Radius authentication conversion method and system based on Ldap server

Abstract

The invention relates to the technical field of network security, in particular to a Radius authentication conversion method and system based on an Ldap server. The method comprises the following steps: acquiring an authentication request submitted by a client by adopting a Radius protocol; analyzing the authentication request to obtain authentication information submitted by the client; transmitting the authentication information to an Ldap server for authentication by adopting an Ldap protocol to obtain an authentication result; judging the authentication result, returning an authentication failure message to the client by adopting a Radius protocol when the authentication result is authentication failure, and performing secondary authentication on the client by adopting a challenge mechanism when the authentication result is authentication success to obtain a secondary authentication result; and based on the secondary authentication result, returning a final authentication result message to the client by adopting a Radius protocol. And an efficient, safe and high-cost-efficiency Radius authentication conversion scheme is provided for an enterprise which only deploys an Ldap server.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a Radius authentication conversion method and system based on an Ldap server. Background Art

[0002] Ldap (Lightweight Directory Access Protocol) authentication is widely used in enterprise environments, especially in scenarios where centralized management of user accounts and permissions is required. The Ldap server provides a centralized user database that can store user account information (including but not limited to user name, password, contact information, organizational structure, etc.). By using the Ldap server, enterprises can effectively manage user accounts and finely control users' network access rights, while providing a single sign-on (SSO) experience that allows users to access a variety of network resources. For this reason, many large and medium-sized enterprises currently use Ldap servers to manage user personnel.

[0003] However, due to differences in protocol design and considerations of network environment and performance, some business systems in the enterprise may not support direct connection to the LDAP server, but support Radius (Remote Authentication Dial-In User Service) authentication. Specifically: First, in terms of protocol design, the Ldap protocol is mainly used for querying and updating directory services, and its authentication mechanism is relatively simple, usually a single-factor authentication based on username and password, while the Radius protocol is mainly used for network access and remote user authentication. It focuses on user identity authentication, authorization and accounting (AAA), and supports more complex authentication processes. The Radius server can support the second factor authentication through a variety of authentication modes, such as PAP (password authentication mode), CHAP (challenge handshake authentication mode) and EAP (extensible authentication mode), which enables Radius to adapt to the ever-changing network security needs. Therefore, compared with Ldap authentication, some business systems are more suitable for the billing model and two-factor authentication of Radius authentication; second, in some network environments (such as wireless networks and VPNs), the Radius protocol is a standard authentication protocol, so business systems that support these network environments tend to integrate Radius authentication; third, especially when processing concurrent authentication requests from a large number of clients, Radius is more lightweight than Ldap, so some business systems will choose Radius authentication instead of Ldap authentication.

[0004] In the case where such a business system does not support direct connection to the Ldap server but supports Radius authentication, the prior art usually adopts a technical solution of deploying another set of Radius servers based on the existing Ldap server of the enterprise, and using scripts or special synchronization tools to regularly copy the account information in the Ldap to the Radius database to keep the account information in the Radius database consistent with the account information in the Ldap database, thereby ensuring that all business systems can use the same and latest user data, avoiding problems such as user authentication failure and permission allocation errors in different business systems of the client. However, the prior art technical solution of deploying another set of Radius servers and synchronizing the account information of the Radius server with the Ldap server not only requires the management and maintenance of two sets of authentication servers, which increases the complexity of the enterprise authentication system, but also needs to overcome the technical difficulties such as synchronization delay and synchronization failure that may exist in keeping the account information in the Radius database consistent with the account information in the Ldap database. Most importantly, it is also necessary to ensure the security of the synchronization process to prevent the account information from being intercepted or tampered with during the transmission process, which generates a lot of additional workload. Summary of the invention

[0005] In view of the above technical problems, the present invention proposes a Radius authentication conversion method and system based on Ldap server, which aims to convert the Radius authentication initiated by the client, and realize the authentication by using the enterprise's existing Ldap server and Ldap database, without the need to deploy another set of Radius servers, directly avoiding the technical difficulties and security risks of keeping the database account information consistent, and breaking through the limitation that the Ldap server only supports single-factor authentication.

[0006] In a first aspect, the present application provides a Radius authentication conversion method based on an Ldap server, comprising the following steps: Use the Radius protocol to obtain the authentication request submitted by the client; Parse the authentication information submitted by the client from the authentication request; The Ldap protocol is used to transmit the authentication information to the Ldap server for authentication to obtain the authentication result; The authentication result is judged. When the authentication result is authentication failure, the Radius protocol is used to return an authentication failure message to the client. When the authentication result is authentication success, a challenge mechanism is used to perform secondary authentication on the client to obtain the secondary authentication result. Based on the secondary authentication result, the Radius protocol is used to return the final authentication result message to the client.

[0007] The challenge mechanism refers to a mechanism in the Radius protocol that is used to enhance network access security and is the basis for implementing two-factor authentication or multi-factor authentication.

[0008] In some embodiments, the “using the Radius protocol to obtain the authentication request submitted by the client” includes: Use a reversible encryption algorithm to encrypt the authentication request submitted by the client; Use the Radius protocol to obtain the encrypted authentication request; The authentication request is decrypted to obtain a decrypted authentication request.

