Terminal authentication method and device, access equipment and medium

Abstract

The embodiment of the invention provides a terminal authentication method and device, access equipment and a medium, and relates to the technical field of communication, the method is applied to the access equipment, and the method comprises the following steps: sending a first message to each authentication server in a plurality of authentication servers, the first message being used for requesting the authentication server to perform access authentication on a terminal; and if a second message sent by any one authentication server is received and the second message is the first second message sent by the plurality of authentication servers after receiving the first message, a third message is sent to the terminal, and the second message and the third message are both used for indicating that the terminal access authentication is successful. In this way, the problem of terminal online failure caused by server faults can be avoided.

Description

Terminal authentication method, device, access equipment and medium Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a terminal authentication method, apparatus, access device, and medium. Background Art

[0002] The 802.1X protocol is a port-based network access control protocol that authenticates connected terminals at the ports of LAN access devices to control their access to network resources. Within the 802.1X protocol, the Extensible Authentication Protocol (EAP) can be used to exchange authentication information between terminals, access devices, and authentication servers.

[0003] When a terminal needs to access network resources, it sends an EAP message to the access device. The access device encapsulates the user identity information carried in the EAP message into an access authentication message and sends it to the authentication server. The authentication server verifies the user identity information. If the verification is successful, it returns an authentication success message to the access device, which contains the user's permission information. After receiving the authentication success message, the access device grants the user the appropriate permissions based on the permission information, allowing the terminal to access network resources.

[0004] However, if the authentication server fails, the access device cannot receive the authentication success message replied by the authentication server, and thus cannot obtain the user's permission information, resulting in terminal access authentication failure and inability to access network resources.

[0005] Summary of the Invention

[0006] The purpose of the embodiments of the present application is to provide a terminal authentication method, apparatus, access device, and medium, which can avoid the problem of terminal online failure caused by server failure. The specific technical solution is as follows:

[0007] In a first aspect, an embodiment of the present application provides a terminal authentication method, which is applied to an access device and includes:

[0008] Sending a first message to each of the multiple authentication servers, wherein the first message is used to request the authentication server to perform access authentication on the terminal;

[0009] If a second message sent by any authentication server is received and the second message is the first second message sent by the multiple authentication servers after receiving the first message, a third message is sent to the terminal, and the second message and the third message are both used to indicate that the terminal access authentication is successful.

[0010] In a possible implementation, after sending the first message to the multiple authentication servers, the method further includes:

[0011] If a fourth message sent by any authentication server is received and the fourth message is the first fourth message sent by the multiple authentication servers after receiving the first message, sending a fifth message to the terminal, where the fifth message includes authentication parameters, and the authentication parameters are carried by the EAP message included in the fourth message;

[0012] receiving a sixth message sent by the terminal, where the sixth message includes user identity information, and the user identity information is encrypted using the authentication parameter;

[0013] A seventh message is sent to each authentication server respectively, where the seventh message includes the sixth message and the EAP message, so that the authentication server verifies the user identity information based on the authentication parameters.

[0014] In a possible implementation, after sending the first message to the multiple authentication servers, the method further includes:

[0015] If, within the first preset time period, the number of eighth messages received is equal to the number of the multiple authentication servers, and the authentication result carried by each eighth message indicates that the terminal access authentication fails, then the authentication result of each server for the terminal is recorded as access authentication failure;

[0016] A ninth message is sent to the terminal, where the ninth message is used to indicate that the terminal access authentication fails.

[0017] In a possible implementation, after sending the first message to the multiple authentication servers, the method further includes:

[0018] After the first preset time has elapsed, if no message is received from any authentication server, the authentication result of each server on the terminal is recorded as unreachable authentication server;

[0019] A ninth message is sent to the terminal, where the ninth message is used to indicate that the terminal access authentication fails.

[0020] In a possible implementation, after sending the first message to the multiple authentication servers, the method further includes:

[0021] If, within the first preset time period, eighth messages sent by the first number of authentication servers are received, and the authentication result carried by each eighth message indicates that the terminal access authentication fails, then the authentication results of the first number of authentication servers for the terminal are respectively recorded as access authentication failure;

[0022] After the first preset time has elapsed, if no messages are received from the second number of authentication servers among the multiple servers, recording the authentication results of the second number of authentication servers on the terminal as unreachable authentication servers;

[0023] Sending a ninth message or a tenth message to the terminal, where the ninth message is used to indicate that the terminal access authentication fails, and the tenth message is used to indicate that the terminal access authentication succeeds, and the sum of the first number and the second number is the same as the number of the multiple authentication servers.

[0024] In a possible implementation, after sending the first message to the multiple authentication servers, the method further includes:

[0025] If, within the second preset time period, the same number of eighth messages as the number of the multiple authentication servers is received, and the authentication result carried by each eighth message indicates that the terminal access authentication fails, then the authentication result of each server for the terminal is recorded as access authentication failure;

[0026] A ninth message is sent to the terminal, where the ninth message is used to indicate that the terminal access authentication fails.

[0027] In a possible implementation, after sending the first message to the multiple authentication servers, the method further includes:

[0028] After the second preset time has elapsed, if no message is received from any authentication server, the authentication result of each server on the terminal is recorded as unreachable authentication server;

[0029] A ninth message is sent to the terminal, where the ninth message is used to indicate that the terminal access authentication fails.

[0030] In a possible implementation, after sending the first message to the multiple authentication servers, the method further includes:

[0031] If, within the second preset time period, eighth messages sent by the third number of authentication servers are received, and the authentication result carried by each eighth message indicates that the terminal access authentication fails, then the authentication results of the third number of authentication servers for the terminal are respectively recorded as access authentication failure;

[0032] After the second preset time has expired, if no messages are received from a fourth number of authentication servers among the plurality of servers, recording the authentication results of the fourth number of authentication servers on the terminal as unreachable authentication servers;

[0033] A ninth message or a tenth message is sent to the terminal, where the ninth message is used to indicate that the terminal access authentication fails, and the tenth message is used to indicate that the terminal access authentication succeeds, and the sum of the third number and the fourth number is the same as the number of the multiple authentication servers.

[0034] In a possible implementation manner, the seventh message includes an EAP message attribute, and the EAP message attribute is used to carry the EAP message.

[0035] In a possible implementation, the length of the EAP message attribute is a preset length;

[0036] If the length of the EAP message is greater than the preset length, the seventh message includes a plurality of EAP message attributes, and the EAP message is carried in the plurality of EAP message attributes in a fragmented form.

[0037] In a possible implementation, the access device is connected to multiple authentication servers; and sending the first message to the multiple authentication servers includes:

[0038] selecting a group of authentication servers from the multiple groups of authentication servers in a load-sharing manner, and sending the first message to the selected group of authentication servers; or

[0039] A preset number of authentication servers are selected from each group of authentication servers included in the multiple groups of authentication servers in a load sharing manner, and the first message is sent to the selected authentication servers.

[0040] In a second aspect, an embodiment of the present application provides a terminal authentication device, which is applied to an access device and includes:

[0041] A sending module, configured to send a first message to each of the multiple authentication servers, wherein the first message is used to request the authentication server to perform access authentication on the terminal;

[0042] The receiving module is configured to trigger the sending module to send a third message to the terminal if a second message sent by any authentication server is received and the second message is the first second message sent by the multiple authentication servers after receiving the first message. The second message and the third message are both used to indicate that the terminal access authentication is successful.

[0043] In one possible implementation, the receiving module is further configured to trigger the sending module to send a fifth message to the terminal if a fourth message sent by any authentication server is received, and the fourth message is the first fourth message sent by the multiple authentication servers after receiving the first message, where the fifth message includes authentication parameters, and the authentication parameters are carried by the EAP message included in the fourth message;

[0044] The receiving module is further configured to receive a sixth message sent by the terminal, the sixth message including user identity information, the user identity information being encrypted using the authentication parameter;

[0045] The sending module is further configured to send a seventh message to each authentication server respectively, where the seventh message includes the sixth message and the EAP message, so that the authentication server verifies the user identity information based on the authentication parameters.

[0046] In a possible implementation, the apparatus further includes a recording module:

[0047] The receiving module is further configured to trigger the recording module to record the authentication result of each server for the terminal as access authentication failure if, within a first preset time period, the same number of eighth messages as the number of the plurality of authentication servers is received, and the authentication result carried by each eighth message indicates that the terminal access authentication has failed;

[0048] The sending module is further configured to send a ninth message to the terminal, where the ninth message is configured to indicate that the terminal access authentication has failed.

[0049] In a possible implementation, the recording module is further configured to, if no message is received from any authentication server after a first preset time period, respectively record the authentication result of each server for the terminal as "authentication server unreachable";

[0050] The sending module is further configured to send a ninth message to the terminal, where the ninth message is configured to indicate that the terminal access authentication has failed.

