based on the authentication message, and sends the terminal identity replied by the terminal device to the authentication server to authenticate the terminal device.

[0016] In an exemplary embodiment, obtaining a terminal identity of the terminal device based on the authentication message so that the authentication server performs identity authentication on the terminal device based on the terminal identity includes:

[0017] The network device inquires the terminal device about the terminal identity based on the authentication message, and sends the terminal identity replied by the terminal device to the authentication server to perform identity authentication on the terminal device.

[0018] In an exemplary embodiment, the identity authentication request is one of the following: 802.1X authentication, Point-to-Point Protocol over Ethernet (PPPoE) authentication, and Portal authentication.

[0019] In an exemplary embodiment, after generating an isolation flow table for the terminal device according to the configured isolation information, the method further includes:

[0020] The network device sends an authentication success message to the terminal device to notify the terminal device that the authentication is successful, so that the terminal device can perform IP address request and allocation with the address allocation server.

[0021] In an exemplary embodiment, the isolation flow table is a MAC table entry, and the MAC table entry includes isolation information, terminal MAC, interface, and interface authority.

[0022] In an exemplary embodiment, after the IP address request and allocation are performed between the terminal device and the address allocation server, the method further includes:

[0023] Receiving an offline request message sent by the terminal device;

[0024] forwarding the offline request message to the controller so that the controller generates a deauthorization flow table;

[0025] The access interface authorization is canceled according to the deauthorization flow table, and the corresponding MAC table entry is deleted, so that the access interface is configured to allow only authentication messages to pass through.

[0026] According to another embodiment of the present invention, a controller-based dynamic isolation method is provided, which is applied to an authentication server, and the method includes:

[0027] Receiving an authentication message forwarded by a network device to request identity authentication of a terminal device, wherein the access interface on the network device is configured to allow only the authentication message to pass;

[0028] Obtain the terminal identity of the terminal device;

[0029] The terminal device is authenticated based on the terminal identity identifier. If the authentication is successful, isolation information and interface permissions are configured for the terminal device through the controller, so that the network device authorizes the access interface based on the interface permissions to allow non-authenticated messages to pass through, and generates an isolation flow table for the terminal device according to the configured isolation information.

[0030] According to another embodiment of the present invention, a controller-based dynamic isolation method is provided, which is applied to the controller. The method includes:

[0031] Receiving an authentication message of a terminal device forwarded by a network device, wherein the access interface on the network device is configured to allow only the authentication message to pass;

[0032] Obtaining a terminal identity based on the authentication message, so that the authentication server performs identity authentication on the terminal device based on the terminal identity, and generating an authentication success message if the authentication succeeds;

[0033] Based on the authentication success message, isolation information and interface permissions are configured for the terminal device, so that the network device authorizes the access interface based on the interface permissions to allow non-authenticated messages to pass through, and generates an isolation flow table for the terminal device according to the configured isolation information.

[0034] According to another embodiment of the present invention, there is provided a network device, including:

[0035] An acquisition module, configured to receive, through an access interface, an authentication message sent by a terminal device for identity authentication request, wherein the access interface on the network device is configured to allow only the authentication message to pass;

[0036] a processing module, configured to obtain a terminal identity of the terminal device based on the authentication message, so that the authentication server performs identity authentication on the terminal device based on the terminal identity, and if the authentication is successful, configure isolation information and interface permissions for the terminal device through a controller; and

[0037] The access interface is authorized based on the interface authority to allow non-authenticated messages to pass through, and an isolation flow table is generated for the terminal device according to the configured isolation information.

[0038] According to another embodiment of the present invention, there is provided an authentication server, comprising:

[0039] An acquisition module is used to receive an authentication message forwarded by a network device to request identity authentication of a terminal device, wherein the access interface on the network device is configured to allow only the authentication message to pass; and obtain a terminal identity of the terminal device;

[0040] A processing module is used to authenticate the terminal device based on the terminal identity identifier. If the authentication is successful, the controller configures isolation information and interface permissions for the terminal device, so that the network device authorizes the access interface based on the interface permissions to allow non-authenticated messages to pass through, and generates an isolation flow table for the terminal device according to the configured isolation information.

[0041] According to another embodiment of the present invention, there is provided a controller, comprising:

[0042] An acquisition module, configured to receive an authentication message of a terminal device forwarded by a network device, wherein the access interface on the network device is configured to allow only the authentication message to pass;

[0043] a processing module, configured to obtain a terminal identity based on the authentication message, so that the authentication server performs identity authentication on the terminal device based on the terminal identity, and generates an authentication success message if the authentication is successful; and

[0044] Based on the authentication success message, isolation information and interface permissions are configured for the terminal device, so that the network device authorizes the access interface based on the interface permissions to allow non-authenticated messages to pass through, and generates an isolation flow table for the terminal device according to the configured isolation information.

[0045] According to yet another embodiment of the present invention, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the steps of any one of the above method embodiments when run.