[0009] In some embodiments, after "transmitting the authentication information to the Ldap server for authentication and obtaining the authentication result" and before "judging the authentication result", the following steps are included: The authentication information and authentication results are stored in the database of the Ldap server to form the user's historical authentication data; The “when the authentication result is successful, a challenge mechanism is used to perform secondary authentication on the client” includes: Build a whitelist of challenge mechanisms based on the user's historical authentication data; When the authentication result is successful, determine whether the current user is in the challenge mechanism whitelist. If the current user is in the challenge mechanism whitelist, the Radius protocol is used to return an authentication success message to the client. If the current user is not in the challenge mechanism whitelist, the challenge mechanism is used to perform secondary authentication on the client.

[0010] In some embodiments, the “building a challenge mechanism whitelist based on the user's historical authentication data” includes: Preset the initial risk scores of all users in the database of the Ldap server; Set risk scoring rules based on the user's historical authentication data; When the user's historical authentication data is updated, the risk score of each user is adjusted based on the risk scoring rules and the updated historical authentication data of the user; The risk scores of all users are sorted in ascending order, and the top several users are selected to generate a whitelist for the challenge mechanism.

[0011] In some embodiments, the authentication information includes the device on which the user initiates authentication. After "transmitting the authentication information to the Ldap server for authentication and obtaining the authentication result" and before "judging the authentication result", it includes: The authentication information and the authentication result are stored in the database of the Ldap server to form the user's historical authentication data, which includes the user's commonly used login device and the authentication result record; The “when the authentication result is successful, performing secondary authentication on the client using a challenge mechanism” also includes: When the authentication result is successful, the device on which the current user initiates authentication is obtained based on the authentication information; Determine whether the device from which the current user initiates authentication is the user's commonly used login device. If the current user does not initiate authentication from a commonly used device, a challenge mechanism is used to perform secondary authentication on the client. If the current user initiates authentication from a commonly used device, the following steps are performed: Based on the authentication result record, determine whether the time interval between the current user and the last successful authentication is within the preset time range. If it is within the preset time range, the Radius protocol is used to return an authentication success message to the client. If it exceeds the preset time range, a challenge mechanism is used to perform a second authentication on the client.

[0012] In some embodiments, the database of the Ldap server includes the mobile phone number bound by the user, and the "using a challenge mechanism to perform secondary authentication on the client" includes: Randomly generate challenge code; Query the database of the Ldap server to retrieve the mobile phone number bound to the current user; Determine whether there is a mobile phone number in the query result. If there is no mobile phone number, use the Radius protocol to return an authentication failure message to the client. If there is a mobile phone number, perform the following steps: Send the generated challenge code to the mobile phone number bound to the current user; Use the Radius protocol to obtain the challenge code response submitted by the client; Verify whether the challenge code response submitted by the client is consistent with the generated challenge code. If the verification results are consistent, the Radius protocol is used to return an authentication success message to the client. If the verification results are inconsistent, the Radius protocol is used to return an authentication failure message to the client.

[0013] In a second aspect, the present application provides a Radius authentication conversion system based on an Ldap server, including a Radius protocol module and an Ldap transmission module, one end of the Radius protocol module is connected to the client, the other end of the Radius protocol module is connected to the Ldap transmission module, and the Ldap transmission module is connected to the Ldap server, wherein: The Radius protocol module is used to obtain the authentication request submitted by the client using the Radius protocol, parse the authentication information submitted by the client from the authentication request, send the parsed authentication information to the Ldap transmission module, and judge the authentication result after receiving the authentication result returned by the Ldap transmission module. When the authentication result is authentication failure, the Radius protocol is used to return an authentication failure message to the client. When the authentication result is authentication success, a challenge mechanism is used to perform secondary authentication on the client to obtain the secondary authentication result, and based on the secondary authentication result, the Radius protocol is used to return the final authentication result message to the client. The Ldap transmission module is used to transmit the received authentication information to the Ldap server for authentication using the Ldap protocol, obtain the authentication result, and return the authentication result to the Radius protocol module.

[0014] In some embodiments, the Radius authentication conversion system includes a reversible encryption module, one end of which is connected to the client, and the other end of which is connected to the Radius protocol module. The reversible encryption module is used to encrypt the authentication request submitted by the client using a reversible encryption algorithm, and the Radius protocol module is used to perform the following steps: Use the Radius protocol to obtain the encrypted authentication request; The authentication request is decrypted to obtain a decrypted authentication request.

[0015] In a third aspect, an electronic device includes a processor and a memory; The processor is connected to the memory; The memory is used to store executable program code; The processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the aforementioned Radius authentication conversion method based on the Ldap server.

[0016] In a fourth aspect, a computer-readable storage medium stores a computer program thereon, and when the computer program is executed by a processor, the Radius authentication conversion method based on the Ldap server as described above is implemented.

