Authentication certificate configuration method, device, storage medium and system

Abstract

The invention discloses an authentication credential configuration method, equipment, a storage medium and a system, and belongs to the technical field of network access. The method comprises the following steps: a terminal device to access a network sends an extensible identity authentication protocol EAP identity authentication message to an authentication device, wherein the EAP identity authentication message carries an identity identifier of the terminal device; receiving an EAP identity response message sent by the authentication device, wherein the EAP identity response message carries a method identifier of the terminal authentication method; if the terminal authentication method is an authentication credential configuration method, sending a first EAP credential request message to the authentication device, the first EAP credential request message being used for requesting to configure a terminal authentication credential; and receiving a first EAP voucher response message sent by the authentication device, wherein the first EAP voucher response message carries the first terminal authentication voucher configured to the terminal device. According to the invention, an access authentication channel under a 802.1 X / EAP co-authentication framework is reused to transmit a terminal authentication credential.

Description

Technical Field

[0001] The present application relates to the field of network access technology, and in particular to an authentication credential configuration method, device, storage medium and system. Background Art

[0002] In the process of terminal devices accessing the network, the extensible authentication protocol (EAP) authentication framework needs to be used between the terminal device and the authentication server, and two-way authentication is performed through the transport layer security protocol (TLS) certificate or pre-shared key (PSK). After completing the authentication, the terminal device can access the network.

[0003] In the related art, before identity authentication, it is necessary to pre-configure authentication credentials for the terminal device. Usually, the terminal authentication credentials can be configured for the terminal device in one of the following three ways: First, the terminal device supplier configures a terminal authentication credential that uniquely identifies the identity of the terminal device for the terminal device during the production and manufacturing of the terminal device. However, the terminal device supplier and the terminal device user exist in different authentication systems. A terminal device supplier usually faces a large number of terminal users. Whether the preset terminal authentication credentials are issued by the supplier's authentication system or by the user authentication system, there is a problem of difficulty in coordination. The second is that after the user purchases the terminal device, the terminal authentication credentials are configured for the terminal device based on the user authentication system. When the terminal device needs to access the network, the configured terminal authentication credentials are imported into the terminal device through a specific credential import tool. However, when the user needs to access multiple terminal devices to the network, it is necessary to configure terminal authentication credentials for multiple terminal devices one by one, and repeat the operation of importing authentication credentials many times, and the terminal credential configuration efficiency is low. The third method is that after the installation and deployment of the terminal device is completed, based on the terminal device identification mechanism, the authentication server can discover and present the terminal information of the terminal device. The network administrator identifies and verifies the terminal identity by checking the terminal information, and after the identity authentication is passed, the authentication server is authorized to dynamically issue a terminal authentication certificate for the terminal device and send the terminal authentication certificate to the terminal device online. In this way, since the terminal device has not completed the access authentication of the link layer and has not configured an IP address, the authentication server cannot communicate with the terminal device through IP routing. If a temporary IP address is configured for the terminal device so that the terminal device and the authentication server can use the TLS protocol to transmit the authentication certificate, in this case, the terminal device needs to support protocols such as TLS, there is a dependency on the protocol stack, and the implementation process is relatively complicated.

[0004] Based on this, there is an urgent need for a method for configuring authentication credentials for terminal devices to access the network, which can quickly and effectively configure terminal authentication credentials for terminal devices without configuring IP addresses, so as to achieve plug-and-play of terminal devices. Summary of the invention

[0005] The present application provides an authentication credential configuration method, device, storage medium and system, which can configure the corresponding terminal authentication credential for the terminal device without configuring the IP address. The technical solution is as follows.

[0006] In a first aspect, a method for configuring authentication credentials is provided, which is applied to a terminal device to be connected to a network, the method comprising: sending an Extensible Authentication Protocol (EAP) identity authentication message to an authentication device, the EAP identity authentication message carrying an identity identifier of the terminal device; receiving an EAP identity response message sent by the authentication device, the EAP identity response message carrying a method identifier of a terminal authentication method; if it is determined based on the method identifier that the terminal authentication method is an authentication credential configuration method, sending a first EAP credential request message to the authentication device, the first EAP credential request message being used to request the authentication device to configure a terminal authentication credential for the terminal device, the terminal authentication credential being used to perform access authentication on the terminal device when the terminal device accesses the network; and receiving a first EAP credential response message sent by the authentication device, the first EAP credential response message carrying a first terminal authentication credential configured for the terminal device.

[0007] This application is based on the 802.1X / EAP authentication framework and the extensibility of the EAP authentication method, and newly extends an EAP authentication method, namely, the authentication credential configuration method. When the terminal device and the authentication device negotiate and determine that the terminal authentication method is the authentication credential configuration method through the EAP format message transmitted by the link layer, the terminal device can request the authentication device online to issue a terminal authentication credential for it. It can be seen that the embodiment of the present application reuses the access authentication channel under the 802.1X / EAP co-authentication framework, and the terminal device can obtain and download the terminal authentication credential configured for it by the authentication device. This process does not require the pre-configuration of a temporary IP address for the terminal device, avoids dependence on IP addresses and IP routing, reduces the resource overhead of the terminal device, and realizes true plug-and-play of the terminal device.

[0008] Optionally, the method also includes: if it is determined based on the method identifier that the terminal authentication method is not the authentication credential configuration method, sending an EAP rejection response message to the authentication device, the EAP rejection response message indicating that the terminal authentication method supported by the terminal device is the authentication credential configuration method; receiving an EAP credential configuration message sent by the authentication device, the EAP credential configuration message indicating that the authentication device has modified the terminal authentication method to the authentication credential configuration method.

[0009] That is, when the terminal authentication method determined by the authentication device is not the authentication credential configuration method, the terminal can send the terminal authentication method supported by itself to the authentication device through an EAP rejection response message to negotiate with the authentication device to determine the final terminal authentication method.

[0010] Optionally, the first EAP credential request message is encrypted and transmitted using a first key determined by a first key generation algorithm, and the first EAP credential response message is encrypted and transmitted using a second key determined by a second key generation algorithm.

[0011] To ensure the security of online transmission of the first terminal authentication credential, the terminal device and the authentication device need to establish a secure transmission channel to encrypt and transmit the first EAP credential request message and the first EAP credential response message.

[0012] Optionally, before sending the first EAP credential request message to the authentication device, the method also includes: sending an EAP key request message to the authentication device, the EAP key request message carrying encryption parameters for generating the first key; receiving an EAP key response message sent by the authentication device, the EAP key response message carrying encryption parameters for generating the second key.

[0013] That is, the terminal device and the authentication device can exchange encryption parameters to determine the encryption key for subsequent transmission of the authentication credentials, thereby encrypting and transmitting the first EAP credential request message and the first EAP credential response message, thereby ensuring the secure transmission of the first terminal authentication credentials.

[0014] Optionally, the terminal authentication credential has a credential validity period; the method also includes: in response to the credential usage duration of the terminal authentication credential exceeding the credential validity period, sending a second EAP credential request message to the authentication device, the second EAP credential request message carrying the identity identifier and credential update identifier of the terminal device; receiving a second EAP credential response message sent by the authentication device, the second EAP credential response message carrying a second terminal authentication credential, the second terminal authentication credential being an authentication credential reconfigured to the terminal device; and updating the terminal authentication credential of the terminal device based on the second terminal authentication credential.

[0015] It can be seen that after the terminal authentication credential has expired, the terminal device can re-execute the process of obtaining the terminal authentication credential based on the access authentication channel under the 802.1X / EAP authentication framework to request the authentication device to issue a second terminal authentication credential, and update the original terminal authentication credential through the second terminal authentication credential. In this way, based on the 802.1X / EAP authentication framework, the terminal authentication credential can also be updated without configuring the IP address and IP routing, which simplifies the update process of the terminal authentication credential and makes it easier and more convenient for the terminal device to update the authentication credential.

[0016] Optionally, the authentication device includes an access gateway and an authentication server, the messages transmitted between the terminal device and the access gateway are messages in the EAP format encapsulated by the link layer protocol, and the messages transmitted between the access gateway and the authentication server are messages in the EAP format encapsulated by the authentication protocol, wherein the authentication protocol is a communication protocol supported by the authentication server under the EAP protocol.

[0017] Among them, according to the actual networking situation, the authentication server can be deployed independently or integrated into the access gateway.

[0018] Optionally, before sending the first EAP credential request message to the authentication device, the method further includes: receiving an EAP credential configuration start message sent by the authentication device; and executing the step of sending the first EAP credential request message to the authentication device in response to the EAP credential configuration start message.

[0019] That is, no matter whether the authentication device directly determines that the terminal authentication method is the authentication credential configuration method in response to the EAP identity authentication message, or the authentication device modifies the terminal authentication method to the authentication credential configuration method in response to the EAP rejection response message, when the terminal authentication method is finally negotiated to be the authentication credential configuration method, the authentication device sends an EAP credential configuration start message to the terminal device to indicate that the terminal authentication method negotiation is completed, and the access authentication process can be executed based on the negotiated terminal authentication method.

[0020] Optionally, after receiving the first EAP credential response message sent by the authentication device, the method further includes: sending an EAP credential configuration completion message to the authentication device; receiving an EAP authentication failure message sent by the authentication device, wherein the EAP authentication failure message indicates that access authentication of the terminal device has failed.

[0021] It should be noted that the authentication credential configuration method is not an EAP authentication method in the general sense. Its function is to request the configuration of terminal authentication credentials, rather than to execute the access authentication process based on the terminal authentication credentials. Therefore, regardless of whether the operation of configuring the terminal authentication credentials is successful or not, the authentication device can only send an EAP authentication failure message. If an EAP authentication success message is sent, the access gateway will mistakenly believe that the terminal device has successfully accessed and authenticated, but in fact the terminal device has not yet started the access authentication process, and naturally has not used the terminal authentication credentials to initiate an access authentication request to the authentication device.

[0022] In a second aspect, a method for configuring authentication credentials is provided, which is applied to an authentication device in a network, the method comprising: receiving an Extensible Authentication Protocol (EAP) authentication message sent by a terminal device, the EAP authentication message carrying an identity identifier of the terminal device; determining a terminal authentication method of the terminal device when verifying that the terminal device is a legally deployed device based on the identity identifier of the terminal device, and sending an EAP identity response message to the terminal device, the EAP identity response message carrying a method identifier of the terminal authentication method; receiving a first EAP credential request message sent by the terminal device, the first EAP credential request message being used to request the authentication device to configure a terminal authentication credential for the terminal device, the terminal authentication credential being used to perform access authentication on the terminal device when the terminal device accesses the network; and sending a first EAP credential response message to the terminal device in response to the first EAP credential request message, the first EAP credential response message carrying a first terminal authentication credential configured for the terminal device.

[0023] This application is based on the 802.1X / EAP authentication framework and the extensibility of the EAP authentication method, and newly extends an EAP authentication method, namely, the authentication credential configuration method. When the terminal device and the authentication device negotiate and determine that the terminal authentication method is the authentication credential configuration method through the EAP format message transmitted by the link layer, the authentication device can dynamically configure the terminal authentication credential for the terminal device online. It can be seen that the embodiment of the present application reuses the access authentication channel under the 802.1X / EAP co-authentication framework to dynamically issue terminal authentication credentials for the terminal device. This process does not require the pre-configuration of a temporary IP address for the terminal device, avoids dependence on IP addresses and IP routing, reduces the resource overhead of the terminal device, and realizes true plug-and-play of the terminal device.

[0024] Optionally, the method also includes: receiving an EAP rejection response message sent by the terminal device, the EAP rejection response message indicating that the terminal authentication method supported by the terminal device is the authentication credential configuration method; in response to the EAP rejection response message, sending an EAP credential configuration message to the terminal device, the EAP credential configuration message indicating that the authentication device has modified the terminal authentication method to the authentication credential configuration method.

[0025] That is, for the authentication device, the terminal authentication method determined by it may be the authentication credential configuration method, or may not be the authentication credential configuration method. The specific selection of the EAP authentication method as the terminal authentication method may be determined by negotiation between the authentication device and the terminal device.

[0026] Optionally, the first EAP credential request message is encrypted and transmitted using a first key determined by a first key generation algorithm, and the first EAP credential response message is encrypted and transmitted using a second key determined by a second key generation algorithm.

[0027] To ensure the security of online transmission of the first terminal authentication credential, the terminal device and the authentication device need to establish a secure transmission channel to encrypt and transmit the first EAP credential request message and the first EAP credential response message.

[0028] Optionally, before sending the first EAP credential response message to the terminal device, the method also includes: receiving an EAP key request message sent by the terminal device, the EAP key request message carrying encryption parameters for generating the first key; and in response to the EAP key request message, sending an EAP key response message to the terminal device, the EAP key response message carrying encryption parameters corresponding to the second key.

[0029] That is, the terminal device and the authentication device can exchange encryption parameters to determine the encryption key for subsequent transmission of the authentication credentials, thereby encrypting and transmitting the first EAP credential request message and the first EAP credential response message, thereby ensuring the secure transmission of the first terminal authentication credentials.

[0030] Optionally, the terminal authentication credential has a credential validity period; the method also includes: receiving a second EAP credential request message sent by the terminal device, the second EAP credential request message carrying the identity identifier and credential update identifier of the terminal device; in response to the second EAP credential request message, sending a second EAP credential response message to the terminal device, the second EAP credential response message carrying a second terminal authentication credential, the second terminal authentication credential is an authentication credential reconfigured to the terminal device, and the second EAP credential response message is used to instruct the terminal device to update the terminal authentication credential of the terminal device based on the second terminal authentication credential.

[0031] It can be seen that after the terminal authentication credential has expired, the authentication device can respond to the request of the terminal device and re-execute the process of configuring the terminal authentication credential based on the access authentication channel under the 802.1X / EAP authentication framework to issue a second terminal authentication credential to the terminal device, so that the terminal device can update the original terminal authentication credential through the second terminal authentication credential. In this way, based on the 802.1X / EAP authentication framework, the terminal authentication credential can also be updated without configuring the IP address and IP routing, which simplifies the update process of the terminal authentication credential and makes it easier and more convenient for the terminal device to update the authentication credential.

[0032] Optionally, the method also includes: receiving an EAP access authentication request message sent by the terminal device, the EAP access authentication request message carrying a third terminal authentication credential of the terminal device; performing credential validity verification on the third terminal authentication credential according to an abandoned credential list, the abandoned credential list including credential information of multiple abandoned terminal authentication credentials; if the credential validity verification result is that the credential is valid, performing access authentication on the terminal device based on the third terminal authentication credential; if the credential validity verification result is that the credential is invalid, sending an EAP authentication failure message to the terminal device, the EAP authentication failure message indicating that the access authentication of the terminal device has failed.

[0033] Optionally, the discarded credential list includes credential information of at least one of the following types of terminal authentication credentials: terminal authentication credentials whose usage duration exceeds the validity period of the credentials; terminal authentication credentials that have been leaked; and terminal authentication credentials of terminal devices whose life cycle has been terminated.

[0034] That is, the authentication device manages and maintains a list of discarded credentials. When performing access authentication on a terminal device, the terminal authentication credentials provided by the terminal device can be first verified for validity based on the discarded credentials list, and access authentication can be performed on it if the credentials are valid. In this way, the efficiency of access authentication and the accuracy of access authentication results can be improved through credential validity verification, avoiding wasting time on access authentication for invalid credentials.

[0035] Optionally, the authentication device includes an access gateway and an authentication server, the messages transmitted between the terminal device and the access gateway are messages in the EAP format encapsulated by the link layer protocol, and the messages transmitted between the access gateway and the authentication server are messages in the EAP format encapsulated by the authentication protocol, wherein the authentication protocol is a communication protocol supported by the authentication server under the EAP protocol.

[0036] Among them, according to the actual networking situation, the authentication server can be deployed independently or integrated into the access gateway.

[0037] Optionally, before sending the first EAP credential response message to the terminal device, the method further includes: when the terminal authentication method is the authentication credential configuration method, sending an EAP credential configuration start message to the terminal device.

[0038] That is, no matter whether the authentication device directly determines that the terminal authentication method is the authentication credential configuration method in response to the EAP identity authentication message, or the authentication device modifies the terminal authentication method to the authentication credential configuration method in response to the EAP rejection response message, when the terminal authentication method is finally negotiated to be the authentication credential configuration method, the authentication device sends an EAP credential configuration start message to the terminal device to indicate that the terminal authentication method negotiation is completed, and the access authentication process can be executed based on the negotiated terminal authentication method.