[0046] According to yet another embodiment of the present invention, there is provided an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0047] Through the above-mentioned embodiments of the present invention, since the terminal device can connect to any access interface of the network device and then authenticate the identity of the terminal device, after the identity authentication is successful, the controller configures isolation information and interface permissions for the terminal device, and the network device creates and maintains the isolation flow table for traffic control and forwarding, thereby solving the network trusted access of terminals in the physical environment and the dynamic isolation problem caused by terminal migration.

[0048] Therefore, the isolation information does not need to be pre-set on the network device, and is managed by the controller with unified policies, which reduces management complexity and increases flexibility. The terminal device identity is authenticated first and then the access interface is isolated to prevent terminal identity impersonation. The terminal identity replaces the access interface and is bound to the isolation information. The terminal access interface is no longer restricted. Even if the location of the terminal device is moved, the terminal device can be automatically isolated after network authentication, achieving the effect of dynamic isolation of the terminal device. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 is a hardware structure block diagram of a mobile terminal according to a controller-based dynamic isolation method according to an embodiment of the present invention;

[0050] Figure 2 is a schematic diagram of a network architecture in which a controller-based dynamic isolation method according to an embodiment of the present invention is executed;

[0051] Figure 3 is a flow chart of a controller-based dynamic isolation method according to an embodiment of the present invention;

[0052] Figure 4 is a signaling diagram between terminals in a network architecture in which a controller obtains a terminal identity according to an embodiment of the present invention;

[0053] Figure 5 is a signaling diagram between various terminals in a network architecture in which a network device obtains a terminal identity according to an embodiment of the present invention;

[0054] Figure 6 is a schematic diagram of a process of a terminal device going offline according to an embodiment of the present invention;

[0055] Figure 7 is a structural block diagram of a network device according to an embodiment of the present invention;

[0056] Figure 8 is a structural block diagram of an authentication server according to an embodiment of the present invention;

[0057] Fig. 9 is a structural block diagram of a controller according to an embodiment of the present invention. DETAILED DESCRIPTION

[0058] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings and in combination with the embodiments.

[0059] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0060] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a computer terminal as an example, Figure 1 1 is a hardware structure block diagram of a computer terminal of a controller-based dynamic isolation method according to an embodiment of the present invention. Figure 1 As shown, the computer terminal may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the above-mentioned computer terminal may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above-mentioned computer terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0061] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the controller-based dynamic isolation method in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, to implement the above method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories can be connected to the computer terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0062] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0063] The present application embodiment can be run on Figure 2 In the network architecture shown in Figure 2 As shown, the network architecture includes: network device A, network device B, terminal device A, terminal device B, authentication server, controller and address allocation server. Network device A and network device B are connected through a network tunnel protocol to facilitate communication between network device A and network device B. Of course, there can be multiple network devices connected, which will not be repeated here. Terminal device A is connected to network device A to facilitate communication with network device A. The network device is connected to the controller and the authentication server, and the terminal device is connected to the address allocation server.

[0064] In this embodiment, a controller-based dynamic isolation method running on the above network architecture is provided. Figure 3 is a flow chart of a controller-based dynamic isolation method according to an embodiment of the present invention, such as Figure 3 As shown, the process includes the following steps:

[0065] Step S301, configuring the access interface on the network device to allow only authentication messages to pass;

[0066] Specifically, you can set it as follows:

[0067] Determine the device model and manufacturer: Different network devices have different operation modes and command syntax. Determine the device model and manufacturer so that configuration commands can be executed correctly;

[0068] Log in to the device: Use the appropriate management interface (for example, SSH, Telnet, or console) to log in to the command line interface of the network device.

[0069] Enter interface configuration mode: Enter interface configuration mode through commands. The specific command may vary from device to device, but it is usually entered by entering commands such as "configure terminal" or "config";

[0070] Select the interface to be configured: Use the command to select the interface to be configured. For example, "interfaceGigabitEthernet0 / 1" selects GigabitEthernet interface 0 / 1 for configuration;

[0071] Configure authentication: Configure the appropriate authentication mechanism based on the device's support and configuration options. Common authentication mechanisms include 802.1X authentication, MAC address authentication, etc. The specific configuration commands depend on the device and the selected authentication mechanism;

[0072] Configure the authentication server: Connect the device to the authentication server to verify the authentication request. Specific configuration commands can be set according to the type of device and authentication server;

[0073] Apply Configuration: Save and apply configuration changes. Use the appropriate command to apply configuration changes to the interface. For example, the "exit" command exits the interface configuration mode and the "write" or "copy running-config startup-config" command saves the changes to the device's persistent configuration.

[0074] Of course, the permission to configure the access interface can be burned into the network device, and the permission to configure the access interface of the network device can also be burned into the controller.

[0075] Step S302, receiving an authentication message sent by a terminal device through an access interface to request identity authentication;

[0076] Specifically, after the terminal device is connected to the access interface of the network device, the terminal device establishes a connection with the network device, and the terminal device sends an authentication message for identity authentication request to the network device through the access interface.

