Access authentication method, device and system, electronic equipment and storage medium

Abstract

The invention provides an access authentication method, device and system, electronic equipment and a storage medium, and relates to the technical field of communication. Two address pools with the same IP address range and gateway address are configured on the SDN controller, and the two address pools are associated with different VRF information. The SDN controller receives a DHCP relay request message sent by the DHCP relay device, and when an address pool associated with VRF information in the DHCP relay request message is an address pool corresponding to a default VLAN, an IP address is allocated to the terminal from the address pool and the terminal is authenticated; and configuring the access port VLAN of the successfully authenticated terminal as an authorized VLAN, and synchronizing the IP address to an allocation list of an address pool corresponding to the authorized VLAN. Therefore, after the terminal is successfully authenticated, the IP address obtained before authentication is directly used for communication, and communication can be performed without waiting for the terminal to renew the lease or manually triggering the terminal to obtain the IP address again in the authorized VLAN.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to an access authentication method, device, system, electronic device and storage medium. Background Art

[0002] In the campus network managed by the SDN (Software Defined Network) controller, in order to perform network access policy control (such as external network access rights, network quality assurance, etc.) for different users, VLAN (Virtual Local Area Network) authorization can be used to authorize different users to different VLANs, and user network access policy control can be implemented based on VLAN.

[0003] In the campus network managed by the SDN controller, portal authentication users can implement network access policy control for portal authentication users by performing VLAN authorization. Portal authentication is also called Web authentication. This authentication method requires that there is Layer 3 network reachability between the terminal and the authentication server. After the terminal accesses the network, it obtains an IP address through DHCP (Dynamic Host Configuration Protocol). After the terminal is successfully authenticated, a new VLAN will be reauthorized for the terminal. The terminal cannot perceive the VLAN change of the access port and will not automatically trigger DHCP to re-acquire the IP address, resulting in a mismatch between the IP address obtained by the terminal before authentication and the authorized VLAN, and then the network is disconnected. It is necessary to manually trigger the terminal to re-acquire the IP address or wait for the authentication server to respond to the new IP address when the terminal renews the DHCP lease, so that the terminal can access the network normally.

[0004] An existing solution is to configure the DHCP lease period before Portal authentication to be short enough, and the terminal frequently renews the lease. After the new VLAN is currently authorized, the terminal can update the IP address to the IP address of the address pool corresponding to the authorized VLAN during the next renewal. This solution can solve the above problems to a certain extent, but the frequent renewal of the terminal may cause greater pressure on the authentication server. At the same time, the network is still inaccessible during the period from the successful authorization of the VLAN to the next renewal request. Summary of the invention

[0005] In view of this, the purpose of the present invention is to provide an access authentication method, device, system, electronic device and storage medium to solve the problem that in the existing terminal access authentication scheme, the IP address obtained before the terminal authentication does not match the authorized VLAN after the authentication is successful, thereby causing the network to be inaccessible.

[0006] In order to achieve the above purpose, the technical solution adopted by the embodiment of the present invention is as follows:

[0007] In a first aspect, the present invention provides an access authentication method, which is applied to an SDN controller, wherein the SDN controller is connected to a DHCP relay device in communication; the SDN controller is configured with an address pool corresponding to a default VLAN and an address pool corresponding to an authorized VLAN, wherein the IP address range and gateway address of the address pool corresponding to the default VLAN and the address pool corresponding to the authorized VLAN are the same, and the address pool corresponding to the default VLAN and the address pool corresponding to the authorized VLAN are associated with different VRF information; the method comprises:

[0008] Receiving a DHCP relay request message sent by the DHCP relay device based on the DHCP request message of the terminal; the DHCP relay request message carries VRF information corresponding to the access port VLAN of the terminal;

[0009] Querying the address pool associated with the VRF information in the DHCP relay request message;

[0010] If the address pool associated with the VRF information in the DHCP relay request message is the address pool corresponding to the default VLAN, an IP address is allocated to the terminal from the address pool corresponding to the default VLAN and the allocated IP address is returned to the terminal through the DHCP relay device;

[0011] Authenticate the terminal after obtaining the IP address, configure the access port VLAN of the terminal after successful authentication as the authorized VLAN, and synchronize the IP address allocated to the terminal in the address pool corresponding to the default VLAN to the allocation list of the address pool corresponding to the authorized VLAN.

[0012] In an optional embodiment, the method further comprises:

[0013] If the address pool associated with the VRF information in the DHCP relay request message is the address pool corresponding to the authorized VLAN, an IP address is allocated to the terminal from the address pool corresponding to the authorized VLAN and the allocated IP address is returned to the terminal through the DHCP relay device.

[0014] In a second aspect, the present invention provides an access authentication method, which is applied to a DHCP relay device, wherein the DHCP relay device is connected to an SDN controller in communication, and VRF information corresponding to a default VLAN and an authorized VLAN is recorded in the DHCP relay device; the method comprises:

[0015] Acquire the access port VLAN of the terminal according to the DHCP request message sent by the terminal;

[0016] If the access port VLAN of the terminal is the default VLAN, adding VRF information corresponding to the default VLAN in a DHCP relay request message generated based on the DHCP request message, and sending the DHCP relay request message carrying the VRF information corresponding to the default VLAN to the SDN controller, so that the SDN controller allocates an IP address to the terminal from the address pool corresponding to the default VLAN according to the VRF information corresponding to the default VLAN in the DHCP relay request message;

[0017] The IP address allocated by the SDN controller is received and returned to the terminal.

[0018] In an optional embodiment, the method further comprises:

[0019] If the access port VLAN of the terminal is the authorized VLAN, adding VRF information corresponding to the authorized VLAN in a DHCP relay request message generated based on the DHCP request message, and sending the DHCP relay request message carrying the VRF information corresponding to the authorized VLAN to the SDN controller, so that the SDN controller allocates an IP address to the terminal from the address pool corresponding to the authorized VLAN according to the VRF information corresponding to the authorized VLAN in the DHCP relay request message;

[0020] The IP address allocated by the SDN controller is received and returned to the terminal.