[0039] Optionally, after sending the first EAP credential response message to the terminal device, the method further includes: receiving an EAP credential configuration completion message sent by the terminal device; in response to the EAP credential configuration completion message, sending an EAP authentication failure message to the terminal device, wherein the EAP authentication failure message indicates that access authentication of the terminal device has failed.

[0040] It should be noted that the authentication credential configuration method is not an EAP authentication method in the general sense. Its function is to request the configuration of terminal authentication credentials, rather than to execute the access authentication process based on the terminal authentication credentials. Therefore, regardless of whether the operation of configuring the terminal authentication credentials is successful or not, the authentication device can only send an EAP authentication failure message. If an EAP authentication success message is sent, the access gateway will mistakenly believe that the terminal device has successfully accessed and authenticated, but in fact the terminal device has not yet started the access authentication process, and naturally has not used the terminal authentication credentials to initiate an access authentication request to the authentication device.

[0041] In a third aspect, an authentication credential configuration device is provided, wherein the authentication credential configuration device has the function of implementing the authentication credential configuration method behavior in the first aspect. The authentication credential configuration device includes at least one module, and the at least one module is used to implement the authentication credential configuration method provided in the first aspect. Specifically, the authentication credential configuration device includes:

[0042] An identity authentication module, used to send an extensible identity authentication protocol (EAP) identity authentication message to an authentication device, wherein the EAP identity authentication message carries an identity identifier of the terminal device;

[0043] The identity authentication module is further configured to receive an EAP identity response message sent by the authentication device, wherein the EAP identity response message carries an algorithm identifier of a terminal authentication method;

[0044] a credential download module, configured to send a first EAP credential request message to the authentication device if it is determined based on the algorithm identifier that the terminal authentication method is an authentication credential configuration method, wherein the first EAP credential request message is used to request the authentication device to configure a terminal authentication credential for the terminal device, and the terminal authentication credential is used to perform access authentication on the terminal device when the terminal device accesses the network;

[0045] The credential download module is further configured to receive a first EAP credential response message sent by the authentication device, where the first EAP credential response message carries a first terminal authentication credential configured for the terminal device.

[0046] Optionally, the device further comprises:

[0047] a method negotiation module, configured to send an EAP rejection response message to the authentication device if it is determined based on the algorithm identifier that the terminal authentication method is not the authentication credential configuration method, wherein the EAP rejection response message indicates that the terminal authentication method supported by the terminal device is the authentication credential configuration method;

[0048] The method negotiation module is further used to receive an EAP credential configuration message sent by the authentication device, wherein the EAP credential configuration message indicates that the authentication device has modified the terminal authentication method to the authentication credential configuration method.

[0049] Optionally, the first EAP credential request message is encrypted and transmitted using a first key determined by a first key generation algorithm, and the first EAP credential response message is encrypted and transmitted using a second key determined by a second key generation algorithm.

[0050] Optionally, before sending the first EAP credential request message to the authentication device, the apparatus further includes:

[0051] A key negotiation module, configured to send an EAP key request message to the authentication device, wherein the EAP key request message carries an encryption parameter for generating the first key;

[0052] The key negotiation module is further used to receive an EAP key response message sent by the authentication device, where the EAP key response message carries encryption parameters used to generate the second key.

[0053] Optionally, the terminal authentication credential has a validity period; and the device further includes:

[0054] a credential update module, configured to send a second EAP credential request message to the authentication device in response to the credential usage time of the terminal authentication credential exceeding the credential validity period, wherein the second EAP credential request message carries an identity identifier and a credential update identifier of the terminal device;

[0055] The credential updating module is further configured to receive a second EAP credential response message sent by the authentication device, wherein the second EAP credential response message carries a second terminal authentication credential, and the second terminal authentication credential is an authentication credential reconfigured to the terminal device;

[0056] The credential updating module is further used to update the terminal authentication credential of the terminal device based on the second terminal authentication credential.

[0057] Optionally, the authentication device includes an access gateway and an authentication server, the messages transmitted between the terminal device and the access gateway are messages in the EAP format encapsulated by the link layer protocol, and the messages transmitted between the access gateway and the authentication server are messages in the EAP format encapsulated by the authentication protocol, wherein the authentication protocol is a communication protocol supported by the authentication server under the EAP protocol.

[0058] Optionally, before sending the first EAP credential request message to the authentication device, the apparatus further includes:

[0059] The credential download module is used to receive an EAP credential configuration start message sent by the authentication device;

[0060] The credential download module is further configured to execute the step of sending a first EAP credential request message to the authentication device in response to the EAP credential configuration start message.

[0061] Optionally, after receiving the first EAP credential response message sent by the authentication device, the apparatus further includes:

[0062] The credential download module is further used to send an EAP credential configuration completion message to the authentication device;

[0063] The credential download module is further used to receive an EAP authentication failure message sent by the authentication device, where the EAP authentication failure message indicates that the terminal device access authentication has failed.

[0064] In a fourth aspect, an authentication credential configuration device is provided, wherein the authentication credential configuration device has the function of implementing the authentication credential configuration method behavior in the second aspect. The authentication credential configuration device includes at least one module, and the at least one module is used to implement the authentication credential configuration method provided in the second aspect. Specifically, the authentication credential configuration device includes:

[0065] An identity authentication module, configured to receive an extensible identity authentication protocol (EAP) identity authentication message sent by a terminal device, wherein the EAP identity authentication message carries an identity identifier of the terminal device;

[0066] The identity authentication module is further configured to determine a terminal authentication method of the terminal device when verifying that the terminal device is a legally deployed device based on the identity identifier of the terminal device, and send an EAP identity response message to the terminal device, wherein the EAP identity response message carries an algorithm identifier of the terminal authentication method;

[0067] a credential configuration module, configured to receive a first EAP credential request message sent by the terminal device, wherein the first EAP credential request message is used to request the authentication device to configure a terminal authentication credential for the terminal device, wherein the terminal authentication credential is used to perform access authentication on the terminal device when the terminal device accesses the network;

[0068] The credential configuration module is further configured to send a first EAP credential response message to the terminal device in response to the first EAP credential request message, wherein the first EAP credential response message carries a first terminal authentication credential configured for the terminal device.

[0069] Optionally, the device further comprises:

[0070] A method negotiation module, configured to receive an EAP rejection response message sent by the terminal device, wherein the EAP rejection response message indicates that the terminal authentication method supported by the terminal device is the authentication credential configuration method;

[0071] The method negotiation module is further configured to send an EAP credential configuration message to the terminal device in response to the EAP rejection response message, wherein the EAP credential configuration message indicates that the authentication device has modified the terminal authentication method to the authentication credential configuration method.

[0072] Optionally, the first EAP credential request message is encrypted and transmitted using a first key determined by a first key generation algorithm, and the first EAP credential response message is encrypted and transmitted using a second key determined by a second key generation algorithm.

[0073] Optionally, before sending the first EAP credential response message to the terminal device, the apparatus further includes:

[0074] A key negotiation module, configured to receive an EAP key request message sent by the terminal device, wherein the EAP key request message carries an encryption parameter for generating the first key;

[0075] The key negotiation module is further used to send an EAP key response message to the terminal device in response to the EAP key request message, where the EAP key response message carries encryption parameters corresponding to the generation of the second key.

[0076] Optionally, the terminal authentication credential has a validity period; and the device further includes:

[0077] a credential update module, configured to receive a second EAP credential request message sent by the terminal device, wherein the second EAP credential request message carries an identity identifier and a credential update identifier of the terminal device;

[0078] The credential update module is further used to send a second EAP credential response message to the terminal device in response to the second EAP credential request message, the second EAP credential response message carrying a second terminal authentication credential, the second terminal authentication credential being an authentication credential reconfigured to the terminal device, and the second EAP credential response message instructs the terminal device to update the terminal authentication credential of the terminal device based on the second terminal authentication credential.

[0079] Optionally, the device further comprises:

[0080] An access authentication module, configured to receive an EAP access authentication request message sent by the terminal device, wherein the EAP access authentication request message carries a third terminal authentication credential of the terminal device;

[0081] a credential verification module, configured to verify the validity of the third terminal authentication credential according to a discarded credential list, wherein the discarded credential list includes credential information of a plurality of discarded terminal authentication credentials;

[0082] The access authentication module is further configured to perform access authentication on the terminal device based on the third terminal authentication credential if the credential validity check result is that the credential is valid;

[0083] The access authentication module is further configured to send an EAP authentication failure message to the terminal device if the result of the credential validity check is that the credential is invalid, wherein the EAP authentication failure message indicates that the terminal device access authentication has failed.

[0084] Optionally, the discarded credential list includes credential information of at least one of the following types of terminal authentication credentials:

[0085] Terminal authentication credentials whose usage period exceeds the validity period of the credentials;

[0086] Terminal authentication credentials that have been compromised;

[0087] Terminal authentication credentials of terminal devices whose life cycle has ended.

[0088] Optionally, the authentication device includes an access gateway and an authentication server, the messages transmitted between the terminal device and the access gateway are messages in the EAP format encapsulated by the link layer protocol, and the messages transmitted between the access gateway and the authentication server are messages in the EAP format encapsulated by the authentication protocol, wherein the authentication protocol is a communication protocol supported by the authentication server under the EAP protocol.

[0089] Optionally, before sending the first EAP credential response message to the terminal device, the apparatus further includes:

[0090] The credential configuration module is further configured to send an EAP credential configuration start message to the terminal device when the terminal authentication method is the authentication credential configuration method.

[0091] Optionally, after sending the first EAP credential response message to the terminal device, the apparatus further includes:

[0092] The credential configuration module is further configured to receive an EAP credential configuration completion message sent by the terminal device;

[0093] The credential configuration module is further configured to send an EAP authentication failure message to the terminal device in response to the EAP credential configuration completion message, wherein the EAP authentication failure message indicates that the terminal device access authentication has failed.

[0094] In a fifth aspect, a terminal device is provided, the terminal device comprising a processor and a memory, the memory being used to store a computer program for executing the authentication credential configuration method provided in the first aspect. The processor is configured to execute the computer program stored in the memory to implement the steps of the authentication credential configuration method described in the first aspect.

[0095] Optionally, the terminal device may further include a communication bus, and the communication bus is used to establish a connection between the processor and the memory.

[0096] In a sixth aspect, an authentication device is provided, the authentication device comprising a processor and a memory, the memory being used to store a computer program for executing the authentication credential configuration method provided in the second aspect. The processor is configured to execute the computer program stored in the memory to implement the steps of the authentication credential configuration method described in the second aspect.

[0097] Optionally, the authentication device may further include a communication bus, and the communication bus is used to establish a connection between the processor and the memory.

[0098] In a seventh aspect, a computer-readable storage medium is provided, wherein a computer program is stored in the storage medium. When the computer program is executed on a terminal device, the terminal device executes the steps of the authentication credential configuration method described in the first aspect above.

[0099] In an eighth aspect, a computer-readable storage medium is provided, wherein the storage medium stores a computer program, and when the computer program runs on an authentication device, the authentication device executes the steps of the authentication credential configuration method described in the second aspect above.

[0100] In a ninth aspect, an authentication credential configuration system is provided, the system comprising the terminal device provided in the fifth aspect and the authentication device provided in the sixth aspect.

[0101] In a tenth aspect, a computer program product is provided, which includes a computer program. When the computer program is executed on a terminal device, the terminal device executes the steps of the authentication credential configuration method described in the first aspect.

[0102] In an eleventh aspect, a computer program product is provided, which includes a computer program. When the computer program is run on an authentication device, the authentication device executes the steps of the authentication credential configuration method described in the second aspect.

[0103] The technical effects obtained in the above-mentioned third to eleventh aspects are similar to the technical effects obtained by the corresponding technical means in the first and second aspects, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0104] Figure 1 It is a schematic diagram of an implementation environment provided by an embodiment of the present application;

[0105] Figure 2 is a schematic diagram of another implementation environment provided by an embodiment of the present application;

[0106] Figure 3 is a flow chart of an authentication credential configuration method provided in an embodiment of the present application;

[0107] Figure 4 is a flow chart of another authentication credential configuration method provided in an embodiment of the present application;

[0108] Figure 5 It is a flowchart of another authentication credential configuration method provided in an embodiment of the present application;

[0109] Figure 6 is a flow chart of an authentication credential updating method provided in an embodiment of the present application;

[0110] Figure 7 It is a flow chart of an authentication credential verification method provided by an embodiment of the present application;

[0111] Figure 8 This is a flow chart of an authentication server verifying terminal authentication credentials provided by an embodiment of the present application;

[0112] Fig. 9 This is a flow chart of an access gateway verifying terminal authentication credentials provided by an embodiment of the present application;

[0113] Fig.10 This is another flow chart of an access gateway verifying terminal authentication credentials provided by an embodiment of the present application;

[0114] Fig.11 It is a structural diagram of an authentication credential configuration device provided in an embodiment of the present application;

[0115] Fig.12 It is a structural diagram of another authentication credential configuration device provided in an embodiment of the present application;

[0116] Fig.13 It is a structural diagram of a terminal device provided in an embodiment of the present application;

[0117] Fig.14 It is a schematic diagram of the structure of an access gateway provided in an embodiment of the present application;

[0118] Fig.15 It is a structural diagram of an authentication server provided in an embodiment of the present application. DETAILED DESCRIPTION

[0119] In order to make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the implementation methods of the present application will be further described in detail below in conjunction with the accompanying drawings.

[0120] For ease of understanding, before explaining in detail the authentication credential configuration method provided in the embodiment of the present application, the nouns, application scenarios and implementation environments involved in the embodiment of the present application are first introduced.

[0121] First, the terms involved in the embodiments of the present application are explained.

[0122] 1. 802.1X protocol

[0123] The 802.1X protocol is one of the local area network (LAN) standards developed by the 802 Committee of the Institute of Electrical and Electronics Engineers (IEEE). It is a user authentication technology used in LAN switches and wireless LAN access points.

[0124] As a network access control protocol, the 802.1X protocol provides an authentication framework for controlling the access rights of users or devices in a local area network or a wireless local area network. Specifically, the 802.1X protocol is a technology that uses switches and access points to authenticate users before they access network resources. Ordinary switches can use the local area network by connecting cables to ports, but switches that support the 802.1X protocol cannot directly use the local area network after connecting cables. Only after the connected user or device is authenticated and confirmed to be a legitimate user can the local area network be used. Through access authentication, the switch can pass or block messages sent by the user. Among them, the access points in wireless LANs also use this working principle.

[0125] The authentication framework of the 802.1X protocol consists of three parts: terminal device (i.e., 802.1X Supplicant), authentication system (i.e., 802.1X Authenticator), and authentication server (i.e., 802.1X Authentication server). Among them, the terminal device is installed with software that supports the 802.1X protocol. The user can start this software in the terminal device to initiate the access authentication process through the authentication framework of the 802.1X protocol. The authentication system is also called the network access system (NAS), which is usually some access gateways that support the 802.1X protocol. In the case of access authentication through the authentication framework of the 802.1X protocol, each physical port on the access gateway used for client (i.e., the applicant's terminal device) access corresponds to two logical ports: uncontrolled port (Uncontrolled Port) and controlled port (Controlled Port). The uncontrolled port is always in a two-way connected state, mainly used to transmit 802.1X protocol frames, ensuring that the terminal device can always send or receive authentication messages. The controlled port is only opened when the terminal device passes the access authentication, and is used to transmit service frames. To adapt to different application environments, the controlled port can be configured as unidirectional control or bidirectional control. In bidirectional control, the sending and receiving of frames are prohibited; in unidirectional control, the access gateway is prohibited from receiving 802.1X protocol frames from the terminal device, but the access gateway is allowed to send 802.1X protocol frames to the terminal device.

[0126] In some embodiments, the access gateway may be a wireless network access point (AP) device or a switch; the authentication server may be a Remote Authentication Dial In User Service (RADIUS) server or a Diameter server.

[0127] Among them, RADIUS is an AAA protocol defined by RFC3579; Diameter is an AAA protocol defined by RFC6733 and improved from RADIUS. The full name of RFC is Request For Comments, which is a series of Internet communication protocol files arranged by numbers. AAA protocol is the abbreviation of Authentication, Authorization and Accounting. It is a security management mechanism for access control in network security, providing three security services: authentication, authorization and accounting.

[0128] Access authentication is performed through the 802.1X protocol authentication framework, which has the following features:

[0129] (1) When access authentication is not completed or fails, the access port of the access gateway only allows the transmission of 802.1X protocol frames. In other words, the access port of the access gateway only allows the 802.1X protocol frames sent by the terminal device to pass through, and other protocol frames sent by the terminal device cannot pass through.