[0077] Step S303, obtaining a terminal identity of the terminal device based on the authentication message, so that the authentication server performs identity authentication on the terminal device based on the terminal identity. If the authentication is successful, the controller configures isolation information and interface permissions for the terminal device;

[0078] Specifically, the terminal identity of the terminal device can be obtained by the controller according to the authentication message, or by the network device according to the authentication message. The controller sends the terminal identity to the authentication server, or the network device sends the terminal identity to the authentication server, so that the authentication server performs identity authentication with the terminal device according to the identity terminal identity. If the authentication server passes the authentication, the controller configures isolation information and interface permissions for the terminal device.

[0079] The isolation information may be a VXLAN ID. The VXLAN ID (Virtual Extensible LAN Identifier) ​​is an identifier used in the VXLAN (Virtual Extensible LAN) network virtualization technology. VXLAN is a network virtualization technology used to expand the number and scale of virtual local area networks (VLANs). It creates a logical network on top of the existing network infrastructure, enabling virtualized devices such as virtual machines (VMs) and containers to communicate across physical networks while providing isolation and flexibility.

[0080] In VXLAN, VXLAN ID is used to identify the isolation and recognition of virtual networks. It is a 24-bit identifier, also known as VNI (VXLAN Network Identifier). VXLAN ID carries VXLAN network identification information in data packets by extending the header of Ethernet frames.

[0081] Specifically, VXLAN ID is used to isolate the network traffic of virtual machines into different virtual networks. Each virtual network has a unique VXLAN ID to ensure that packets between different virtual networks are not mixed or crossed in the extended virtual network. By using VXLAN ID, virtual machines can communicate between different hosts through the underlying physical network and maintain logical isolation between virtual networks.

[0082] The VXLAN ID ranges from 1 to 16,777,215 (0xFFFFFF). It can be assigned and configured by network administrators to meet specific network needs and deployment requirements.

[0083] In short, VXLAN ID is a unique identifier used to identify and isolate virtual networks in VXLAN network virtualization technology. It transmits VXLAN network identification information in data packets by extending the header of the Ethernet frame.

[0084] Step S304: Authorize the access interface based on the interface authority to allow non-authenticated messages to pass through, and generate an isolation flow table for the terminal device according to the configured isolation information.

[0085] After the access interface is authorized, the access interface is allowed to pass non-authentication messages, so that the terminal device and the network device can exchange information. Non-authentication messages can be: control messages, routing protocol messages, network protocol messages, broadcast and multicast messages, etc.

[0086] In one implementation, the isolation flow table is a MAC table entry, and the MAC table entry includes isolation information, terminal MAC, interface, and interface authority.

[0087] Specifically, a MAC table entry is a record used in a network switch to maintain the mapping relationship between a MAC address and the corresponding port. It is used to implement the forwarding function of the switch, forwarding data packets from the input port to the correct output port to ensure that the data packets can reach the target device correctly. Whenever a network switch receives a data frame, it checks the source MAC address in the data frame. The switch then associates the source MAC address with the input port and creates or updates the corresponding MAC table entry. When the switch needs to forward a data frame, it looks up the entry for the destination MAC address in the MAC table and forwards the data frame to the output port associated with the destination MAC address.

[0088] MAC table entries typically include: 1. MAC address: Each MAC table entry contains a MAC address that uniquely identifies the device. 2. Port number: The MAC table entry also contains the port number associated with the MAC address, indicating which port the data packet should be forwarded from. 3. Timestamp: In order to keep the MAC table up to date, the MAC table entry typically contains a timestamp that records the time of the last activity (such as receipt of a data packet). When an entry has been inactive for a long time, the switch may delete it to free up resources. 4. Other attributes: Some switches may include other attributes in the MAC table entry, such as a virtual local area network (VLAN) identifier, which is used to implement VLAN isolation and forwarding.

[0089] Through the above steps, since the terminal device can connect to any access interface of the network device, and then authenticate the identity of the terminal device, after the identity authentication is successful, the controller configures isolation information and interface permissions for the terminal device, and the network device creates and maintains the isolation flow table for traffic control and forwarding, solving the network trusted access of terminals in the physical environment and the dynamic isolation problem caused by terminal migration.

[0090] Therefore, the isolation information does not need to be pre-set on the network device, and is managed by the controller with unified policies, which reduces management complexity and increases flexibility. The terminal device identity is authenticated first and then the access interface is isolated to prevent terminal identity impersonation. The terminal identity replaces the access interface and is bound to the isolation information. The terminal access interface is no longer restricted. Even if the location of the terminal device is moved, the terminal device can be automatically isolated after network authentication, achieving the effect of dynamic isolation of the terminal device.

[0091] See also Figure 4 , Figure 4 It is a signaling diagram between various terminals in a network architecture in which a controller obtains a terminal identity according to an embodiment of the present invention.