[0051] In one possible implementation, the receiving module is further configured to, if receiving eighth messages sent by a first number of authentication servers within a first preset time period, and the authentication results carried by each eighth message indicate that the terminal access authentication fails, trigger the recording module to respectively record that the authentication results of the first number of authentication servers for the terminal are access authentication failures;

[0052] The recording module is further configured to, if no messages sent by the second number of authentication servers among the multiple servers are received after the first preset time period, respectively record the authentication results of the second number of authentication servers for the terminal as unreachable authentication servers;

[0053] The sending module is further used to send a ninth message or a tenth message to the terminal, the ninth message is used to indicate that the terminal access authentication failed, and the tenth message is used to indicate that the terminal access authentication succeeded, and the sum of the first number and the second number is the same as the number of the multiple authentication servers.

[0054] In one possible implementation, the receiving module is further configured to trigger the recording module to record, respectively, the authentication result of each server for the terminal as access authentication failure if, within a second preset time period, the receiving module receives the same number of eighth messages as the number of the multiple authentication servers, and the authentication result carried by each eighth message indicates that the terminal access authentication has failed;

[0055] The sending module is further configured to send a ninth message to the terminal, where the ninth message is configured to indicate that the terminal access authentication has failed.

[0056] In a possible implementation, the recording module is further configured to, if no message is received from any authentication server after a second preset time period, respectively record the authentication result of each server for the terminal as "authentication server unreachable";

[0057] The sending module is further configured to send a ninth message to the terminal, where the ninth message is configured to indicate that the terminal access authentication has failed.

[0058] In one possible implementation, the receiving module is further configured to trigger the recording module to respectively record that the authentication results of the third number of authentication servers for the terminal are access authentication failures if the receiving module receives eighth messages sent by the third number of authentication servers within the second preset time period, and the authentication results carried by each eighth message indicate that the terminal access authentication fails;

[0059] The recording module is further configured to, if no messages are received from a fourth number of authentication servers among the plurality of servers after the second preset time period, respectively record that the authentication results of the fourth number of authentication servers for the terminal are unreachable;

[0060] The sending module is further used to send a ninth message or a tenth message to the terminal, the ninth message is used to indicate that the terminal access authentication failed, and the tenth message is used to indicate that the terminal access authentication succeeded, and the sum of the third number and the fourth number is the same as the number of the multiple authentication servers.

[0061] In a possible implementation manner, the seventh message includes an EAP message attribute, and the EAP message attribute is used to carry the EAP message.

[0062] In a possible implementation, the length of the EAP message attribute is a preset length;

[0063] If the length of the EAP message is greater than the preset length, the seventh message includes a plurality of EAP message attributes, and the EAP message is carried in the plurality of EAP message attributes in a fragmented form.

[0064] In a possible implementation, the access device is connected to multiple groups of authentication servers; the sending module is further configured to select a group of authentication servers from the multiple groups of authentication servers in a load sharing manner, and send the first message to the selected group of authentication servers; or,

[0065] A preset number of authentication servers are selected from each group of authentication servers included in the multiple groups of authentication servers in a load sharing manner, and the first message is sent to the selected authentication servers.

[0066] In a third aspect, an embodiment of the present application provides an access device, the access device comprising:

[0067] processor;

[0068] transceiver;

[0069] A machine-readable storage medium storing machine-executable instructions capable of being executed by the processor; the machine-executable instructions prompting the processor to perform the following steps:

[0070] Sending a first message to each of the multiple authentication servers through the transceiver, wherein the first message is used to request the authentication server to perform access authentication on the terminal;

[0071] If a second message sent by any authentication server is received through the transceiver and the second message is the first second message sent by the multiple authentication servers after receiving the first message, a third message is sent to the terminal through the transceiver, and both the second message and the third message are used to indicate that the terminal access authentication is successful.

[0072] In one possible implementation, the machine executable instructions further cause the processor to execute the following steps:

[0073] If a fourth message sent by any authentication server is received through the transceiver and the fourth message is the first fourth message sent by the multiple authentication servers after receiving the first message, sending a fifth message to the terminal through the transceiver, where the fifth message includes authentication parameters, and the authentication parameters are carried by the EAP message included in the fourth message;

[0074] receiving, by the transceiver, a sixth message sent by the terminal, wherein the sixth message includes user identity information, and the user identity information is encrypted using the authentication parameter;

[0075] A seventh message is sent to each authentication server through the transceiver, where the seventh message includes the sixth message and the EAP message, so that the authentication server verifies the user identity information based on the authentication parameters.

[0076] In one possible implementation, the machine executable instructions further cause the processor to execute the following steps:

[0077] If, within the first preset time period, the transceiver receives, through the transceiver, the same number of eighth messages as the number of the multiple authentication servers, and the authentication result carried by each eighth message indicates that the terminal access authentication fails, then the authentication result of each server for the terminal is recorded as access authentication failure;

[0078] A ninth message is sent to the terminal through the transceiver, where the ninth message is used to indicate that the terminal access authentication fails.

[0079] In one possible implementation, the machine executable instructions further cause the processor to execute the following steps:

[0080] After the first preset time has elapsed, if no message is received from any authentication server, the authentication result of each server on the terminal is recorded as unreachable authentication server;

[0081] A ninth message is sent to the terminal through the transceiver, where the ninth message is used to indicate that the terminal access authentication fails.

[0082] In one possible implementation, the machine executable instructions further cause the processor to execute the following steps:

[0083] If, within the first preset time period, the transceiver receives, through the transceiver, an eighth message sent by the first number of authentication servers, and the authentication result carried by each eighth message indicates that the terminal access authentication fails, then the authentication result of the first number of authentication servers for the terminal is respectively recorded as access authentication failure;

[0084] After the first preset time has elapsed, if no messages are received from the second number of authentication servers among the multiple servers, recording the authentication results of the second number of authentication servers on the terminal as unreachable authentication servers;

[0085] A ninth message or a tenth message is sent to the terminal through the transceiver, where the ninth message is used to indicate that the terminal access authentication fails, and the tenth message is used to indicate that the terminal access authentication succeeds, and the sum of the first number and the second number is the same as the number of the multiple authentication servers.

[0086] In one possible implementation, the machine executable instructions further cause the processor to execute the following steps:

[0087] If, within the second preset time period, the transceiver receives, through the transceiver, the same number of eighth messages as the number of the multiple authentication servers, and the authentication result carried by each eighth message indicates that the terminal access authentication fails, then the authentication result of each server for the terminal is recorded as access authentication failure;

[0088] A ninth message is sent to the terminal through the transceiver, where the ninth message is used to indicate that the terminal access authentication fails.

[0089] In one possible implementation, the machine executable instructions further cause the processor to execute the following steps:

[0090] After the second preset time has elapsed, if no message is received from any authentication server, the authentication result of each server on the terminal is recorded as unreachable authentication server;

[0091] A ninth message is sent to the terminal through the transceiver, where the ninth message is used to indicate that the terminal access authentication fails.

[0092] In one possible implementation, the machine executable instructions further cause the processor to execute the following steps:

[0093] If, within the second preset time period, eighth messages sent by the third number of authentication servers are received through the transceiver, and the authentication result carried by each eighth message indicates that the terminal access authentication fails, then the authentication results of the third number of authentication servers for the terminal are respectively recorded as access authentication failure;

[0094] After the second preset time has expired, if no messages are received from a fourth number of authentication servers among the plurality of servers, recording the authentication results of the fourth number of authentication servers on the terminal as unreachable authentication servers;

[0095] A ninth message or a tenth message is sent to the terminal through the transceiver, where the ninth message is used to indicate that the terminal access authentication fails, and the tenth message is used to indicate that the terminal access authentication succeeds, and the sum of the third number and the fourth number is the same as the number of the multiple authentication servers.

[0096] In a possible implementation manner, the seventh message includes an EAP message attribute, and the EAP message attribute is used to carry the EAP message.

[0097] In a possible implementation, the length of the EAP message attribute is a preset length;

[0098] If the length of the EAP message is greater than the preset length, the seventh message includes a plurality of EAP message attributes, and the EAP message is carried in the plurality of EAP message attributes in a fragmented form.

[0099] In one possible implementation, the access device is connected to multiple authentication servers; and the machine-executable instructions cause the processor to perform the following steps:

[0100] selecting a group of authentication servers from the multiple groups of authentication servers in a load-sharing manner, and sending the first message to the selected group of authentication servers through the transceiver; or,

[0101] A preset number of authentication servers are selected from each group of authentication servers included in the multiple groups of authentication servers in a load sharing manner, and the first message is sent to the selected authentication servers through the transceiver.