[0021] In a third aspect, the present invention provides an access authentication system, comprising an SDN controller and a DHCP relay device, wherein the SDN controller is in communication connection with the DHCP relay device; the DHCP relay device records VRF information corresponding to a default VLAN and an authorized VLAN, the SDN controller is configured with an address pool corresponding to the default VLAN and an address pool corresponding to the authorized VLAN, the address pool corresponding to the default VLAN and the address pool corresponding to the authorized VLAN have the same IP address range and gateway address, and the address pool corresponding to the default VLAN and the address pool corresponding to the authorized VLAN are associated with different VRF information;

[0022] The DHCP relay device is used to obtain the access port VLAN of the terminal according to the DHCP request message sent by the terminal, and if the access port VLAN of the terminal is the default VLAN, add the VRF information corresponding to the default VLAN in the DHCP relay request message generated based on the DHCP request message, and send the DHCP relay request message carrying the VRF information corresponding to the default VLAN to the SDN controller;

[0023] The SDN controller is used to allocate an IP address to the terminal from the address pool corresponding to the default VLAN according to the VRF information corresponding to the default VLAN in the DHCP relay request message, return the allocated IP address to the terminal through the DHCP relay device, authenticate the terminal after obtaining the IP address, configure the access port VLAN of the terminal after successful authentication as the authorized VLAN, and synchronize the IP address allocated to the terminal in the address pool corresponding to the default VLAN to the allocation list of the address pool corresponding to the authorized VLAN.

[0024] In an optional implementation manner, the DHCP relay device is further configured to, if the access port VLAN of the terminal is the authorized VLAN, add VRF information corresponding to the authorized VLAN in a DHCP relay request message generated based on the DHCP request message, and send the DHCP relay request message carrying the VRF information corresponding to the authorized VLAN to the SDN controller;

[0025] The SDN controller is further configured to allocate an IP address to the terminal from an address pool corresponding to the authorized VLAN according to the VRF information corresponding to the authorized VLAN in the DHCP relay request message, and return the allocated IP address to the terminal through the DHCP relay device.

[0026] In a fourth aspect, the present invention provides an access authentication device, which is applied to an SDN controller, wherein the SDN controller is connected to a DHCP relay device in communication; the SDN controller is configured with an address pool corresponding to a default VLAN and an address pool corresponding to an authorized VLAN, wherein the IP address range and gateway address of the address pool corresponding to the default VLAN and the address pool corresponding to the authorized VLAN are the same, and the address pool corresponding to the default VLAN and the address pool corresponding to the authorized VLAN are associated with different VRF information; the device comprises:

[0027] A transceiver module, configured to receive a DHCP relay request message sent by the DHCP relay device based on a DHCP request message of a terminal; the DHCP relay request message carries VRF information corresponding to an access port VLAN of the terminal;

[0028] A processing module, configured to query the address pool associated with the VRF information in the DHCP relay request message; if the address pool associated with the VRF information in the DHCP relay request message is the address pool corresponding to the default VLAN, an IP address is allocated to the terminal from the address pool corresponding to the default VLAN;

[0029] The transceiver module is further used to return the allocated IP address to the terminal through the DHCP relay device;

[0030] The processing module is also used to authenticate the terminal after obtaining the IP address, configure the access port VLAN of the terminal after successful authentication as the authorized VLAN, and synchronize the IP address allocated to the terminal in the address pool corresponding to the default VLAN to the allocation list of the address pool corresponding to the authorized VLAN.

[0031] In a fifth aspect, the present invention provides an access authentication device, which is applied to a DHCP relay device, wherein the DHCP relay device is connected to an SDN controller for communication, and the DHCP relay device records VRF information corresponding to a default VLAN and an authorized VLAN; the device comprises:

[0032] The first transceiver module is used to receive a DHCP request message sent by a terminal and obtain an access port VLAN of the terminal;

[0033] A second transceiver module is configured to, if the access port VLAN of the terminal is the default VLAN, add VRF information corresponding to the default VLAN in a DHCP relay request message generated based on the DHCP request message, and send the DHCP relay request message carrying the VRF information corresponding to the default VLAN to the SDN controller, so that the SDN controller allocates an IP address to the terminal from an address pool corresponding to the default VLAN according to the VRF information corresponding to the default VLAN in the DHCP relay request message;

[0034] The second transceiver module is further used to receive the IP address assigned by the SDN controller;

[0035] The first transceiver module is further configured to return the IP address allocated by the SDN controller to the terminal.

[0036] In a sixth aspect, the present invention provides an electronic device, comprising a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the access authentication method as described in any one of the aforementioned embodiments.

[0037] In a seventh aspect, the present invention provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the access authentication method as described in any one of the aforementioned embodiments are implemented.

[0038] The access authentication method, device, system, electronic device and storage medium provided by the embodiment of the present invention configure an address pool corresponding to the default VLAN and an address pool corresponding to the authorized VLAN on the SDN controller, the IP address range and gateway address of the two address pools are the same, and the two address pools are associated with different VRF information. The SDN controller receives a DHCP relay request message sent by a DHCP relay device based on a DHCP request message of a terminal, the DHCP relay request message carries the VRF information corresponding to the access port VLAN of the terminal, when the address pool associated with the VRF information corresponding to the access port VLAN of the terminal is the address pool corresponding to the default VLAN, the SDN controller can allocate an IP address to the terminal from the address pool corresponding to the default VLAN, authenticate the terminal after obtaining the IP address, configure the access port VLAN of the terminal after successful authentication as the authorized VLAN, and synchronize the IP address allocated to the terminal in the address pool corresponding to the default VLAN to the allocation list of the address pool corresponding to the authorized VLAN. In this way, after the terminal is successfully authenticated, it can directly use the IP address obtained before authentication to communicate in the authorized VLAN after successful authentication. There is no need to wait for the terminal to renew its lease or manually trigger the terminal to re-acquire the IP address in the authorized VLAN before communication can be achieved. This effectively avoids the problem of network inaccessibility caused by the mismatch between the IP address obtained before the terminal authentication and the authorized VLAN after successful authentication.