[0092] In one implementation, obtaining a terminal identity of a terminal device based on an authentication message so that an authentication server performs identity authentication on the terminal device based on the terminal identity includes:

[0093] The network device sends an authentication message to the controller, so that the controller inquires the terminal device about the terminal identity based on the authentication message, and sends the terminal identity replied by the terminal device to the authentication server to authenticate the terminal device.

[0094] Specifically, a network device, such as a switch or a wireless access point, sends an authentication message to the controller. The authentication message contains the relevant identity information of the terminal device and an authentication request. After receiving the authentication message, the controller will initiate a query to the terminal device based on the identity information therein, requiring the terminal device to provide its identity. After receiving the query from the controller, the terminal device provides its own identity to reply to the controller through an authentication method (such as a user name, password, certificate, etc.). After receiving the identity of the terminal device, the controller forwards it to the authentication server for identity authentication. The authentication server verifies the validity and legitimacy of the identity provided by the terminal device.

[0095] Therefore, through the above authentication process, the effect of identity authentication of the terminal device can be achieved. The network device sends the authentication message to the controller, and the controller interacts with the terminal device to obtain the identity of the terminal device and send it to the authentication server for verification. This process can ensure that only authenticated terminal devices are allowed to access the network, thereby enhancing the security and access control capabilities of the network.

[0096] See also Figure 5 , Figure 5 It is a signaling diagram between various terminals in a network architecture in which a network device obtains a terminal identity according to an embodiment of the present invention.

[0097] In one implementation, obtaining a terminal identity of a terminal device based on an authentication message so that an authentication server performs identity authentication on the terminal device based on the terminal identity includes:

[0098] The network device inquires the terminal device about the terminal identity based on the authentication message, and sends the terminal identity replied by the terminal device to the authentication server to authenticate the terminal device.

[0099] Specifically, the terminal identity of the terminal device is obtained by the network device, which relieves the data processing pressure of the controller.

[0100] In one implementation, the identity authentication request is one of the following: 802.1X authentication, Point-to-Point Protocol over Ethernet (PPPoE) authentication, and Portal authentication.

[0101] Specifically, 802.1X provides a network access control method based on identity authentication, requiring terminal devices to perform identity authentication before accessing the network, ensuring that only authenticated devices can access the network, thereby improving the security of device access. It can be used in combination with a variety of authentication methods, including username / password, digital certificate, One-Time Password (OTP), etc., to provide flexible authentication methods. By using encryption technology and key exchange protocols, 802.1X can protect the confidentiality and integrity of data transmitted during the authentication process, providing higher security.

[0102] PPPoE authentication assigns a unique username and password to each user, achieving isolation between users and ensuring that traffic between users does not interfere with or interfere with each other. It supports dynamic allocation of IP addresses, which can assign different IP addresses to each user as needed, providing a more flexible address management and resource allocation method. It provides a simple and effective authentication and authorization mechanism that can authenticate users and limit user access rights according to authorization policies.

[0103] Portal authentication usually provides an authentication interface through a web page. Users can authenticate using usernames and passwords, providing a simple and intuitive user experience. Authentication policies can be customized according to needs, such as restricting access to specific websites and limiting access time, providing a more flexible authentication and access control method. It is usually integrated with an identity authentication server to achieve centralized management and control of user authentication and access rights, making it easier for administrators to manage uniformly.

[0104] Therefore, through the above authentication method, comprehensive network access control and security can be provided.

[0105] In one implementation, the network device sends an authentication message to the controller, so that the controller inquires the terminal device about the terminal identity based on the authentication message, and sends the terminal identity replied by the terminal device to the authentication server to authenticate the terminal device. The specific process may be: obtaining the EAPOL Start message sent by the terminal device;

[0106] Forwarding the EAPOL_Start message to the controller, so that the controller sends an EAP Request / Identity message to the terminal device, so that the terminal device generates an EAP Response / Identity message based on the EAP Request / Identity message, and sends the EAP Response / Identity message to the controller, so that the controller obtains the terminal identity;

[0107] The controller generates a Radius access request message based on the EAP Response / Identity message, and sends the Radius access request message to the authentication server, so that the authentication server performs identity authentication with the terminal device.

[0108] Specifically, the authentication server and the terminal device may perform identity authentication in the form of TLS authentication, MD5 authentication, PEAP authentication, etc. Among them, TLS authentication, MD5 authentication, PEAP authentication, etc. are all authentication methods in the prior art, and will not be described in detail here.

[0109] In one implementation, the network device inquires the terminal device about the terminal identity based on the authentication message, and sends the terminal identity replied by the terminal device to the authentication server to authenticate the terminal device. Specifically, it can be:

[0110] Get the EAPOL_Start message sent by the terminal device and generate an EAP Request / Identity message;

[0111] Sending an EAP Request / Identity message to the terminal device so that the terminal device generates an EAP Response / Identity message;

[0112] Get the EAP Response / Identity message and generate a Radius access request message;

[0113] The Radius access request message is sent to the authentication server so that the authentication server and the terminal device can perform identity authentication.

