A message processing method and device

Abstract

The application provides a message processing method and device. The method is applied to an access device in communication with an AAA server, and comprises: a main process module in the access device notifying an ordinary process module corresponding to a user terminal determined by the main process module to send a RADIUS authentication request message for the user terminal to the AAA server after receiving an online request message from the user terminal; the ordinary process module calculating key information corresponding to authorization information of the user terminal according to a preset algorithm when receiving a RADIUS authentication response message carrying the key information sent by the AAA server, obtaining a key index corresponding to the key information, and judging whether the key index exists in a first storage space corresponding to the ordinary process module; and if the result of the judgment is yes, sending an online response message for indicating that the authentication is passed to the user terminal. The application can save bandwidth resources between the access device and the AAA server.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a message processing method and device. Background Art

[0002] Currently, in application scenarios where an Authentication, Authorization, Accounting (AAA) server needs to issue corresponding authorization information to a user terminal, once an access device communicating with the AAA server receives a login request message from the user terminal, it exchanges a Remote Authentication Dial-In User Service (RADIUS) authentication request message with the AAA server to obtain the authorization information of the user terminal. Afterwards, the access device sends an online response message to the user terminal, indicating that the authentication has been passed.

[0003] Here, when the user terminal is a wired terminal, the access device may be a switching device; when the user terminal is a wireless terminal, the access device may be a fat access point (AP) or an access controller (AC).

[0004] In the above message processing flow, if the authorization information of the user terminal is large, the access device needs to interact with the AAA server multiple times to obtain the complete authorization information. If some user terminals use the same authorization information, the access device needs to interact with the AAA server multiple times for these user terminals respectively. This consumes a lot of bandwidth resources between the access device and the AAA server and also affects the processing performance of both. Summary of the Invention

[0005] In order to overcome the problems existing in the related art, the present application provides a message processing method and device.

[0006] According to a first aspect of an embodiment of the present application, a message processing method is provided, the method being applied to an access device communicating with an AAA server, the method comprising:

[0007] After receiving the online request message from the user terminal, the main process module in the access device notifies the common process module corresponding to the user terminal determined by the main process module in the access device to send a RADIUS authentication request message for the user terminal to the AAA server;

[0008] When the common process module receives a RADIUS authentication response message sent by the AAA server and carrying key information corresponding to the authorization information of the user terminal, the common process module calculates the key information according to a preset algorithm to obtain a key index corresponding to the key information, and determines whether the key index exists in the first storage space corresponding to the common process module;

[0009] If the judgment result is yes, sending an online response message to the user terminal to indicate that the authentication is successful;

[0010] If the judgment result is no, query the main process module whether the key index exists in the second storage space corresponding to the main process module; when the query result is yes, send the online response message to the user terminal; when the query result is no, notify the main process module to obtain the authorization information from the AAA server, and after receiving the notification message sent by the main process module to notify that the authorization information has been obtained, store the key index in the first storage space and send the online response message to the user terminal.

[0011] According to a second aspect of an embodiment of the present application, a message processing device is provided, which is applied to an access device communicating with an AAA server, and includes a main process module and multiple common process modules.

[0012] The main process module is configured to, after receiving an online request message from a user terminal, notify the common process module corresponding to the user terminal determined by the main process module in the access device to send a RADIUS authentication request message for the user terminal to the AAA server;

[0013] The common process module is configured to, upon receiving a RADIUS authentication response message sent by the AAA server carrying key information corresponding to the authorization information of the user terminal, calculate the key information according to a preset algorithm to obtain a key index corresponding to the key information, and determine whether the key index exists in the first storage space corresponding to the common process module; if the determination result is yes, send an online response message to the user terminal to indicate that the authentication is successful; if the determination result is no, query the main process module to determine whether the key index exists in the second storage space corresponding to the main process module; if the query result is yes, send the online response message to the user terminal; if the query result is no, notify the main process module to obtain the authorization information from the AAA server, and after receiving a notification message sent by the main process module to notify that the authorization information has been obtained, store the key index in the first storage space and send the online response message to the user terminal.