[0130] (2) The IP address of the authentication server must be configured on the access gateway to achieve IP routable reachability. When the access gateway receives the 802.1X protocol frame sent by the terminal device, it re-encapsulates the 802.1X protocol frame using the authentication protocol supported by the authentication server (for example, RADIUS protocol, Diameter protocol), and sends the re-encapsulated protocol frame to the authentication server for access authentication.

[0131] (3) After the access authentication succeeds, the authentication server sends an access authentication success message to the terminal device to end the access authentication session. When the access gateway receives the access authentication success message sent by the authentication server, it opens the access port corresponding to the terminal device and allows all data frames of the terminal device to pass.

[0132] Afterwards, the authentication server configures network parameters such as IP address and domain name system (DNS) for the terminal device through the dynamic host configuration protocol (DHCP) server. The network controller in the network to which the terminal device is connected can communicate with the terminal device based on the IP address of the terminal device.

[0133] (4) If the access authentication fails, the authentication server will send an access authentication failure message to the terminal device to end the access authentication session.

[0134] (5) The 802.1X protocol defines the underlying transmission module of the extensible authentication protocol (EAP), such as the PACP interface (full name: packet capture, which is an application program interface for capturing network traffic) of terminal devices and the PACP interface of access gateways.

[0135] It should be noted that the 802.1X protocol only provides a basic framework for link access authentication (i.e., access authentication at the link layer). The specific authentication method is provided by EAP. More precisely, the specific terminal authentication method is provided by a specific EAP authentication method. Therefore, in actual applications, different terminal authentication methods can be selected to perform access authentication on terminal devices according to specific network access scenarios and access requirements.

[0136] 2. EAP

[0137] EAP is an extensible authentication framework defined in RFC3748, and usually runs directly on the data link layer, such as Point to Point Protocol (PPP) (RFC1661), IEEE-802.3 LAN or IEEE-802.11 wireless LAN, without the need to configure IP addresses in advance.

[0138] The EAP networking model and access authentication process have the following characteristics:

[0139] (1) EAP divides device roles into three categories: Peer (the terminal device that initiates the EAP access authentication request), Authenticator (the access gateway that first receives the EAP access authentication request), and Authentication Server (the authentication server that performs access authentication on the Peer).

[0140] Although the terms used in the EAP and 802.1X authentication frameworks to define device roles are different, there is a simple correspondence between the two: the peer in the EAP authentication framework is equivalent to the client supplicant in the 802.1X authentication framework, the authenticator in the EAP authentication framework is equivalent to the authenticator in the 802.1X authentication framework, and the authentication server in the EAP authentication framework is equivalent to the authentication server in the 802.1X authentication framework of the protocol. The operations performed by these devices during the access authentication process are also similar.

[0141] In some embodiments, the access gateway may also be integrated with the function of an authentication server, so that access authentication of the terminal device is performed through the access gateway without interacting with the authentication server.

[0142] (2) The EAP authentication framework itself does not define an addressing mechanism, and relies on the underlying protocol to transmit EAP messages during the access authentication process. For example, 802.1X defines a method for transmitting EAP messages in Ethernet (IEEE-802.3) and Wi-Fi (IEEE-802.11) networks: EAP over LAN (EAPOL); the draft document (draft-ietf-ace-wg-coap-eap-08) in RFC7252 defines the use of a constrained application protocol (CoAP) to transmit EAP messages (abbreviated as CoAP-EAP).

[0143] (3) Currently, EAPOL is the most common link layer authentication method. That is, before a terminal device accesses the network (allocating IP addresses, configuring DNS parameters, negotiating data transmission encryption / decryption keys, granting network access rights, etc.), it must pass the 802.1X protocol authentication framework for access authentication. Among them, the 802.1X protocol mainly provides the operating environment of EAP, and the actual access authentication process is implemented by EAP.

[0144] (4) From the perspective of EAP message encapsulation, because the terminal device and the access gateway are directly connected (on-line), the EAP format messages transmitted between the terminal device and the access gateway are usually encapsulated using the link layer protocol, such as EAPOL, EAP over PPP (RFC1661). However, between the access gateway and the authentication server, it is necessary to use authentication protocols such as RADIUS (RFC3579) or Diameter (RFC6733) to re-encapsulate the EAP format messages, and transmit the EAP format messages encapsulated by the RADIUS or Diameter protocol through mechanisms such as secure tunnels.

[0145] (5) The highlight of the EAP authentication framework is the extensibility of the authentication method. That is, in the EAP authentication framework, the EAP authentication method (called EAP method) used by the terminal device for access authentication can be arbitrarily expanded as needed. Currently, a large number of EAP authentication methods have been standardized, and up to 30 different EAP authentication methods can be defined.

[0146] In addition, RFC3748 Section 2.3 defines the pass-through behavior under the EAP authentication framework, which is an important extensible mechanism of the EAP authentication framework. In other words, in the EAP authentication architecture, if the access gateway receives a message of an EAP authentication method that it does not support, that is, when its own EAP authentication method is default, it directly forwards the access authentication request message sent by the terminal device to the back-end authentication server, and the authentication server negotiates the terminal authentication method with the terminal device.

[0147] Based on the transparent transmission mode under the EAP authentication framework, when expanding a new EAP authentication method, it is only necessary to modify the EAP authentication method supported by the terminal device and the authentication server under the EAP authentication architecture, without modifying the access gateway itself.

[0148] 3. Access authentication method for terminal equipment based on wireless fidelity (Wi-Fi) technology

[0149] Wi-Fi is the trademark name of the Wi-Fi Alliance. The Wi-Fi Alliance has proposed a series of certification programs for products that comply with the technical specifications of the 802.11 protocol. If a product passes the relevant certification of the Wi-Fi Alliance, the Wi-Fi label can be affixed to the product for sale.

[0150] Wi-Fi protected access (WPA) is the mainstream access authentication scheme of the Wi-Fi Alliance for 802.11 STA (STA is the abbreviation of Station, referring to Wi-Fi terminal), including three versions: WPA, second-generation Wi-Fi protected access 2 (WPA2), and third-generation Wi-Fi protected access 3 (WPA3). All three provide two modes: personal mode (i.e., Personal mode, suitable for small and medium-sized enterprises or home users) and enterprise mode (i.e., Enterprise mode, suitable for medium and large enterprises).

[0151] Among them, the enterprise mode of WPA, WPA2, and WPA3 uses the 802.1X / EAP authentication framework as the access authentication scheme for Wi-Fi terminals. In this scheme, the X.509v3 certificate (RFC5280) is the most widely used terminal authentication credential, and the corresponding EAP authentication method is EAP-TLS1.2 (RFC5216) or EAP-TLS1.3 (RFC9190).

[0152] The personal modes of WPA, WPA2, and WPA3 do not use the 802.1X / EAP authentication framework, nor do they use X.509v3 certificates as authentication credentials. Instead, they use pre-shared keys (PSK) or passwords as terminal authentication credentials.

[0153] 4. Access authentication method for terminal equipment based on Ethernet technology

[0154] The 802.1X authentication framework is also applicable to Ethernet links. Similarly, EAP-TLS is the most widely used access authentication method for Ethernet terminals.

[0155] Although the Internet Engineering Task Force (IETF) also defines PSK authentication methods applicable to Ethernet terminals, for example, EAP-PSK (RFC4764), EAP-GPSK (RFC5433), EAP-pwd (RFC5931), etc.

[0156] 5. Safe channel establishment plan

[0157] If you want to transmit confidential information online, you need to encrypt the information you are transmitting. The separation of encryption algorithms and encryption keys is a basic requirement of cryptography. Encryption algorithms can be made public, but encryption keys must remain private.

[0158] Therefore, the key to confidential information transmission is to reach a consensus between the sender and the receiver on the encryption key to be used. This process is called key exchange or key agreement. Once the key agreement is completed, it can be considered that a secure transmission channel for confidential information has been established between the sender and the receiver.

[0159] Among them, the DH (Diffie-Hellman) algorithm (RFC2631) is a classic key generation algorithm used to exchange random numbers between the terminal device and the authentication device to generate the encryption key used when transmitting messages. The DH algorithm is also used in the TLS access authentication method to negotiate a symmetric encryption key between the terminal device to be connected to the network and the authentication server.

[0160] In one possible implementation, the implementation process of the sender and the receiver using the DH algorithm to negotiate the encryption key is as follows: the sender locally assigns a random number as the sender random number, and sends the sender random number to the receiver. The receiver generates a random number as the receiver random number, and then executes the DH algorithm based on the sender random number and the receiver random number to calculate the symmetric key. Similarly, the receiver sends the receiver random number to the sender, and the sender executes the DH algorithm based on the sender random number and the receiver random number to calculate the symmetric key. Afterwards, the sender and the receiver perform data secure transmission based on the negotiated symmetric key.

[0161] In this key negotiation method, the encryption key used by the sender and the receiver to encrypt data is the same. For either the sender or the receiver, the encryption key and decryption key are also the same. Therefore, the data encryption transmission method is symmetric encryption.

[0162] In addition to the DH algorithm, elliptic curve Diffie-Hellman (ECDH) is also a key generation algorithm based on public key cryptography. Because ECDH has lower resource overhead, it has been increasingly used, especially in the field of Internet of Things (IoT).

[0163] In a possible implementation, the implementation process of the sender and the receiver using the ECDH algorithm to negotiate the encryption key is as follows: the sender locally allocates a sender key pair based on elliptic curve cryptography (ECC) (including the sender public key and the sender private key), and sends the sender public key to the receiver. The receiver also allocates a receiver key pair based on elliptic curve cryptography (including the receiver public key and the receiver private key), and executes the ECDH algorithm based on the sender public key and the receiver private key to calculate the symmetric key. Similarly, the receiver sends the receiver public key to the sender, and the sender executes the ECDH algorithm based on the receiver public key and the sender private key to calculate the symmetric key.

[0164] Compared with the DH algorithm, the ECDH algorithm exchanges an ECC-based public key (i.e., public key) instead of a random number between the sender and the receiver.

[0165] In addition, asymmetric encryption is also supported for cryptographic algorithms that exchange public keys, such as the RSA algorithm (an asymmetric encryption algorithm named after the initials of the three proposers), the ECC algorithm, etc. For example, the elliptic curve integrated encryption scheme (ECIES) is an asymmetric encryption scheme for the ECC algorithm.

[0166] In a possible implementation, the implementation process of the sender and the receiver using the ECIES algorithm to negotiate the encryption key is as follows: the receiver allocates an ECC-based receiver key pair (including the receiver public key and the receiver private key), and sends the receiver public key to the sender. The sender allocates an ECC-based sender key pair (including the sender public key and the sender private key) for each message to be sent, and then uses the receiver public key and the sender private key to calculate the symmetric key through the ECDH algorithm, and then uses the symmetric key to encrypt and send the corresponding message, wherein the message also carries the sender public key encapsulated in plain text. After receiving the message, the receiver first parses the sender public key from it, and then calculates the symmetric key through the ECDH algorithm based on the sender public key and the receiver private key, and then uses the symmetric key to decrypt the message to be sent.

[0167] It can be seen that the ECIES algorithm relies on the ECDH algorithm at the bottom layer, and ECIES can be considered as another implementation form of ECDH. The main difference is that ECDH is symmetric (bidirectional), and the symmetric key used for all messages in the session is negotiated at one time. ECIES is asymmetric (unidirectional), and each data message needs to recalculate the symmetric key, that is, the sender needs to allocate a new sender key pair when sending each message. Therefore, ECIES has higher security, but the corresponding overhead is also greater.

[0168] When using ECIES asymmetric encryption, if the receiver needs to send a response message to the sender, there are two implementation options:

[0169] Implementation solution 1: Continue to use the ECIES algorithm to send a response message to the sender.

[0170] That is, the receiving end can calculate a symmetric key using the ECDH algorithm based on the sending end public key and the receiving end private key, and then use the symmetric key to encrypt the response message.

[0171] Implementation 2: Before sending a message to the receiver, the sender first allocates a random number (assuming it is called a symmetric key), and encapsulates the random number in the message and encrypts it before sending it to the receiver. When the receiver sends a response message, it can use the decrypted random number (symmetric key) as the encryption key to symmetrically encrypt the response message.

[0172] That is, the receiving end can calculate the symmetric key through the ECDH algorithm based on the public key and the private key of the sending end, and then use the symmetric key to decrypt the message sent by the sending end. However, when encrypting the response message, the receiving end can use the random number sent by the sending end to asymmetrically encrypt the response message instead of using the symmetric key for symmetric encryption.

[0173] It should be noted that the above DH algorithm, ECDH algorithm, ECIES algorithm, etc. only solve the problem of negotiating encryption keys between two devices, and cannot solve the problem of access authentication when the terminal device accesses the network. In other words, for a specified device, any other device can negotiate keys with it, thereby establishing a secure channel between the two. Therefore, the DH algorithm, ECDH algorithm, and ECIES algorithm are usually not used alone, but must be used in combination with an access authentication method (for example, certificates, PSK, etc.).

[0174] For example, TLS (RFC5246 / RFC8446) first uses 802.1X certificates or PSK to authenticate between the terminal device and the authentication server, and then negotiates the encryption key used for transmitting messages through the key generation algorithms such as the above-mentioned DH algorithm, ECDH algorithm, and ECIES algorithm. Of course, in order to improve operational performance, the encryption key can also be negotiated first, and then the identity authentication can be performed. If the authentication fails, the negotiated key can be simply discarded.

[0175] Secondly, the application scenarios involved in the embodiments of the present application are introduced.

[0176] When a terminal device accesses the network, the 802.1X / EAP authentication framework needs to be used between the terminal device and the authentication server, and two-way identity authentication is performed through TLS certificates or PSK. After completing the identity authentication, the terminal device can access the network.

[0177] For the access authentication methods of Wi-Fi terminal devices and Ethernet terminal devices, at the standard / specification level, only the authentication interaction process is defined, but no solution is defined for how to configure terminal authentication credentials for the terminal devices.

[0178] Taking Wi-Fi terminal devices as an example, if certificate authentication is used, it is necessary to pre-deploy a certificate authorized and issued by a certification body, namely a CA (certificate authority) certificate, and a device certificate of the Wi-Fi terminal device (used to uniquely identify the terminal identity of the Wi-Fi terminal device) on the Wi-Fi terminal device.

[0179] The access authentication process is as follows: the access gateway uses an EAP request message or an EAP-TLS certificate request message to send the server certificate of the authentication server (used to uniquely identify the server identity of the authentication server) to the Wi-Fi terminal device, and the Wi-Fi terminal device uses the pre-deployed CA certificate to verify the server certificate, thereby authenticating the authentication server. Similarly, the Wi-Fi terminal device uses an EAP response message or an EAP-TLS certificate response message to send the device certificate to the authentication server through the access gateway, and the authentication server uses the locally pre-deployed CA certificate to verify the device certificate, thereby authenticating the Wi-Fi terminal device. In this way, two-way authentication is achieved by sending EAP formatted messages to each other at the link layer.

[0180] If PSK is used for authentication, the simultaneous authentication of equals (SAE) of WPA-PSK, WPA2-PSK, and WPA3 all explicitly require that a shared PSK (or Password) must be configured on the terminal device and access gateway before access.

[0181] That is, the 802.1X / EAP authentication framework only defines a two-way authentication process, but does not define a method for deploying terminal authentication credentials (CA certificate and device certificate) in terminal devices.

[0182] Based on this, an embodiment of the present application provides an authentication credential configuration method, that is, based on the 802.1X / EAP authentication framework and the scalability of the EAP authentication method, a new EAP authentication method is extended, namely, the authentication credential configuration method. When the terminal authentication method negotiated by the terminal device and the authentication server is the authentication credential configuration method, the authentication server reuses the access authentication channel of the 802.1X / EAP authentication framework and transmits the terminal authentication credentials configured for the terminal device online.

[0183] The authentication credential configuration method provided in the embodiment of the present application is applicable to the access authentication scenario of the 802.1X protocol or the EAP protocol, and is used as a pre-operation for the Wi-Fi terminal device and the Ethernet terminal device to perform access authentication. The terminal authentication credentials are dynamically configured for the Wi-Fi terminal device and the Ethernet terminal device, so that the Wi-Fi terminal device and the Ethernet terminal device can download the terminal authentication credentials online.

[0184] Finally, the implementation environment involved in the embodiments of the present application is introduced.

[0185] Please refer to Figure 1 , Figure 1 Schematic diagram of an implementation environment provided by an embodiment of the present application. The authentication credential configuration system provided by an embodiment of the present application includes a terminal device 10 to be connected to a network and an authentication device 20 for controlling device access in the network. The terminal device 10 can be connected to the authentication device 20 for communication, and the communication connection can be a wired connection or a wireless connection, which is not limited by the embodiment of the present application.

