Message processing method and device

Abstract

The invention provides a message processing method and device. The method is applied to an access device communicating with an AAA server, and comprises the following steps: a host process module in the access device receives an online request message from a user terminal; notifying a common process module corresponding to the user terminal determined by a host process module in the access equipment to send an RADIUS authentication request message for the user terminal to an AAA server; when the common process module receives an RADIUS authentication response message which is sent by the AAA server and carries key information corresponding to the authorization information of the user terminal, the key information is calculated according to a preset algorithm, a key index corresponding to the key information is obtained, and whether the key index exists in a first storage space corresponding to the common process module or not is judged; and if the judgment result is yes, sending an online response message for representing that the authentication is passed to the user terminal. According to the invention, bandwidth resources between the access device and the AAA server can be saved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a message processing method and device. Background Art

[0002] At present, in the application scenario where the Authentication, Authorization, Accounting (AAA) server needs to issue corresponding authorization information to the user terminal, once the access device communicating with the AAA server receives the online request message from the user terminal, it will exchange the Remote Authentication Dial-In User Service (RADIUS) authentication request message with the AAA server to obtain the authorization information of the user terminal; after that, the access device sends an online response message to the user terminal to indicate that the authentication has been passed.

[0003] Here, when the user terminal is a wired terminal, the access device may be a switching device; when the user terminal is a wireless terminal, the access device may be a fat access point (AP) or an access controller (AC).

[0004] In the above message processing flow, when the authorization information of the user terminal is large, the access device needs to interact with the AAA server multiple times to obtain complete authorization information. If some user terminals use the same authorization information, the access device needs to interact with the AAA server multiple times for these user terminals respectively. This consumes more bandwidth resources between the access device and the AAA server and also affects the processing performance of both. Summary of the invention

[0005] In order to overcome the problems existing in the related art, the present application provides a message processing method and device.

[0006] According to a first aspect of an embodiment of the present application, a message processing method is provided, the method being applied to an access device communicating with an AAA server, the method comprising:

[0007] After receiving the online request message from the user terminal, the main process module in the access device notifies the common process module corresponding to the user terminal determined by the main process module in the access device to send a RADIUS authentication request message for the user terminal to the AAA server;

[0008] When the common process module receives the RADIUS authentication response message sent by the AAA server and carrying the key information corresponding to the authorization information of the user terminal, the common process module calculates the key information according to a preset algorithm to obtain a key index corresponding to the key information, and determines whether the key index exists in the first storage space corresponding to the common process module;

[0009] If the judgment result is yes, sending an online response message to the user terminal to indicate that the authentication is successful;

[0010] If the judgment result is no, query the main process module whether the key index exists in the second storage space corresponding to the main process module; when the query result is yes, send the online response message to the user terminal; when the query result is no, notify the main process module to obtain the authorization information from the AAA server, and after receiving the notification message sent by the main process module to notify that the authorization information has been obtained, store the key index in the first storage space and send the online response message to the user terminal.

[0011] According to a second aspect of an embodiment of the present application, a message processing device is provided, the device being applied to an access device communicating with an AAA server, the device comprising a main process module and a plurality of common process modules,

[0012] The main process module is used to notify the common process module corresponding to the user terminal determined by the main process module in the access device to send a RADIUS authentication request message for the user terminal to the AAA server after receiving the online request message from the user terminal;

[0013] The common process module is used for, when receiving a RADIUS authentication response message sent by the AAA server and carrying key information corresponding to the authorization information of the user terminal, calculating the key information according to a preset algorithm to obtain a key index corresponding to the key information, and judging whether the key index exists in the first storage space corresponding to the common process module; if the judgment result is yes, sending an online response message used to indicate that the authentication is passed to the user terminal; if the judgment result is no, querying the main process module whether the key index exists in the second storage space corresponding to the main process module; when the query result is yes, sending the online response message to the user terminal; when the query result is no, notifying the main process module to obtain the authorization information from the AAA server, and after receiving a notification message sent by the main process module to notify that the authorization information has been obtained, storing the key index in the first storage space, and sending the online response message to the user terminal.