[0102] In a fourth aspect, an embodiment of the present application provides a machine-readable storage medium storing machine-executable instructions. When called and executed by a processor, the machine-executable instructions prompt the processor to implement the method described in the first aspect.

[0103] In a fifth aspect, an embodiment of the present application provides a computer program product, which prompts the processor to implement the method described in the first aspect.

[0104] Using the above technical solution, the access device can send a first message to multiple authentication servers requesting access authentication for the terminal. If a second message is received from any authentication server, and the second message is the first second message received by the multiple authentication servers, a third message can be sent to the terminal. Both the second and third messages are used to indicate successful access authentication. This shows that the access device can send a first message to multiple authentication servers. Even if some authentication servers fail, as long as a second message is received from any authentication server, and the second message is the first second message received, a third message can be sent to the terminal. This does not affect the terminal's authentication process and can avoid terminal online failures caused by server failures. BRIEF DESCRIPTION OF THE DRAWINGS

[0105] The drawings described herein are used to provide further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute improper limitations on the present application.

[0106] FIG1 is an exemplary schematic diagram of an EAP relay processing mechanism provided in an embodiment of the present application;

[0107] FIG2 is an exemplary schematic diagram of an EAP termination processing mechanism provided in an embodiment of the present application;

[0108] FIG3 is an exemplary schematic diagram of a networking system provided in an embodiment of the present application;

[0109] FIG4 is a flow chart of a terminal authentication method provided in an embodiment of the present application;

[0110] FIG5 is an exemplary schematic diagram of a first terminal authentication method provided in an embodiment of the present application;

[0111] FIG6 is an exemplary schematic diagram of a second terminal authentication method provided in an embodiment of the present application;

[0112] FIG7 is an exemplary schematic diagram of a third terminal authentication method provided in an embodiment of the present application;

[0113] FIG8 is an exemplary schematic diagram of a fourth terminal authentication method provided in an embodiment of the present application;

[0114] FIG9 is a schematic structural diagram of a terminal authentication device provided in an embodiment of the present application;

[0115] FIG10 is a schematic structural diagram of an access device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0116] To make the objectives, technical solutions, and advantages of this application more clearly understood, the present application is further described below with reference to the accompanying drawings and examples. It is apparent that the described examples are only a portion of the embodiments of this application, and not all of them. All other embodiments derived by persons of ordinary skill in the art based on the examples in this application are intended to fall within the scope of protection of this application.

[0117] To facilitate understanding, the relevant terms involved in the embodiments of this application are first introduced.

[0118] Authentication, Authorization, Accounting (AAA) is a network security management mechanism that provides three security functions: authentication, authorization, and accounting.

[0119] Authentication: Confirm the identity of the user who accesses the network remotely and determine whether the user is a legitimate network user.

[0120] Authorization: Assign different permissions to different users and limit the services they can use. For example, an administrator can grant office users the permission to access and print files on the server, while other users do not have this permission.

[0121] Billing: Records all operations performed by users during the use of network services, including the type of service used, start time, data traffic, etc., to collect and record users' usage of network resources. It can implement billing based on time and traffic. The billing function can monitor the network.

[0122] The Remote Authentication Dial-In User Service (RADIUS) protocol combines the authentication and authorization processes. The RADIUS protocol is a distributed information exchange protocol that can be applied to networking systems that include terminals and authentication servers. The authentication server can protect the network from interference from unauthorized users based on the RADIUS protocol. The RADIUS protocol is used in network environments with high security requirements and that allow users to access the network remotely. The RADIUS protocol defines the RADIUS message format and message transmission mechanism, and stipulates the use of the User Datagram Protocol (UDP) as the transport layer protocol for encapsulating RADIUS messages. Among them, UDP port 1812 can be used as an authentication / authorization port, and port 1813 can be used as a billing port.

[0123] In systems using the 802.1X protocol, authentication information can be exchanged between terminals, access devices, and authentication servers based on EAP. EAP supports multiple authentication methods, including Message-Digest algorithm 5-Challenge (MD5-Challenge), Extensible Authentication Protocol-Transport Layer Security (EAP-TLS), and Protected Extensible Authentication Protocol (PEAP).

[0124] During the terminal authentication process, the terminal may use the Extensible Authentication Protocol over Local Area Network (EAPOL) encapsulation format to encapsulate an EAP message in a data frame and send the data frame to the access device.

[0125] The access device can exchange EAP messages with the authentication server through the EAP relay processing mechanism or the EAP termination processing mechanism.

[0126] The EAP relay processing mechanism refers to the access device relaying the received EAP messages.

[0127] As shown in FIG. 1 , FIG. 1 exemplarily shows a terminal, an access device, and an authentication server, where the authentication server may specifically be a RADIUS server.

[0128] In the EAP relay processing mechanism, EAP authentication is performed between the terminal and the authentication server. During the EAP authentication process, the terminal sends an EAP message to the access device. This EAP message is encapsulated in the Extensible Authentication Protocol over LAN (EAP packets over LAN). The access device relays the received EAP message, obtaining a relayed EAP message encapsulated in the Extensible Authentication Protocol over RADIUS (EAP packets over RADIUS) format. The device then sends the encapsulated EAP message to the authentication server.

[0129] In the above process, the authentication server acts as an EAP server to process the EAP messages of the terminal, and the access device acts as a relay device to transfer the EAP messages sent by the terminal.

[0130] The EAP termination mechanism refers to the access device terminating the received EAP messages.

[0131] As shown in FIG2 , FIG2 exemplarily shows a terminal, an access device, and an authentication server.

[0132] In the EAP termination mechanism, EAP authentication is used between the terminal and the access device, and Password Authentication Protocol (PAP) or Challenge Handshake Authentication Protocol (CHAP) is used between the access device and the authentication server. The terminal sends an EAP message to the access device. This EAP message is encapsulated in the Extensible Authentication Protocol over LAN (EAP packets over LAN). The access device encapsulates the user identity information carried in the EAP message into a standard Remote Authentication Dial-In User Service (RADIUS) message and sends the RADIUS message to the authentication server.

[0133] In order to avoid terminal access authentication failure due to authentication server failure, an embodiment of the present application provides a terminal authentication method, which can be applied to the networking system shown in Figure 3.

[0134] In the embodiment of the present application, the access device can be connected to multiple authentication servers. FIG3 exemplarily shows authentication server 1, authentication server 2, authentication server 3, the access device and the terminal.

[0135] The terminal accesses the network through an access device, and the access device is connected to authentication server 1, authentication server 2, and authentication server 3 respectively.

[0136] Among them, when a terminal accesses network resources, it needs to go through an access device. The terminal can send an EAP message to the access device to request access authentication. The access device can send an authentication request message to the authentication server through the EAP relay processing mechanism or the EAP termination mechanism. The authentication request message can be the EAP packets over LAN or RADIUS message introduced above.

[0137] The authentication server performs terminal access authentication based on the user identity information carried in the authentication request message. If access authentication is successful, the authentication server sends an authentication success message to the access device, carrying the user's permission information. The access device then grants the user the appropriate permissions based on the user's permission information. This allows the access device to pass traffic within the user's permission range, allowing the terminal to access network resources.

[0138] It should be noted that in the embodiments of the present application, a terminal may be a mobile phone, a computer, a network device such as a switch that applies for access to network resources, or other electronic devices that can apply for access to network resources. It may also be a phone or printer that uses an Internet Protocol (IP) or Media Access Control (MAC) address as an identity credential, or an electronic device used to manage access devices. The term "terminal" generally refers to electronic devices that need to access network resources and electronic devices used to manage access devices.

[0139] Access devices generally refer to various network devices that support user access authentication, such as switches, routers, wireless access points (APs), access controllers (ACs), and firewalls.

[0140] The following is a detailed introduction to the terminal authentication method provided in the embodiment of the present application.

[0141] As shown in FIG4 , an embodiment of the present application provides a terminal authentication method, which is applied to an access device and includes:

[0142] S401: Send a first message to each authentication server of a plurality of authentication servers.

[0143] The first message is used to request the authentication server to perform access authentication on the terminal. As an example, the first message may be an Access-Request message.

[0144] The first message carries the user identity information of the user. The authentication server can parse the first message to obtain the user identity information, and authenticate the terminal based on the parsed user identity information.

[0145] S402: If a second message sent by any authentication server is received and the second message is the first second message sent by multiple authentication servers after receiving the first message, a third message is sent to the terminal.

[0146] The second message and the third message are both used to indicate that the terminal access authentication is successful. As an example, the second message may be an Access-Accept message, and the third message may be an EAP-Success message.

[0147] The access device can simultaneously send a first message to each of multiple authentication servers. After receiving the first message, each authentication server authenticates the terminal based on the first message. If authentication is successful, it responds with a second message to the access device. Accordingly, the access device may receive multiple second messages. Upon receiving the first second message, it can send a third message to the terminal. Upon receiving the second and subsequent second messages, it does not need to send the third message to the terminal again.