[0114] In one implementation, after generating an isolation flow table for a terminal device according to the configured isolation information, the method further includes:

[0115] The network device sends an authentication success message to the terminal device to notify the terminal device that the authentication is successful, so that the terminal device can request and allocate an IP address with the address allocation server, where the address allocation server can be a DHCP server.

[0116] See also Figure 6 , Figure 6 It is a schematic diagram of the process of terminal equipment going offline according to an embodiment of the present invention.

[0117] In one embodiment, Figure 6 As shown, the process includes the following steps:

[0118] After the IP address request and allocation between the terminal device and the address allocation server, it also includes:

[0119] S601, receiving an offline request message sent by a terminal device;

[0120] S602, forwarding the offline request message to the controller, so that the controller generates a deauthorization flow table;

[0121] S603: Cancel the access interface authorization according to the deauthorization flow table, and delete the corresponding MAC table entry, so that the access interface is configured to allow only the authentication message to pass.

[0122] In this embodiment, a controller-based dynamic isolation method is also provided, which is applied to an authentication server. The method includes:

[0123] receiving an authentication message forwarded by a network device for requesting identity authentication of a terminal device, wherein an access interface on the network device is configured to allow only the authentication message to pass;

[0124] Obtain the terminal identity of the terminal device;

[0125] The terminal device is authenticated based on the terminal identity. If the authentication is successful, the controller configures isolation information and interface permissions for the terminal device so that the network device authorizes the access interface based on the interface permissions to allow non-authenticated messages to pass through, and generates an isolation flow table for the terminal device based on the configured isolation information.

[0126] In one implementation, obtaining a terminal identity of a terminal device based on an authentication message so that an authentication server performs identity authentication on the terminal device based on the terminal identity includes:

[0127] The network device sends an authentication message to the controller, so that the controller inquires the terminal device about the terminal identity based on the authentication message, and sends the terminal identity replied by the terminal device to the authentication server to authenticate the terminal device.

[0128] In one implementation, obtaining a terminal identity of a terminal device based on an authentication message so that an authentication server performs identity authentication on the terminal device based on the terminal identity includes:

[0129] The network device inquires the terminal device about the terminal identity based on the authentication message, and sends the terminal identity replied by the terminal device to the authentication server to authenticate the terminal device.

[0130] In one implementation, the identity authentication request is one of the following: 802.1X authentication, Point-to-Point Protocol over Ethernet (PPPoE) authentication, and Portal authentication.

[0131] In one implementation, after generating an isolation flow table for a terminal device according to the configured isolation information, the method further includes:

[0132] The network device sends an authentication success message to the terminal device to notify the terminal device that the authentication is successful, so that the terminal device can request and allocate an IP address with the address allocation server.

[0133] In one implementation, the isolation flow table is a MAC table entry, and the MAC table entry includes isolation information, terminal MAC, interface, and interface authority.

[0134] In one embodiment, after the IP address request and allocation are performed between the terminal device and the address allocation server, the method further includes:

[0135] Receiving an offline request message sent by a terminal device;

[0136] Forwarding the offline request message to the controller so that the controller generates a deauthorization flow table;

[0137] The access interface authorization is canceled according to the deauthorization flow table, and the corresponding MAC table entry is deleted, so that the access interface is configured to allow only authentication messages to pass.

[0138] In this embodiment, a controller-based dynamic isolation method is also provided, which is applied to the controller. The method includes:

[0139] receiving an authentication message of a terminal device forwarded by a network device, wherein an access interface on the network device is configured to allow only the authentication message to pass;

[0140] Obtaining the terminal identity based on the authentication message, so that the authentication server performs identity authentication on the terminal device based on the terminal identity, and if the authentication is successful, generating an authentication success message;

[0141] Based on the authentication success message, isolation information and interface permissions are configured for the terminal device, so that the network device authorizes the access interface based on the interface permissions to allow non-authenticated messages to pass through, and generates an isolation flow table for the terminal device according to the configured isolation information.

[0142] In one implementation, obtaining a terminal identity of a terminal device based on an authentication message so that an authentication server performs identity authentication on the terminal device based on the terminal identity includes:

[0143] The network device sends an authentication message to the controller, so that the controller inquires the terminal device about the terminal identity based on the authentication message, and sends the terminal identity replied by the terminal device to the authentication server to authenticate the terminal device.

[0144] In one implementation, obtaining a terminal identity of a terminal device based on an authentication message so that an authentication server performs identity authentication on the terminal device based on the terminal identity includes:

[0145] The network device inquires the terminal device about the terminal identity based on the authentication message, and sends the terminal identity replied by the terminal device to the authentication server to authenticate the terminal device.

[0146] In one implementation, the identity authentication request is one of the following: 802.1X authentication, Point-to-Point Protocol over Ethernet (PPPoE) authentication, and Portal authentication.