[0039] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0041] Figure 1 A schematic diagram of an application scenario of the access authentication system provided by an embodiment of the present invention is shown;

[0042] Figure 2 A schematic diagram of a process flow of an access authentication method applied to an SDN controller provided by an embodiment of the present invention is shown;

[0043] Figure 3 Another schematic diagram of a flow chart of an access authentication method applied to an SDN controller provided by an embodiment of the present invention is shown;

[0044] Figure 4A schematic diagram of a process flow of an access authentication method applied to a DHCP relay device provided by an embodiment of the present invention is shown;

[0045] Figure 5 Another schematic diagram of a flow chart of an access authentication method applied to a DHCP relay device provided by an embodiment of the present invention is shown;

[0046] Figure 6 A functional module diagram of an access authentication device applied to an SDN controller provided by an embodiment of the present invention is shown;

[0047] Figure 7 A functional module diagram of an access authentication device applied to a DHCP relay device provided by an embodiment of the present invention is shown;

[0048] Figure 8 A block diagram of an electronic device provided by an embodiment of the present invention is shown.

[0049] Icon: 100 - SDN controller; 110 - memory; 120 - processor; 130 - communication module; 200 - DHCP relay device; 300 - terminal; 400 - terminal access device; 610 - transceiver module; 620 - processing module; 710 - first transceiver module; 720 - second transceiver module. DETAILED DESCRIPTION

[0050] The following will be combined with the accompanying drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0051] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present invention.

[0052] It should be noted that relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0053] Please refer to Figure 1 , is a schematic diagram of an application scenario of the access authentication system provided by an embodiment of the present invention. The access authentication system includes an SDN controller 100 and a DHCP relay device 200, the SDN controller 100 is communicatively connected to the DHCP relay device 200, and the terminal 300 is communicatively connected to the DHCP relay device 200 through a terminal access device 400.

[0054] In this embodiment, a DHCP Server and an authentication service may be deployed in the SDN controller 100. The DHCP relay device 200 may be a network device such as a router or a switch that supports the DHCP protocol. The terminal 300 is a terminal used by a user, including but not limited to a personal computer (PC), a tablet computer, a smart phone, a personal digital assistant (PDA), etc. The terminal access device 400 may be a gateway, a router, a switch, an access controller, a wireless access point, etc. The embodiment of the present invention does not limit the types of the SDN controller 100, the DHCP relay device 200, the terminal 300, and the terminal access device 400.

[0055] Among them, the DHCP relay device 200 records the VRF (Virtual Routing Forwarding) information corresponding to the default VLAN and the authorized VLAN, and the SDN controller 100 is configured with the address pool corresponding to the default VLAN and the address pool corresponding to the authorized VLAN. The IP address range and gateway address of the address pool corresponding to the default VLAN and the address pool corresponding to the authorized VLAN are the same, and the address pool corresponding to the default VLAN and the address pool corresponding to the authorized VLAN are associated with different VRF information.

[0056] In this embodiment, the VRF information may be a VRF name, which may be understood as the name of a layer-3 network corresponding to each VLAN.

[0057] The DHCP relay device 200 is used to obtain the access port VLAN of the terminal 300 according to the DHCP request message sent by the terminal 300. If the access port VLAN of the terminal 300 is the default VLAN, the VRF information corresponding to the default VLAN is added to the DHCP relay request message generated based on the DHCP request message broadcasted by the terminal 300, and the DHCP relay request message carrying the VRF information corresponding to the default VLAN is unicasted to the SDN controller 100.

[0058] In this embodiment, when the terminal 300 accesses the network through the terminal access device 400, the VLAN of the port (access port) of the terminal access device 400 connected to the terminal 300 is the default VLAN. The terminal 300 broadcasts a DHCP request message to the DHCP relay device 200 through the terminal access device 400. The DHCP request message received by the DHCP relay device 200 carries the access port VLAN of the terminal 300. The DHCP relay device 200 obtains the VLAN to which the interface receiving the DHCP request message belongs as the default VLAN, obtains the corresponding VRF information according to the default VLAN, and adds the VRF information of the default VLAN in the DHCP request message broadcasted by the terminal 300, obtains the corresponding DHCP relay request message, and sends the DHCP relay request message to the DHCP Server of the SDN controller 100 by unicast.

[0059] For example, a custom Option, such as Option 122, can be added to the DHCP relay request message, the length of Option 122 can be defined, such as 8 bytes, and the value of Option 122 can be set to the VRF information corresponding to the default VLAN. Then, the DHCP relay request message carrying the VRF information corresponding to the default VLAN is unicasted to the SDN controller 100.

[0060] The SDN controller 100 is used to allocate an IP address to the terminal 300 from the address pool corresponding to the default VLAN according to the VRF information corresponding to the default VLAN in the DHCP relay request message, and return the allocated IP address to the terminal 300 through the DHCP relay device, and authenticate the terminal 300 after obtaining the IP address, configure the access port VLAN of the terminal 300 after the authentication is successful as the authorized VLAN, and synchronize the IP address allocated to the terminal 300 in the address pool corresponding to the default VLAN to the allocation list of the address pool corresponding to the authorized VLAN.