[0148] Using the above technical solution, the access device can send a first message to multiple authentication servers requesting access authentication for the terminal. If a second message is received from any authentication server, and the second message is the first second message received by the multiple authentication servers, a third message can be sent to the terminal. Both the second and third messages are used to indicate successful access authentication. This shows that the access device can send a first message to multiple authentication servers. Even if some authentication servers fail, as long as a second message is received from any authentication server, and the second message is the first second message received, a third message can be sent to the terminal. This does not affect the terminal's authentication process and can avoid terminal online failures caused by server failures.

[0149] In another embodiment of the present application, in a scenario where an EAP relay processing mechanism is adopted, after S401, respectively sending a first message to each of the multiple authentication servers, the method further includes:

[0150] Step 1: If a fourth message is received from any authentication server and the fourth message is the first fourth message sent by multiple authentication servers after receiving the first message, a fifth message is sent to the terminal.

[0151] The fifth message includes authentication parameters, which are carried by the EAP message included in the fourth message.

[0152] Authentication parameters can include the algorithm suite of the Transport Layer Security (TLS) tunnel, the random number in the Server Hello message, or the Challenge parameter of the Microsoft Challenge-Handshake Authentication Protocol version 2 (MSCHAPv2).

[0153] As an example, the fourth message may be an Access-Challenge message, and the fifth message may be an EAP-request message. In the case where the fourth message is an Access-Challenge, the authentication parameter may be a Challenge parameter, and accordingly, the fifth message also carries the Challenge parameter.

[0154] It should be noted that the fourth message is a message encapsulated in the EAPOR format. The access device can obtain the EAP message encapsulated in the first fourth message and record the EAP message.

[0155] The EAP message is specifically encapsulated in the EAP-Message attribute of the fourth message. The access device can extract the EAP-Message attribute, record the EAP-Message attribute as the server-EAP-Message attribute, and store it locally. In this way, it is equivalent to storing the EAP message in the fourth message.

[0156] Step 2: Receive the sixth message sent by the terminal.

[0157] The sixth message includes user identity information, which is encrypted using authentication parameters. For example, the user identity information can be a password entered by the user. If the authentication parameter is a Challenge parameter, the terminal can obtain the Challenge parameter from the fifth message and encrypt the password entered by the user based on the Challenge parameter to obtain an encrypted password. The encrypted password is then encapsulated in the sixth message.

[0158] As an example, the sixth message may be an EAP reply (EAP-Response) message.

[0159] Step 3: Send a seventh message to each authentication server respectively, where the seventh message includes the sixth message and the EAP message, so that the authentication server verifies the user identity information based on the authentication parameters.

[0160] As an example, the seventh message may be an Access-Request message.

[0161] The seventh message includes an EAP message attribute, which is used to carry the EAP message. The length of the EAP message attribute is a preset length. If the length of the EAP message is greater than the preset length, the seventh message includes multiple EAP message attributes, and the EAP message is carried in fragments within the multiple EAP message attributes.

[0162] As an example, the preset length can be 253 bytes. That is, if an EAP message exceeds 253 bytes, it will be fragmented. The access device then encapsulates the fragmented EAP message into multiple EAP message attributes. The attribute number of each EAP-Message attribute can be assigned based on actual circumstances, such as assigning an unused attribute number, such as 239. This embodiment of the present application does not specifically limit the attribute number value; the data type carried is octets.

[0163] In the embodiment of the present application, the EAP-Message attribute is added to the seventh message. Specifically, the newly added EAP-Message attribute may be a Server-EAP-Message attribute. The Server-EAP-Message attribute is used to carry the EAP message in the Server-EAP-Message attribute recorded after the access device receives the first fourth message in step 1.

[0164] According to the protocol, the seventh message also includes a Client-EAP-Message attribute, and the Client-EAP-Message attribute is used to carry the sixth message.

[0165] After receiving the seventh message, each authentication server obtains the EAP message from the Server-EAP-Message attribute and the authentication parameters carried in the EAP message. It also obtains the sixth message from the Client-EAP-Message attribute and the user identity information carried in the sixth message.

[0166] It should be noted that both the Server-EAP-Message attribute and the Client-EAP-Message attribute are EAP-Message attributes. In this embodiment of the present application, to distinguish the two EAP-Message attributes carried in the seventh message, these two EAP-Message attributes are referred to as the Server-EAP-Message attribute and the Client-EAP-Message attribute, respectively. This embodiment of the present application does not limit the names of the EAP-Message attributes.

[0167] It is understandable that the authentication parameters generated by each authentication server are different, and each authentication server locally stores its own generated authentication parameters. The authentication parameters obtained by the authentication server from the seventh message may be different from the locally stored authentication parameters.

[0168] Since the user identity information carried in the seventh message is encrypted using the authentication parameters carried in the seventh message, in order to correctly verify the user identity information, the authentication server needs to update the locally stored authentication parameters to the authentication parameters carried in the seventh message, and then use the updated authentication parameters to encrypt the locally stored user identity information. If the encrypted user identity information is the same as the user identity information obtained from the seventh message, the terminal access authentication is passed.

[0169] For example, the multiple authentication servers include authentication server 1, authentication server 2, and authentication server 3. Authentication server 1 locally stores authentication parameter 1, authentication server 2 locally stores authentication parameter 2, and authentication server 3 locally stores authentication parameter 3.

[0170] The first fourth message received by the access device is sent by authentication server 1. The EAP message encapsulated in the Server-EAP-Message attribute of the seventh message is the same as the EAP message in the fourth message. That is, the authentication parameter carried in the seventh message is authentication parameter 1, and the user identity information carried in the seventh message is encrypted using authentication parameter 1.

[0171] If authentication server 1 subsequently fails or the network between authentication server 1 and the access device is unreachable, authentication server 1 cannot receive the seventh message, while authentication server 2 and authentication server 3 can receive the seventh message.

[0172] Because the user identity information carried in the seventh message is encrypted using authentication parameter 1, if authentication server 2 uses locally stored authentication parameter 2 to verify the user identity information after receiving the seventh message, authentication will fail. Therefore, in this embodiment of the application, the newly added Server-EAP-Message attribute in the seventh message carries the EAP message. Authentication server 1 can obtain authentication parameter 1 from the EAP message and use it to overwrite the locally stored authentication parameter 2, thereby authenticating the user identity information carried in the seventh message using authentication parameter 1.

[0173] Similarly, after receiving the seventh message, the authentication server 3 obtains the authentication parameter 1 from the seventh message, and uses the authentication parameter 1 to overwrite the locally stored authentication parameter 3, and then uses the authentication parameter 3 to authenticate the user identity information carried in the seventh message.

[0174] It can be seen that by adding the Server-EAP-Message attribute to the seventh message, synchronization of authentication parameters between different authentication servers is achieved, so that the authentication server can use the correct authentication parameters to authenticate the user's identity information, avoiding the problem of access authentication failure due to the authentication server using incorrect authentication parameters, thereby avoiding the problem of users being unable to access the network for a long time, and improving the user experience. In addition, although a data synchronization channel can be established between authentication servers, if the authentication parameters are synchronized using the data synchronization channel between authentication servers, real-time synchronization cannot be achieved. However, the embodiment of the present application carries the authentication parameters in the seventh message sent by the access device, ensuring that the authentication server can obtain the correct authentication parameters when performing user identity authentication, which can avoid the problem of authentication failure due to the failure to synchronize the authentication parameters in a timely manner.

[0175] It should be noted that in the scenario where the EAP relay processing mechanism is adopted, there may be multiple user information authentication interaction processes between the terminal and the authentication server. Each interaction process is used to authenticate different identity information of the user. The number of interactions and the user identity information that needs to be authenticated for each interaction can refer to the relevant protocol regulations. The embodiments of this application do not limit this.

[0176] Continuing with the above example, if both authentication servers 2 and 3 succeed, they can send a further authentication message to the access device. The EAP message encapsulated in the further authentication message also carries the authentication parameters. The access device still records the EAP message in the first received further authentication message. The subsequent process is similar to steps 1 through 3 above. After the access device receives the first second message, it sends a third message to the terminal.

[0177] As an optional implementation, after the authentication server generates authentication parameters, it can use a newly added RADIUS attribute to carry these parameters. This newly added RADIUS attribute can also be used to carry the authentication parameters in subsequent messages sent to multiple authentication servers. This approach can also avoid authentication failures caused by unsynchronized authentication parameters. However, the method described above of synchronizing authentication parameters using Server-EAP-Message attributes is more secure and easier to implement.