[0014] The technical solution provided by the embodiments of the present application may have the following beneficial effects:

[0015] In an embodiment of the present application, in a scenario where a large number of user terminals use the same authorization information when going online, the access device only needs to interact with the AAA server when the first user terminal among these user terminals goes online to obtain authorization information. When the remaining user terminals go online, the access device only needs to know that the remaining user terminals have been authenticated based on the key index corresponding to the authorization information responded by the AAA server, and no longer needs to interact with the AAA server frequently. In this way, the same authorization information is only transmitted once between the access device and the AAA server, which greatly saves bandwidth resources between the access device and the AAA server, thereby improving the processing performance of both.

[0016] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings, which are incorporated in the specification and constitute a part of this application, illustrate embodiments consistent with the application and, together with the description, serve to explain the principles of the application.

[0018] Figure 1 A flowchart of a message processing method provided in an embodiment of the present application;

[0019] Figure 2 A schematic diagram of a wireless local area network (WLAN) provided in an embodiment of the present application;

[0020] Figure 3 A schematic diagram of the structure of a message processing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0021] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0022] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. The singular forms of "a", "said" and "the" used in this application and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0023] It should be understood that, although the terms first, second, third, etc. may be used in the present application to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the words "if" or "if" as used herein may be interpreted as "at the time of" or "when...".

[0024] Next, the embodiments of the present application are described in detail.

[0025] The present application embodiment provides a message processing method, which is applied to an access device communicating with an AAA server, such as Figure 1 As shown, the method may include the following steps:

[0026] S11. After receiving an online request message from a user terminal, the main process module in the access device notifies a common process module corresponding to the user terminal determined by the main process module in the access device to send a RADIUS authentication request message for the user terminal to the AAA server.

[0027] In this step, the online request message is forwarded to the main process module by the receiving module in the access device when the receiving module receives the online request message sent by the user terminal.

[0028] S12. When the common process module receives the RADIUS authentication response message sent by the AAA server and carrying the key information corresponding to the authorization information of the user terminal, the common process module calculates the key information according to a preset algorithm to obtain the key index corresponding to the key information, and determines whether the key index exists in the first storage space corresponding to the common process module; when the judgment result is yes, execute step S13; when the judgment result is no, execute step S14.

[0029] S13. Send an online response message to the user terminal to indicate that the authentication is successful.

[0030] S14. Query the main process module whether there is a key index in the second storage space corresponding to the main process module; when the query result is yes, send an online response message to the user terminal; when the query result is no, notify the main process module to obtain authorization information from the AAA server, and after receiving the notification message sent by the main process module to notify that the authorization information has been obtained, store the key index in the first storage space and send an online response message to the user terminal.

[0031] It should be noted that, in the embodiment of the present application, when the user terminal is a wired terminal, the access device may be a switching device. Or,

[0032] When the user terminal is a wireless terminal, the access device may be a FAT AP or an AC.

[0033] It should be further explained that in the above step S11, when the main process module determines the common process module corresponding to the user terminal, it can determine it according to a preset load balancing strategy. The specific determination process is prior art and will not be described in detail here.

[0034] Specifically, in the above step S12, the common process module can obtain the key index corresponding to the key information in the following manner:

[0035] The common process module calculates the key information according to a preset hash algorithm to obtain a hash value, and determines the obtained hash value as a key index corresponding to the key information.

[0036] It should be noted that in the embodiment of the present application, the RADIUS authentication response message no longer carries the complete authorization information corresponding to the user terminal, but only carries its corresponding key information. In this way, the computing resources of the ordinary process module when calculating the key index can be reduced.

[0037] Here, the authorization information may be the access rights of the user terminal to access the network, etc. For example, when the authorization information includes multiple access control list (ACL) rules, the corresponding key information may be the group name of the ACL group to which these ACL rules belong.

[0038] In addition, the above hash algorithm may be a message-digest algorithm (Message-Digest Algorithm 5, MD5) and the like.

[0039] Specifically, in the above step S14, the common process module may query the main process module in the following manner whether there is a key index in the second storage space corresponding to the main process module:

[0040] The common process module sends a query request message carrying a key index to the main process module;

[0041] If a first query response message sent by the main process module and used to indicate that the key index is found in the second storage space is received, determining that the query result is yes;

[0042] If a second query response message sent by the main process module and used to indicate that the key index is not found in the second storage space is received, determining that the query result is negative;

[0043] The key index stored in the second storage space is stored when the main process module first receives a query request message carrying the key index.