[0061] In this embodiment, the SDN controller 100 supports Portal authentication, VLAN authorization, and DHCP Server, and the DHCP Server supports parsing custom options. The DHCP Server of the SDN controller 100 opens DHCP address pools for the default VLAN before terminal authentication and the authorized VLAN after terminal authentication, respectively. The IP address ranges and gateway addresses of the two address pools are consistent, and the two address pools are associated with different VRF information. When a DHCP relay request message is sent to the DHCP Server of the SDN controller 100, the DHCP Server of the SDN controller queries from the address pool list which address pool to allocate the IP address from according to the value of the custom Option in the DHCP relay request message. The address pool list records the association between different address pools and VRF information.

[0062] For example, after the SDN controller 100 receives the DHCP relay request message sent by the DHCP relay device 200, the value of Option 122 obtained from the DHCP relay request message by the DHCP Server is the VRF information corresponding to the default VLAN (the configured VRF name), and the associated address pool is queried in the address pool list according to the VRF information corresponding to the default VLAN. The associated address pool is the address pool corresponding to the default VLAN, and an IP address (such as IP1) is allocated from the address pool corresponding to the default VLAN, and a DHCP response message corresponding to the DHCP relay request message is generated and unicasted to the DHCP relay device 200.

[0063] After receiving the DHCP response message sent by the SDN controller 100, the DHCP relay device 200 converts the DHCP response message from unicast to a broadcast message of the default VLAN and returns it to the terminal 300. The terminal 300 performs portal authentication based on the assigned IP address, that is, the SDN controller 100 authenticates the terminal 300 after obtaining the IP address. After successful authentication, the SDN controller 100 sends a VLAN authorization based on the terminal 300 to the access port of the terminal 300 on the terminal access device 400, reallocates the access port of the terminal 300 to the authorized VLAN, and synchronizes the IP address assigned to the terminal 300 in the address pool corresponding to the default VLAN to the allocation list of the address pool corresponding to the authorized VLAN. At this time, the terminal 300 has been authorized to the new VLAN (authorized VLAN). For the terminal 300, its three-layer gateway and IP address have not changed, but the three-layer network is available at this time, and the user does not perceive the VLAN change.

[0064] In one embodiment, the DHCP relay device 200 is further used to add VRF information corresponding to the authorized VLAN in a DHCP relay request message generated based on the DHCP request message if the access port VLAN of the terminal 300 is an authorized VLAN, and unicast the DHCP relay request message carrying the VRF information corresponding to the authorized VLAN to the SDN controller 100; the SDN controller 100 is further used to allocate an IP address to the terminal 300 from the address pool corresponding to the authorized VLAN according to the VRF information corresponding to the authorized VLAN in the DHCP relay request message, and return the allocated IP address to the terminal 300 through the DHCP relay device 200.

[0065] In this embodiment, since the IP address assigned by the SDN controller 100 has a lease period, that is, the terminal 300 can only use the assigned IP address within a period of time, the length of the lease period can be configured on the SDN controller 100. When the use period of the IP address reaches a certain length of time (such as half of the lease period), the terminal 300 broadcasts and sends a DHCP renewal request message. At this time, the access port VLAN of the terminal 300 is an authorized VLAN. After the DHCP relay device 200 receives the DHCP renewal request message broadcast by the terminal, the DHCP relay device 200 obtains that the VLAN to which the interface receiving the DHCP renewal request message belongs is the authorized VLAN, obtains the corresponding VRF information according to the authorized VLAN, and adds the VRF information of the authorized VLAN to the DHCP renewal request message sent by the terminal 300, obtains the corresponding DHCP relay request message, and sends the DHCP relay request message to the DHCP Server of the SDN controller 100 by unicast.

[0066] After the SDN controller 100 receives the DHCP relay request message sent by the DHCP relay device 200 in unicast, the value of the custom Option obtained from the DHCP relay request message is the VRF information corresponding to the authorized VLAN. According to the VRF information corresponding to the authorized VLAN, the associated address pool is queried in the address pool list. The associated address pool is the address pool corresponding to the authorized VLAN, and the IP address is allocated from the address pool corresponding to the authorized VLAN. A DHCP response message corresponding to the DHCP relay request message is generated and unicasted to the DHCP relay device 200. After the DHCP relay device 200 receives the DHCP response message sent by the SDN controller 100, it converts the DHCP response message from unicast to a broadcast message of the authorized VLAN and returns it to the terminal 300. At this time, the terminal 300 obtains the IP address from the address pool of the authorized VLAN, and the three-layer network is still accessible.

[0067] Please refer to Figure 2, is a flow chart of an access authentication method applied to the SDN controller 100 provided in an embodiment of the present invention. It should be noted that the access authentication method in the embodiment of the present invention is not based on Figure 2 It should be understood that in other embodiments, the order of some steps in the access authentication method of the embodiment of the present invention can be interchanged according to actual needs, or some steps can be omitted or deleted. Figure 2 The specific process shown is described in detail.

[0068] Step S201: receiving a DHCP relay request message sent by a DHCP relay device based on a DHCP request message of a terminal; the DHCP relay request message carries VRF information corresponding to an access port VLAN of the terminal.

[0069] In this embodiment, the VRF information corresponding to the access port VLAN is added to the DHCP relay request message by the DHCP relay device 200. When the terminal 300 accesses the network through the terminal access device 400, the access port VLAN of the terminal is the default VLAN. After the DHCP relay device 200 receives the DHCP request message broadcasted by the terminal, it obtains the corresponding VRF information according to the access port VLAN of the terminal 300 carried in the message, that is, the VRF information corresponding to the default VLAN, and generates a DHCP relay request message corresponding to the DHCP request message, and then adds the VRF information corresponding to the default VLAN to the DHCP relay request message corresponding to the DHCP request message, and unicasts the DHCP relay request message to the DHCP Server of the SDN controller 100.

[0070] Step S202: query the address pool associated with the VRF information in the DHCP relay request message.

[0071] In this embodiment, after receiving the DHCP relay request message unicasted by the DHCP relay device 200, the SDN controller 100 queries the associated address pool according to the VRF information corresponding to the default VLAN to find that the address pool is the address pool corresponding to the default VLAN.