[0178] In a scenario where the EAP relay processing mechanism is used, after sending the first message to multiple authentication servers, terminal access authentication failure may be determined in the following three situations, which are described below:

[0179] Case 1: If within the first preset time period, the number of eighth messages received is the same as the number of authentication servers, then the authentication result of each server for the terminal is recorded as access authentication failure, and a ninth message is sent to the terminal.

[0180] The first preset duration can be set based on experience. The authentication result carried by each eighth message indicates that the terminal access authentication failed, and the ninth message is used to indicate that the terminal access authentication failed. As an example, the eighth message is an Access-Reject message, and the ninth message is an EAP-Failure message.

[0181] The access device locally stores a user table for each user. In this embodiment, the access device may set a server table within the user table for the user currently being authenticated. This server table includes basic information about each of the multiple authentication servers and the authentication result returned. This basic information may include the authentication server's IP address, port number, and shared key. The authentication result may be success, failure, or continued authentication.

[0182] It is understood that, each time the access device receives an eighth message within the first preset time period, it may record the authentication result corresponding to the authentication server that sent the eighth message as authentication failure. If the authentication results of multiple authentication servers are all recorded as authentication failure, a ninth message may be sent to the terminal.

[0183] Case 2: After the first preset time has expired, if no message is received from any authentication server, each server's authentication result for the terminal is recorded as unreachable, and a ninth message is sent to the terminal.

[0184] If no message is received from any authentication server after the first preset duration, then each of the multiple authentication servers has failed to respond to the first message. This may indicate that all of the authentication servers are faulty, or the network between them and the access device is unreachable. In conjunction with the server table described in Scenario 1, for each authentication server, if no reply message is received from that server after the first preset duration, the authentication result corresponding to that server may be recorded in the server table as "authentication server unreachable."

[0185] If the authentication results of multiple authentication servers are all recorded as the authentication server is unreachable, a ninth message may be sent to the terminal.

[0186] Case 3: If within the first preset time period, the eighth message sent by the first number of authentication servers is received, and the authentication result carried by each eighth message indicates that the terminal access authentication fails, then the authentication results of the first number of authentication servers for the terminal are recorded as access authentication failure.

[0187] After the first preset time period has expired, if no messages are received from the second number of authentication servers among the multiple servers, the authentication results of the second number of authentication servers on the terminal are respectively recorded as unreachable authentication servers.

[0188] A ninth message or a tenth message is sent to the terminal, where the ninth message indicates that the terminal access authentication fails, and the tenth message indicates that the terminal access authentication succeeds. The sum of the first quantity and the second quantity is the same as the number of the multiple authentication servers.

[0189] Combined with the introduction in Case 1 and Case 2, for each authentication server among the multiple authentication servers, if the eighth message sent by the authentication server is received within the first preset time period, the authentication result corresponding to the authentication server is recorded as authentication failure; if the message sent by the authentication server is not received after the first preset time period, the authentication result corresponding to the authentication server is recorded as authentication server unreachable.

[0190] Furthermore, if a second message is received from the authentication server within the first preset time period, the authentication result corresponding to the authentication server is recorded as a successful authentication. If a message indicating continued authentication is received from the authentication server within the first preset time period, the authentication result corresponding to the authentication server is recorded as continued authentication. It is understood that, in the event of multiple interactions, if continued authentication is included in the authentication results corresponding to multiple authentication servers, the access device must update the authentication results of each authentication server according to the above method in each subsequent interaction.

[0191] If some of the authentication results of multiple authentication servers are recorded as access authentication failure, and the other authentication servers are all recorded as authentication server unreachable, the ninth message or the tenth message may be sent to the terminal.

[0192] If an escape policy is configured in the access device, the tenth message may be sent to the terminal to allow the terminal to access network resources; if an escape policy is not configured, the ninth message may be sent to the terminal to deny the terminal access to network resources. This embodiment of the application does not limit the configuration method and policy content of the escape policy; for details, please refer to the relevant EAP authentication protocol provisions.

[0193] As an example, if the access device is connected to five authentication servers, after the access device sends the first message to the five authentication servers, it receives the eighth message sent by three authentication servers within the first preset time period, but does not receive the messages sent by the other two authentication servers. Then, the authentication results corresponding to the three authentication servers are all recorded as authentication failures, and the authentication results of the two authentication servers are recorded as authentication servers unreachable, and then the access device sends the ninth message or the tenth message to the terminal.

[0194] Using this method, the access device can simultaneously send a first message to each of multiple authentication servers and record each server's access authentication result for the terminal. After receiving a second message from any authentication server, the access device can then send a third message to the terminal, reducing terminal waiting time. Furthermore, the terminal is notified of the failure only if multiple authentication servers fail authentication. This avoids issues such as authentication failures or prolonged waiting times due to partial authentication server failures or network unreachability.

[0195] In a scenario where the EAP termination mechanism is used, after sending the first message to multiple authentication servers, terminal access authentication failure may be determined in the following three situations, which are described below:

[0196] Case 1: If within the second preset time period, the same number of eighth messages as the number of multiple authentication servers are received, and the authentication results carried by each eighth message indicate that the terminal access authentication failed, then the authentication result of each server for the terminal is recorded as access authentication failure, and a ninth message is sent to the terminal.

[0197] The second preset duration can be set based on experience. The authentication result carried by each eighth message indicates that the terminal access authentication failed, and the ninth message is used to indicate that the terminal access authentication failed. As an example, the eighth message is an Access-Reject message, and the ninth message is an EAP-Failure message.

[0198] The access device locally stores a user table for each user. In this embodiment, the access device may set a server table within the user table for the user currently being authenticated. This server table includes basic information about each of the multiple authentication servers and the authentication result returned. This basic information may include the authentication server's IP address, port number, and shared key. The authentication result may be success, failure, or continued authentication.

[0199] It is understood that, each time the access device receives an eighth message within the first preset time period, it may record the authentication result corresponding to the authentication server that sent the eighth message as authentication failure. If the authentication results of multiple authentication servers are all recorded as authentication failure, a ninth message may be sent to the terminal.

[0200] Case 2: After the second preset time has expired, if no message is received from any authentication server, each server's authentication result for the terminal is recorded as unreachable, and a ninth message is sent to the terminal.

[0201] If no message is received from any authentication server after the first preset duration, then each of the multiple authentication servers has failed to respond to the first message. This may indicate that all of the authentication servers are faulty, or the network between them and the access device is unreachable. In conjunction with the server table described in Scenario 1, for each authentication server, if no reply message is received from that server after the first preset duration, the authentication result corresponding to that server may be recorded in the server table as "authentication server unreachable."

[0202] If the authentication results of multiple authentication servers are all recorded as the authentication server is unreachable, a ninth message may be sent to the terminal.

[0203] Case 3: If within the second preset time period, the eighth message sent by the third number of authentication servers is received, and the authentication result carried by each eighth message indicates that the terminal access authentication fails, then the authentication results of the third number of authentication servers for the terminal are recorded as access authentication failure.

[0204] After the second preset time period has expired, if no messages are received from the fourth number of authentication servers among the multiple servers, the authentication results of the fourth number of authentication servers on the terminal are respectively recorded as unreachable authentication servers.

[0205] A ninth message or a tenth message is sent to the terminal, where the ninth message indicates that the terminal access authentication fails, and the tenth message indicates that the terminal access authentication succeeds. The sum of the third quantity and the fourth quantity is the same as the number of the multiple authentication servers.

[0206] Combined with the introduction in Case 1 and Case 2, for each authentication server among the multiple authentication servers, if the eighth message sent by the authentication server is received within the first preset time period, the authentication result corresponding to the authentication server is recorded as authentication failure; if the message sent by the authentication server is not received after the first preset time period, the authentication result corresponding to the authentication server is recorded as authentication server unreachable.

[0207] In addition, if a second message is received from the authentication server within the first preset time period, the authentication result corresponding to the authentication server is recorded as successful authentication; if a message indicating continued authentication is received from the authentication server within the first preset time period, the authentication result corresponding to the authentication server is recorded as continued authentication. If the authentication results of multiple authentication servers are all recorded as failed authentication, a ninth message may be sent to the terminal.

[0208] Using this method, the access device can simultaneously send a first message to each of multiple authentication servers and record each server's access authentication result for the terminal. After receiving a second message from any authentication server, the device can then send a third message to the terminal, reducing terminal waiting time. Furthermore, the terminal is notified of the failure only if multiple authentication servers fail authentication. This avoids issues such as authentication failures or prolonged waiting times due to partial authentication server failures or network unreachability.

[0209] In another embodiment of the present application, the access device is connected to multiple authentication server groups, each authentication server group includes at least one authentication server. Then S401, sending a first message to each of the multiple authentication servers, can be implemented as follows:

[0210] Selecting a group of authentication servers from multiple groups of authentication servers in a load-sharing manner, and sending a first message to the selected group of authentication servers; or selecting a preset number of authentication servers from each group of authentication servers included in the multiple groups of authentication servers in a load-sharing manner, and sending the first message to the selected authentication servers.