[0147] In one implementation, after generating an isolation flow table for a terminal device according to the configured isolation information, the method further includes:

[0148] The network device sends an authentication success message to the terminal device to notify the terminal device that the authentication is successful, so that the terminal device can request and allocate an IP address with the address allocation server.

[0149] In one implementation, the isolation flow table is a MAC table entry, and the MAC table entry includes isolation information, terminal MAC, interface, and interface authority.

[0150] In one embodiment, after the IP address request and allocation are performed between the terminal device and the address allocation server, the method further includes:

[0151] Receiving an offline request message sent by a terminal device;

[0152] Forwarding the offline request message to the controller so that the controller generates a deauthorization flow table;

[0153] The access interface authorization is canceled according to the deauthorization flow table, and the corresponding MAC table entry is deleted, so that the access interface is configured to allow only authentication messages to pass.

[0154] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0155] See also Figure 7 , Figure 7 is a structural block diagram of a network device according to an embodiment of the present invention.

[0156] In this embodiment, a network device is also provided, including:

[0157] The acquisition module 71 is used to receive, through the access interface, an authentication message sent by the terminal device for identity authentication request, wherein the access interface on the network device is configured to allow only the authentication message to pass;

[0158] A processing module 72 is used to obtain a terminal identity of the terminal device based on the authentication message, so that the authentication server performs identity authentication on the terminal device based on the terminal identity. If the authentication is successful, the controller configures isolation information and interface permissions for the terminal device; and

[0159] Authorize access interfaces based on interface permissions to allow non-authenticated packets to pass through, and generate isolation flow tables for terminal devices based on configured isolation information;

[0160] The output module 73 is used to output the terminal identity.

[0161] In one embodiment, the network device is further configured to:

[0162] Acquiring a terminal identity of the terminal device based on the authentication message so that the authentication server performs identity authentication on the terminal device based on the terminal identity, including:

[0163] The network device sends an authentication message to the controller, so that the controller inquires the terminal device about the terminal identity based on the authentication message, and sends the terminal identity replied by the terminal device to the authentication server to authenticate the terminal device.

[0164] In one embodiment, the network device is further configured to:

[0165] Acquiring a terminal identity of the terminal device based on the authentication message so that the authentication server performs identity authentication on the terminal device based on the terminal identity, including:

[0166] The network device inquires the terminal device about the terminal identity based on the authentication message, and sends the terminal identity replied by the terminal device to the authentication server to authenticate the terminal device.

[0167] In one embodiment, in the network device:

[0168] The identity authentication request is one of the following: 802.1X authentication, PPPoE authentication, and Portal authentication.

[0169] In one embodiment, the network device is further configured to:

[0170] After generating an isolation flow table for the terminal device according to the configured isolation information, it also includes:

[0171] The network device sends an authentication success message to the terminal device to notify the terminal device that the authentication is successful, so that the terminal device can request and allocate an IP address with the address allocation server.

[0172] In one implementation, in the network device: the isolation flow table is a MAC table entry, and the MAC table entry includes isolation information, terminal MAC, interface, and interface authority.

[0173] In one embodiment, the network device is further configured to:

[0174] After the IP address request and allocation between the terminal device and the address allocation server, it also includes:

[0175] Receiving an offline request message sent by a terminal device;

[0176] Forwarding the offline request message to the controller so that the controller generates a deauthorization flow table;

[0177] The access interface authorization is canceled according to the deauthorization flow table, and the corresponding MAC table entry is deleted, so that the access interface is configured to allow only authentication messages to pass.

[0178] See also Figure 8 , Figure 8 is a structural block diagram of an authentication server according to an embodiment of the present invention.

[0179] In this embodiment, an authentication server is also provided, including:

[0180] The acquisition module 81 is used to receive an authentication message forwarded by a network device to request identity authentication of a terminal device, wherein the access interface on the network device is configured to allow only the authentication message to pass; and obtain a terminal identity identifier of the terminal device;

[0181] The processing module 82 is used to authenticate the terminal device based on the terminal identity identifier. If the authentication is successful, the controller is used to configure isolation information and interface permissions for the terminal device, so that the network device authorizes the access interface based on the interface permissions to allow non-authenticated messages to pass through, and generates an isolation flow table for the terminal device according to the configured isolation information;

[0182] The output module 83 is used to output the result of the identity authentication.

[0183] In one embodiment, the authentication server is further configured to:

[0184] Acquiring a terminal identity of the terminal device based on the authentication message so that the authentication server performs identity authentication on the terminal device based on the terminal identity, including:

[0185] The network device sends an authentication message to the controller, so that the controller inquires the terminal device about the terminal identity based on the authentication message, and sends the terminal identity replied by the terminal device to the authentication server to authenticate the terminal device.

[0186] In one embodiment, the authentication server is further configured to:

[0187] Acquiring a terminal identity of the terminal device based on the authentication message so that the authentication server performs identity authentication on the terminal device based on the terminal identity, including:

[0188] The network device inquires the terminal device about the terminal identity based on the authentication message, and sends the terminal identity replied by the terminal device to the authentication server to authenticate the terminal device.