[0044] In the above step S14, when the main process module obtains the authorization information from the AAA server, it can obtain it by sending a RADIUS authentication request message for the user terminal to the AAA server.

[0045] Here, the main process module may obtain the authorization information of the user terminal by interacting with the AAA server once, or may obtain the authorization information of the user terminal by interacting with the AAA server multiple times. The specific number of interactions is related to the size of the authorization information.

[0046] In addition, the notification message sent by the main process module and received by the common process module to notify that the authorization information has been obtained may carry a key index. In this way, after receiving the notification message, the common process module may store the key index in the first storage space.

[0047] Furthermore, in the embodiment of the present application, the main process module may also perform the following operations:

[0048] After obtaining the authorization information from the AAA server, the main process module stores the authorization information in the kernel state memory area in the access device.

[0049] The main process module performs this operation flow so that the subsequent access device can restrict the network access of the user terminal that needs to use the authorization information based on the authorization information stored in the kernel state memory area.

[0050] The above message processing method is described in detail below in conjunction with specific embodiments.

[0051] like Figure 2 As shown, at time 1, assuming that the receiving module in the AC receives an online request message 1 sent by the wireless terminal 1 through the AP1 and the switching device, the receiving module forwards the online request message 1 to the main process module in the AC.

[0052] After receiving the online request message 1, the main process module notifies the common process module (for example, common process module 1) corresponding to the wireless terminal 1 determined by the main process module in the AC to send a RADIUS authentication request message 1 for the wireless terminal 1 to the AAA server.

[0053] When the ordinary process module 1 receives the RADIUS authentication response message 1 sent by the AAA server and carrying the key information (for example, key information 1) corresponding to the authorization information of the wireless terminal 1 (recorded as authorization information 1), the key information 1 is calculated according to MD5 to obtain the key index (for example, key index a) corresponding to the key information 1.

[0054] The common process module 1 determines whether there is a key index a in the storage space corresponding to the common process module 1 (recorded as storage space 1).

[0055] Assuming that the judgment result is no, at this time, the common process module 1 queries the main process module whether there is a key index a in the storage space corresponding to the main process module (recorded as storage space 2).

[0056] Specifically, the common process module 1 may send a query request message carrying the key index a to the main process module to query whether the key index a exists in the storage space 2.

[0057] Assuming the query result is no, at this time, the ordinary process module 1 notifies the main process module to obtain authorization information 1 from the AAA server, and after determining that the main process module has obtained the authorization information 1, stores the key index a in the storage space 1 and sends an online response message 1 to the wireless terminal 1.

[0058] For the main process module, after receiving the message sent by the ordinary process module 1, it queries the main process module whether there is a key index a in the storage space corresponding to the main process module (recorded as storage space 2). After obtaining the authorization information 1 from the AAA server, the authorization information 1 is stored in the kernel state memory area in the access device.

[0059] Next, at time 2, assuming that the receiving module in the AC receives an online request message 2 sent by the wireless terminal 2 through the AP1 and the switching device, the receiving module forwards the online request message 2 to the main process module.

[0060] After receiving the online request message 2, the main process module notifies the common process module (for example, common process module 2) corresponding to the wireless terminal 2 determined by the main process module to send a RADIUS authentication request message 2 for the wireless terminal 2 to the AAA server.

[0061] Assume that when the common process module 2 receives the RADIUS authentication response message 2 carrying the key information 1 sent by the AAA server, the key information 1 is calculated according to MD5 to obtain the key index a.

[0062] The common process module 2 determines whether the key index exists in the storage space corresponding to the common process module 2 (recorded as storage space 3).

[0063] Assuming that the judgment result is no, at this time, the ordinary process module 2 queries the main process module whether there is a key index a in the storage space 2.

[0064] Since the key index a exists in the storage space 2, the judgment result is yes, which means that the wireless terminal 2 and the wireless terminal 1 use the same authorization information. In this case, the AC no longer needs to obtain the authorization information 1 from the AAA server side. The normal process module 2 directly sends an online response message 2 to the wireless terminal 2 to indicate that the authentication is successful.