[0186] After completing the wiring deployment, the terminal device 10 can send an EAP identity authentication message to the authentication device 20 on the link layer based on the 802.1X / EAP authentication framework, and carry the identity of the terminal device 10 in the EAP authentication message. After receiving the EAP identity authentication message sent by the terminal device 10, the authentication device 20 verifies whether the terminal device 10 is a legally deployed device based on the identity of the terminal device. In the case of determining that the terminal device 10 is a legally deployed device, the terminal authentication method of the terminal device 10 is determined, and an EAP identity response message is sent to the terminal device 10, and the EAP identity response message carries the method identifier of the terminal authentication method. After receiving the EAP identity response message sent by the authentication device 20, the terminal device 10 determines whether the terminal authentication method is an authentication credential configuration method according to the method identifier carried in the EAP identity response message. In the case of determining that the terminal authentication method is an authentication credential configuration method based on the method identifier, a first EAP credential request message is sent to the authentication device 20 to request the authentication device 20 to configure the terminal authentication credential required for the terminal device 10 to perform access authentication when accessing the network later. After receiving the first EAP credential request message sent by the terminal device 10 , the authentication device 20 sends a first EAP credential response message to the terminal device 10 , and carries the first terminal authentication credential configured for the terminal device 10 in the first EAP credential response message.

[0187] That is, based on the scalability of the EAP authentication method, the embodiment of the present application adds a new EAP authentication method, namely, the authentication credential configuration method, to the terminal authentication method supported by the terminal device and the authentication device for negotiation. Therefore, when the terminal device and the authentication device perform access authentication based on the 802.1X / EAP authentication framework, they can negotiate that the terminal authentication method is the authentication credential configuration method, and then transmit the terminal authentication credential online. In other words, the embodiment of the present application reuses the join authentication channel of the 802.1X / EAP authentication framework to transmit the terminal authentication credential dynamically configured for the terminal device online.

[0188] It should be noted that Figure 1 The example in which the terminal device to be connected to the network is a desktop computer, the number of terminal devices is one, and the authentication device is a server is taken as an example. In actual applications, the terminal device can also be other electronic products, and the number is multiple; at the same time, the authentication device can also be an access gateway, router and other devices, and the embodiments of the present application do not limit this.

[0189] In addition, the network that the terminal device requests to access may be the Internet or the Internet of Things, and the embodiments of the present application do not limit this. Correspondingly, the authentication device may also be a controller in the network that requests access, such as an Internet access controller, an Internet of Things controller, etc., and the embodiments of the present application do not limit this.

[0190] In some embodiments, based on the above 802.1X / EAP authentication framework, reference Figure 2 The authentication device 20 includes an access gateway 201 and an authentication server 202. The messages transmitted between the terminal device 10 and the access gateway 201 are messages in the EAP format encapsulated by the link layer protocol. The messages transmitted between the access gateway 201 and the authentication server 202 are messages in the EAP format encapsulated by the authentication protocol, wherein the authentication protocol is a communication protocol supported by the authentication server 202 under the EAP protocol.

[0191] As an example, the authentication server may be an AAA server such as a RADIUS server or a Diameter server, and the authentication protocol may be a RADIUS protocol, a Diameter protocol, etc., which is not limited in the embodiments of the present application.

[0192] After the terminal device 10 completes the wiring deployment, the 802.1X / EAP authentication framework sends an EAP identity authentication message to the access gateway 201 at the link layer, and carries the identity of the terminal device 10 in the EAP authentication message. After receiving the EAP identity authentication message sent by the terminal device 10, the access gateway 201 adopts the transparent transmission mode to forward the EAP identity authentication message to the authentication server 202. The authentication server 202 verifies whether the terminal device 10 is a legally deployed device based on the identity of the terminal device. In the case that it is determined that the terminal device 10 is a legally deployed device, the terminal authentication method of the terminal device 10 is determined, and an EAP identity response message is sent to the terminal device 10 through the access gateway 201. The EAP identity response message carries the method identifier of the terminal authentication method. After receiving the EAP identity response message sent by the access gateway 201, the terminal device 10 determines whether the terminal authentication method is the authentication credential configuration method according to the method identifier carried in the EAP identity response message. In the case where the terminal authentication method is determined to be the authentication credential configuration method based on the method identifier, a first EAP credential request message is sent to the access gateway 201 to request the configuration of the terminal authentication credential required for the subsequent access authentication of the terminal device 10 when accessing the network. After receiving the first EAP credential request message sent by the terminal device 10, the access gateway 201 adopts the transparent transmission mode to forward the first EAP credential request message to the authentication server 202, requesting the authentication server 202 to configure the terminal authentication credential for the terminal device. In response to the first EAP credential request message forwarded by the access gateway, the authentication server 202 sends a first EAP credential response message to the terminal device 10 through the access gateway 201, and carries the first terminal authentication credential configured for the terminal device 10 in the first EAP credential response message.

[0193] In this implementation, the access gateway acts as a message agent, transferring messages between the terminal device and the authentication server, and does not participate in the process of negotiating the terminal authentication method. That is, the terminal device and the authentication server negotiate the terminal authentication method through messages in the interactive EAP format. When both parties determine that the terminal authentication method is the authentication credential configuration method, the authentication server transmits the first terminal authentication credential dynamically issued to the terminal device online.

[0194] It should be noted that Figure 2 The example in which the terminal device to be connected to the network is a mobile phone and the number of the terminal devices is two is taken as an example. In actual applications, the terminal devices may also be other electronic products, and the number may be more or less, and the embodiments of the present application do not impose any limitation on this.

[0195] In some embodiments, the authentication server 202 can be deployed independently or integrated in the access gateway 201. When the authentication server 202 is integrated in the access gateway 201, the authentication device 20 is a device that directly communicates with the terminal device 10, and the messages transmitted between the terminal device 10 and the authentication device 20 are messages in the EAP format encapsulated by the link layer protocol.

[0196] In some embodiments, the terminal device may be any electronic product that can interact with a user through one or more methods such as a keyboard, a touchpad, a touch screen, a remote control, voice interaction or a handwriting device, such as a personal computer (PC), a mobile phone, a smart phone, a personal digital assistant (PDA), a wearable device, a handheld computer, a tablet computer, a smart car machine, a smart TV, a smart speaker, a sensor, etc. The access gateway may be a switch, a router, a wireless access point, etc. The authentication server may be an independent server, or a server cluster or a distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms, or a cloud computing service center.

[0197] Those skilled in the art should understand that the above-mentioned terminal devices, access gateways, and authentication servers are only examples, and other existing or future terminal devices, access gateways, or servers that are applicable to the embodiments of the present application should also be included in the protection scope of the embodiments of the present application and are included here by reference.

[0198] It should be noted that the application scenarios and implementation environments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. A person of ordinary skill in the art can appreciate that, with the evolution of the implementation environment, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0199] Next, the authentication credential configuration method provided in the embodiment of the present application is explained in detail.

[0200] See also Figure 3 , Figure 3This is a flow chart of an authentication credential configuration method provided by an embodiment of the present application, in which a first terminal authentication credential is dynamically configured for a terminal device through interaction between a terminal device to be connected to a network and an authentication device in the network. The method includes the following steps.

[0201] Step 301: The terminal device sends an EAP identity authentication message to an authentication device. The EAP identity authentication message carries the identity of the terminal device.

[0202] After the terminal equipment is wired and installed at the actual installation site, the terminal equipment must first be authenticated before it can access the network and use network resources. However, the terminal equipment after wiring and installation has not yet been configured with terminal authentication credentials, and access authentication cannot be performed based on the terminal authentication credentials. At the same time, since the terminal equipment has not yet completed access authentication, the corresponding IP address and route are not configured for it.

[0203] Based on this, the terminal device can request the authentication device to configure the terminal authentication credentials for it based on the access authentication path of the 802.1X / EAP authentication framework. After the terminal device obtains the first terminal authentication credential, the terminal device can initiate access authentication to the authentication device based on the first terminal authentication credential to request access to the network controlled by the authentication device.

[0204] That is, after the terminal device completes the wiring installation, it can execute the above step 301 to send an EAP identity authentication message to the authentication device. The identity of the terminal device carried in the EAP identity authentication message is used to uniquely identify the identity of the terminal device, so that the authentication device can determine whether the terminal device is a legally deployed device based on the identity.

[0205] As an example, the identity identifier of the terminal device may be a terminal number, a terminal ID, a terminal identifier, a terminal address, etc., which is not limited in this embodiment of the present application.

[0206] In some embodiments, the authentication device includes an access gateway and an authentication server, and the authentication server can be deployed independently or integrated into the access gateway. Since the terminal device is directly connected to the access gateway, and the step of obtaining the authentication credential is not necessarily performed immediately after the terminal device is installed. Therefore, when the terminal device needs to obtain the terminal authentication credential, it can interact with the access gateway to ensure that both parties are in a normal working state and can transmit messages normally.

[0207] In a possible implementation, when the terminal device needs to obtain the terminal authentication credentials, it sends an EAP authentication start message to the access gateway. In response to receiving the EAP authentication start message from the connection port of the terminal device, the access gateway sends an EAP identity request message to the terminal device. After receiving the EAP identity request message sent by the access gateway, the terminal device starts to perform the operation of step 301 above and sends an EAP identity authentication message to the access gateway.

[0208] It should be noted that the above-mentioned EAP format messages are all messages encapsulated based on the Extensible Authentication Protocol over Local Area Networks (EAPOL), which can be transmitted on the link layer, do not rely on the protocols supported by the network layer, transport layer, application layer, etc., and can be transmitted without configuring IP addresses and communication routes.

[0209] Step 302: The authentication device receives the EAP identity authentication message sent by the terminal device, verifies that the terminal device is a legally deployed device based on the identity identifier of the terminal device, determines the terminal authentication method of the terminal device, and sends an EAP identity response message to the terminal device. The EAP identity response message carries the method identifier of the terminal authentication method.

[0210] In a possible implementation, in response to the EAP identity authentication message sent by the terminal device, the authentication device first verifies whether the terminal device is a legally deployed device based on the identity identifier of the terminal device carried in the EAP identity authentication message. If it is determined that the terminal device is a legally deployed device, the terminal authentication method used by the terminal device for subsequent access authentication is determined, and the method identifier of the determined terminal authentication method is sent to the terminal device through an EAP identity response message.

[0211] That is, for legally deployed terminal devices, the authentication device will dynamically issue terminal authentication credentials based on the access authentication path of the 802.1X / EAP authentication framework, and perform access authentication on the terminal devices according to the negotiated terminal authentication method.

[0212] When it is determined that the terminal device is not a legally deployed device, an EAP authentication failure message is sent to the terminal device, indicating that the terminal device access authentication has failed, and the access authentication process is terminated without executing the step of negotiating the terminal authentication method.

[0213] In some embodiments, based on the identity of the terminal device, verifying whether the terminal device is a legally deployed device includes the following two verification methods: manual verification and whitelist verification. Among them, the implementation process of manual verification is: the authentication device displays the identity of the terminal device to the network administrator, and the network administrator verifies whether the terminal device is a legally deployed device based on the identity of the terminal device within a specific time period. The implementation process of whitelist verification is: pre-build a terminal whitelist, and the terminal whitelist includes the identities of multiple legally deployed terminal devices. After receiving the EAP identity authentication message, the authentication device searches the terminal whitelist for the identity of the terminal device carried in the EAP identity authentication message. If the same identity is found, it is determined that the terminal device is a legally deployed device; if the same identity is not found, it is determined that the terminal device is not a legally deployed device.

[0214] Of course, other methods can also be used to verify whether the terminal device is a legally deployed device. For example, by judging whether the identity of the terminal device is in the terminal blacklist, it is determined whether the terminal device is a legally deployed device. The terminal blacklist includes multiple identities of illegally deployed terminal devices. When the identity of the terminal device is the same as any identity in the terminal blacklist, it is determined that the terminal device is not a legally deployed device; if the identity of the terminal device is different from all the identities in the terminal blacklist, it is determined that the terminal device is a legally deployed device. The embodiment of the present application does not limit the verification method.

[0215] In some embodiments, when the authentication device determines the terminal authentication method, since there are many EAP authentication methods, the authentication device can select an EAP authentication method from multiple EAP authentication methods supported by itself as the terminal authentication method based on a local selection policy. The embodiment of the present application does not limit the specific implementation method of selecting the terminal authentication method.

[0216] As an example, since the embodiment of the present application reuses the access authentication process to realize the dynamic issuance of terminal authentication credentials, when determining the terminal authentication method, the authentication device can determine the authentication credential configuration method as the terminal authentication method.

[0217] In other words, for the authentication device, the terminal authentication method determined by it may be the authentication credential configuration method, or may not be the authentication credential configuration method. The specific selection of the EAP authentication method as the terminal authentication method may be determined by negotiation between the authentication device and the terminal device.

[0218] Step 303: If the terminal device determines that the terminal authentication method is the authentication credential configuration method based on the method identifier, the terminal device sends a first EAP credential request message to the authentication device. The first EAP credential request message is used to request the authentication device to configure a terminal authentication credential for the terminal device, and the terminal authentication credential is used to perform access authentication on the terminal device when the terminal device accesses the network.

[0219] That is, if the terminal authentication method determined by the authentication device is the authentication credential configuration method, after receiving the EAP identity response message, the terminal device sends a first EAP credential request message to the authentication device to request the authentication device to issue a terminal authentication credential for it.

[0220] It should be understood that for different terminal devices, the corresponding terminal authentication credentials are different. Therefore, when applying for the terminal authentication credentials, the credential application parameters are also different, and the authentication device configures the corresponding terminal authentication credentials for the terminal device based on the credential application parameters provided by the terminal device. Therefore, the first EAP credential request message sent by the terminal device to the authentication device can carry the credential application parameters of the terminal authentication credentials applied by itself.

[0221] The credential application parameters include, but are not limited to, user name, media access control address (MAC), terminal serial number, etc., and the present application embodiment does not impose any restrictions on this.

[0222] In some embodiments, after receiving the EAP identity response message, if the terminal device determines based on the method identifier that the terminal authentication method is not the authentication credential configuration method, an EAP rejection response message may be sent to the authentication device, and the EAP rejection response message indicates that the terminal authentication method supported by the terminal device is the authentication credential configuration method. After receiving the EAP rejection response message, the authentication device modifies the terminal authentication method to the authentication credential configuration method, and sends an EAP credential configuration message to the terminal device in response to the EAP rejection response message. The terminal device receives the EAP credential configuration message sent by the authentication device, and confirms that the authentication device has modified the terminal authentication method to the authentication credential configuration method.

[0223] That is, when the terminal authentication method determined by the authentication device is not the authentication credential configuration method, the terminal can send the terminal authentication method supported by itself to the authentication device through an EAP rejection response message to negotiate the supported EAP authentication method with the authentication device, thereby determining the final terminal authentication method.

[0224] In some embodiments, to ensure the security of online transmission of the first terminal authentication credential, the terminal device and the authentication device need to establish a secure transmission channel to transmit the first EAP credential request message and the first EAP credential response message.

[0225] Based on this, before the terminal device sends the first EAP credential request message to the authentication device, the terminal device and the authentication device need to negotiate the key generation algorithm and encryption parameters for transmitting the first EAP credential request message and the first EAP credential response message to encrypt the transmitted messages.

[0226] It should be noted that when the key generation algorithm is known, the terminal device and the authentication device may also only exchange encryption parameters based on the key generation algorithm, and the embodiments of the present application do not impose any restrictions on this.

[0227] Among them, the negotiation of encryption key mainly involves the terminal device and the authentication device exchanging encryption parameters, and then using the key generation algorithm to calculate the key for encrypting and decrypting the message based on the exchanged encryption parameters.

[0228] In a possible implementation, the first EAP credential request message is encrypted and transmitted using a first key determined by a first key generation algorithm; and the first EAP credential response message is encrypted and transmitted using a second key determined by a second key generation algorithm.

[0229] The implementation process of exchanging encryption parameters between the terminal device and the authentication device may be: when it is determined that the terminal authentication method is the authentication credential configuration method, the terminal device sends an EAP key request message to the authentication device, and the EAP key request message carries the encryption parameters used to generate the first key. The authentication device receives the EAP key request message sent by the terminal device, and in response to the EAP key request message, sends an EAP key response message to the terminal device, and the EAP key response message carries the encryption parameters corresponding to the second key.

[0230] As an example, the first key generation algorithm and the second key generation algorithm may be the same or different; and the first key generation algorithm and the second key generation algorithm may be a DH algorithm, an ECDH algorithm, an RSA algorithm, etc., and the encryption parameters may be random numbers (the DH algorithm exchanges random numbers), public keys (ECDH algorithm and ECIES algorithm need to exchange public keys), etc. The embodiments of the present application do not impose any restrictions on this.