[0014] The technical solutions provided by the embodiments of the present application may have the following beneficial effects:

[0015] In an embodiment of the present application, in a scenario where a large number of user terminals use the same authorization information when going online, the access device only needs to interact with the AAA server when the first user terminal among these user terminals goes online to obtain authorization information. When the remaining user terminals go online, the access device only needs to know that the remaining user terminals have been authenticated based on the key index corresponding to the authorization information responded by the AAA server, and no longer needs to frequently interact with the AAA server. In this way, the same authorization information is only transmitted once between the access device and the AAA server, which greatly saves bandwidth resources between the access device and the AAA server, thereby improving the processing performance of both.

[0016] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0018] Figure 1 A flowchart of a message processing method provided in an embodiment of the present application;

[0019] Figure 2 A schematic diagram of a wireless local area network (WLAN) provided in an embodiment of the present application;

[0020] Figure 3 A schematic diagram of the structure of a message processing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0021] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.

[0022] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. As used in this application and the appended claims, the singular forms "a," "an," "the," and "the" are intended to include the plural forms, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0023] It should be understood that although the terms first, second, third, etc. may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the words "if" or "if" as used herein may be interpreted as "when" or "when".

[0024] Next, the embodiments of the present application are described in detail.

[0025] The embodiment of the present application provides a message processing method, which is applied to an access device communicating with an AAA server, such as Figure 1 As shown, the method may include the following steps:

[0026] S11. After receiving the online request message from the user terminal, the main process module in the access device notifies the common process module corresponding to the user terminal determined by the main process module in the access device to send a RADIUS authentication request message for the user terminal to the AAA server.

[0027] In this step, the online request message is forwarded to the main process module by the receiving module in the access device when the receiving module receives the online request message sent by the user terminal.

[0028] S12. When the common process module receives a RADIUS authentication response message sent by the AAA server and carrying key information corresponding to the authorization information of the user terminal, the common process module calculates the key information according to a preset algorithm to obtain a key index corresponding to the key information, and determines whether the key index exists in the first storage space corresponding to the common process module; if the judgment result is yes, execute step S13; if the judgment result is no, execute step S14.

[0029] S13. Send an online response message to the user terminal, indicating that the authentication is successful.

[0030] S14. Query the main process module to determine whether a key index exists in the second storage space corresponding to the main process module; if the query result is yes, send an online response message to the user terminal; if the query result is no, notify the main process module to obtain authorization information from the AAA server, and after receiving the notification message sent by the main process module to notify that the authorization information has been obtained, store the key index in the first storage space and send an online response message to the user terminal.

[0031] It should be noted that, in the embodiment of the present application, when the user terminal is a wired terminal, the access device may be a switching device. Or,

[0032] When the user terminal is a wireless terminal, the access device may be a Fat AP or an AC.

[0033] It should be further explained that in the above step S11, when the main process module determines the common process module corresponding to the user terminal, it can determine it according to a preset load balancing strategy. The specific determination process is an existing technology and will not be described in detail here.

[0034] Specifically, in the above step S12, the common process module can obtain the key index corresponding to the key information in the following manner:

[0035] The common process module calculates the key information according to a preset hash algorithm to obtain a hash value, and determines the obtained hash value as a key index corresponding to the key information.

[0036] It should be noted that, in the embodiment of the present application, the RADIUS authentication response message no longer carries the complete authorization information corresponding to the user terminal, but only carries its corresponding key information. This can reduce the computing resources of the ordinary process module when calculating the key index.

[0037] Here, the authorization information may be the access rights of the user terminal to access the network, etc. For example, when the authorization information includes multiple access control list (ACL) rules, the corresponding key information may be the group name of the ACL group to which these ACL rules belong.

[0038] In addition, the above hash algorithm may be a message-digest algorithm (Message-Digest Algorithm 5, MD5) or the like.

[0039] Specifically, in the above step S14, the common process module may query the main process module in the following manner whether the key index exists in the second storage space corresponding to the main process module:

[0040] The common process module sends a query request message carrying a key index to the main process module;

[0041] If a first query response message sent by the main process module is received, indicating that the key index is found in the second storage space, determining that the query result is yes;

[0042] If a second query response message sent by the main process module is received, indicating that no key index is found in the second storage space, determining that the query result is negative;

[0043] The key index stored in the second storage space is stored when the main process module first receives a query request message carrying the key index.