[0211] In an embodiment of the present application, for a scenario with a large number of concurrent users going online, the authentication servers to which the access device is connected may be grouped in advance, and the IP address of each group of authentication servers is stored in the access device.

[0212] In this way, after the terminal initiates access authentication to the access device, the terminal can select an authentication server in a load balancing manner.

[0213] For example, the access device is connected to three authentication server groups, each of which includes three authentication servers.

[0214] In one implementation, if the load pressure of the first group of authentication servers is relatively small, the three authentication servers included in the first group of authentication servers are used as the multiple authentication servers in the above embodiment, and the first message is sent to the three authentication servers respectively.

[0215] In another embodiment, if the load pressure of authentication server A in the first group of authentication servers, authentication server B in the second group of authentication servers, and authentication server C in the third group of authentication servers is relatively small, authentication server A, authentication server B, and authentication server C can be used as multiple authentication servers in the above embodiment, and the first message can be sent to authentication server A, authentication server B, and authentication server C respectively.

[0216] The embodiment of the present application can use any load sharing algorithm to select the authentication server, and the embodiment of the present application is not limited to this.

[0217] This method can avoid the problem of multiple terminals initiating access authentication at the same time and the access device sending authentication request messages for multiple terminals to all authentication servers at the same time. It can enable the access authentication requests of different terminals to be shared among different servers, reducing the processing pressure of a single authentication server.

[0218] The following describes the EAP termination processing mechanism and the EAP relay processing mechanism in the embodiments of the present application with reference to specific examples.

[0219] Taking the EAP termination processing mechanism as an example, the terminal authentication method provided in the embodiment of the present application is introduced. Taking the connection between the access device and the authentication server 1 and the authentication server 2 as an example, as shown in Figure 5, the method includes the following steps:

[0220] S501: User logs in.

[0221] S502: The terminal sends an EAP-Start message to the access device. Correspondingly, the access device receives the EAP-Start message.

[0222] After a user logs in to a terminal, the terminal begins the access authentication process, sending an EAP-Start message to the access device. This message can be a protocol message such as 802.1x, Point-to-Point Protocol (PPP), or Dynamic Host Configuration Protocol (DHCP), or a service message such as a MAC address authentication message. The EAP-Start message generally refers to any message that triggers the access device to perform access authentication.

[0223] After receiving the EAP-Start message, the access device creates a user entry for the user in its local user table. This user entry is used to store user information. Specifically, the user entry uses the terminal's MAC address as the key and stores information such as the terminal's interface and VLAN.

[0224] S503: The access device sends an EAP-Request-Identity (EAP identity request) message to the terminal. Correspondingly, the terminal receives the EAP-Request-Identity message.

[0225] The EAP-Request-Identity message is used to request the user name of the terminal.

[0226] S504: The terminal sends an EAP-Response-Identity (EAP identity reply) message to the access device. Correspondingly, the access device receives the EAP-Response-Identity message.

[0227] The EAP-Response-Identity message includes the username entered by the user on the terminal. The access device obtains the username from the EAP-Response-Identity message and searches for it in a pre-stored username list. If the username is found, it randomly generates an MD5Challenge.

[0228] S505 : The access device sends an EAP-Request-MD5-Challenge (MD5 challenge EAP request) message to the terminal. Correspondingly, the terminal receives the EAP-Request-MD5-Challenge message.

[0229] The EAP-Request-MD5-Challenge message includes the MD5Challenge generated by the access device.

[0230] S506 : The terminal sends an EAP-Response-MD5-Challenge (MD5 challenge EAP reply) message to the access device. Correspondingly, the access device receives the EAP-Response-MD5-Challenge message.

[0231] After receiving the EAP-Request-MD5-Challenge message, the terminal obtains the MD5Challenge from the EAP-Request-MD5-Challenge message and uses the MD5Challenge to encrypt the password input by the user to obtain the encrypted password.

[0232] The EAP-Response-MD5-Challenge packet carries the encrypted password.

[0233] S507: The access device sends Access-Request messages to authentication server 1 and authentication server 2. Correspondingly, authentication server 1 and authentication server 2 receive the Access-Request messages.

[0234] The Access-Request message includes the user name, encrypted password, and MD5 Challenge.

[0235] Authentication server 1 and authentication server 2 can both obtain the user name, encrypted password, and MD5Challenge from the Access-Request message, obtain the password corresponding to the user name from the local server, encrypt the password obtained locally using the MD5Challenge, and then compare the encrypted result with the encrypted password obtained from the Access-Request message. If they are consistent, the terminal access authentication succeeds; if they are inconsistent, the terminal access authentication fails.

[0236] In the embodiment of the present application, assuming that authentication server 1 successfully authenticates the terminal access, and authentication server 2 fails to authenticate the terminal access, then after authentication server 1 completes authentication, S508 is executed, and after authentication server 2 completes authentication, S509 is executed.

[0237] In addition, the access device can determine the user table entry corresponding to the terminal based on the MAC address of the terminal, and create a server table in the corresponding user table. The server table is used to store the authentication results fed back by each authentication server.

[0238] S508: The authentication server 1 sends an Access-Accept message to the access device. Correspondingly, the access device receives the Access-Accept message.

[0239] After receiving the Access-Accept message, the access device may record the authentication result corresponding to the authentication server 1 in the server table as a successful access authentication. After S508, S510 is executed.

[0240] S509 : The authentication server 2 sends an Access-Reject message to the access device. Correspondingly, the access device receives the Access-Reject message.

[0241] The Access-Reject message is used to indicate that the authentication server 2 has failed to authenticate the terminal. After receiving the Access-Reject message, the access device may record the authentication result corresponding to the authentication server 2 in the server table as access authentication failure.

[0242] S510: The access device sends an EAP-Success message to the terminal. Correspondingly, the terminal receives the EAP-Success message.

[0243] The EAP-Success message is used to indicate that the authentication server has successfully authenticated the terminal.

[0244] S511, the terminal goes online successfully.

[0245] At this point, the terminal is successfully online and can subsequently access network resources through the access device.

[0246] Using this method, the access device can simultaneously send Access-Request messages to multiple authentication servers. Upon receiving an Access-Accept message from any authentication server, the access device responds with an EAP-Success message to the terminal. If some authentication servers are faulty or busy, the access device does not need to wait for Access-Accept messages from these servers. Instead, it notifies the terminal of successful authentication upon receiving the first Access-Accept message. This prevents terminal network access speeds from being affected by authentication server failures or busyness, improving the user experience.

[0247] Furthermore, since the access device receives an Access-Accept message from any authentication server, it can determine that the terminal access authentication is successful. The terminal access authentication is only determined to have failed when all authentication servers have failed the access authentication results for the terminal. This can prevent terminal access authentication failures caused by failures or busyness of some authentication servers.

[0248] It should be noted that Figure 5 uses EAP protocol messages as an example for illustration. In a scenario where only one interaction is required between the access device and the authentication server to complete the authentication of the terminal, if the access authentication process between the terminal and the access device uses other non-EAP protocols such as PPP, Http / Https messages, etc., the method described in Figure 5 can also be used to achieve fast access authentication.

[0249] Taking the EAP relay processing mechanism as an example, the terminal authentication method provided by the embodiment of the present application is introduced. Taking the connection between the access device and the authentication server 1 and the authentication server 2 as an example, as shown in Figure 6, the method includes the following steps:

[0250] S601: User logs in.

[0251] S602: The terminal sends an EAP-Start message to the access device. Correspondingly, the access device receives the EAP-Start message.

[0252] For an introduction to the EAP-Start message, please refer to the relevant description in S502 above, which will not be repeated here.

[0253] S603: The access device sends an EAP-Request-Identity (EAP identity request) message to the terminal. Correspondingly, the terminal receives the EAP-Request-Identity message.

[0254] The EAP-Request-Identity message is used to request the user name of the terminal.

[0255] S604: The terminal sends an EAP-Response-Identity (EAP identity reply) message to the access device. Correspondingly, the access device receives the EAP-Response-Identity message.

[0256] The EAP-Response-Identity message includes the user name.

[0257] S605: The access device sends Access-Request messages to authentication server 1 and authentication server 2. Correspondingly, authentication server 1 and authentication server 2 receive the Access-Request messages.

[0258] The Access-Request message is a message encapsulated using the RADIUS protocol. The Access-Request message includes a Client-EAP-Message attribute, and the EAP-Response Identity message is encapsulated in the Client-EAP-Message attribute.