[0231] By exchanging encryption parameters, the terminal device and the authentication device can determine the encryption parameters used by the other party when encrypting messages, and thus determine the key for decrypting messages based on the encryption parameters. When the terminal device sends data to the authentication device, the terminal device can determine the first key through a first key generation algorithm based on the private key of the terminal device and the encryption parameters sent by the authentication device, and use the first key to encrypt the transmitted data. When the authentication device sends data to the terminal device, the authentication device can determine the second key through a second key generation algorithm based on the private key of the authentication device and the encryption parameters sent by the terminal device, and use the second key to encrypt the transmitted data.

[0232] In this way, key generation algorithms such as the DH algorithm, ECDH algorithm, RSA algorithm, or algorithms that include key negotiation and encryption mechanisms such as the ECIES algorithm are used to generate encryption keys that can be used when transmitting messages, thereby ensuring the secure transmission of the first terminal authentication credentials, avoiding dependence on general secure transmission protocols (HTTP, TLS and other protocols) outside the 802.1X / EAP authentication framework, reducing the implementation complexity of the terminal device, and reducing the resource overhead of the terminal device in the process of obtaining the terminal authentication credentials.

[0233] In some embodiments, when the terminal device and the authentication device negotiate to determine that the terminal authentication method is the authentication credential configuration method, the authentication device can send an EAP credential configuration start message to the terminal device. After receiving the EAP credential configuration start message, the terminal device performs the above step of sending the first EAP credential request message to the authentication device.

[0234] That is, no matter whether the authentication device directly determines that the terminal authentication method is the authentication credential configuration method in response to the EAP identity authentication message, or the authentication device modifies the terminal authentication method to the authentication credential configuration method in response to the EAP rejection response message, when the terminal authentication method is finally negotiated to be the authentication credential configuration method, the authentication device sends an EAP credential configuration start message to the terminal device to indicate that the terminal authentication method negotiation is completed, and the access authentication process can be executed based on the negotiated terminal authentication method.

[0235] Step 304: the authentication device receives the first EAP credential request message sent by the terminal device, and sends a first EAP credential response message to the terminal device, where the first EAP credential response message carries the first terminal authentication credential configured for the terminal device.

[0236] The first terminal authentication credential may be a certificate or a PSK, and the embodiment of the present application does not limit the type of the terminal authentication credential.

[0237] As described above, the first EAP credential response message is a message encrypted by the authentication device using the second key determined by the second key generation algorithm. After receiving the first EAP credential response message, the terminal device can use the encryption parameters corresponding to the second key and its own private key to decrypt the first EAP credential response message, thereby obtaining the first terminal authentication credential.

[0238] In some embodiments, after parsing and obtaining the first terminal authentication credential, the terminal device may send an EAP credential configuration completion message to the authentication device. After receiving the EAP credential configuration completion message, the authentication device sends an EAP authentication failure message to the terminal device, indicating that the terminal device access authentication failed.

[0239] It should be noted that since the authentication credential configuration method is not an EAP authentication method in the general sense, its function is to request the configuration of the terminal authentication credential, rather than to execute the access authentication process based on the terminal authentication credential. Therefore, regardless of whether the operation of configuring the terminal authentication credential is successful, the authentication device can only send an EAP authentication failure message. If an EAP authentication success message is sent, it will be mistakenly believed that the terminal device has successfully accessed and authenticated, but in fact the terminal device has not yet started to execute the access authentication process, and naturally has not used the terminal authentication credential to initiate an access authentication request to the authentication device.

[0240] In the embodiment of the present application, based on the 802.1X / EAP authentication framework and the scalability of the EAP authentication method, a new EAP authentication method, namely the authentication credential configuration method, is extended. When the terminal device and the authentication device negotiate and determine that the terminal authentication method is the authentication credential configuration method through the message in the EAP format transmitted by the link layer, the authentication device can dynamically configure the terminal authentication credential for the terminal device online. It can be seen that the embodiment of the present application reuses the access authentication channel under the 802.1X / EAP co-authentication framework to dynamically configure the terminal authentication credential for the terminal device. This process does not require the pre-configuration of a temporary IP address for the terminal device, avoids dependence on the IP address and IP routing, reduces the resource overhead of the terminal device, and realizes true plug-and-play of the terminal device.

[0241] In the above-mentioned Figure 3 Based on the authentication credential configuration method shown in FIG, the present application embodiment also provides an authentication credential configuration method. Figure 4 In this embodiment of the application, the authentication device includes an access gateway and an authentication server, and the key generation algorithm is the ECIES algorithm, the encryption parameter of the first key is the terminal public key of the terminal device, and the encryption parameter of the second key is the server public key of the authentication server as an example to illustrate the implementation process of configuring the terminal authentication credential. In this embodiment, the terminal device reuses the access authentication channel under the 802.1X / EAP authentication framework. Figure 4 The implementation process of configuring terminal authentication credentials shown may include the following steps.

[0242] Step 401: The terminal device sends an EAP authentication start message to the access gateway.

[0243] That is, after the terminal device completes the connection with the access gateway, if the terminal authentication credentials are not configured in the terminal device, the terminal device can send an EAP authentication start message to the access gateway to request the authentication server to configure the terminal authentication credentials for the terminal device using the method provided in the embodiment of the present application.

[0244] Step 402: The access gateway receives the EAP authentication start message sent by the terminal device, and sends an EAP identity request message to the terminal device.

[0245] The EAP identity request message is used to instruct the terminal device to provide an identity identifier for verification to determine whether the terminal device is a legally deployed device.

[0246] Step 403: The terminal device receives the EAP identity request message sent by the access gateway, and sends an EAP identity authentication message to the access gateway. The EAP identity authentication message carries the identity of the terminal device.

[0247] Step 404: The access gateway receives the EAP identity authentication message sent by the terminal device, and uses the transparent transmission mode to send the EAP identity authentication message to the authentication server.

[0248] Step 405: The authentication server receives the EAP identity authentication message, and verifies whether the terminal device is a legally deployed device based on the identity identifier of the terminal device; if the terminal device is a legally deployed device, a terminal authentication method for the terminal device is determined.

[0249] Among them, identity verification can be carried out by manual verification and whitelist verification, etc., and the embodiments of the present application do not limit this.

[0250] It should be noted that the terminal authentication method initially selected by the authentication server may be the authentication credential configuration method, or it may not be the authentication credential configuration method. In this case, the authentication server needs to negotiate the final terminal authentication method with the terminal device.

[0251] In some embodiments, after determining the terminal authentication method, the authentication server sends an EAP identity response message to the access gateway, and the EAP identity response message carries a method identifier of the terminal authentication method. The access gateway receives the EAP identity response message and sends the EAP identity response message to the terminal device. The terminal device receives the EAP identity response message and determines the terminal authentication method based on the method identifier of the terminal authentication method carried in the EAP identity response message.

[0252] If the terminal device determines that the terminal authentication method selected by the authentication server is not the authentication credential configuration method based on the method identifier carried in the EAP identity response message, the terminal device sends an EAP rejection response message to the access gateway in response to the EAP identity response message, and the EAP rejection response message indicates that the terminal authentication method supported by the terminal device is the authentication credential configuration method. The access gateway forwards the EAP rejection response message to the authentication server, and receives the EAP credential configuration message sent by the authentication server, and the EAP credential configuration message indicates that the authentication server has modified the terminal authentication method to the authentication credential configuration method.

[0253] When the terminal authentication method is determined to be the authentication credential configuration method through negotiation, the authentication server may execute the following step 407 to send an EAP credential configuration start message to the terminal device through the access network to start the process of dynamically issuing the terminal authentication credential.

[0254] If the terminal device determines that the terminal authentication method selected by the authentication server is the authentication credential configuration method based on the method identifier carried in the EAP identity response message, then in response to the EAP identity response message, the terminal device directly executes the following step 408 to send a first EAP credential request message to the access gateway to request configuration of the terminal authentication credential.

[0255] Step 406: When it is determined that the terminal authentication method is the authentication credential configuration method, the authentication server generates a server key pair used for subsequent encrypted transmission of the first terminal authentication credential, the server key pair including a server public key and a server private key.

[0256] Step 407: When it is determined through negotiation that the terminal authentication method is the authentication credential configuration method, the authentication server sends an EAP credential configuration start message to the access gateway.

[0257] Step 408: The access gateway receives the EAP credential configuration start message sent by the authentication server, and forwards the EAP credential configuration start message to the terminal device.

[0258] Step 409: The terminal device receives the EAP credential configuration start message sent by the access gateway, and sends an EAP key request message to the access gateway. The EAP key request message carries the terminal public key of the terminal device.

[0259] Step 410: The access gateway receives the EAP key request message sent by the terminal device, and sends the EAP key request message to the authentication server in a transparent transmission mode.

[0260] Step 411: The authentication server receives the EAP key request message sent by the access gateway, obtains and stores the terminal public key of the terminal device therefrom, and sends an EAP key response message to the access gateway, the EAP key response message carrying the server public key of the authentication server.

[0261] It should be understood that steps 408 to 410 are the process of the terminal device and the authentication server negotiating the encryption algorithm and exchanging keys. The encryption algorithm can be pre-defined or negotiated in real time. In the case of a default encryption algorithm, the encryption algorithm and encryption key need to be negotiated before the terminal authentication credentials are transmitted.

[0262] Step 412: The access gateway receives the EAP key response message sent by the authentication server, and forwards the EAP key response message to the terminal device.

[0263] Step 413: The terminal device receives the EAP key response message sent by the access gateway, obtains and stores the server public key of the authentication server; and dynamically allocates a symmetric terminal key pair, the terminal key pair includes a terminal public key and a terminal private key, constructs a first EAP credential request message to encapsulate the credential application parameters and the terminal private key, and uses the ECIES algorithm and the server public key to asymmetrically encrypt the first EAP credential request message; then, the terminal device sends a first EAP credential request message to the access gateway, requesting to configure the terminal authentication credential for the terminal device.

[0264] Step 414: The access gateway receives the first EAP credential request message sent by the terminal device, and sends the first EAP credential request message to the authentication server in a transparent transmission mode.

[0265] Step 415: The authentication server receives the first EAP credential request message sent by the access gateway, decrypts the first EAP credential request message using the server private key, queries or applies for the authentication credential related to the terminal device based on the credential application parameter, and obtains the first terminal authentication credential. Then, the first EAP credential response message symmetrically encrypted using the terminal public key is sent to the access gateway, and the first EAP credential response message carries the first terminal authentication credential.

[0266] Step 416: The access gateway receives the first EAP credential response message sent by the authentication server, and forwards the first EAP credential response message to the terminal device.

[0267] Step 417: The terminal device receives the first EAP credential response message sent by the access gateway, and uses the symmetric key to perform symmetric decryption to obtain the first terminal authentication credential. Then, the terminal device sends an EAP credential configuration completion message to the access gateway.

[0268] Step 418: The access gateway receives the EAP credential configuration completion message sent by the terminal device, and uses the transparent transmission mode to send the EAP credential configuration completion message to the authentication server.

[0269] Step 419: The authentication server receives the EAP credential configuration completion message sent by the access gateway, and sends an EAP authentication failure message to the access gateway, where the EAP authentication failure message indicates that the terminal device access authentication has failed.

[0270] Step 420: The access gateway receives the EAP authentication failure message sent by the authentication server, and forwards the EAP authentication failure message to the terminal device.

[0271] It should be noted that Figure 4The focus is on the EAP format messages transmitted between the terminal device, the access gateway and the authentication server. The specific operations performed by each device can be found in the above text description, or Figure 3 The explanation of the embodiments will not be repeated here.

[0272] In the above-mentioned Figure 3 Based on the authentication credential configuration method shown in FIG. 1 , the present application embodiment further provides an authentication credential configuration method. Figure 5 , taking the example that the authentication device includes an access gateway and an authentication server, and the authentication server is integrated in the access gateway, the key generation algorithm is the ECIES algorithm, the encryption parameter of the first key is the terminal public key of the terminal device, and the encryption parameter of the second key is the server public key of the authentication server, the implementation process of configuring the terminal authentication credential is described. In this embodiment, the terminal device reuses the access authentication channel under the 802.1X / EAP authentication framework. Appendix Figure 5 The implementation process of configuring terminal authentication credentials shown may include the following steps.

[0273] Step 501: The terminal device sends an EAP authentication start message to the access gateway.

[0274] That is, after the terminal device completes the connection with the access gateway, if the terminal authentication credentials are not configured in the terminal device, the terminal device can send an EAP authentication start message to the access gateway to request the authentication server to configure the terminal authentication credentials for the terminal device using the method provided in the embodiment of the present application.

[0275] Step 502: The access gateway receives the EAP authentication start message sent by the terminal device, and sends an EAP identity request message to the terminal device.

[0276] The EAP identity request message is used to instruct the terminal device to provide an identity identifier for verification to determine whether the terminal device is a legally deployed device.

[0277] Step 503: The terminal device receives the EAP identity request message sent by the access gateway, and sends an EAP identity authentication message to the access gateway. The EAP identity authentication message carries the identity of the terminal device.

[0278] Step 504: the access gateway receives the EAP identity authentication message sent by the terminal device, and verifies whether the terminal device is a legally deployed device based on the identity identifier of the terminal device; if the terminal device is a legally deployed device, the terminal authentication method of the terminal device is determined.

[0279] Among them, identity verification can be carried out by manual verification and whitelist verification, etc., and the embodiments of the present application do not limit this.

[0280] It should be noted that the terminal authentication method initially selected by the access gateway may be the authentication credential configuration method, or it may not be the authentication credential configuration method. In this case, the access gateway needs to negotiate the final terminal authentication method with the terminal device.

[0281] In some embodiments, after determining the terminal authentication method, the access gateway sends an EAP identity response message to the terminal device, and the EAP identity response message carries a method identifier of the terminal authentication method. The terminal device receives the EAP identity response message and determines the terminal authentication method based on the method identifier of the terminal authentication method carried in the EAP identity response message.

[0282] If the terminal device determines that the terminal authentication method selected by the access gateway is not the authentication credential configuration method based on the method identifier carried in the EAP identity response message, the terminal device sends an EAP rejection response message to the access gateway in response to the EAP identity response message, and the EAP rejection response message indicates that the terminal authentication method supported by the terminal device is the authentication credential configuration method. In response to the EAP rejection response message, the access gateway modifies the terminal authentication method to the authentication credential configuration method, and sends an EAP credential configuration message to the terminal device, and the EAP credential configuration message indicates that the terminal authentication method has been modified to the authentication credential configuration method.

[0283] When the terminal authentication method is determined to be the authentication credential configuration method through negotiation, the access gateway may execute the following step 506 to send an EAP credential configuration start message to the terminal device to start the process of dynamically issuing the terminal authentication credential.

[0284] If the terminal device determines that the terminal authentication method selected by the access gateway is the authentication credential configuration method based on the method identifier carried in the EAP identity response message, then in response to the EAP identity response message, the terminal device directly executes the following step 507 to send a first EAP credential request message to the access gateway to request configuration of the terminal authentication credential.

[0285] Step 505: When it is determined that the terminal authentication method is the authentication credential configuration method, the access gateway generates a server key pair used for subsequent encrypted transmission of the terminal authentication credential, the server key pair including a server public key and a server private key.

[0286] Step 506: When it is determined through negotiation that the terminal authentication method is the authentication credential configuration method, the access gateway sends an EAP credential configuration start message to the terminal device.

[0287] Step 507: The terminal device receives the EAP credential configuration start message sent by the access gateway, and sends an EAP key request message to the access gateway. The EAP key request message carries the terminal public key of the terminal device.

[0288] Step 508: The access gateway receives the EAP key request message sent by the terminal device, obtains and stores the terminal public key of the terminal device therefrom, and sends an EAP key response message to the terminal device, the EAP key response message carrying the server public key.

[0289] It should be understood that steps 507 and 508 are the process of the terminal device and the access gateway negotiating the encryption algorithm and exchanging encryption parameters (i.e., public keys). The encryption algorithm can be predefined or negotiated in real time. In the case of a default encryption algorithm, it is necessary to negotiate the encryption algorithm before transmitting the terminal authentication credentials, and generate an encryption key based on the negotiated encryption algorithm and the exchanged encryption parameters.