[0189] In one implementation, in the authentication server: the identity authentication request is one of the following: 802.1X authentication, Ethernet Point-to-Point Protocol PPPoE authentication, and Portal authentication.

[0190] In one embodiment, the authentication server is further configured to:

[0191] After generating an isolation flow table for the terminal device according to the configured isolation information, it also includes:

[0192] The network device sends an authentication success message to the terminal device to notify the terminal device that the authentication is successful, so that the terminal device can request and allocate an IP address with the address allocation server.

[0193] In one implementation, in the authentication server: the isolation flow table is a MAC table entry, and the MAC table entry includes isolation information, terminal MAC, interface, and interface authority.

[0194] In one embodiment, the authentication server is further configured to:

[0195] After the IP address request and allocation between the terminal device and the address allocation server, it also includes:

[0196] Receiving an offline request message sent by a terminal device;

[0197] Forwarding the offline request message to the controller so that the controller generates a deauthorization flow table;

[0198] The access interface authorization is canceled according to the deauthorization flow table, and the corresponding MAC table entry is deleted, so that the access interface is configured to allow only authentication messages to pass.

[0199] See also Fig. 9 , Fig. 9 is a structural block diagram of a controller according to an embodiment of the present invention.

[0200] In this embodiment, a controller is also provided, including:

[0201] An acquisition module 91 is used to receive an authentication message of a terminal device forwarded by a network device, wherein the access interface on the network device is configured to allow only the authentication message to pass;

[0202] A processing module 92 is used to obtain a terminal identity based on the authentication message, so that the authentication server performs identity authentication on the terminal device based on the terminal identity, and generates an authentication success message if the authentication is successful; and

[0203] Based on the authentication success message, the terminal device is configured with isolation information and interface authority, so that the network device authorizes the access interface based on the interface authority to allow non-authenticated messages to pass through, and generates an isolation flow table for the terminal device according to the configured isolation information;

[0204] The output module 93 is used to output the authentication message and the authentication success message.

[0205] In one embodiment, the controller is further configured to:

[0206] Acquiring a terminal identity of the terminal device based on the authentication message so that the authentication server performs identity authentication on the terminal device based on the terminal identity, including:

[0207] The network device sends an authentication message to the controller, so that the controller inquires the terminal device about the terminal identity based on the authentication message, and sends the terminal identity replied by the terminal device to the authentication server to authenticate the terminal device.

[0208] In one embodiment, the controller is further configured to:

[0209] Acquiring a terminal identity of the terminal device based on the authentication message so that the authentication server performs identity authentication on the terminal device based on the terminal identity, including:

[0210] The network device inquires the terminal device about the terminal identity based on the authentication message, and sends the terminal identity replied by the terminal device to the authentication server to authenticate the terminal device.

[0211] In one implementation, in the controller: the identity authentication request is one of the following: 802.1X authentication, Ethernet Point-to-Point Protocol PPPoE authentication, and Portal authentication.

[0212] In one embodiment, the controller is further configured to:

[0213] After generating an isolation flow table for the terminal device according to the configured isolation information, it also includes:

[0214] The network device sends an authentication success message to the terminal device to notify the terminal device that the authentication is successful, so that the terminal device can request and allocate an IP address with the address allocation server.

[0215] In one implementation, in the controller: the isolation flow table is a MAC table entry, and the MAC table entry includes isolation information, terminal MAC, interface, and interface authority.

[0216] In a possible implementation manner, the controller is further configured to:

[0217] After the IP address request and allocation between the terminal device and the address allocation server, it also includes:

[0218] Receiving an offline request message sent by a terminal device;

[0219] Forwarding the offline request message to the controller so that the controller generates a deauthorization flow table;

[0220] The access interface authorization is canceled according to the deauthorization flow table, and the corresponding MAC table entry is deleted, so that the access interface is configured to allow only authentication messages to pass.

[0221] It should be noted that the above modules can be implemented by software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above modules are all located in the same processor; or the above modules are located in different processors in any combination.

[0222] An embodiment of the present invention further provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when running.

[0223] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0224] An embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0225] In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0226] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail herein.

[0227] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0228] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A controller-based dynamic isolation method, characterized in that: Applied to a network device, the method comprises: Configuring the access interface on the network device to allow only authentication messages to pass; Receiving, through the access interface, an authentication message sent by a terminal device for requesting identity authentication; Acquire the terminal identity of the terminal device based on the authentication message, so that the authentication server performs identity authentication on the terminal device based on the terminal identity, and if the authentication is successful, configure isolation information and interface permissions for the terminal device through the controller; The access interface is authorized based on the interface authority to allow non-authenticated messages to pass through, and an isolation flow table is generated for the terminal device according to the configured isolation information.