[0065] It should be noted that if there are multiple (for example, 240) wireless terminals ( Figure 2 In the figure, other wireless terminals except wireless terminal 1 and wireless terminal 2 are not shown in the figure) use authorization information 1 (for example, authorization information 1 includes 255 ACL rules). In this case, using this solution, AC only needs to obtain authorization information 1 from the AAA server side once, while using the existing method, AC needs to obtain authorization information 1 from the AAA server side 240 times. Obviously, the bandwidth resources between AC and AAA server are greatly saved, thereby improving the processing performance of AC and AAA server.

[0066] It can be seen from the above technical solution that in an embodiment of the present application, in a scenario where a large number of user terminals use the same authorization information when going online, the access device only needs to interact with the AAA server when the first user terminal among these user terminals goes online to obtain authorization information. When the remaining user terminals go online, the access device only needs to know that the remaining user terminals have been authenticated based on the key index corresponding to the authorization information responded by the AAA server, and no longer needs to interact with the AAA server frequently. In this way, the same authorization information is only transmitted once between the access device and the AAA server, which greatly saves bandwidth resources between the access device and the AAA server, thereby improving the processing performance of both.

[0067] Based on the same inventive concept, the present application also provides a message processing device, which is applied to an access device that communicates with an AAA server, and its structural diagram is shown in FIG. Figure 3 As shown, the device includes a main process module 31 and a plurality of common process modules 32 ( Figure 3 Only one is shown),

[0068] The main process module is used to notify the common process module corresponding to the user terminal determined by the main process module in the access device to send a RADIUS authentication request message for the user terminal to the AAA server after receiving the online request message from the user terminal;

[0069] The common process module (i.e., the common process module corresponding to the user terminal, hereinafter referred to as such) is used to, when receiving a RADIUS authentication response message sent by the AAA server and carrying key information corresponding to the authorization information of the user terminal, calculate the key information according to a preset algorithm to obtain a key index corresponding to the key information, and determine whether the key index exists in the first storage space corresponding to the common process module; if the determination result is yes, send an online response message used to indicate that the authentication is passed to the user terminal; if the determination result is no, query the main process module to determine whether the key index exists in the second storage space corresponding to the main process module; when the query result is yes, send the online response message to the user terminal; when the query result is no, notify the main process module to obtain the authorization information from the AAA server, and after receiving a notification message sent by the main process module to notify that the authorization information has been obtained, store the key index in the first storage space, and send the online response message to the user terminal.

[0070] Preferably, the common process module 32 is specifically used for:

[0071] The common process module calculates the key information according to a preset hash algorithm to obtain a hash value, and determines the obtained hash value as a key index corresponding to the key information.

[0072] Preferably, the common process module 32 is specifically used for:

[0073] The common process module sends a query request message carrying the key index to the main process module;

[0074] If a first query response message sent by the main process module and used to indicate that the key index is found in the second storage space is received, determining that the query result is yes;

[0075] If a second query response message sent by the main process module and used to indicate that the key index is not found in the second storage space is received, determining that the query result is negative;

[0076] Among them, the key index stored in the second storage space is stored when the main process module first receives a query request message carrying the key index.

[0077] Preferably, the main process module 31 is also used for:

[0078] After obtaining the authorization information from the AAA server, the authorization information is stored in a kernel-mode memory area in the access device.

[0079] Preferably, when the user terminal is a wired terminal, the access device is a switching device; or,

[0080] When the user terminal is a wireless terminal, the access device is a Fat AP or an AC.

[0081] It can be seen from the above technical solution that in an embodiment of the present application, in a scenario where a large number of user terminals use the same authorization information when going online, the access device only needs to interact with the AAA server when the first user terminal among these user terminals goes online to obtain authorization information. When the remaining user terminals go online, the access device only needs to know that the remaining user terminals have been authenticated based on the key index corresponding to the authorization information responded by the AAA server, and no longer needs to interact with the AAA server frequently. In this way, the same authorization information is only transmitted once between the access device and the AAA server, which greatly saves bandwidth resources between the access device and the AAA server, thereby improving the processing performance of both.