[0290] Step 509: The terminal device receives the EAP key response message sent by the access gateway, obtains and stores the server public key; and dynamically allocates a symmetric terminal key pair, which includes a terminal public key and a terminal private key, constructs a first EAP credential request message to encapsulate the credential application parameters and the terminal private key, and uses the ECIES algorithm and the server public key to asymmetrically encrypt the first EAP credential request message; then, the terminal device sends the first EAP credential request message to the access gateway, requesting to configure the terminal authentication credential for the terminal device.

[0291] Step 510: The access gateway receives the first EAP credential request message sent by the terminal device, decrypts the first EAP credential request message using the server private key, queries or applies for the authentication credential related to the terminal device based on the credential application parameter, and obtains the first terminal authentication credential. Then, the first EAP credential response message symmetrically encrypted using the terminal public key of the terminal device is sent to the terminal device, and the first EAP credential response message carries the first terminal authentication credential.

[0292] Step 511: The terminal device receives the first EAP credential response message sent by the access gateway, performs symmetric decryption using the symmetric key, and obtains the first terminal authentication credential. Then, the terminal device sends an EAP credential configuration completion message to the access gateway.

[0293] Step 512: The access gateway receives the EAP credential configuration completion message sent by the terminal device, and sends an EAP authentication failure message to the terminal device, where the EAP authentication failure message indicates that the terminal device access authentication has failed.

[0294] It should be noted that Figure 5 The focus is on the EAP format messages transmitted between the terminal device and the access gateway with integrated authentication server function. The specific operations performed by each device can be found in the above text description, or Figure 3 The explanation of the embodiments will not be repeated here.

[0295] It should be understood that whether the authentication server is deployed independently or integrated into the access gateway, the terminal device is not aware of this. In other words, the terminal device only transmits EAP format messages with the access gateway, but does not know whether it is the access gateway or the authentication server that configures the terminal authentication credentials.

[0296] In addition, in order to improve security and meet security policy requirements (for example, temporarily assigning a short-term valid authentication credential), the authentication device can specify a credential validity period when issuing a terminal authentication credential to the terminal device. During access authentication, the authentication device can verify the credential validity period. For the specific verification process, please refer to the attached document below. Figure 7 -Attached Fig.10 Corresponding embodiments. That is, if the terminal authentication credential exceeds the time range indicated by the validity period of the credential, the terminal authentication credential will become invalid, and access authentication using the terminal authentication credential will also fail.

[0297] In other words, if the terminal authentication certificate issued by the authentication device for the terminal device has a certificate validity period, then after the validity period has expired, the terminal device will not be able to use the terminal authentication certificate to initiate the access authentication process, nor will it be able to access the corresponding network resources. Therefore, in the case where the terminal authentication certificate has a certificate validity period, if the terminal device wishes to continue to maintain network access after the certificate validity period, the terminal device can request the authentication device to configure a new terminal authentication certificate when it determines that the certificate usage time exceeds the certificate validity period, so as to update the original terminal authentication certificate.

[0298] In the above-mentioned Figure 3 -Attached Figure 5 Based on the embodiments shown, the present application also provides a method for updating authentication credentials, see Figure 6 , so that the terminal device can request the authentication device to configure a new terminal authentication credential. The method includes the following steps.

[0299] Step 601: In response to the credential usage duration of the terminal authentication credential exceeding the credential validity period, the terminal device sends a second EAP credential request message to the authentication device, where the second EAP credential request message carries the identity identifier and credential update identifier of the terminal device.

[0300] The identity of the terminal device is used by the authentication device to verify whether the terminal device is a legally deployed device. The credential update identifier is used to indicate that the second EAP credential request message is a request for a new terminal authentication credential, not the first application for configuring a terminal authentication credential.

[0301] It should be noted that due to the update process of the above terminal authentication credentials, Figure 3The process of the terminal device obtaining the terminal authentication credential for the first time is shown. In order to distinguish the first EAP credential request message from the second EAP credential request message, a credential update identifier is set in the second EAP credential request message.

[0302] Step 602: the authentication device receives the second EAP credential request message sent by the terminal device, and sends a second EAP credential response message to the terminal device, the second EAP credential response message carries the second terminal authentication credential, and the second terminal authentication credential is the authentication credential reconfigured to the terminal device.

[0303] In a possible implementation, when the terminal device is verified to be a legally deployed device based on the identity of the terminal device, a new authentication credential is generated / applied for the terminal device based on the credential update identifier, and a second EAP credential response message is sent to the terminal device.

[0304] It should be noted that, to ensure the security of online transmission of terminal authentication credentials, the terminal device and the authentication device may negotiate a new encryption algorithm and encryption parameters to encrypt and transmit the second EAP credential request message and the second EAP credential response message.

[0305] Step 603: The terminal device receives the second EAP credential response message sent by the authentication device, and updates the terminal authentication credential of the terminal device based on the second EAP credential response message carrying the second terminal authentication credential.

[0306] In a possible implementation, after the terminal device parses the second terminal authentication credential from the second EAP credential response message, it can use the second terminal authentication credential to overwrite the original terminal authentication credential to update the original terminal authentication credential. In this way, when the terminal device performs access authentication later, it can use the second terminal authentication credential to initiate an access authentication process to the authentication device.

[0307] It should be understood that the operation flow of the terminal device requesting to update the terminal authentication credential in the above steps 601 to 603 is the same as the above steps. Figure 3 In the embodiment, the implementation process of the terminal device requesting to configure the first terminal authentication credential is the same, and it still reuses the access authentication channel under the 802.1X / EAP authentication framework and transmits the second terminal authentication credential online. Therefore, the specific implementation process can be referred to the explanation of step 303 and step 304, which will not be repeated here.

[0308] In the embodiment of the present application, after the terminal authentication credential has expired, the terminal device can re-execute the process of obtaining the terminal authentication credential based on the access authentication channel under the 802.1X / EAP authentication framework to request the authentication device to issue a second terminal authentication credential, and update the original terminal authentication credential through the second terminal authentication credential. In this way, based on the 802.1X / EAP authentication framework, the terminal authentication credential can also be updated without configuring the IP address and IP routing, which simplifies the update process of the terminal authentication credential and makes it easier and more convenient for the terminal device to update the authentication credential.

[0309] In addition, in some embodiments, after completing the issuance of terminal authentication credentials, or updating expired terminal authentication credentials, the terminal device can initiate an access authentication process to the authentication device based on the terminal authentication credentials to obtain the right to access network resources through access authentication.

[0310] Based on this, in the above appendix Figure 3 -Attached Figure 6 Based on the embodiments shown, the present application also provides an authentication credential verification method, see Figure 7 , the method is applied in an authentication device and includes the following steps.

[0311] Step 701: Receive an EAP access authentication request message sent by a terminal device, where the EAP access authentication request message carries a third terminal authentication credential of the terminal device.

[0312] Combined with the above description, the third terminal authentication credential here can be Figure 3 In the embodiment shown, the first terminal authentication credential initially obtained by the terminal device may also be Figure 6 The updated second terminal authentication credential in the illustrated embodiment may also be an authentication credential of another terminal device, which is not limited in the embodiment of the present application.

[0313] Step 702: Performing a credential validity check on the third terminal authentication credential according to the discarded credential list, wherein the discarded credential list includes credential information of a plurality of discarded terminal authentication credentials.

[0314] That is, after receiving the EAP access authentication request sent by the terminal device, the authentication device first verifies whether the third terminal authentication credential carried in the EAP access authentication request is valid through the discarded credential list. If the third terminal authentication credential is a valid credential, the content of the third terminal authentication credential is verified to perform access authentication on the terminal device. In this way, access authentication can be avoided for invalid terminal authentication credentials, thereby improving the efficiency of access authentication.

[0315] The discarded credential list may be a list manually managed by a network administrator, and the network administrator updates the credential information included in the discarded credential list in real time or periodically. The discarded credential list may also be a list automatically managed by an authentication device, and the credential information included in the discarded credential list may be updated in real time or periodically. The embodiments of the present application are not limited to this.

[0316] As an example, the credential information included in the abandoned credential list is updated, including adding the credential information of the abandoned terminal authentication credential therein, or deleting / modifying the credential information of the terminal authentication credential included therein, which is not limited in the embodiment of the present application.

[0317] In a possible implementation, the discarded credential list includes credential information of at least one of the following types of terminal authentication credentials:

[0318] (1) Terminal authentication credentials whose usage period exceeds the validity period of the credentials.

[0319] For a terminal authentication credential that carries a credential validity period, when the usage time of the terminal authentication credential exceeds the credential validity period, the credential information of the terminal authentication credential is added to the discarded credential list.

[0320] (2) Leaked terminal authentication credentials.

[0321] Since the terminal authentication credential is the only authentication credential of the terminal device during the access authentication process, the security of the terminal authentication credential must be guaranteed. If the terminal authentication credential has been leaked, in order to prevent other terminal devices from using the leaked terminal authentication credential for access authentication, the credential information of the leaked terminal authentication credential needs to be added to the discarded credential list, so that the terminal device that initiates the EAP access request can be accurately identified through the discarded credential list.

[0322] (3) Terminal authentication credentials of terminal devices whose life cycle has ended.

[0323] For terminal devices whose life cycle has expired, they will no longer access network resources and will naturally no longer initiate access authentication. Therefore, after the life cycle of a terminal device expires, the credential information of the corresponding terminal authentication credential needs to be added to the discarded credential list to prevent other terminal devices from using the terminal authentication credential to initiate EAP access requests.

[0324] In some embodiments, the authentication device includes an access gateway and an authentication server, and the authentication server can be deployed independently or integrated into the access gateway. The above-mentioned abandoned credential list can be stored in the access gateway or in the authentication server, and the credential validity check is performed by the device storing the abandoned credential list.

[0325] Step 703: If the result of the credential validity check is that the credential is valid, access authentication is performed on the terminal device based on the third terminal authentication credential.

[0326] Among them, the specific implementation method of access authentication can be referred to the relevant technology, and the embodiments of the present application do not limit this.

[0327] Step 704: If the result of the credential validity check is that the credential is invalid, an EAP authentication failure message is sent to the terminal device, and the EAP authentication failure message indicates that the terminal device access authentication has failed.

[0328] That is, when the certificate is invalid, the authentication device does not need to continue to verify the content of the third terminal authentication certificate, and directly determines that the EAP authentication of the terminal device fails.

[0329] Based on the above steps 701 to 704, the validity of the authentication credential of the third terminal is verified according to the abandoned credential list, including the following three implementation methods.

[0330] (1) The authentication server is deployed independently, and the list of revoked credentials is stored in the authentication server.

[0331] See also Figure 8 In this implementation, the implementation process of the above authentication credential verification method includes the following steps.

[0332] Step 801: The terminal device sends an EAP access authentication request message to the access gateway. The EAP access authentication request message carries the third terminal authentication credential of the terminal device.

[0333] Step 802: The access gateway sends a credential verification request message to the authentication server in response to the EAP access authentication request message sent by the terminal device. The credential verification request message carries the third terminal authentication credential.

[0334] Step 803: In response to the credential verification request message sent by the access gateway, the authentication server performs a credential validity verification on the authentication credential of the third terminal according to the discarded credential list to obtain a credential validity verification result.

[0335] Step 804: If the credential is invalid, the authentication server sends a credential validity verification result to the access gateway to indicate that the terminal device access authentication has failed.

[0336] Step 805: If the credential is valid, the authentication server performs access authentication on the terminal device based on the third terminal authentication credential.

[0337] Step 806: The access gateway sends an EAP authentication failure message to the terminal device in response to the credential validity verification result sent by the authentication server when the credential is invalid.

[0338] (2) The authentication server is deployed independently, and the list of abandoned credentials is stored in the access gateway.

[0339] Because the credential validity check is an operation before access authentication, not an access authentication process. Therefore, when the terminal device initiates access authentication, the access gateway can perform a credential validity check on the terminal authentication credential. If the credential is valid, the authentication server will perform access authentication. In other words, the credential validity check and access authentication are implemented by two devices.

[0340] Based on this, see Fig. 9 , the authentication server may send the discarded credential list to the access gateway in advance, and the access gateway stores the discarded credential list. The implementation process of the above authentication credential verification method includes the following steps.

[0341] Step 901: The terminal device sends an EAP access authentication request message to the access gateway. The EAP access authentication request message carries a third terminal authentication credential of the terminal device.

[0342] Step 902: In response to the EAP access authentication request message sent by the terminal device, the access gateway performs a credential validity check on the third terminal authentication credential according to the locally stored abandoned credential list to obtain a credential validity check result.

[0343] Step 903: If the credential is invalid, the access gateway sends an EAP authentication failure message to the terminal device.

[0344] Step 904: If the credential is valid, the access gateway sends the third terminal authentication credential to the authentication server.

[0345] Step 905: The authentication server performs access authentication on the terminal device based on the third terminal authentication credential sent by the access gateway.

[0346] It should be noted that the authentication server can send the full list of discarded credentials to the access gateway. In this case, the access gateway completes the credential validity check alone. Of course, the authentication server can also send part of the discarded credential list to the access gateway. In this case, the access gateway completes the credential validity check alone, or the credential validity check is completed by the access gateway interacting with the authentication server. The embodiments of the present application do not limit this.

[0347] (3) The authentication server is integrated into the access gateway, and the list of abandoned credentials is stored in the access gateway.

[0348] See also Fig.10When the authentication server is integrated into the access gateway, after receiving the EAP access authentication request message, the access gateway performs a credential validity check on the authentication credential of the third terminal according to the locally stored discarded credential list. The implementation process of the above authentication credential verification method includes the following steps.

[0349] Step 1001: The terminal device sends an EAP access authentication request message to the access gateway. The EAP access authentication request message carries a third terminal authentication credential of the terminal device.

[0350] Step 1002: In response to the EAP access authentication request message sent by the terminal device, the access gateway performs a credential validity check on the third terminal authentication credential according to the locally stored abandoned credential list to obtain a credential validity check result.

[0351] Step 1003: If the credential is invalid, the access gateway sends an EAP authentication failure message to the terminal device.

[0352] Step 1004: If the credential is valid, the access gateway performs access authentication on the terminal device based on the third terminal authentication credential.

[0353] That is, the access gateway completes the credential validity verification alone, and if the credential is valid, continues to execute the access authentication process to verify the content of the third terminal authentication credential.

[0354] In the embodiment of the present application, the authentication device manages and maintains a list of abandoned credentials. When performing access authentication on the terminal device, the terminal authentication credentials provided by the terminal device can be first verified for validity based on the list of abandoned credentials, and then access authentication can be performed if the credentials are valid. In this way, the efficiency of access authentication and the accuracy of access authentication results can be improved through the verification of credential validity, avoiding wasting time on access authentication for invalid credentials.

[0355] Fig.11 The present invention provides a schematic diagram of the structure of an authentication credential configuration device, which can be implemented by software, hardware or a combination of the two. Figure 1 -Attached Fig.10 The terminal devices involved in each embodiment shown in the figure may be part or all of the terminal devices involved in the embodiment shown in the figure. Fig.11 The authentication credential configuration device 1100 includes: an identity authentication module 1101 and a credential downloading module 1102 .

[0356] The identity authentication module 1101 is used to send an extensible identity authentication protocol EAP identity authentication message to an authentication device, where the EAP identity authentication message carries an identity identifier of a terminal device;

[0357] The identity authentication module 1101 is further configured to receive an EAP identity response message sent by an authentication device, where the EAP identity response message carries a method identifier of a terminal authentication method;

[0358] The credential download module 1102 is used to send a first EAP credential request message to the authentication device if it is determined based on the method identifier that the terminal authentication method is the authentication credential configuration method, the first EAP credential request message is used to request the authentication device to configure a terminal authentication credential for the terminal device, and the terminal authentication credential is used to perform access authentication on the terminal device when the terminal device accesses the network;

[0359] The credential downloading module 1102 is further configured to receive a first EAP credential response message sent by the authentication device, where the first EAP credential response message carries a first terminal authentication credential configured for the terminal device.

[0360] Optionally, the device further comprises:

[0361] A method negotiation module, configured to send an EAP rejection response message to the authentication device if it is determined based on the method identifier that the terminal authentication method is not the authentication credential configuration method, wherein the EAP rejection response message indicates that the terminal authentication method supported by the terminal device is the authentication credential configuration method;

[0362] The method negotiation module is also used to receive an EAP credential configuration message sent by the authentication device, where the EAP credential configuration message indicates that the authentication device has modified the terminal authentication method to the authentication credential configuration method.

[0363] Optionally, the first EAP credential request message is encrypted and transmitted using a first key determined by a first key generation algorithm, and the first EAP credential response message is encrypted and transmitted using a second key determined by a second key generation algorithm.