[0017] The beneficial technical effects of the present invention include at least: 1. A Radius authentication conversion method and system based on Ldap server is adopted. The existing Ldap server of the enterprise is used to effectively convert the authentication package of the Ldap server into Radius authentication. Compared with the existing technology, there is no need to deploy another set of Radius servers to solve the problem that the business system does not support direct connection with the Ldap server but supports Radius authentication. At the same time, since this method does not build its own independent Radius user database, there is no need to consider the need to synchronize the user account information with the Ldap database, which directly avoids the technical difficulties and security risks of keeping the database account information consistent, greatly reducing the complexity of the enterprise authentication system. At the same time, a secondary authentication is performed on the client through a challenge mechanism, breaking through the limitation that the Ldap server only supports single-factor authentication, enhancing the security of authentication, and providing an efficient, secure and cost-effective Radius authentication conversion solution for enterprises that have only deployed Ldap servers; 2. In order to improve the security of the Radius protocol module in the process of receiving the authentication request, before the client uses the Radius protocol to send the authentication request to the Radius protocol module, a reversible encryption module is first designed to encrypt the authentication request using a reversible encryption algorithm, and then the encrypted authentication request is sent to the Radius protocol module using the Radius protocol, and the Radius protocol module decrypts the received encrypted authentication request. Under the technical solution of the present application, although the authentication request is sent to the Radius protocol module in plaintext mode, the authentication request has been encrypted before sending, so the plaintext authentication request content seen is also the encrypted authentication request, so that the Radius protocol module can parse and obtain the original authentication information while ensuring the security of the process of receiving the authentication request; 3. By building a challenge mechanism whitelist that is dynamically adjusted based on the user's historical authentication data, when the authentication result is successful, it is determined whether the current user needs to undergo secondary authentication based on the current challenge mechanism whitelist, aiming to provide a more convenient authentication experience for trusted users while maintaining vigilance against potential security risks; 4. By combining device identification, user authentication behavior analysis and dynamic secondary authentication decisions, a smoother and more user-friendly authentication process is provided for users who initiate authentication from commonly used devices and need to frequently use business system services. While maintaining a certain level of security, unnecessary authentication steps are reduced, thereby improving the efficiency of the enterprise authentication system.

[0018] Other features and advantages of the present invention will be disclosed in detail in the following specific embodiments and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The present invention will be further described below in conjunction with the accompanying drawings: Figure 1 The present invention is a flowchart of a Radius authentication conversion method based on an Ldap server according to an embodiment of the present invention.

[0020] Figure 2 The present invention is a schematic diagram of the structure of a Radius authentication conversion system based on an Ldap server according to an embodiment of the present invention.

[0021] Figure 3 This is a structural diagram of a Radius authentication conversion system based on an Ldap server according to another embodiment of the present invention.

[0022] Figure 4 The figure is a schematic diagram of the structure of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0023] The technical solutions of the embodiments of the present invention are explained and described below in conjunction with the drawings of the embodiments of the present invention, but the following embodiments are only preferred embodiments of the present invention, not all. Based on the embodiments in the implementation mode, other embodiments obtained by those skilled in the art without creative work are all within the protection scope of the present invention.

[0024] In the following description, terms such as "inside", "outside", "up", "down", "left", "right", etc. that indicate directions or positional relationships are only used to facilitate the description of the embodiments and simplify the description, and do not indicate or imply that the referred device or element must have a specific direction, be constructed and operate in a specific direction. Therefore, it should not be understood as a limitation of the present invention.

[0025] Embodiment 1: Please refer to the attached Figure 1 , Figure 1 A flow chart of a Radius authentication conversion method based on an Ldap server provided in one embodiment of this specification is shown.

[0026] like Figure 1 As shown, the Radius authentication conversion method based on the Ldap server may at least include the following steps: S101, using the Radius protocol to obtain the authentication request submitted by the client.

[0027] The client in this embodiment is a client corresponding to different business systems of an enterprise, including but not limited to desktop applications, mobile applications, Web clients, etc. The authentication request submitted by the client includes at least a user name and a password.

[0028] S102, parsing the authentication request to obtain authentication information submitted by the client; S103, using the Ldap protocol to transmit the authentication information to the Ldap server for authentication, and obtaining an authentication result; S104, judging the authentication result, when the authentication result is authentication failure, using the Radius protocol to return an authentication failure message to the client, when the authentication result is authentication success, using the challenge mechanism to perform secondary authentication on the client to obtain the secondary authentication result.

[0029] Among them, the access-challenge mechanism refers to a mechanism in the Radius protocol for enhancing network access security, and is the basis for implementing two-factor authentication or multi-factor authentication. In the challenge mechanism, the first factor (such as username and password) is usually entered first, and then the second factor is entered. Furthermore, within the RADIUS protocol framework, these two steps can be seamlessly integrated into one authentication process, rather than as two independent processes, thereby providing a smoother and more user-friendly authentication process.

[0030] Among them, the second authentication factor of "secondary authentication" includes but is not limited to mobile phone SMS verification code, mobile phone token, smart card, biometrics, etc., which is not limited in this embodiment.