[0259] In addition, the access device can determine the user table entry corresponding to the terminal based on the MAC address of the terminal, and create a server table in the corresponding user table. The server table is used to store the authentication results fed back by each authentication server.

[0260] After receiving the Access-Request message, authentication server 1 and authentication server 2 can negotiate an authentication method with the terminal. The specific negotiation method can be referenced in the relevant protocol and is not limited in this embodiment. If both authentication server 1 and authentication server 2 need to continue authenticating the terminal, authentication server 1 executes S606 and authentication server 2 executes S607.

[0261] S606 : The authentication server 1 sends an Access-challenge message to the access device. Correspondingly, the access device receives the Access-challenge message.

[0262] After receiving the Access-Request message, the authentication server 1 may obtain the user name from the Access-Request message and search for the user name in a pre-stored user name list. If the user name is found, a Challenge is randomly generated, such as Challenge 1.

[0263] The Access-Challenge message is a RADIUS message. The Access-Challenge message includes a Client-EAP-Message attribute. The Client-EAP-Message attribute encapsulates an EAP message. The EAP message carries Challenge 1.

[0264] S607: Authentication server 2 sends an Access-challenge message to the access device. Correspondingly, the access device receives the Access-challenge message.

[0265] After receiving the Access-Request message, the authentication server 2 may obtain the user name from the Access-Request message and search for the user name in a pre-stored user name list. If the user name is found, a Challenge is randomly generated, such as Challenge 2.

[0266] The Access-challenge message is a RADIUS protocol message. The Access-challenge message includes a Client-EAP-Message attribute. The Client-EAP-Message attribute encapsulates an EAP message. The EAP message carries Challenge 2.

[0267] It is understandable that the access device receives the Access-challenge messages replied by authentication server 1 and authentication server 2 at different times. The access device may execute S608 after receiving the first Access-challenge message.

[0268] It should be noted that after receiving the first Access-Challenge message, the access device extracts the Client-EAP-Message attribute of the Access-Challenge message and records the Client-EAP-Message as the Server-EAP-Message attribute.

[0269] In this round of interaction, if the access device receives another Access-Challenge message, it can check whether the Server-EAP-Message attribute has been recorded locally. If so, there is no need to record it again.

[0270] Because both authentication server 1 and authentication server 2 reply with Access-Challenge packets, the access device can record the access authentication results corresponding to authentication server 1 and authentication server 2 as Continue Authentication in the server table.

[0271] S608: The access device sends an EAP-Request message to the terminal. Correspondingly, the terminal receives the EAP-Request message.

[0272] For example, if the first Access-Challenge message received by the access device comes from authentication server 1, the EAP-Request message carries Challenge 1.

[0273] S609: The terminal sends an EAP-Response (EAP reply) message to the access device. Correspondingly, the access device receives the EAP-Response message.

[0274] The terminal can obtain challenge1 from the EAP-Request message, calculate an MD5 value using challenge1, the user name, and the password entered by the user, and then encapsulate the MD5 value in the EAP-Response message.

[0275] S610: The access device sends Access-Request messages to authentication server 1 and authentication server 2. Correspondingly, authentication server 2 receives the Access-Request message.

[0276] The Access-Challenge message is a RADIUS protocol message and includes the Client-EAP-Message attribute and the Server-EAP-Message attribute.

[0277] The Client-EAP-Message attribute encapsulates the EAP-Response message in S610 , and the Server-EAP-Message attribute encapsulates an EAP message. This EAP message is the EAP message in the Server-EAP-Message attribute recorded by the access device in S606 , and this EAP message carries Challenge 1 .

[0278] After receiving the Access-Request message, authentication server 1 and authentication server 2 first parse the Server-EAP-Message attribute to obtain Challenge 1, and then use Challenge 1 to overwrite the locally stored Challenge.

[0279] It is understandable that the updated Challenge by the authentication server 1 is still Challenge 1, and the authentication server 2 updates the locally stored Challenge from Challenge 2 to Challenge 1.

[0280] Authentication Server 1 and Authentication Server 2 both parse the MD5 value from the Client-EAP-Message attribute and obtain the locally stored password for the user. They then calculate an MD5 value using Challenge 1, the user name, and the locally stored password. They then compare the calculated MD5 value with the MD5 value parsed from the Client-EAP-Message attribute. If the two values ​​match, authentication succeeds. If they don't, authentication fails.

[0281] After authentication server 1 and authentication server 2 receive the Access-Request message, assuming that authentication server 1 successfully authenticates the user identity information and authentication server 2 fails to authenticate the user identity information, authentication server 1 executes S611 and authentication server 2 executes S612.

[0282] S611. Authentication server 1 sends an Access-Accept message to the access device. Correspondingly, the access device receives the Access-Accept message.

[0283] The Access-Accept message indicates that the access authentication is successful and does not carry the EAP-Message attribute.

[0284] After receiving the Access-Accept message, the access device may record the authentication result of authentication server 1 as access authentication success in the server table.

[0285] After S611, execute S613.

[0286] S612: Authentication server 2 sends an Access-Reject message to the access device. Correspondingly, the access device receives the Access-Reject message.

[0287] The Access-reject message indicates that the authentication has failed.

[0288] After receiving the Access-reject message, the access device may record the authentication result corresponding to the authentication server 2 as access authentication failure in the server table.

[0289] S613: The access device sends an EAP-Success message to the terminal. Correspondingly, the terminal receives the EAP-Success message.

[0290] At this point, the user has successfully logged in and can access network resources.

[0291] It should be noted that after S610, if authentication server 1 times out without a response, the authentication result corresponding to authentication server 1 may be recorded in the server table as authentication server unreachable. Furthermore, if an Access-reject response is received from authentication server 2, the authentication result corresponding to authentication server 2 may be recorded in the server table as access authentication failure.

[0292] In this situation, some authentication servers are unreachable, some authentication servers fail authentication, and the access device does not receive any Access-Accept responses from the authentication servers. In this case, the access device can determine whether to allow the user to access network resources based on preconfigured policies. For example, if an escape policy is configured on the access device, the escape process can be triggered, sending an EAP-Success message to the terminal, thereby allowing the terminal to access network resources. If no escape policy is configured, an EAP authentication failure message can be sent to the terminal, denying the user access to network resources.

[0293] FIG6 takes the MD5-based EAP relay processing mechanism as an example to illustrate the role of the newly added Server-EAP-Message attribute in the embodiment of the present application. The detailed process of the EAP relay processing mechanism can refer to the standard EAP relay authentication process.

[0294] With this method, the access device can use the Server-EAP-Message attribute to carry the challenge parameters generated by one authentication server. This allows other authentication servers to use the challenge parameters carried in the Server-EAP-Message attribute to authenticate user identity information. Even if the authentication server that generated the challenge parameters fails, the terminal access authentication process is not affected. This prevents terminal online failures caused by server failures and does not affect terminal access authentication speed. This improves the user online speed and online results, thereby improving the user experience.

[0295] As an example, the method provided in the embodiments of this application is also applicable to the PEAP-MSCHAPv2 authentication method. During the PEAP-MSCHAPv2 authentication process, the access device can also perform authentication processes with multiple authentication servers simultaneously, and the Server-EAP-Message attribute is included in the Access-Request message sent to the authentication server in each round, thereby synchronizing authentication information between multiple authentication servers.

[0296] As shown in Figure 7, the PEAP-MSCHAPv2 authentication process includes the following steps:

[0297] S701. User logs in.

[0298] S702: The terminal sends an EAP-Start message to the access device. Correspondingly, the access device receives the EAP-Start message.

[0299] For an introduction to the Start message, please refer to the relevant description in S502 above, which will not be repeated here.

[0300] S703: The access device sends an EAP-Request-Identity (EAP identity request) message to the terminal. Correspondingly, the terminal receives the EAP-Request-Identity message.

[0301] The EAP-Request-Identity message is used to request the user name of the terminal.

[0302] S704: The terminal sends an EAP-Response-Identity (EAP identity reply) message to the access device. Correspondingly, the access device receives the EAP-Response-Identity message.

[0303] For the PEAP-MSCHAPv2 method, the EAP-Response-Identity message includes the outer user name of the terminal, which may not be the real user name of the user.

[0304] S705: The access device sends Access-Request messages to authentication server 1 and authentication server 2. Correspondingly, authentication server 1 and authentication server 2 receive the Access-Request messages.

[0305] The Access-Request message is a message encapsulated using the RADIUS protocol. The Access-Request message includes a Client-EAP-Message attribute, and the Client-EAP-Message attribute encapsulates a Response-Identity message.

[0306] In addition, the access device can determine the user table entry corresponding to the terminal based on the MAC address of the terminal, and create a server table in the corresponding user table. The server table is used to store the authentication results fed back by each authentication server.