[0364] Optionally, before sending the first EAP credential request message to the authentication device, the apparatus further includes:

[0365] A key negotiation module, used to send an EAP key request message to an authentication device, where the EAP key request message carries an encryption parameter used to generate a first key;

[0366] The key negotiation module is further used to receive an EAP key response message sent by the authentication device, where the EAP key response message carries encryption parameters used to generate the second key.

[0367] Optionally, the terminal authentication credential has a validity period; the device further includes:

[0368] A credential update module, configured to send a second EAP credential request message to the authentication device in response to the credential usage time of the terminal authentication credential exceeding the credential validity period, wherein the second EAP credential request message carries an identity identifier and a credential update identifier of the terminal device;

[0369] The credential update module is further used to receive a second EAP credential response message sent by the authentication device, the second EAP credential response message carries a second terminal authentication credential, and the second terminal authentication credential is an authentication credential reconfigured to the terminal device;

[0370] The credential updating module is further used to update the terminal authentication credential of the terminal device based on the second terminal authentication credential.

[0371] Optionally, the authentication device includes an access gateway and an authentication server, the messages transmitted between the terminal device and the access gateway are messages in the EAP format encapsulated by the link layer protocol, and the messages transmitted between the access gateway and the authentication server are messages in the EAP format encapsulated by the authentication protocol, wherein the authentication protocol is a communication protocol supported by the authentication server under the EAP protocol.

[0372] Optionally, before sending the first EAP credential request message to the authentication device, the apparatus further includes:

[0373] The credential download module is used to receive the EAP credential configuration start message sent by the authentication device;

[0374] The credential download module is further configured to execute the step of sending a first EAP credential request message to the authentication device in response to the EAP credential configuration start message.

[0375] Optionally, after receiving the first EAP credential response message sent by the authentication device, the apparatus further includes:

[0376] The credential download module is also used to send an EAP credential configuration completion message to the authentication device;

[0377] The credential download module is also used to receive an EAP authentication failure message sent by the authentication device, where the EAP authentication failure message indicates that the terminal device access authentication has failed.

[0378] In the embodiment of the present application, based on the 802.1X / EAP authentication framework and the extensibility of the EAP authentication method, a new EAP authentication method is extended, namely, the authentication credential configuration method. When the terminal device and the authentication device negotiate and determine that the terminal authentication method is the authentication credential configuration method through the EAP format message transmitted by the link layer, the terminal device can request the authentication device online to issue a terminal authentication credential for it. It can be seen that the embodiment of the present application reuses the access authentication channel under the 802.1X / EAP co-authentication framework, and the terminal device can obtain and download the terminal authentication credential configured for it by the authentication device. This process does not require the pre-configuration of a temporary IP address for the terminal device, avoids dependence on IP addresses and IP routing, reduces the resource overhead of the terminal device, and realizes true plug-and-play of the terminal device.

[0379] It should be noted that the authentication credential configuration device provided in the above embodiment only uses the division of the above functional modules as an example when obtaining the terminal authentication credential. In actual applications, the above functional distribution can be completed by different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the authentication credential configuration device provided in the above embodiment and the embodiment of the authentication credential configuration method executed by the terminal device belong to the same concept. The specific implementation process is detailed in the corresponding method embodiment, which will not be repeated here.

[0380] Fig.12 is a schematic diagram of the structure of another authentication credential configuration device provided in an embodiment of the present application. The authentication credential configuration device can be implemented by software, hardware, or a combination of both to form an attached Figure 1 -Attached Fig.10 The embodiments shown in the figure may involve part or all of the authentication device. Fig.12 The authentication credential configuration device 1200 includes: an identity authentication module 1201 and a credential configuration module 1202 .

[0381] The identity authentication module 1201 is used to receive an extensible identity authentication protocol EAP identity authentication message sent by a terminal device, where the EAP identity authentication message carries an identity identifier of the terminal device;

[0382] The identity authentication module 1201 is further used to determine the terminal authentication method of the terminal device when verifying that the terminal device is a legally deployed device based on the identity identifier of the terminal device, and send an EAP identity response message to the terminal device, where the EAP identity response message carries a method identifier of the terminal authentication method;

[0383] The credential configuration module 1202 is used to receive a first EAP credential request message sent by the terminal device, where the first EAP credential request message is used to request the authentication device to configure a terminal authentication credential for the terminal device, where the terminal authentication credential is used to perform access authentication on the terminal device when the terminal device accesses the network;

[0384] The credential configuration module 1202 is further configured to send a first EAP credential response message to the terminal device in response to the first EAP credential request message, where the first EAP credential response message carries the first terminal authentication credential configured for the terminal device.

[0385] Optionally, the device further comprises:

[0386] A method negotiation module, used for receiving an EAP rejection response message sent by a terminal device, wherein the EAP rejection response message indicates that the terminal authentication method supported by the terminal device is an authentication credential configuration method;

[0387] The method negotiation module is further used to send an EAP credential configuration message to the terminal device in response to the EAP rejection response message, wherein the EAP credential configuration message indicates that the authentication device has modified the terminal authentication method to the authentication credential configuration method.

[0388] Optionally, the first EAP credential request message is encrypted and transmitted using a first key determined by a first key generation algorithm, and the first EAP credential response message is encrypted and transmitted using a second key determined by a second key generation algorithm.

[0389] Optionally, before sending the first EAP credential response message to the terminal device, the apparatus further includes:

[0390] A key negotiation module, used to receive an EAP key request message sent by a terminal device, where the EAP key request message carries an encryption parameter used to generate a first key;

[0391] The key negotiation module is further used to send an EAP key response message to the terminal device in response to the EAP key request message, where the EAP key response message carries encryption parameters corresponding to the generation of the second key.

[0392] Optionally, the terminal authentication credential has a validity period; the device further includes:

[0393] The credential update module is used to receive a second EAP credential request message sent by the terminal device, where the second EAP credential request message carries an identity identifier and a credential update identifier of the terminal device;

[0394] The credential update module is also used to send a second EAP credential response message to the terminal device in response to the second EAP credential request message, the second EAP credential response message carries the second terminal authentication credential, the second terminal authentication credential is the authentication credential reconfigured to the terminal device, and the second EAP credential response message is used to instruct the terminal device to update the terminal authentication credential of the terminal device based on the second terminal authentication credential.

[0395] Optionally, the device further comprises:

[0396] An access authentication module, configured to receive an EAP access authentication request message sent by a terminal device, wherein the EAP access authentication request message carries a third terminal authentication credential of the terminal device;

[0397] A credential verification module, used to verify the validity of the third terminal authentication credential according to the abandoned credential list, wherein the abandoned credential list includes credential information of multiple abandoned terminal authentication credentials;

[0398] The access authentication module is further used to perform access authentication on the terminal device based on the third terminal authentication credential if the credential validity check result is that the credential is valid;

[0399] The access authentication module is also used to send an EAP authentication failure message to the terminal device if the result of the credential validity check is that the credential is invalid. The EAP authentication failure message indicates that the terminal device access authentication has failed.

[0400] Optionally, the discarded credential list includes credential information of at least one of the following types of terminal authentication credentials:

[0401] Terminal authentication credentials whose usage period exceeds the validity period of the credentials;

[0402] Terminal authentication credentials that have been compromised;

[0403] Terminal authentication credentials of terminal devices whose life cycle has ended.

[0404] Optionally, the authentication device includes an access gateway and an authentication server, the messages transmitted between the terminal device and the access gateway are messages in the EAP format encapsulated by the link layer protocol, and the messages transmitted between the access gateway and the authentication server are messages in the EAP format encapsulated by the authentication protocol, wherein the authentication protocol is a communication protocol supported by the authentication server under the EAP protocol.

[0405] Optionally, before sending the first EAP credential response message to the terminal device, the apparatus further includes:

[0406] The credential configuration module is further used to send an EAP credential configuration start message to the terminal device when the terminal authentication method is the authentication credential configuration method.

[0407] Optionally, after sending the first EAP credential response message to the terminal device, the apparatus further includes:

[0408] The credential configuration module is further used to receive an EAP credential configuration completion message sent by the terminal device;

[0409] The credential configuration module is further used to send an EAP authentication failure message to the terminal device in response to the EAP credential configuration completion message, where the EAP authentication failure message indicates that the terminal device access authentication fails.

[0410] In the embodiment of the present application, based on the 802.1X / EAP authentication framework and the scalability of the EAP authentication method, a new EAP authentication method, namely the authentication credential configuration method, is extended. When the terminal device and the authentication device negotiate and determine that the terminal authentication method is the authentication credential configuration method through the message in the EAP format transmitted by the link layer, the authentication device can dynamically issue a terminal authentication credential for the terminal device online. It can be seen that the embodiment of the present application reuses the access authentication channel under the 802.1X / EAP co-authentication framework to dynamically configure the terminal authentication credential for the terminal device. This process does not require the pre-configuration of a temporary IP address for the terminal device, avoids dependence on the IP address and IP routing, reduces the resource overhead of the terminal device, and realizes true plug-and-play of the terminal device.

[0411] It should be noted that the authentication credential configuration device provided in the above embodiment only uses the division of the above functional modules as an example when configuring the terminal authentication credential for the terminal device. In actual applications, the above functional distribution can be completed by different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the authentication credential configuration device provided in the above embodiment and the embodiment of the authentication credential configuration method performed by the authentication device belong to the same concept. The specific implementation process is detailed in the corresponding method embodiment, which will not be repeated here.

[0412] Fig.13This is a block diagram of a terminal device provided in an embodiment of the present application. The terminal device 1300 may be a portable mobile terminal, such as a smart phone, a tablet computer, an MP3 player (Moving Picture Experts Group Audio Layer III), an MP4 (Moving Picture Experts Group Audio Layer IV), a laptop computer or a desktop computer. The terminal device 1300 may also be referred to as a user device, a portable terminal device, a laptop terminal device, a desktop terminal device or other names. In addition, the terminal device 1300 may also be any type of sensor in the Internet of Things.

[0413] Typically, the terminal device 1300 includes: a processor 1301 and a memory 1302 .

[0414] The processor 1301 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 1301 may be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The processor 1301 may also include a main processor and a coprocessor. The main processor is a processor for processing data in an awake state, also known as a central processing unit (CPU); the coprocessor is a low-power processor for processing data in a standby state. In some embodiments, the processor 1301 may be integrated with a graphics processing unit (GPU), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 1301 may also include an artificial intelligence (AI) processor, which is used to process computing operations related to machine learning.

[0415] The memory 1302 may include one or more computer-readable storage media, which may be non-transitory. The memory 1302 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In some embodiments, the non-transitory computer-readable storage medium in the memory 1302 is used to store at least one instruction, which is used to be executed by the processor 1301 to implement the authentication credential acquisition method provided in the method embodiment of the present application.

[0416] In some embodiments, the terminal device 1300 may also optionally include: a peripheral device interface 1303 and at least one peripheral device. The processor 1301, the memory 1302 and the peripheral device interface 1303 may be connected via a bus or a signal line. Each peripheral device may be connected to the peripheral device interface 1303 via a bus, a signal line or a circuit board. Specifically, the peripheral device includes: at least one of a radio frequency circuit 1304, a touch display screen 1305, a camera 1306, an audio circuit 1307, a positioning component 1308 and a power supply 1309.

[0417] The peripheral device interface 1303 may be used to connect at least one peripheral device related to input / output (I / O) to the processor 1301 and the memory 1302. In some embodiments, the processor 1301, the memory 1302, and the peripheral device interface 1303 are integrated on the same chip or circuit board; in some other embodiments, any one or two of the processor 1301, the memory 1302, and the peripheral device interface 1303 may be implemented on a separate chip or circuit board, which is not limited in this embodiment.

[0418] The radio frequency circuit 1304 is used to receive and transmit radio frequency (RF) signals, also known as electromagnetic signals. The radio frequency circuit 1304 communicates with the communication network and other communication devices through electromagnetic signals. The radio frequency circuit 1304 converts the electrical signal into an electromagnetic signal for transmission, or converts the received electromagnetic signal into an electrical signal. Optionally, the radio frequency circuit 1304 includes: an antenna system, an RF transceiver, one or more amplifiers, a tuner, an oscillator, a digital signal processor, a codec chipset, a user identity module card, etc. The radio frequency circuit 1304 can communicate with other terminal devices through at least one wireless communication protocol. The wireless communication protocol includes but is not limited to: the World Wide Web, a metropolitan area network, an intranet, various generations of mobile communication networks (2G, 3G, 4G and 5G), a wireless local area network and / or a WiFi network. In some embodiments, the radio frequency circuit 1304 may also include circuits related to near field communication (NFC), which is not limited in the embodiments of the present application.

[0419] The display screen 1305 is used to display a user interface (UI). The UI may include graphics, text, icons, videos, and any combination thereof. When the display screen 1305 is a touch display screen, the display screen 1305 also has the ability to collect touch signals on the surface or above the surface of the display screen 1305. The touch signal can be input to the processor 1301 as a control signal for processing. At this time, the display screen 1305 can also be used to provide virtual buttons and / or virtual keyboards, also known as soft buttons and / or soft keyboards. In some embodiments, the display screen 1305 can be one, and the front panel of the terminal device 1300 is set; in other embodiments, the display screen 1305 can be at least two, which are respectively set on different surfaces of the terminal device 1300 or are folded; in some embodiments, the display screen 1305 can be a flexible display screen, which is set on the curved surface or folded surface of the terminal device 1300. Even, the display screen 1305 can also be set as a non-rectangular irregular shape, that is, a special-shaped screen. The display screen 1305 can be made of materials such as liquid crystal display (LCD) and organic light-emitting diode (OLED).

[0420] The camera assembly 1306 is used to capture images or videos. Optionally, the camera assembly 1306 includes a front camera and a rear camera. Typically, the front camera is arranged on the front panel of the terminal device, and the rear camera is arranged on the back of the terminal device. In some embodiments, there are at least two rear cameras, which are any one of a main camera, a depth of field camera, a wide-angle camera, and a telephoto camera, so as to realize the fusion of the main camera and the depth of field camera to realize the background blur function, the fusion of the main camera and the wide-angle camera to realize panoramic shooting and virtual reality (VR) shooting function or other fusion shooting functions. In some embodiments, the camera assembly 1306 may also include a flash. The flash can be a monochrome temperature flash or a dual-color temperature flash. A dual-color temperature flash refers to a combination of a warm light flash and a cold light flash, which can be used for light compensation at different color temperatures.

[0421] The audio circuit 1307 may include a microphone and a speaker. The microphone is used to collect sound waves from the user and the environment, and convert the sound waves into electrical signals and input them into the processor 1301 for processing, or input them into the RF circuit 1304 to achieve voice communication. For the purpose of stereo acquisition or noise reduction, there may be multiple microphones, which are respectively arranged at different parts of the terminal device 1300. The microphone may also be an array microphone or an omnidirectional acquisition microphone. The speaker is used to convert the electrical signal from the processor 1301 or the RF circuit 1304 into sound waves. The speaker may be a traditional film speaker or a piezoelectric ceramic speaker. When the speaker is a piezoelectric ceramic speaker, it can not only convert the electrical signal into sound waves audible to humans, but also convert the electrical signal into sound waves inaudible to humans for purposes such as ranging. In some embodiments, the audio circuit 1307 may also include a headphone jack.

[0422] The positioning component 1308 is used to locate the current geographic location of the terminal device 1300 to implement navigation or location based service (LBS). The positioning component 1308 can be a positioning component based on the global positioning system (GPS) of the United States, the Beidou system of China, or the Galileo system of Russia.

[0423] The power supply 1309 is used to power various components in the terminal device 1300. The power supply 1309 can be an alternating current, a direct current, a disposable battery, or a rechargeable battery. When the power supply 1309 includes a rechargeable battery, the rechargeable battery can be a wired rechargeable battery or a wireless rechargeable battery. A wired rechargeable battery is a battery charged through a wired line, and a wireless rechargeable battery is a battery charged through a wireless coil. The rechargeable battery can also be used to support fast charging technology.

[0424] In some embodiments, the terminal device 1300 further includes one or more sensors 1310. The one or more sensors 1310 include, but are not limited to: an acceleration sensor, a gyroscope sensor, a pressure sensor, a fingerprint sensor, an optical sensor, and a proximity sensor.

[0425] Those skilled in the art will understand that Fig.13 The structure shown in the figure does not constitute a limitation on the terminal device 1300, and may include more or fewer components than shown in the figure, or combine certain components, or adopt a different component arrangement.

[0426] Fig.1414 is a schematic diagram of the structure of an access gateway provided in an embodiment of the present application. The access gateway 1400 may be a switch, a router or other access gateway for forwarding messages. In this embodiment, the access gateway 1400 includes: a main control board 1410, an interface board 1430 and an interface board 1440. In the case of multiple interface boards, a switching network board ( Fig.14 The switching network board is used to complete data exchange between interface boards (interface boards are also called line cards or service boards).