[0082] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A message processing method, characterized in that: The method is applied to an access device that communicates with an authentication, authorization, and accounting AAA server, and the method comprises: After receiving the online request message from the user terminal, the main process module in the access device notifies the common process module corresponding to the user terminal determined by the main process module in the access device to send a remote authentication dial-in user service RADIUS authentication request message for the user terminal to the AAA server; When the common process module receives the RADIUS authentication response message sent by the AAA server and carrying the key information corresponding to the authorization information of the user terminal, the common process module calculates the key information according to a preset algorithm to obtain a key index corresponding to the key information, and determines whether the key index exists in the first storage space corresponding to the common process module; If the judgment result is yes, sending an online response message to the user terminal to indicate that the authentication is successful; If the judgment result is no, query the main process module whether the key index exists in the second storage space corresponding to the main process module; when the query result is yes, send the online response message to the user terminal; when the query result is no, notify the main process module to obtain the authorization information from the AAA server, and after receiving the notification message sent by the main process module to notify that the authorization information has been obtained, store the key index in the first storage space and send the online response message to the user terminal.

2. The method according to claim 1, characterized in that The common process module calculates the key information according to a preset algorithm to obtain a key index corresponding to the key information, specifically including: The common process module calculates the key information according to a preset hash algorithm to obtain a hash value, and determines the obtained hash value as a key index corresponding to the key information.

3. The method according to claim 1, characterized in that The common process module queries the main process module whether the key index exists in the second storage space corresponding to the main process module, specifically including: The common process module sends a query request message carrying the key index to the main process module; If a first query response message sent by the main process module and used to indicate that the key index is found in the second storage space is received, determining that the query result is yes; If a second query response message sent by the main process module and used to indicate that the key index is not found in the second storage space is received, determining that the query result is negative; Among them, the key index stored in the second storage space is stored when the main process module first receives a query request message carrying the key index.

4. The method according to claim 1, characterized in that The method further comprises: After acquiring the authorization information from the AAA server, the main process module stores the authorization information in a kernel state memory area in the access device.

5. The method according to claim 1, characterized in that When the user terminal is a wired terminal, the access device is a switching device; or, When the user terminal is a wireless terminal, the access device is a fat access point AP or an access controller AC.

6. A message processing device, characterized in that: The device is applied to an access device that communicates with an authentication, authorization, and accounting AAA server, and includes a main process module and a plurality of common process modules. The main process module is used to notify the common process module corresponding to the user terminal determined by the main process module in the access device to send a remote authentication dial-in user service RADIUS authentication request message for the user terminal to the AAA server after receiving the online request message from the user terminal; The common process module is used for, when receiving a RADIUS authentication response message sent by the AAA server and carrying key information corresponding to the authorization information of the user terminal, calculating the key information according to a preset algorithm to obtain a key index corresponding to the key information, and judging whether the key index exists in the first storage space corresponding to the common process module; if the judgment result is yes, sending an online response message used to indicate that the authentication is passed to the user terminal; if the judgment result is no, querying the main process module whether the key index exists in the second storage space corresponding to the main process module; when the query result is yes, sending the online response message to the user terminal; when the query result is no, notifying the main process module to obtain the authorization information from the AAA server, and after receiving a notification message sent by the main process module to notify that the authorization information has been obtained, storing the key index in the first storage space, and sending the online response message to the user terminal.

7. The device according to claim 6, characterized in that The common process module is specifically used for: The common process module calculates the key information according to a preset hash algorithm to obtain a hash value, and determines the obtained hash value as a key index corresponding to the key information.

8. The device according to claim 6, characterized in that The common process module is specifically used for: The common process module sends a query request message carrying the key index to the main process module; If a first query response message sent by the main process module and used to indicate that the key index is found in the second storage space is received, determining that the query result is yes; If a second query response message sent by the main process module and used to indicate that the key index is not found in the second storage space is received, determining that the query result is negative; Among them, the key index stored in the second storage space is stored when the main process module first receives a query request message carrying the key index.

9. The device according to claim 6, characterized in that The main process module is also used for: After obtaining the authorization information from the AAA server, the authorization information is stored in a kernel-mode memory area in the access device.

10. The device according to claim 6, characterized in that When the user terminal is a wired terminal, the access device is a switching device; or, When the user terminal is a wireless terminal, the access device is a fat access point AP or an access controller AC.

Images