[0031] For example, taking the SMS verification code as the second authentication factor of "secondary authentication", the implementation method of "using the challenge mechanism to perform secondary authentication on the client" is: First, since the system does not build its own independent database, it can be searched from the database of the company's existing ladp server. The database of the ldap server usually includes the mobile phone numbers bound to each user; Secondly, a challenge code is randomly generated, which is used in the secondary authentication process to verify the user's identity; Next, query the database of the Ldap server to retrieve the mobile phone number bound to the current user; Then, determine whether there is a mobile phone number in the query result. If there is no mobile phone number, directly use the Radius protocol to return an authentication failure message to the client. If there is a mobile phone number, perform the subsequent secondary authentication steps: First, send the generated challenge code to the mobile phone number bound to the current user. At this time, the Radius protocol module will send an Access-Challenge message (i.e., challenge) to the client. The client presents the challenge to the user and requires the user to provide a response. The Radius protocol is then used to obtain the challenge code response submitted by the client. At this time, the user sends the response back to the Radius protocol module from the client. This response is included in a new Access-Request message. (3) Verify whether the challenge code response submitted by the client is consistent with the generated challenge code. If the verification results are consistent, the Radius protocol is used to return an authentication success message to the client. If the verification results are inconsistent, the Radius protocol is used to return an authentication failure message to the client.

[0032] S105, based on the secondary authentication result, the Radius protocol is used to return the final authentication result message to the client.

[0033] Specifically, the implementation method of "based on the secondary authentication result, using the Radius protocol to return the final authentication result message to the client" is: judge the secondary authentication result, if the secondary authentication result is authentication failure, then use the Radius protocol to return an authentication failure message to the client; if the secondary authentication result is authentication success, then use the Radius protocol to return an authentication success message to the client.

[0034] The technical concept of the present embodiment is as follows: the Radius authentication conversion method based on the Ldap server provided in the present embodiment is a "proxy" method applied between the client of the business system and the existing Ldap server of the enterprise. The method does not build its own independent user database, but directly adopts the Radius protocol to receive the authentication request sent by the client, parses the received authentication request, and does not store the authentication information obtained by the parsing. Instead, after the authentication information is parsed, the authentication information is forwarded by the Ldap protocol to the existing Ldap server of the enterprise for authentication. The authentication result obtained is returned to the Radius protocol module via the Ldap transmission module, and the Radius protocol module judges the authentication result. If the authentication result is an authentication failure, the Radius protocol is used to return an authentication failure message to the client, so as to utilize the existing Ldap server of the enterprise and effectively convert the Ldap server into a new one. The authentication package of the server is converted into Radius authentication. There is no need to deploy a Radius server to solve the problem that the business system does not support direct connection to the Ldap server but supports Radius authentication. At the same time, since this method does not have its own independent Radius user database, there is no need to consider the need to synchronize user account information with the Ldap database, which directly avoids the technical difficulties and security risks of keeping the database account information consistent, greatly reducing the complexity of the enterprise authentication system. On the other hand, if the authentication result is judged to be successful, the challenge mechanism in the Radius protocol can be further used to perform secondary authentication on the client, breaking through the limitation that the Ldap server only supports single-factor authentication, enhancing the security of the authentication process, and providing an efficient, secure and cost-effective Radius authentication conversion solution for enterprises that have only deployed Ldap servers.

[0035] Embodiment 2: Although the Radius authentication conversion method based on the Ldap server provided in Example 1 avoids the potential security risks of keeping the database account information consistent, since this method only acts as an "agent" and does not build its own independent Radius user database and does not store user passwords, the Radius authentication after encapsulating the authentication request sent by the client cannot support the PAP or CHAP authentication mode like the original Radius server, because it does not have a stored password to generate a correct response. Therefore, the encapsulated Radius authentication can only enable the Radius protocol module to parse the original authentication information in plaintext mode, and then forward the original authentication information to the Ldap server for authentication through the Ldap protocol. However, the information in the plaintext mode exists in plaintext during transmission or storage, which is extremely vulnerable to the risk of unauthorized access and eavesdropping.

[0036] Therefore, in order to improve the security in the process of receiving the authentication request, compared with the first embodiment, this embodiment adds a scheme of encrypting the authentication request using a reversible encryption algorithm. Specifically, "using the Radius protocol to obtain the authentication request submitted by the client" includes: Use a reversible encryption algorithm to encrypt the authentication request submitted by the client; Use the Radius protocol to obtain the encrypted authentication request; The authentication request is decrypted to obtain a decrypted authentication request.

[0037] It is understandable that during the authentication process of this embodiment, the Ldap server needs to obtain the user's original authentication information (such as user name and password) to verify the user's identity. If a non-reversible encryption algorithm is used, the encrypted data cannot be decrypted and restored to the original data, which means that once the data is encrypted, the original password cannot be obtained on the server for verification. Taking non-reversible hash encryption algorithms such as SHA-256 and MD5 as an example, the encrypted data needs to be compared with the original password or pre-stored hash value, so it is not suitable for this scenario where the Ldap server needs to verify the original data.