[0427] The main control board 1410 is used to complete functions such as system management, equipment maintenance, and protocol processing. The interface boards 1430 and 1440 are used to provide various service interfaces (for example, POS interface, GE interface, ATM interface, etc.) and realize the forwarding of data streams. There are mainly three types of functional units on the main control board 1410: system management control unit, system clock unit, and system maintenance unit. The main control board 1410, the interface board 1430, and the interface board 1440 are connected to the system backplane through the system bus to realize intercommunication. The interface board 1430 includes one or more processors 1431. The processor 1431 is used to control and manage the interface board and communicate with the central processing unit on the main control board, as well as to forward the data stream. The memory 1432 on the interface board 1430 is used to store the forwarding table items, and the processor 1431 forwards the data stream by searching the forwarding table items stored in the memory 1432.

[0428] The interface board 1430 includes one or more network interfaces 1433 for receiving data streams or other information sent by terminal devices, authentication servers or other devices, and processing these data streams or data according to instructions of the processor 1431. The specific implementation process will not be described one by one here.

[0429] It is understandable that Fig.14 As shown, the embodiment of the present application includes multiple interface boards, and adopts a distributed forwarding mechanism. Under this mechanism, the operation on the interface board 1440 is basically similar to the operation on the interface board 1430, and for the sake of brevity, it will not be repeated. In addition, it can be understood that Fig.14 The processor 1431 and / or 1441 in the interface board 1430 can be dedicated hardware or chips, such as a network processor or an application specific integrated circuit (ASIC) to implement the above functions. This implementation is what is commonly referred to as a forwarding plane using dedicated hardware or chip processing. Of course, the processor 1431 and / or 1441 can also use a general-purpose processor, such as a general-purpose CPU, to implement the above-described functions.

[0430] In addition, it should be noted that there may be one or more main control boards, and when there are multiple boards, they may include a main main control board and a standby main control board. There may be one or more interface boards. The stronger the data processing capability of the access gateway, the more interface boards are provided. In the case of multiple interface boards, the multiple interface boards can communicate with each other through one or more switching network boards, and when there are multiple boards, load sharing redundant backup can be achieved together. Under the centralized forwarding architecture, the access gateway may not need a switching network board, and the interface board bears the processing function of the business data of the entire system. Under the distributed forwarding architecture, the access gateway includes multiple interface boards, and data exchange between multiple interface boards can be achieved through the switching network board, providing large-capacity data exchange and processing capabilities. Therefore, the data access and processing capabilities of the access gateway with a distributed architecture are greater than those of the access gateway with a centralized architecture. Which architecture to adopt depends on the specific networking deployment scenario, and no limitation is made here.

[0431] In some embodiments, the memory 1432 may be a read-only memory (ROM), a random access memory (RAM), an electrically erasable programmable read-only memory (EEPROM), an optical disc including (compact disc read-only memory (CD-ROM), a compressed optical disc, a laser disc, a digital versatile disc, a Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 1432 may exist independently and be connected to the processor 1431 via a communication bus. The memory 1432 may also be integrated with the processor 1431.

[0432] In some embodiments, the network interface 1433 may be a device using any transceiver type for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc. The network interface 1433 includes a wired network interface and may also include a wireless network interface. Among them, the wired network interface may be, for example, an Ethernet interface. The Ethernet interface may be an optical interface, an electrical interface, or a combination thereof. The wireless network interface may be a WLAN interface, a cellular network communication interface, or a combination thereof, etc. When the access gateway serves as any access gateway within the domain, the network interface 1433 is used to forward data packets to other access gateways. When the access gateway serves as the head node within the domain, the network interface 1433 may also be used to communicate with terminal devices, such as receiving messages in EAP format sent by terminal devices.

[0433] In some embodiments, the access gateway may include multiple processors, each of which may be a single-core processor or a multi-core processor. The processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0434] In some embodiments, the memory 1432 is used to store a computer program for executing the solution of the present application, and the processor 1431 can execute the computer program stored in the memory 1432 to prompt the access gateway 1400 to execute Figures 3 to 10 The processing steps of accessing the gateway in the embodiment shown in the figure can be referred to in detail. Figures 3 to 10 The detailed description in the illustrated embodiment will not be repeated here.

[0435] Fig.15 1 is a schematic diagram of the structure of an authentication server provided in an embodiment of the present application. The authentication server 1500 includes a central processing unit (CPU) 1501, a system memory 1504 including a random access memory (RAM) 1502 and a read-only memory (ROM) 1503, and a system bus 1505 connecting the system memory 1504 and the central processing unit 1501. The authentication server 1500 also includes a basic input / output system (I / O system) 1506 for facilitating information transmission between various components within the server, and a large-capacity storage device 1507 for storing an operating system 1513, an application program 1514, and other program modules 1515.

[0436] The basic input / output system 1506 includes a display 1508 for displaying information and an input device 1509 such as a mouse and a keyboard for user inputting information. The display 1508 and the input device 1509 are connected to the central processing unit 1501 through an input / output controller 1510 connected to the system bus 1505. The basic input / output system 1506 may also include an input / output controller 1510 for receiving and processing inputs from a plurality of other devices such as a keyboard, a mouse, or an electronic stylus. Similarly, the input / output controller 1510 also provides output to a display screen, a printer, or other types of output devices.

[0437] The mass storage device 1507 is connected to the central processing unit 1501 through a mass storage controller (not shown) connected to the system bus 1505. The mass storage device 1507 and its associated computer readable media provide non-volatile storage for the authentication server 1500. That is, the mass storage device 1507 may include a computer readable medium (not shown) such as a hard disk or a CD-ROM drive.

[0438] Without loss of generality, computer readable media may include computer storage media and communication media. Computer storage media include volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information such as computer readable instructions, data structures, program modules or other data. Computer storage media include RAM, ROM, EPROM, EEPROM, flash memory or other solid-state memory technology, CD-ROM, DVD or other optical storage, cassettes, magnetic tapes, disk storage or other magnetic storage devices. Of course, those skilled in the art will appreciate that computer storage media are not limited to the above. The above-mentioned system memory 1504 and mass storage device 1507 can be collectively referred to as memory.

[0439] According to various embodiments of the present application, the authentication server 1500 can also be connected to a remote computer on the network through a network such as the Internet. That is, the authentication server 1500 can be connected to the network 1512 through the network interface unit 1511 connected to the system bus 1505, or the network interface unit 1511 can be used to connect to other types of networks or remote computer systems (not shown).

[0440] The above-mentioned memory also includes one or more programs, and the one or more programs are stored in the memory and configured to be executed by the CPU.

[0441] The embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program runs on a terminal device, the terminal device executes the steps of the above-mentioned authentication credential configuration method.

[0442] The embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program runs on an authentication device, the authentication device executes the steps of the above-mentioned authentication credential configuration method.

[0443] An embodiment of the present application also provides a computer program product, which includes a computer program. When the computer program is executed on a terminal device, the terminal device executes the steps of the above-mentioned authentication credential configuration method.

[0444] An embodiment of the present application also provides a computer program product, which includes a computer program. When the computer program is executed on an authentication device, the authentication device executes the steps of the above-mentioned authentication credential configuration method.

[0445] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access, or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a digital versatile disc (DVD)), or a semiconductor medium (e.g., a solid state disk (SSD)). It is worth noting that the computer-readable storage medium mentioned in the embodiment of the present application may be a non-volatile storage medium, in other words, a non-transient storage medium.

[0446] It should be understood that the "multiple" mentioned herein refers to two or more. In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in this article is only a description of the association relationship of the associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in order to facilitate the clear description of the technical solution of the embodiments of the present application, in the embodiments of the present application, the words "first", "second" and the like are used to distinguish between the same items or similar items with basically the same functions and effects. Those skilled in the art can understand that the words "first", "second" and the like do not limit the quantity and execution order, and the words "first", "second" and the like do not limit them to be necessarily different.

[0447] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data for analysis, stored data, displayed data, etc.) and signals involved in the embodiments of this application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions. For example, the identity identification of the terminal device and the credential application parameters involved in the embodiments of this application are all obtained with full authorization.

[0448] The above-mentioned embodiments are provided for the present application and are not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the principles of the present application shall be included in the protection scope of the present application.

Claims

1. A method for configuring authentication credentials, characterized in that: Applied to a terminal device to be connected to a network, the method comprises: Sending an Extensible Authentication Protocol (EAP) authentication message to an authentication device, wherein the EAP authentication message carries an identity identifier of the terminal device; receiving an EAP identity response message sent by the authentication device, wherein the EAP identity response message carries a method identifier of a terminal authentication method; If it is determined based on the method identifier that the terminal authentication method is an authentication credential configuration method, sending a first EAP credential request message to the authentication device, the first EAP credential request message being used to request the authentication device to configure a terminal authentication credential for the terminal device, the terminal authentication credential being used to perform access authentication on the terminal device when the terminal device accesses the network; A first EAP credential response message sent by the authentication device is received, where the first EAP credential response message carries a first terminal authentication credential configured for the terminal device.

2. The method according to claim 1, characterized in that The method further comprises: If it is determined based on the method identifier that the terminal authentication method is not the authentication credential configuration method, sending an EAP rejection response message to the authentication device, wherein the EAP rejection response message indicates that the terminal authentication method supported by the terminal device is the authentication credential configuration method; An EAP credential configuration message is received from the authentication device, where the EAP credential configuration message indicates that the authentication device has modified the terminal authentication method to the authentication credential configuration method.

3. The method according to claim 1, characterized in that The first EAP credential request message is encrypted and transmitted using a first key determined by a first key generation algorithm, and the first EAP credential response message is encrypted and transmitted using a second key determined by a second key generation algorithm.

4. The method according to claim 3, characterized in that Before sending the first EAP credential request message to the authentication device, the method further includes: Sending an EAP key request message to the authentication device, where the EAP key request message carries an encryption parameter used to generate the first key; An EAP key response message sent by the authentication device is received, where the EAP key response message carries an encryption parameter used to generate the second key.

5. The method according to claim 1, characterized in that The terminal authentication certificate has a certificate validity period; the method further includes: In response to the credential usage time of the terminal authentication credential exceeding the credential validity period, sending a second EAP credential request message to the authentication device, wherein the second EAP credential request message carries an identity identifier and a credential update identifier of the terminal device; receiving a second EAP credential response message sent by the authentication device, where the second EAP credential response message carries a second terminal authentication credential, where the second terminal authentication credential is an authentication credential reconfigured to the terminal device; Based on the second terminal authentication credential, the terminal authentication credential of the terminal device is updated.

6. The method according to claim 1, characterized in that The authentication device includes an access gateway and an authentication server, the messages transmitted between the terminal device and the access gateway are messages in the EAP format encapsulated by the link layer protocol, and the messages transmitted between the access gateway and the authentication server are messages in the EAP format encapsulated by the authentication protocol, wherein the authentication protocol is a communication protocol supported by the authentication server under the EAP protocol.

7. The method according to any one of claims 1 to 6, characterized in that Before sending the first EAP credential request message to the authentication device, the method further includes: Receiving an EAP credential configuration start message sent by the authentication device; In response to the EAP credentials configuration start message, the step of sending a first EAP credentials request message to the authentication device is performed.

8. The method according to any one of claims 1 to 6, characterized in that After receiving the first EAP credential response message sent by the authentication device, the method further includes: Sending an EAP credential configuration completion message to the authentication device; An EAP authentication failure message sent by the authentication device is received, where the EAP authentication failure message indicates that access authentication of the terminal device has failed.

9. A method for configuring authentication credentials, characterized in that: Applied to an authentication device in a network, the method comprises: Receiving an Extensible Authentication Protocol (EAP) authentication message sent by a terminal device, wherein the EAP authentication message carries an identity identifier of the terminal device; In the case of verifying that the terminal device is a legally deployed device based on the identity identifier of the terminal device, determining a terminal authentication method of the terminal device, and sending an EAP identity response message to the terminal device, where the EAP identity response message carries a method identifier of the terminal authentication method; receiving a first EAP credential request message sent by the terminal device, where the first EAP credential request message is used to request the authentication device to configure a terminal authentication credential for the terminal device, where the terminal authentication credential is used to perform access authentication on the terminal device when the terminal device accesses the network; In response to the first EAP credential request message, a first EAP credential response message is sent to the terminal device, where the first EAP credential response message carries a first terminal authentication credential configured for the terminal device.

10. The method according to claim 9, characterized in that The method further comprises: Receiving an EAP rejection response message sent by the terminal device, wherein the EAP rejection response message indicates that the terminal authentication method supported by the terminal device is the authentication credential configuration method; In response to the EAP rejection response message, an EAP credential configuration message is sent to the terminal device, wherein the EAP credential configuration message indicates that the authentication device has modified the terminal authentication method to the authentication credential configuration method.

11. The method according to claim 9, characterized in that The first EAP credential request message is encrypted and transmitted using a first key determined by a first key generation algorithm, and the first EAP credential response message is encrypted and transmitted using a second key determined by a second key generation algorithm.

12. The method according to claim 11, characterized in that Before sending the first EAP credential response message to the terminal device, the method further includes: receiving an EAP key request message sent by the terminal device, where the EAP key request message carries an encryption parameter used to generate the first key; In response to the EAP key request message, an EAP key response message is sent to the terminal device, where the EAP key response message carries encryption parameters corresponding to the second key for generating the second key.

13. The method according to claim 9, characterized in that The terminal authentication certificate has a certificate validity period; the method further includes: receiving a second EAP credential request message sent by the terminal device, where the second EAP credential request message carries an identity identifier and a credential update identifier of the terminal device; In response to the second EAP credential request message, a second EAP credential response message is sent to the terminal device, the second EAP credential response message carries a second terminal authentication credential, the second terminal authentication credential is an authentication credential reconfigured to the terminal device, and the second EAP credential response message instructs the terminal device to update the terminal authentication credential of the terminal device based on the second terminal authentication credential.

14. The method according to claim 9, characterized in that The method further comprises: Receiving an EAP access authentication request message sent by the terminal device, where the EAP access authentication request message carries a third terminal authentication credential of the terminal device; Performing a credential validity check on the third terminal authentication credential according to a discarded credential list, wherein the discarded credential list includes credential information of a plurality of discarded terminal authentication credentials; If the result of the credential validity check is that the credential is valid, performing access authentication on the terminal device based on the third terminal authentication credential; If the result of the credential validity check is that the credential is invalid, an EAP authentication failure message is sent to the terminal device, and the EAP authentication failure message indicates that the terminal device access authentication has failed.

15. The method according to claim 14, characterized in that The discarded credentials list includes credential information of at least one type of terminal authentication credentials: Terminal authentication credentials whose usage period exceeds the validity period of the credentials; Terminal authentication credentials that have been compromised; Terminal authentication credentials of terminal devices whose life cycle has ended.

16. The method according to claim 9, characterized in that The authentication device includes an access gateway and an authentication server, the messages transmitted between the terminal device and the access gateway are messages in the EAP format encapsulated by the link layer protocol, and the messages transmitted between the access gateway and the authentication server are messages in the EAP format encapsulated by the authentication protocol, wherein the authentication protocol is a communication protocol supported by the authentication server under the EAP protocol.

17. The method according to any one of claims 9 to 16, characterized in that Before sending the first EAP credential response message to the terminal device, the method further includes: In case the terminal authentication method is the authentication credential configuration method, an EAP credential configuration start message is sent to the terminal device.

18. The method according to any one of claims 9 to 16, characterized in that After sending the first EAP credential response message to the terminal device, the method further includes: Receiving an EAP credential configuration completion message sent by the terminal device; In response to the EAP credential configuration completion message, an EAP authentication failure message is sent to the terminal device, wherein the EAP authentication failure message indicates that the terminal device access authentication has failed.

19. A terminal device, characterized in that: The terminal device includes a memory and a processor, the memory is used to store a computer program, and the processor is configured to execute the computer program stored in the memory to implement the steps of the method according to any one of claims 1 to 8.

20. An authentication device, characterized in that: The authentication device comprises a memory and a processor, the memory is used to store a computer program, and the processor is configured to execute the computer program stored in the memory to implement the steps of the method according to any one of claims 9 to 18.

21. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed on the terminal device, the terminal device executes the steps of the method according to any one of claims 1 to 8.

22. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program runs on the authentication device, the authentication device executes the steps of the method described in any one of claims 9 to 18.

23. An authentication credential configuration system, characterized in that: The system comprises the terminal device according to claim 19 and the authentication device according to claim 20.

Images