[0044] In the above step S14, when the main process module obtains the authorization information from the AAA server, it can obtain it by sending a RADIUS authentication request message for the user terminal to the AAA server.

[0045] Here, the main process module may obtain the authorization information of the user terminal by interacting with the AAA server once, or may obtain the authorization information of the user terminal by interacting with the AAA server multiple times. The specific number of interactions is related to the size of the authorization information.

[0046] In addition, the notification message sent by the main process module and received by the common process module to notify that the authorization information has been obtained may carry a key index. In this way, after receiving the notification message, the common process module may store the key index in the first storage space.

[0047] Furthermore, in the embodiment of the present application, the main process module may also perform the following operations:

[0048] After obtaining the authorization information from the AAA server, the main process module stores the authorization information in the kernel state memory area of ​​the access device.

[0049] The main process module performs this operation flow so that the subsequent access device can restrict network access to the user terminal that needs to use the authorization information based on the authorization information stored in the kernel memory area.

[0050] The above message processing method is described in detail below with reference to specific embodiments.

[0051] like Figure 2 As shown, at time 1, it is assumed that the receiving module in the AC receives the online request message 1 sent by the wireless terminal 1 through the AP1 and the switching device, and the receiving module forwards the online request message 1 to the main process module in the AC.

[0052] The main process module notifies the normal process module corresponding to the wireless terminal 1 (for example, the normal process module 1) determined by the main process module to send a RADIUS authentication request message 1 for the wireless terminal 1 to the AAA server after receiving the online request message 1.

[0053] The normal process module 1 calculates the key index (for example, the key index a) corresponding to the key information (for example, the key information 1) according to MD5 after receiving the RADIUS authentication response message 1 carrying the key information (marked as the authorization information 1) of the wireless terminal 1 sent by the AAA server.

[0054] The normal process module 1 judges whether the key index a exists in the storage space (marked as the storage space 1) corresponding to the normal process module 1.

[0055] Suppose the judgment result is no, at this time, the normal process module 1 queries the main process module corresponding to the storage space (marked as the storage space 2) of the main process module whether the key index a exists.

[0056] Specifically, the normal process module 1 can send a query request message carrying the key index a to the main process module to query whether the key index a exists in the storage space 2.

[0057] Suppose the query result is no, at this time, the normal process module 1 notifies the main process module to obtain the authorization information 1 from the AAA server, and stores the key index a in the storage space 1 after determining that the main process module obtains the authorization information 1, and sends an online response message 1 to the wireless terminal 1.

[0058] For the main process module, after receiving the query sent by the normal process module 1 to the main process module whether the key index a exists in the storage space (marked as the storage space 2) corresponding to the main process module and obtaining the authorization information 1 from the AAA server, the authorization information 1 will be stored in the kernel memory area in the access device.

[0059] Next, at time 2, suppose that the receiving module in the AC receives the online request message 2 sent by the wireless terminal 2 through the AP1 and the switching device, and the receiving module forwards the online request message 2 to the main process module.

[0060] The main process module notifies the normal process module (for example, the normal process module 2) corresponding to the wireless terminal 2 determined by the main process module to send a RADIUS authentication request message 2 for the wireless terminal 2 to the AAA server after receiving the online request message 2.

[0061] Assume that when the common process module 2 receives the RADIUS authentication response message 2 carrying the key information 1 sent by the AAA server, it calculates the key information 1 according to MD5 to obtain the key index a.

[0062] The common process module 2 determines whether the key index exists in the storage space corresponding to the common process module 2 (recorded as storage space 3).

[0063] Assuming that the judgment result is no, at this time, the common process module 2 queries the main process module whether there is a key index a in the storage space 2.

[0064] Since key index a exists in storage space 2, the judgment result is yes, which means that wireless terminal 2 and wireless terminal 1 use the same authorization information. In this case, AC no longer needs to obtain authorization information 1 from the AAA server side. The normal process module 2 directly sends an online response message 2 to wireless terminal 2 to indicate that the authentication is successful.