[0072] Step S203: If the address pool associated with the VRF information in the DHCP relay request message is the address pool corresponding to the default VLAN, an IP address is allocated to the terminal from the address pool corresponding to the default VLAN and the allocated IP address is returned to the terminal through the DHCP relay device.

[0073] In this embodiment, when the SDN controller 100 finds that the address pool associated with the VRF information in the DHCP relay request message is the address pool corresponding to the default VLAN, it allocates an IP address from the address pool corresponding to the default VLAN, and generates a DHCP response message corresponding to the DHCP relay request message and unicasts it to the DHCP relay device 200. After receiving the DHCP response message, the DHCP relay device 200 converts the DHCP response message from unicast to a broadcast message of the default VLAN and returns it to the terminal 300.

[0074] Step S204, authenticate the terminal after obtaining the IP address, configure the access port VLAN of the terminal after successful authentication as the authorized VLAN, and synchronize the IP address allocated to the terminal in the address pool corresponding to the default VLAN to the allocation list of the address pool corresponding to the authorized VLAN.

[0075] In this embodiment, the terminal 300 performs portal authentication based on the assigned IP address, that is, the SDN controller 100 authenticates the terminal 300 after obtaining the IP address. After successful authentication, the SDN controller 100 issues a VLAN authorization based on the terminal 300 to the access port of the terminal 300 on the terminal access device 400, reallocates the access port of the terminal 300 to the authorized VLAN, and synchronizes the IP address assigned to the terminal 300 in the address pool corresponding to the default VLAN to the allocation list of the address pool corresponding to the authorized VLAN. At this time, the terminal 300 has been authorized to the new VLAN (authorized VLAN). For the terminal 300, its three-layer gateway and IP address have not changed, but the three-layer network is available at this time, and the user does not perceive the VLAN change.

[0076] In one embodiment, see Figure 3 The access authentication method provided by the embodiment of the present invention may further include:

[0077] Step S301: If the address pool associated with the VRF information in the DHCP relay request message is the address pool corresponding to the authorized VLAN, an IP address is allocated to the terminal from the address pool corresponding to the authorized VLAN and the allocated IP address is returned to the terminal through the DHCP relay device.

[0078] In this embodiment, when the usage period of the IP address allocated to the terminal 300 reaches a certain period of time, the terminal 300 can broadcast and send a DHCP renewal request message. At this time, the access port VLAN of the terminal 300 is an authorized VLAN. After the DHCP relay device 200 receives the DHCP renewal request message broadcast by the terminal 300, it obtains the VLAN to which the interface receiving the DHCP renewal request message belongs as the authorized VLAN. The DHCP relay device 200 obtains the corresponding VRF information according to the authorized VLAN, and generates a DHCP relay request message corresponding to the DHCP request message. In the DHCP relay request message, the custom Option is set as the VRF information corresponding to the authorized VLAN, and then the DHCP relay request message carrying the VRF information corresponding to the authorized VLAN is unicasted to the SDN controller 100.

[0079] After the SDN controller 100 receives the DHCP relay request message sent by the DHCP relay device 200 in unicast, the value of the custom Option obtained from the DHCP relay request message is the VRF information corresponding to the authorized VLAN. According to the VRF information corresponding to the authorized VLAN, the associated address pool is queried in the address pool list as the address pool corresponding to the authorized VLAN, so the IP address is allocated from the address pool corresponding to the authorized VLAN, and a DHCP response message corresponding to the DHCP relay request message is generated and unicasted to the DHCP relay device 200. After the DHCP relay device 200 receives the DHCP response message sent by the SDN controller 100, it converts the DHCP response message from unicast to a broadcast message of the authorized VLAN and returns it to the terminal 300. At this time, the terminal 300 obtains the IP address from the address pool of the authorized VLAN, and the three-layer network is still accessible.

[0080] Please refer to Figure 4 , is a flow chart of an access authentication method applied to a DHCP relay device 200 provided in an embodiment of the present invention. It should be noted that the access authentication method in the embodiment of the present invention is not based on Figure 4 It should be understood that in other embodiments, the order of some steps in the access authentication method of the embodiment of the present invention can be interchanged according to actual needs, or some steps can be omitted or deleted. Figure 4 The specific process shown is described in detail.

[0081] Step S401: Acquire the access port VLAN of the terminal according to the DHCP request message sent by the terminal.

[0082] In this embodiment, when the terminal 300 accesses the network through the terminal access device 400, the access port VLAN of the terminal is the default VLAN, and the DHCP relay device 200 can determine the access port VLAN of the terminal according to the VLAN to which the interface receiving the DHCP request message belongs.

[0083] Step S402: If the access port VLAN of the terminal is the default VLAN, VRF information corresponding to the default VLAN is added to the DHCP relay request message generated based on the DHCP request message, and the DHCP relay request message carrying the VRF information corresponding to the default VLAN is unicasted to the SDN controller, so that the SDN controller allocates an IP address to the terminal from the address pool corresponding to the default VLAN according to the VRF information corresponding to the default VLAN in the DHCP relay request message.

[0084] In this embodiment, the DHCP relay device 200 determines that the access port VLAN of the terminal 300 carried in the DHCP request message of the terminal is the default VLAN, then obtains the VRF information corresponding to the default VLAN, generates the corresponding DHCP relay request message, then adds the VRF information corresponding to the default VLAN to the generated DHCP relay request message, and unicasts the DHCP relay request message to the SDN controller 100. After receiving the DHCP relay request message sent by the DHCP relay device 200, the SDN controller 100 queries the associated address pool according to the VRF information corresponding to the default VLAN, and finds that it is the address pool corresponding to the default VLAN, then allocates an IP address from the address pool corresponding to the default VLAN, and generates a DHCP response message corresponding to the DHCP relay request message, and unicasts it to the DHCP relay device 200.