[0038] Among them, the reversible encryption algorithm used in this embodiment can be a reversible symmetric encryption algorithm such as AES, Twofish, RC6, etc., or a reversible asymmetric encryption algorithm such as RSA, ECC, etc., which is not limited in this embodiment.

[0039] It is understandable that the method provided in this embodiment cannot support the CHAP authentication mode because CHAP requires the hash value of the password to be stored in advance in order to generate challenges and verification responses. Since this method does not store any password information, it cannot execute this authentication mode. However, this embodiment uses a reversible encryption algorithm to encrypt the authentication request before the client uses the Radius protocol to send the authentication request to the Radius protocol module. Although decryption is required when receiving the authentication request, it does not need to store the user's password. The decryption process is to parse the encrypted authentication information and forward it to the Ldap server, rather than to retain this information in the system. That is, the decryption operation is temporary and is only used to process the encrypted authentication request in the memory, and the password will not be stored in any persistent storage medium.

[0040] By first designing a reversible encryption algorithm to encrypt the authentication request before the client uses the Radius protocol to send the authentication request to the Radius protocol module, and then sending the encrypted authentication request to the Radius protocol module using the Radius protocol, and the Radius protocol module decrypts the received encrypted authentication request. Under the technical solution of this embodiment, although the authentication request is sent to the Radius protocol module in plaintext mode, the authentication request has been encrypted before sending it, so the plaintext authentication request content seen is also the encrypted authentication request, thereby ensuring that the Radius protocol module can parse and obtain the original authentication information while ensuring the security of the authentication request receiving process.

[0041] Embodiment three: In one embodiment of the present specification, compared with the second embodiment, this embodiment adds a solution of building a challenge mechanism whitelist to determine whether to perform secondary authentication, including the following steps: S201, using the Radius protocol to obtain the authentication request submitted by the client; S202, parsing the authentication request to obtain authentication information submitted by the client; S203, using the Ldap protocol to transmit the authentication information to the Ldap server for authentication, obtaining an authentication result, and storing the authentication information and the authentication result in a database of the Ldap server to form historical authentication data of the user.

[0042] It is understandable that each authentication result corresponding to the authentication request submitted by the client will be stored in the database of the Ldap server, thereby accumulating historical authentication information of each user.

[0043] S204, constructing a challenge mechanism whitelist based on the user's historical authentication data.

[0044] Specifically, in this embodiment, “building a challenge mechanism whitelist based on the user's historical authentication data” includes: S301, preset the initial risk scores of all users in the database of the Ldap server.

[0045] S302, setting risk scoring rules based on the user's historical authentication data.

[0046] For example, taking the user's historical authentication data including the user's frequently used network environment, the number of authentication failures, the password change record, and the commonly used login device as an example, the implementation method of setting the risk scoring rule based on the user's historical authentication data can be: (1) Network environment rule: If the current user initiates authentication from a common network environment, the risk score of the current user is reduced (e.g., reduced by 10 points); otherwise, the risk score of the current user is increased (e.g., increased by 20 points).

[0047] (2) Authentication failure rule: If the number of authentication failures of the current user is within the preset range (e.g., 0-2 times), the risk score of the current user is maintained; if the number of authentication failures of the current user exceeds the preset range (e.g., more than 2 times), the risk score of the current user is increased (e.g., 10 points for each additional failure).

[0048] (3) Password change rules: If there is a password change record within a preset time period (i.e., recently, such as within the last 15 days), it may indicate that the account is at risk, and the risk score of the current user will be increased (e.g., by 15 points). If there is a password change record beyond the preset time period (e.g., more than 15 days ago), it indicates that regular password changes are a good security practice, and therefore the risk score of the current user is maintained.

[0049] (4) Device identification rule: If the current user initiates authentication from a commonly used device, the risk score of the current user is reduced (for example, reduced by 5 points); otherwise, the risk score of the current user is increased (for example, increased by 15 points).

[0050] S303: When the historical authentication data of a user is updated, the risk score of each user is adjusted based on the risk scoring rule and the updated historical authentication data of the user.

[0051] For example, assuming that the user's initial risk score is 50 points (out of 100 points, the higher the score, the greater the risk), and the user's historical authentication data is updated to authenticate from a very different network environment, and the last password change was 20 days ago, then based on the risk scoring rules and the updated historical authentication data of the user, the implementation method of adjusting the risk score of each user can be: (1) Apply network environment rules: If a user is detected to be authenticating from an unusual network environment, the risk score is increased by 20 points according to the rules. The score is adjusted to 50+20=70 points.

[0052] (2) Apply authentication failure rules: If the number of times a user fails to authenticate is detected to be 3, which exceeds the preset range, the risk score is increased by 10 points according to the rules (only the number of failures exceeding the limit is counted). The score is adjusted to 70+10=80 points.

[0053] (3) Apply password change rules: If the user password change record is detected 20 days ago, the current risk score is maintained according to the rules. The score remains unchanged at 80.

[0054] (4) Application device identification rules: If a user is detected to be authenticating from an uncommon device, the risk score is increased by 15 points according to the rules. The score is adjusted to 80+15=95 points.