[0065] It should be noted that if there are multiple (for example, 240) wireless terminals ( Figure 2 In the embodiment, other wireless terminals except wireless terminal 1 and wireless terminal 2 are not shown in the figure and use authorization information 1 (for example, authorization information 1 includes 255 ACL rules). In this case, using this solution, the AC only needs to obtain authorization information 1 from the AAA server side once, while using the existing method, the AC needs to obtain authorization information 1 from the AAA server side 240 times. Obviously, this greatly saves bandwidth resources between the AC and the AAA server, thereby improving the processing performance of the AC and the AAA server.

[0066] It can be seen from the above technical solution that in an embodiment of the present application, in a scenario where a large number of user terminals use the same authorization information when going online, the access device only needs to interact with the AAA server when the first user terminal among these user terminals goes online to obtain authorization information. When the remaining user terminals go online, the access device only needs to know that the remaining user terminals have been authenticated based on the key index corresponding to the authorization information responded by the AAA server, and no longer needs to frequently interact with the AAA server. In this way, the same authorization information is only transmitted once between the access device and the AAA server, which greatly saves bandwidth resources between the access device and the AAA server, thereby improving the processing performance of both.

[0067] Based on the same inventive concept, the present application also provides a message processing device, which is applied to an access device communicating with an AAA server, and its structural diagram is shown in FIG. Figure 3 As shown, the device includes a main process module 31 and multiple common process modules 32 ( Figure 3 Only one is shown),

[0068] The main process module is configured to, after receiving an online request message from a user terminal, notify the common process module corresponding to the user terminal determined by the main process module in the access device to send a RADIUS authentication request message for the user terminal to the AAA server;

[0069] The common process module (i.e., the common process module corresponding to the user terminal, hereinafter referred to as such) is used to, upon receiving a RADIUS authentication response message sent by the AAA server carrying key information corresponding to the authorization information of the user terminal, calculate the key information according to a preset algorithm to obtain a key index corresponding to the key information, and determine whether the key index exists in the first storage space corresponding to the common process module; if the judgment result is yes, send an online response message to the user terminal to indicate that the authentication is successful; if the judgment result is no, query the main process module to determine whether the key index exists in the second storage space corresponding to the main process module; if the query result is yes, send the online response message to the user terminal; if the query result is no, notify the main process module to obtain the authorization information from the AAA server, and after receiving a notification message sent by the main process module to notify that the authorization information has been obtained, store the key index in the first storage space and send the online response message to the user terminal.

[0070] Preferably, the general process module 32 is specifically used to:

[0071] The common process module calculates the key information according to a preset hash algorithm to obtain a hash value, and determines the obtained hash value as a key index corresponding to the key information.

[0072] Preferably, the general process module 32 is specifically used to:

[0073] The common process module sends a query request message carrying the key index to the main process module;

[0074] If a first query response message sent by the main process module and indicating that the key index is found in the second storage space is received, determining that the query result is yes;

[0075] If a second query response message sent by the main process module is received, indicating that the key index is not found in the second storage space, determining that the query result is negative;

[0076] The key index stored in the second storage space is stored when the main process module first receives a query request message carrying the key index.

[0077] Preferably, the main process module 31 is further configured to:

[0078] After obtaining the authorization information from the AAA server, the authorization information is stored in a kernel state memory area in the access device.

[0079] Preferably, when the user terminal is a wired terminal, the access device is a switching device; or,

[0080] When the user terminal is a wireless terminal, the access device is a Fat AP or an AC.

[0081] As can be seen from the above technical solutions, in the application embodiment, in the scenario where the same authorization information is used when a large number of user terminals are online, the access device only needs to interact with the AAA server when the first user terminal of the user terminals is online to obtain the authorization information, and the remaining user terminals only need to know that the remaining user terminals have been authenticated based on the key index corresponding to the authorization information responded by the AAA server when the user terminals are online, and do not need to frequently interact with the AAA server, so that the same authorization information is transmitted only once between the access device and the AAA server, greatly saving the bandwidth resources between the access device and the AAA server, and further improving the processing performance of the two.

[0082] The above only describes the preferred embodiments of the present application and is not intended to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the scope of protection of the present application.