[0085] Step S403: receiving the IP address assigned by the SDN controller and returning it to the terminal.

[0086] In this embodiment, after receiving the DHCP response message sent by the SDN controller 100, the DHCP relay device 200 converts the DHCP response message from unicast to a broadcast message of the default VLAN and returns it to the terminal 300. The terminal 300 performs portal authentication based on the assigned IP address, that is, the SDN controller 100 authenticates the terminal 300 after obtaining the IP address. After successful authentication, the SDN controller 100 sends a VLAN authorization based on the terminal 300 to the access port of the terminal 300 on the terminal access device 400, reallocates the access port of the terminal 300 to the authorized VLAN, and synchronizes the IP address assigned to the terminal 300 in the address pool corresponding to the default VLAN to the allocation list of the address pool corresponding to the authorized VLAN. At this time, the terminal 300 has been authorized to the new VLAN (authorized VLAN). For the terminal 300, its three-layer gateway and IP address have not changed, but the three-layer network is available at this time, and the user does not perceive the VLAN change.

[0087] In one embodiment, see Figure 5 The access authentication method provided by the embodiment of the present invention may further include:

[0088] Step S501: If the access port VLAN of the terminal is an authorized VLAN, VRF information corresponding to the authorized VLAN is added to the DHCP relay request message generated based on the DHCP request message, and the DHCP relay request message carrying the VRF information corresponding to the authorized VLAN is sent to the SDN controller, so that the SDN controller allocates an IP address to the terminal from the address pool corresponding to the authorized VLAN according to the VRF information corresponding to the authorized VLAN in the DHCP relay request message.

[0089] In this embodiment, when the usage period of the IP address allocated to the terminal 300 reaches a certain length of time, the terminal 300 can broadcast and send a DHCP renewal request message. At this time, the access port VLAN of the terminal 300 is an authorized VLAN, that is, the DHCP relay device 200 determines that the access port VLAN of the terminal 300 is an authorized VLAN based on the VLAN to which the interface receiving the DHCP renewal request message belongs. At this time, the corresponding VRF information is obtained according to the authorized VLAN, and a corresponding DHCP relay request message is generated. The custom Option is set as the VRF information corresponding to the authorized VLAN in the DHCP relay request message, and then the DHCP relay request message carrying the VRF information corresponding to the authorized VLAN is unicasted to the SDN controller 100. After the SDN controller 100 receives the DHCP relay request message unicasted by the DHCP relay device 200, the value of the custom Option obtained from the DHCP relay request message is the VRF information corresponding to the authorized VLAN. At this time, according to the VRF information corresponding to the authorized VLAN, the associated address pool is queried in the address pool list, which is the address pool corresponding to the authorized VLAN. Therefore, an IP address is allocated from the address pool corresponding to the authorized VLAN, and a DHCP response message corresponding to the DHCP relay request message is generated and unicasted to the DHCP relay device 200.

[0090] Step S502: Receive the IP address assigned by the SDN controller and return it to the terminal.

[0091] In this embodiment, after receiving the DHCP response message sent by the SDN controller 100, the DHCP relay device 200 converts the DHCP response message from unicast to a broadcast message of the default VLAN and returns it to the terminal 300. At this time, the terminal 300 obtains an IP address from the address pool of the authorized VLAN, and the three-layer network is still accessible.

[0092] In order to execute the corresponding steps in the above embodiments and various possible methods, a method for implementing the access authentication device is given below. Figure 6 , which is a functional module diagram of an access authentication device applied to an SDN controller 100 provided in an embodiment of the present invention. It should be noted that the basic principle and technical effects of the access authentication device provided in this embodiment are the same as those of the above embodiments. For the sake of brief description, for parts not mentioned in this embodiment, reference can be made to the corresponding contents in the above embodiments. The access authentication device includes a transceiver module 610 and a processing module 620.

[0093] The transceiver module 610 is used to receive a DHCP relay request message sent by a DHCP relay device based on a DHCP request message of a terminal; the DHCP relay request message carries VRF information corresponding to the access port VLAN of the terminal.

[0094] The processing module 620 is used to query the address pool associated with the VRF information in the DHCP relay request message; if the address pool associated with the VRF information in the DHCP relay request message is the address pool corresponding to the default VLAN, an IP address is allocated to the terminal from the address pool corresponding to the default VLAN.

[0095] The transceiver module 610 is also used to return the allocated IP address to the terminal via the DHCP relay device;

[0096] The processing module 620 is also used to authenticate the terminal after obtaining the IP address, configure the access port VLAN of the terminal after successful authentication as the authorized VLAN, and synchronize the IP address allocated to the terminal in the address pool corresponding to the default VLAN to the allocation list of the address pool corresponding to the authorized VLAN.

[0097] Optionally, the processing module 620 is further used to allocate an IP address to the terminal from the address pool corresponding to the authorized VLAN if the address pool associated with the VRF information in the DHCP relay request message is the address pool corresponding to the authorized VLAN; the transceiver module 610 is further used to return the allocated IP address to the terminal through the DHCP relay device.

[0098] Please refer to Figure 7 , is a functional module diagram of an access authentication device applied to a DHCP relay device 200 provided in an embodiment of the present invention. It should be noted that the basic principle and technical effects of the access authentication device provided in this embodiment are the same as those of the above embodiments. For the sake of brief description, for parts not mentioned in this embodiment, reference can be made to the corresponding contents in the above embodiments. The access authentication device includes a first transceiver module 710 and a second transceiver module 720.

[0099] The first transceiver module 710 is configured to receive a DHCP request message sent by a terminal and obtain an access port VLAN of the terminal.

[0100] The second transceiver module 720 is used to add VRF information corresponding to the default VLAN in a DHCP relay request message generated based on the DHCP request message if the access port VLAN of the terminal is the default VLAN, and send the DHCP relay request message carrying the VRF information corresponding to the default VLAN to the SDN controller, so that the SDN controller allocates an IP address to the terminal from the address pool corresponding to the default VLAN according to the VRF information corresponding to the default VLAN in the DHCP relay request message.