[0055] (5) In this update of the user's historical authentication data, the current user's risk score is updated to 95 points, which is undoubtedly in a high-risk state and requires additional security verification measures, namely secondary authentication.

[0056] S304, arranging the risk scores of all users in ascending order, selecting the first several users to generate a challenge mechanism whitelist, that is, the users in the challenge mechanism whitelist are the several users with the lowest risk scores.

[0057] It is understandable that when the user's historical authentication data is updated, the risk score of each user will be adjusted accordingly, so the users in the challenge mechanism whitelist may also be updated accordingly, thereby achieving dynamic adjustment of the challenge mechanism whitelist according to changes in the user's authentication behavior.

[0058] S205, judging the authentication result, when the authentication result is authentication failure, using the Radius protocol to return an authentication failure message to the client, when the authentication result is authentication success, executing the following steps: S206, determining whether the current user is in the whitelist of the challenge mechanism. If the current user is in the whitelist of the challenge mechanism, the Radius protocol is used to return an authentication success message to the client, that is, no secondary authentication is required. If the current user is not in the whitelist of the challenge mechanism, the challenge mechanism is used to perform secondary authentication on the client to obtain a secondary authentication result. S207, based on the secondary authentication result, the Radius protocol is used to return the final authentication result message to the client.

[0059] The solution provided in this embodiment constructs a challenge mechanism whitelist that is dynamically adjusted based on the user's historical authentication data. When the authentication result is successful, it is determined whether the current user needs to perform a secondary authentication based on the current challenge mechanism whitelist. This aims to provide trusted users with a more convenient authentication experience while maintaining vigilance against potential security risks.

[0060] Embodiment 4: In one embodiment of the present specification, compared with the second embodiment, the present embodiment adds a scheme for determining whether to perform secondary authentication based on the login device of the user authentication behavior and the authentication result record, including the following steps: S401, using the Radius protocol to obtain the authentication request submitted by the client; S402, parsing the authentication request to obtain authentication information submitted by the client; S403, using the Ldap protocol to transmit the authentication information to the Ldap server for authentication, obtain the authentication result, store the authentication information and the authentication result in the database of the Ldap server, and form the user's historical authentication data. The user's historical authentication data includes the user's frequently used login devices and authentication result records.

[0061] The authentication information may include the identification information of the device from which the user initiates the authentication, and the identification of the device from which the user initiates the authentication may be achieved through an IP address, a device fingerprint, or other unique identifier. The authentication result record may include the time point at which each Ldap server generates an authentication result (including authentication success and authentication failure).

[0062] S404, judging the authentication result. When the authentication result is authentication failure, using the Radius protocol to return an authentication failure message to the client. When the authentication result is authentication success, executing the following steps: S405, obtaining a device for the current user to initiate authentication based on the authentication information; S406: Determine whether the device from which the current user initiates authentication is a commonly used login device for the user. If the current user does not initiate authentication from a commonly used device, perform secondary authentication on the client using a challenge mechanism. If the current user initiates authentication from a commonly used device, execute step S407: S407, based on the authentication result record, determine whether the time interval between the current user and the last successful authentication is within a preset time range. If it is within the preset time range, the risk is considered low, and the Radius protocol is directly used to return an authentication success message to the client, that is, no secondary authentication is required. If it exceeds the preset time range, even if the authentication is initiated from a common device, a challenge mechanism will be used to perform secondary authentication on the client to obtain a secondary authentication result; Among them, the preset time range can be adjusted according to actual security requirements and user behavior patterns, and this embodiment does not limit this.

[0063] For example, taking the preset time range as one day, if a user currently initiates authentication on a commonly used login device and the time interval since the last successful authentication is within the past 8 hours, the user's authentication this time can be exempted from secondary authentication, even if the user initiates authentication again on the commonly used login device within the next 16 hours.

[0064] S408: Based on the secondary authentication result, the Radius protocol is used to return the final authentication result message to the client.

[0065] The solution provided in this embodiment, by combining device identification, user authentication behavior analysis and dynamic secondary authentication decisions, provides a smoother and more user-friendly authentication process for users who initiate authentication from commonly used devices and need to frequently use business system services. While maintaining a certain level of security, it reduces unnecessary authentication steps and improves the efficiency of the enterprise authentication system.

[0066] Embodiment five: Please refer to the attached Figure 2 , Figure 2 A schematic diagram of the structure of a Radius authentication conversion system based on an Ldap server provided in one embodiment of this specification is shown.

[0067] like Figure 2 As shown, the Radius authentication conversion system based on the Ldap server may at least include a Radius protocol module and an Ldap transmission module, one end of the Radius protocol module is connected to the client, the other end of the Radius protocol module is connected to the Ldap transmission module, and the Ldap transmission module is connected to the Ldap server, wherein: The Radius protocol module is used to obtain the authentication request submitted by the client using the Radius protocol, parse the authentication information submitted by the client from the authentication request, send the parsed authentication information to the Ldap transmission module, and judge the authentication result after receiving the authentication result returned by the Ldap transmission module. When the authentication result is authentication failure, the Radius protocol is used to return an authentication failure message to the client. When the authentication result is authentication success, a challenge mechanism is used to perform secondary authentication on the client to obtain the secondary authentication result, and based on the secondary authentication result, the Radius protocol is used to return the final authentication result message to the client. The Ldap transmission module is used to transmit the received authentication information to the Ldap server for authentication using the Ldap protocol, obtain the authentication result, and return the authentication result to the Radius protocol module.