Claims

1. A message processing method, characterized in that: The method is applied to an access device communicating with an authentication, authorization, and accounting AAA server, and includes: After receiving the online request message from the user terminal, the main process module in the access device notifies the common process module corresponding to the user terminal determined by the main process module in the access device to send a Remote Authentication Dial-In User Service (RADIUS) authentication request message for the user terminal to the AAA server; When the common process module receives a RADIUS authentication response message sent by the AAA server and carrying key information corresponding to the authorization information of the user terminal, the common process module calculates the key information according to a preset algorithm to obtain a key index corresponding to the key information, and determines whether the key index exists in the first storage space corresponding to the common process module; If the judgment result is yes, sending an online response message to the user terminal to indicate that the authentication is successful; If the judgment result is no, query the main process module whether the key index exists in the second storage space corresponding to the main process module; when the query result is yes, send the online response message to the user terminal; when the query result is no, notify the main process module to obtain the authorization information from the AAA server, and after receiving the notification message sent by the main process module to notify that the authorization information has been obtained, store the key index in the first storage space and send the online response message to the user terminal.

2. The method according to claim 1, characterized in that The common process module calculates the key information according to a preset algorithm to obtain a key index corresponding to the key information, specifically including: The common process module calculates the key information according to a preset hash algorithm to obtain a hash value, and determines the obtained hash value as a key index corresponding to the key information.

3. The method according to claim 1, characterized in that The common process module queries the main process module whether the key index exists in the second storage space corresponding to the main process module, specifically including: The common process module sends a query request message carrying the key index to the main process module; If a first query response message sent by the main process module and indicating that the key index is found in the second storage space is received, determining that the query result is yes; If a second query response message sent by the main process module is received, indicating that the key index is not found in the second storage space, determining that the query result is negative; The key index stored in the second storage space is stored when the main process module first receives a query request message carrying the key index.

4. The method according to claim 1, wherein The method further comprises: After obtaining the authorization information from the AAA server, the main process module stores the authorization information in a kernel-mode memory area in the access device.

5. The method according to claim 1, wherein When the user terminal is a wired terminal, the access device is a switching device; or When the user terminal is a wireless terminal, the access device is a fat access point AP or an access controller AC.

6. A message processing device, characterized in that: The device is applied to an access device that communicates with an authentication, authorization, and accounting AAA server, and includes a main process module and multiple common process modules. The main process module is configured to, after receiving an online request message from a user terminal, notify the common process module corresponding to the user terminal determined by the main process module in the access device to send a Remote Authentication Dial-In User Service (RADIUS) authentication request message for the user terminal to the AAA server; The common process module is configured to, upon receiving a RADIUS authentication response message sent by the AAA server carrying key information corresponding to the authorization information of the user terminal, calculate the key information according to a preset algorithm to obtain a key index corresponding to the key information, and determine whether the key index exists in the first storage space corresponding to the common process module; if the determination result is yes, send an online response message to the user terminal to indicate that the authentication is successful; if the determination result is no, query the main process module to determine whether the key index exists in the second storage space corresponding to the main process module; if the query result is yes, send the online response message to the user terminal; if the query result is no, notify the main process module to obtain the authorization information from the AAA server, and after receiving a notification message sent by the main process module to notify that the authorization information has been obtained, store the key index in the first storage space and send the online response message to the user terminal.

7. The device according to claim 6, characterized in that This common process module is specifically used for: The common process module calculates the key information according to a preset hash algorithm to obtain a hash value, and determines the obtained hash value as a key index corresponding to the key information.

8. The device according to claim 6, characterized in that This common process module is specifically used for: The common process module sends a query request message carrying the key index to the main process module; If a first query response message sent by the main process module and indicating that the key index is found in the second storage space is received, determining that the query result is yes; If a second query response message sent by the main process module is received, indicating that the key index is not found in the second storage space, determining that the query result is negative; The key index stored in the second storage space is stored when the main process module first receives a query request message carrying the key index.

9. The device according to claim 6, characterized in that The main process module is further used to: After obtaining the authorization information from the AAA server, the authorization information is stored in a kernel-mode memory area in the access device.

10. The device according to claim 6, characterized in that When the user terminal is a wired terminal, the access device is a switching device; or When the user terminal is a wireless terminal, the access device is a fat access point AP or an access controller AC.

Images