[0101] The second transceiver module 720 is further configured to receive an IP address allocated by the SDN controller.

[0102] The first transceiver module 710 is further configured to return the IP address allocated by the SDN controller to the terminal.

[0103] Optionally, the second transceiver module 720 is also used to add VRF information corresponding to the authorized VLAN in a DHCP relay request message generated based on the DHCP request message if the access port VLAN of the terminal is an authorized VLAN, and send the DHCP relay request message carrying the VRF information corresponding to the authorized VLAN to the SDN controller, so that the SDN controller allocates an IP address to the terminal from the address pool corresponding to the authorized VLAN according to the VRF information corresponding to the authorized VLAN in the DHCP relay request message; the second transceiver module 720 is also used to receive the IP address allocated by the SDN controller, and the first transceiver module 710 is also used to return the IP address allocated by the SDN controller to the terminal.

[0104] Please refer to Figure 8 , is a block diagram of an electronic device that can implement the above-mentioned SDN controller 100 and DHCP relay device 200 provided by an embodiment of the present invention. The electronic device includes a memory 110, a processor 120 and a communication module 130. The memory 110, the processor 120 and the communication module 130 are electrically connected to each other directly or indirectly to realize data transmission or interaction. For example, these components can be electrically connected to each other through one or more communication buses or signal lines.

[0105] The memory 110 is used to store programs or data. The memory 110 may be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), etc.

[0106] The processor 120 is used to read / write data or programs stored in the memory 110 and execute corresponding functions. For example, when the computer program stored in the memory 110 is executed by the processor 120, the access authentication method disclosed in the above embodiments can be implemented.

[0107] The communication module 130 is used to establish a communication connection between the electronic device and other devices through a network, and to send and receive data through the network.

[0108] It should be understood that Figure 8 The structure shown is only a schematic diagram of the structure of the electronic device. The electronic device may also include Figure 8 More or fewer components as shown, or with Figure 8 Different configurations are shown. Figure 8 Each component shown in the figure can be implemented by hardware, software or a combination thereof.

[0109] The embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by the processor 120, the access authentication method disclosed in the above embodiments is implemented.

[0110] In summary, the access authentication method, device, system, electronic device and storage medium provided by the embodiments of the present invention configure an address pool corresponding to the default VLAN and an address pool corresponding to the authorized VLAN on the SDN controller, the IP address range and gateway address of the two address pools are the same, and the two address pools are associated with different VRF information. The SDN controller receives a DHCP relay request message sent by a DHCP relay device based on a DHCP request message of a terminal, the DHCP relay request message carries the VRF information corresponding to the access port VLAN of the terminal, when the address pool associated with the VRF information corresponding to the access port VLAN of the terminal is the address pool corresponding to the default VLAN, the SDN controller can allocate an IP address to the terminal from the address pool corresponding to the default VLAN, authenticate the terminal after obtaining the IP address, configure the access port VLAN of the terminal after successful authentication as the authorized VLAN, and synchronize the IP address allocated to the terminal in the address pool corresponding to the default VLAN to the allocation list of the address pool corresponding to the authorized VLAN. In this way, after the terminal is successfully authenticated, the IP address obtained before authentication can be directly used to communicate in the authorized VLAN after successful authentication, without waiting for the terminal to renew its lease or manually triggering the terminal to re-acquire the IP address in the authorized VLAN to communicate, effectively avoiding the problem of network inaccessibility caused by the mismatch between the IP address obtained before the terminal authentication and the authorized VLAN after successful authentication. In the existing solution, after the terminal is successfully authenticated, the IP address assigned before authentication cannot be directly used for communication, and the IP address needs to be re-acquired, which at least causes the network to be disconnected in seconds or the network is unavailable. However, by adopting the access authentication scheme of the present invention, the network is immediately available after VLAN authorization in the Portal authentication scenario, and the user does not perceive the VLAN change.

[0111] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present invention. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0112] In addition, the functional modules in the various embodiments of the present invention may be integrated together to form an independent part, or each module may exist independently, or two or more modules may be integrated to form an independent part.

[0113] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0114] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. An access authentication method, characterized in that: Applied to an SDN controller, the SDN controller is connected to a DHCP relay device; the SDN controller is configured with an address pool corresponding to a default VLAN and an address pool corresponding to an authorized VLAN, the IP address range and gateway address of the address pool corresponding to the default VLAN and the address pool corresponding to the authorized VLAN are the same, and the address pool corresponding to the default VLAN and the address pool corresponding to the authorized VLAN are associated with different virtual routing forwarding VRF information; the method comprises: Receiving a DHCP relay request message sent by the DHCP relay device based on the DHCP request message of the terminal; the DHCP relay request message carries VRF information corresponding to the access port VLAN of the terminal; Querying the address pool associated with the VRF information in the DHCP relay request message; If the address pool associated with the VRF information in the DHCP relay request message is the address pool corresponding to the default VLAN, an IP address is allocated to the terminal from the address pool corresponding to the default VLAN and the allocated IP address is returned to the terminal through the DHCP relay device; Authenticate the terminal after obtaining the IP address, configure the access port VLAN of the terminal after successful authentication as the authorized VLAN, and synchronize the IP address allocated to the terminal in the address pool corresponding to the default VLAN to the allocation list of the address pool corresponding to the authorized VLAN.

2. The access authentication method according to claim 1, characterized in that: The method further comprises: If the address pool associated with the VRF information in the DHCP relay request message is the address pool corresponding to the authorized VLAN, an IP address is allocated to the terminal from the address pool corresponding to the authorized VLAN and the allocated IP address is returned to the terminal through the DHCP relay device.