[0068] It can be understood that the technical concept of the Radius authentication conversion system based on the Ldap server provided in this embodiment is similar to the technical concept of the Radius authentication conversion method based on the Ldap server provided in the aforementioned embodiment 1, and this embodiment will not be repeated here.

[0069] Embodiment six: Please refer to the attached Figure 3 , Figure 3 A schematic diagram of the structure of a Radius authentication conversion system based on an Ldap server provided in yet another embodiment of the present specification is shown.

[0070] like Figure 3 As shown, one end of the reversible encryption module is connected to the client, and the other end of the reversible encryption module is connected to the Radius protocol module. The reversible encryption module is used to encrypt the authentication request submitted by the client using a reversible encryption algorithm. The Radius protocol module is used to perform the following steps: Use the Radius protocol to obtain the encrypted authentication request; The authentication request is decrypted to obtain a decrypted authentication request.

[0071] It can be understood that the technical concept of the Radius authentication conversion system based on the Ldap server provided in this embodiment is similar to the technical concept of the Radius authentication conversion method based on the Ldap server provided in the aforementioned second embodiment, and this embodiment will not be repeated here.

[0072] Another embodiment of the present specification provides an electronic device structure. Figure 4 The electronic device 400 may include: at least one processor 401 , at least one network interface 404 , a user interface 403 , a memory 405 , and at least one communication bus 402 .

[0073] The communication bus 402 may be used to realize the connection and communication among the above-mentioned components.

[0074] The user interface 403 may include buttons, and the optional user interface may also include a standard wired interface or a wireless interface.

[0075] The network interface 404 may include, but is not limited to, a Bluetooth module, an NFC module, a Wi-Fi module, etc.

[0076] Among them, the processor 401 may include one or more processing cores. The processor 401 uses various interfaces and lines to connect the various parts of the entire electronic device 400, and executes various functions and processes data of the electronic device 400 by running or executing instructions, programs, code sets or instruction sets stored in the memory 405, and calling data stored in the memory 405. Optionally, the processor 401 can be implemented in at least one hardware form of DSP, FPGA, and PLA. The processor 401 can integrate one or a combination of CPU, GPU, modem, etc. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 401, and it can be implemented separately through a chip.

[0077] Among them, the memory 405 may include RAM or ROM. Optionally, the memory 405 includes a non-transitory computer-readable medium. The memory 405 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 405 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data involved in the above-mentioned various method embodiments, etc. The memory 405 may also be at least one storage device located away from the aforementioned processor 401. The memory 405 as a computer storage medium may include an operating system, a network communication module, a user interface module and an application. The processor 401 may be used to call the application stored in the memory 405 and execute the method in one or more of the above-mentioned embodiments.

[0078] Another embodiment of the present specification provides a computer-readable storage medium, which stores instructions, and when the instructions are executed on a computer or a processor, the computer or the processor executes one or more steps in the above-mentioned Radius authentication conversion method embodiment based on the Ldap server. If the component modules of the above-mentioned electronic device are implemented in the form of software functional units and predicted or used as independent downstream tasks, they can be stored in the computer-readable storage medium.

[0079] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of this specification is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted through the computer-readable storage medium. The computer instructions can be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (Digital Subscriber Line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a digital versatile disc (DVD)), or a semiconductor medium (eg, a solid state drive (SSD)).

[0080] The above description is only the preferred embodiment disclosed in this application and the description of the technical principle used. Those skilled in the art should understand that the scope of protection involved in this disclosure is not limited to the technical solution formed by a specific combination of the above technical features, but also should cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in this disclosure (but not limited to) to form a technical solution.

[0081] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

Claims

1. A Radius authentication conversion method based on an Ldap server, characterized in that: The following steps are involved: Use the Radius protocol to obtain the authentication request submitted by the client; Parse the authentication information submitted by the client from the authentication request; The Ldap protocol is used to transmit the authentication information to the Ldap server for authentication to obtain the authentication result; The authentication result is judged. When the authentication result is authentication failure, the Radius protocol is used to return an authentication failure message to the client. When the authentication result is authentication success, a challenge mechanism is used to perform secondary authentication on the client to obtain the secondary authentication result. Based on the secondary authentication result, the Radius protocol is used to return the final authentication result message to the client.

2. The Radius authentication conversion method based on the Ldap server as claimed in claim 1, characterized in that: The "using the Radius protocol to obtain the authentication request submitted by the client" includes: Use a reversible encryption algorithm to encrypt the authentication request submitted by the client; Use the Radius protocol to obtain the encrypted authentication request; The authentication request is decrypted to obtain a decrypted authentication request.