2. The method according to claim 1, characterized in that Acquiring a terminal identity of the terminal device based on the authentication message so that the authentication server performs identity authentication on the terminal device based on the terminal identity, including: The network device sends the authentication message to the controller, so that the controller inquires the terminal device about the terminal identity based on the authentication message, and sends the terminal identity replied by the terminal device to the authentication server to authenticate the terminal device.

3. The method according to claim 1, characterized in that Acquiring a terminal identity of the terminal device based on the authentication message so that the authentication server performs identity authentication on the terminal device based on the terminal identity, including: The network device inquires the terminal device about the terminal identity based on the authentication message, and sends the terminal identity replied by the terminal device to the authentication server to perform identity authentication on the terminal device.

4. The method according to claim 1, characterized in that The identity authentication request is one of the following: 802.1X authentication, Ethernet Point-to-Point Protocol PPPoE authentication, and Portal authentication.

5. The method according to claim 1, characterized in that After generating an isolation flow table for the terminal device according to the configured isolation information, the method further includes: The network device sends an authentication success message to the terminal device to notify the terminal device that the authentication is successful, so that the terminal device can perform IP address request and allocation with the address allocation server.

6. The method according to claim 1, characterized in that The isolation flow table is a MAC table entry, and the MAC table entry includes isolation information, terminal MAC, interface, and interface authority.

7. The method according to claim 5, characterized in that After the IP address request and allocation are performed between the terminal device and the address allocation server, the method further includes: Receiving an offline request message sent by the terminal device; forwarding the offline request message to the controller so that the controller generates a deauthorization flow table; The access interface authorization is canceled according to the deauthorization flow table, and the corresponding MAC table entry is deleted, so that the access interface is configured to allow only authentication messages to pass through.

8. A controller-based dynamic isolation method, characterized in that: Applied to an authentication server, the method comprises: Receiving an authentication message forwarded by a network device to request identity authentication of a terminal device, wherein the access interface on the network device is configured to allow only the authentication message to pass; Obtain the terminal identity of the terminal device; The terminal device is authenticated based on the terminal identity identifier. If the authentication is successful, isolation information and interface permissions are configured for the terminal device through the controller, so that the network device authorizes the access interface based on the interface permissions to allow non-authenticated messages to pass through, and generates an isolation flow table for the terminal device according to the configured isolation information.

9. A controller-based dynamic isolation method, characterized in that: Applied to a controller, the method comprises: Receiving an authentication message of a terminal device forwarded by a network device, wherein the access interface on the network device is configured to allow only the authentication message to pass; Obtaining a terminal identity based on the authentication message, so that the authentication server performs identity authentication on the terminal device based on the terminal identity, and generating an authentication success message if the authentication succeeds; Based on the authentication success message, isolation information and interface permissions are configured for the terminal device, so that the network device authorizes the access interface based on the interface permissions to allow non-authenticated messages to pass through, and generates an isolation flow table for the terminal device according to the configured isolation information.

10. A network device, characterized in that: include: An acquisition module, configured to receive, through an access interface, an authentication message sent by a terminal device for identity authentication request, wherein the access interface on the network device is configured to allow only the authentication message to pass; a processing module, configured to obtain a terminal identity of the terminal device based on the authentication message, so that the authentication server performs identity authentication on the terminal device based on the terminal identity, and if the authentication is successful, configure isolation information and interface permissions for the terminal device through a controller; and The access interface is authorized based on the interface authority to allow non-authenticated messages to pass through, and an isolation flow table is generated for the terminal device according to the configured isolation information.

11. An authentication server, characterized in that: include: An acquisition module, configured to receive an authentication message forwarded by a network device to request identity authentication of a terminal device, wherein the access interface on the network device is configured to allow only the authentication message to pass; and to acquire a terminal identity identifier of the terminal device; A processing module is used to authenticate the terminal device based on the terminal identity identifier. If the authentication is successful, the controller configures isolation information and interface permissions for the terminal device, so that the network device authorizes the access interface based on the interface permissions to allow non-authenticated messages to pass through, and generates an isolation flow table for the terminal device according to the configured isolation information.

12. A controller, characterized in that: include: An acquisition module, configured to receive an authentication message of a terminal device forwarded by a network device, wherein the access interface on the network device is configured to allow only the authentication message to pass; a processing module, configured to obtain a terminal identity based on the authentication message, so that the authentication server performs identity authentication on the terminal device based on the terminal identity, and generates an authentication success message if the authentication is successful; and Based on the authentication success message, isolation information and interface permissions are configured for the terminal device, so that the network device authorizes the access interface based on the interface permissions to allow non-authenticated messages to pass through, and generates an isolation flow table for the terminal device according to the configured isolation information.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the computer program implements the steps of the method described in any one of claims 1 to 7, or implements the steps of the method described in claim 8, or implements the steps of the method described in claim 9.

14. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the processor implements the steps of the method described in any one of claims 1 to 7, or implements the steps of the method described in claim 8, or implements the steps of the method described in claim 9.

Images