3. An access authentication method, characterized in that: Applied to a DHCP relay device, the DHCP relay device is connected to an SDN controller for communication, and the DHCP relay device records VRF information corresponding to a default VLAN and an authorized VLAN; the method comprises: Acquire the access port VLAN of the terminal according to the DHCP request message sent by the terminal; If the access port VLAN of the terminal is the default VLAN, adding VRF information corresponding to the default VLAN in a DHCP relay request message generated based on the DHCP request message, and sending the DHCP relay request message carrying the VRF information corresponding to the default VLAN to the SDN controller, so that the SDN controller allocates an IP address to the terminal from the address pool corresponding to the default VLAN according to the VRF information corresponding to the default VLAN in the DHCP relay request message; The IP address allocated by the SDN controller is received and returned to the terminal.

4. The access authentication method according to claim 3, characterized in that: The method further comprises: If the access port VLAN of the terminal is the authorized VLAN, adding VRF information corresponding to the authorized VLAN in a DHCP relay request message generated based on the DHCP request message, and sending the DHCP relay request message carrying the VRF information corresponding to the authorized VLAN to the SDN controller, so that the SDN controller allocates an IP address to the terminal from the address pool corresponding to the authorized VLAN according to the VRF information corresponding to the authorized VLAN in the DHCP relay request message; The IP address allocated by the SDN controller is received and returned to the terminal.

5. An access authentication system, characterized in that: The invention comprises an SDN controller and a DHCP relay device, wherein the SDN controller is in communication connection with the DHCP relay device; the DHCP relay device records VRF information corresponding to the default VLAN and the authorized VLAN, the SDN controller is configured with an address pool corresponding to the default VLAN and an address pool corresponding to the authorized VLAN, the IP address range and gateway address of the address pool corresponding to the default VLAN and the address pool corresponding to the authorized VLAN are the same, and the address pool corresponding to the default VLAN and the address pool corresponding to the authorized VLAN are associated with different VRF information; The DHCP relay device is used to obtain the access port VLAN of the terminal according to the DHCP request message sent by the terminal, and if the access port VLAN of the terminal is the default VLAN, add the VRF information corresponding to the default VLAN in the DHCP relay request message generated based on the DHCP request message, and send the DHCP relay request message carrying the VRF information corresponding to the default VLAN to the SDN controller; The SDN controller is used to allocate an IP address to the terminal from the address pool corresponding to the default VLAN according to the VRF information corresponding to the default VLAN in the DHCP relay request message, return the allocated IP address to the terminal through the DHCP relay device, authenticate the terminal after obtaining the IP address, configure the access port VLAN of the terminal after successful authentication as the authorized VLAN, and synchronize the IP address allocated to the terminal in the address pool corresponding to the default VLAN to the allocation list of the address pool corresponding to the authorized VLAN.

6. The access authentication system according to claim 5, characterized in that: The DHCP relay device is further configured to, if the access port VLAN of the terminal is the authorized VLAN, add VRF information corresponding to the authorized VLAN in a DHCP relay request message generated based on the DHCP request message, and send the DHCP relay request message carrying the VRF information corresponding to the authorized VLAN to the SDN controller; The SDN controller is further configured to allocate an IP address to the terminal from an address pool corresponding to the authorized VLAN according to the VRF information corresponding to the authorized VLAN in the DHCP relay request message, and return the allocated IP address to the terminal through the DHCP relay device.

7. An access authentication device, characterized in that: Applied to an SDN controller, the SDN controller is connected to a DHCP relay device in communication; the SDN controller is configured with an address pool corresponding to a default VLAN and an address pool corresponding to an authorized VLAN, the IP address range and gateway address of the address pool corresponding to the default VLAN and the address pool corresponding to the authorized VLAN are the same, and the address pool corresponding to the default VLAN and the address pool corresponding to the authorized VLAN are associated with different VRF information; the device comprises: A transceiver module, configured to receive a DHCP relay request message sent by the DHCP relay device based on a DHCP request message of a terminal; the DHCP relay request message carries VRF information corresponding to an access port VLAN of the terminal; A processing module, configured to query the address pool associated with the VRF information in the DHCP relay request message; if the address pool associated with the VRF information in the DHCP relay request message is the address pool corresponding to the default VLAN, an IP address is allocated to the terminal from the address pool corresponding to the default VLAN; The transceiver module is further used to return the allocated IP address to the terminal through the DHCP relay device; The processing module is also used to authenticate the terminal after obtaining the IP address, configure the access port VLAN of the terminal after successful authentication as the authorized VLAN, and synchronize the IP address allocated to the terminal in the address pool corresponding to the default VLAN to the allocation list of the address pool corresponding to the authorized VLAN.

8. An access authentication device, characterized in that: Applied to a DHCP relay device, the DHCP relay device is connected to an SDN controller for communication, and the DHCP relay device records VRF information corresponding to a default VLAN and an authorized VLAN; the device comprises: The first transceiver module is used to receive a DHCP request message sent by a terminal and obtain an access port VLAN of the terminal; A second transceiver module is configured to, if the access port VLAN of the terminal is the default VLAN, add VRF information corresponding to the default VLAN in a DHCP relay request message generated based on the DHCP request message, and send the DHCP relay request message carrying the VRF information corresponding to the default VLAN to the SDN controller, so that the SDN controller allocates an IP address to the terminal from an address pool corresponding to the default VLAN according to the VRF information corresponding to the default VLAN in the DHCP relay request message; The second transceiver module is further used to receive the IP address assigned by the SDN controller; The first transceiver module is further configured to return the IP address allocated by the SDN controller to the terminal.

9. An electronic device, characterized in that: The method comprises a processor, a memory and a computer program stored in the memory and executable on the processor, wherein the computer program implements the steps of the access authentication method according to any one of claims 1 to 4 when executed by the processor.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the access authentication method according to any one of claims 1 to 4 are implemented.

Images