3. The Radius authentication conversion method based on the Ldap server as claimed in claim 1, characterized in that: After "transmitting the authentication information to the Ldap server for authentication and obtaining the authentication result" and before "judging the authentication result", it includes: The authentication information and authentication results are stored in the database of the Ldap server to form the user's historical authentication data; The "when the authentication result is successful, a challenge mechanism is used to perform secondary authentication on the client" includes: Build a whitelist of challenge mechanisms based on the user's historical authentication data; When the authentication result is successful, determine whether the current user is in the challenge mechanism whitelist. If the current user is in the challenge mechanism whitelist, the Radius protocol is used to return an authentication success message to the client. If the current user is not in the challenge mechanism whitelist, the challenge mechanism is used to perform secondary authentication on the client.

4. The Radius authentication conversion method based on the Ldap server as claimed in claim 3, characterized in that: The "building a challenge mechanism whitelist based on the user's historical authentication data" includes: Preset the initial risk scores of all users in the database of the Ldap server; Set risk scoring rules based on the user's historical authentication data; When the user's historical authentication data is updated, the risk score of each user is adjusted based on the risk scoring rules and the updated historical authentication data of the user; The risk scores of all users are sorted in ascending order, and the top several users are selected to generate a whitelist for the challenge mechanism.

5. The Radius authentication conversion method based on the Ldap server as claimed in claim 1, characterized in that: The authentication information includes the device that the user initiates authentication. After "transmitting the authentication information to the Ldap server for authentication and obtaining the authentication result" and before "judging the authentication result", it includes: The authentication information and the authentication result are stored in the database of the Ldap server to form the user's historical authentication data, which includes the user's commonly used login device and the authentication result record; The "when the authentication result is successful, performing secondary authentication on the client using a challenge mechanism" also includes: When the authentication result is successful, the device on which the current user initiates authentication is obtained based on the authentication information; Determine whether the device from which the current user initiates authentication is the user's commonly used login device. If the current user does not initiate authentication from a commonly used device, a challenge mechanism is used to perform secondary authentication on the client. If the current user initiates authentication from a commonly used device, the following steps are performed: Based on the authentication result record, determine whether the time interval between the current user and the last successful authentication is within the preset time range. If it is within the preset time range, the Radius protocol is used to return an authentication success message to the client. If it exceeds the preset time range, a challenge mechanism is used to perform a second authentication on the client.

6. The Radius authentication conversion method based on the Ldap server according to any one of claims 1 to 5, characterized in that: The database of the Ldap server includes the mobile phone number bound by the user, and the "using the challenge mechanism to perform secondary authentication on the client" includes: Randomly generate challenge code; Query the database of the Ldap server to retrieve the mobile phone number bound to the current user; Determine whether there is a mobile phone number in the query result. If there is no mobile phone number, use the Radius protocol to return an authentication failure message to the client. If there is a mobile phone number, perform the following steps: Send the generated challenge code to the mobile phone number bound to the current user; Use the Radius protocol to obtain the challenge code response submitted by the client; Verify whether the challenge code response submitted by the client is consistent with the generated challenge code. If the verification results are consistent, the Radius protocol is used to return an authentication success message to the client. If the verification results are inconsistent, the Radius protocol is used to return an authentication failure message to the client.

7. Radius authentication conversion system based on Ldap server, characterized in that: It includes a Radius protocol module and an Ldap transmission module, one end of the Radius protocol module is connected to the client, the other end of the Radius protocol module is connected to the Ldap transmission module, and the Ldap transmission module is connected to the Ldap server, wherein: The Radius protocol module is used to obtain the authentication request submitted by the client using the Radius protocol, parse the authentication information submitted by the client from the authentication request, send the parsed authentication information to the Ldap transmission module, and judge the authentication result after receiving the authentication result returned by the Ldap transmission module. When the authentication result is authentication failure, the Radius protocol is used to return an authentication failure message to the client. When the authentication result is authentication success, a challenge mechanism is used to perform secondary authentication on the client to obtain the secondary authentication result, and based on the secondary authentication result, the Radius protocol is used to return the final authentication result message to the client. The Ldap transmission module is used to transmit the received authentication information to the Ldap server for authentication using the Ldap protocol, obtain the authentication result, and return the authentication result to the Radius protocol module.

8. The Radius authentication conversion system based on Ldap server as claimed in claim 7, characterized in that: The Radius authentication conversion system includes a reversible encryption module, one end of which is connected to the client, and the other end of which is connected to the Radius protocol module. The reversible encryption module is used to encrypt the authentication request submitted by the client using a reversible encryption algorithm, and the Radius protocol module is used to perform the following steps: Use the Radius protocol to obtain the encrypted authentication request; The authentication request is decrypted to obtain a decrypted authentication request.

9. An electronic device, characterized in that: including a processor and a memory; The processor is connected to the memory; The memory is used to store executable program code; The processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the Radius authentication conversion method based on the Ldap server as described in any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by a processor, the Radius authentication conversion method based on the Ldap server as claimed in any one of claims 1 to 6 is implemented.

Images