[0307] After receiving the Access-Request message, authentication server 1 and authentication server 2 can negotiate an authentication method with the terminal. The specific negotiation method can be referenced in the relevant protocol and is not limited in this embodiment. Assuming that the default authentication method configured on the authentication server is PEAP-MSCHAPv2, authentication server 1 executes S706 and authentication server 2 executes S707.

[0308] S706 : The authentication server 1 sends an Access-challenge message to the access device. Correspondingly, the access device receives the Access-challenge message.

[0309] S707 : Authentication server 2 sends an Access-challenge message to the access device. Correspondingly, the access device receives the Access-challenge message.

[0310] The Access-challenge messages sent by authentication server 1 and authentication server 2 are both encapsulated using the RADIUS protocol. The Access-challenge message includes an EAP-Message attribute, which encapsulates an EAP message that carries the PEAP authentication method.

[0311] The PEAP authentication methods carried in the EAP messages encapsulated by authentication server 1 and authentication server 2 are different.

[0312] After receiving the first Access-Challenge message sent by the authentication server, the access device can execute S708 . That is, after S706 , the access device can execute S708 .

[0313] S708: The access device sends an EAP-Request message to the terminal. Correspondingly, the terminal receives the EAP-Request message.

[0314] The EAP-Request message may specifically be a Request-EAP-PEAP message, which is used to notify the terminal of the PEAP authentication method.

[0315] S709: The terminal sends an EAP-Response message to the access device. Correspondingly, the access device receives the EAP-Response message.

[0316] The EAP-Response message may specifically be a Response-TLS-Client-Hello message.

[0317] If the terminal's authentication method matches the PEAP authentication method announced in the Request-EAP-PEAP message, the terminal sends a Response-TLS-Client-Hello message. The Response-TLS-Client-Hello message is a response message carrying the TLS Client Hello message. This message is used to trigger negotiation with the authentication server to establish a TLS tunnel.

[0318] The TLS-Client-Hello message contains a random number generated by the client.

[0319] S710: The access device sends Access-Request messages to authentication server 1 and authentication server 2 respectively.

[0320] After receiving the Response-TLS-Client-Hello message, the access device encapsulates the message into the Client-EAP-Message attribute and the previously recorded Server-EAP-Message attribute into an Access-Request message. The access device then sends the Access-Request message to authentication server 1 and authentication server 2.

[0321] After receiving the Access-Request, authentication server 1 executes S711 ; after receiving the Access-Request, authentication server 2 executes S712 .

[0322] S711: Authentication server 1 sends an Access-Challenge message to the access device. Correspondingly, the access device receives the Access-Challenge message.

[0323] Authentication server 1 can parse the TLS Client Hello message encapsulated in the Access-Request message, establish a TLS session, encapsulate the Server Hello 1 message, Server Certificate message, and Server Hello Done message in the EAP-Message attribute of the Access-Challenge message, and send it to the access device.

[0324] The Server-Hello 1 message contains the random number 1 generated by the authentication server 1. The authentication server 1 records the random number 1 in the TLS session.

[0325] S712: Authentication server 2 sends an Access-Challenge message to the access device. Correspondingly, the access device receives the Access-Challenge message.

[0326] Authentication server 2 parses the TLS Client Hello message encapsulated in the Access-Request message, establishes a TLS session, encapsulates the Server Hello 2 message, Server Certificate message, and Server Hello Done message in the EAP-Message attribute of the Access-Challenge message, and sends it to the access device.

[0327] The Server Hello 2 message includes the random number 2 generated by the authentication server 2, and the authentication server 2 records the random number 2 in the TLS session.

[0328] Authentication server 1 and authentication server 2 use the same certificate, and the encapsulated Server Certificate and Server Hello Done messages are the same. However, the random numbers generated by authentication server 1 and authentication server 2 are different, so the Server Hello 1 and Server Hello 2 messages are different.

[0329] The embodiment of the present application does not limit the execution order between S711 and S712. In the embodiment of the present application, taking the case where the access device first receives the Access-challenge message sent by authentication server 2 as an example, after the access device receives the Access-challenge message sent by authentication server 2, it records the EAP-Message attribute in the Access-challenge message as the Server-EAP-Message2 attribute and executes S713.

[0330] S713: The access device sends an EAP-Request message to the terminal. Correspondingly, the terminal receives the EAP-Request message.

[0331] The EAP-Request message includes the Server-EAP-Message2 attribute, which includes the Server Hello2 message and an internal random number 2.

[0332] S714: The terminal sends an EAP-Response message to the access device. Correspondingly, the access device receives the EAP-Response message.

[0333] The EAP-Response message includes a TLS Client Key Exchange message, a Change Cipher Spec message, and an Encrypted Handshake Message message, thereby performing algorithm and key exchange.

[0334] S715: The access device sends Access-Request messages to authentication server 1 and authentication server 2 respectively.

[0335] The Access-Request message includes a Client-EAP-Message attribute and a Server-EAP-Message2 attribute. The EAP-Response message in S714 is encapsulated in the Client-EAP-Message attribute.

[0336] After receiving the Access-Request message, authentication server 1 executes S716 , and after receiving the Access-Request message, authentication server 2 executes S717 .

[0337] S716: Authentication server 1 sends an Access-Challenge message to the access device. Correspondingly, the access device receives the Access-Challenge message.

[0338] After receiving the Access-Request message, authentication server 1 parses the Client-EAP-Message and Server-EAP-Message2 attributes, encapsulates the Change Cipher Spec message and Encrypted Handshake Message into an Access-Challenge message, and sends it to the access device.

[0339] Furthermore, authentication server 1 compares random number 1 recorded in the local TLS session with random number 2 in the Server Hello 2 message in the Server-EAP-Message 2 attribute. If they are different, authentication server 1 replaces random number 1 recorded in the local TLS session with random number 2.

[0340] The terminal and each authentication server use the random number in the TLS Client Hello message and random number 2 in the Server Hello2 message to generate a symmetric key and a message authentication code in the handshake message. Authentication Server 1 and Authentication Server 2 both use the same random number 2, allowing them to simultaneously establish TLS tunnels with the terminal without the terminal being aware of the presence of two authentication servers.

[0341] S717: Authentication server 2 sends an Access-Challenge message to the access device. Correspondingly, the access device receives the Access-Challenge message.

[0342] After receiving the Access-Request message, authentication server 2 parses the Client-EAP-Message and Server-EAP-Message2 attributes, encapsulates the Change Cipher Spec message and Encrypted Handshake Message into an Access-Challenge message, and sends it to the access device.

[0343] Furthermore, authentication server 2 compares random number 2 recorded in the local TLS session with random number 2 in the Server Hello 2 message in the Server-EAP-Message2 attribute. If they are the same, no replacement is performed.

[0344] The embodiment of the present application does not limit the execution order between S716 and S717. After S715, after the access device receives the first Access-challenge message, it records the EAP-Message attribute in the Access-challenge message as the Server-EAP-Message3 attribute and executes S718.

[0345] S718: The access device sends an EAP-Request message to the terminal. Correspondingly, the terminal receives the EAP-Request message.

[0346] The EAP-Request message includes the above-mentioned Server-EAP-Message3 attributes.

[0347] S719: The terminal sends an EAP-Response message to the access device. Correspondingly, the access device receives the EAP-Response message.

[0348] This EAP-Response message is the EAP-PEAP response message, completing the TLS tunnel establishment in the first phase of PEAP authentication. The second phase of MSCHAPv2 authentication then begins.

[0349] S720: The access device sends Access-Request messages to authentication server 1 and authentication server 2 respectively.

[0350] The Access-Request message carries the Client-EAP-Message attribute and Server-EAP-Message 3. The Client-EAP-Message attribute encapsulates the EAP-Response message in S719.

[0351] After receiving the Access-Request message, authentication server 1 executes S721 . After receiving the Access-Request message, authentication server 1 executes S722 .

[0352] S721: Authentication server 1 sends an Access-Challenge message to the access device. Correspondingly, the access device receives the Access-Challenge message.

[0353] Assuming that authentication server 1 is operating normally, authentication server 1 can encapsulate the Access-Challenge message and send it to the access device. The access device can record the EAP-Message attribute carried in the Access-Challenge message as the Server-EAP-Message4 attribute and execute S723.

[0354] S722: Authentication server 2 sends an Access-Reject message to the access device. Correspondingly, the access device receives the Access-Reject message.

[0355] Assume that an internal component of authentication server 2 fails and the terminal is rejected for authentication. Then, an Access-Reject message is encapsulated and sent to the access device.

[0356] It should be noted that during the entire authentication process, the authentication server may fail at any stage, causing the authentication server to send an Access-Reject message to the access device. This process uses the failure of authentication server 2 during the second phase of MSCHAPv2 authentication as an example.

[0357] S723: The access device terminal sends an EAP-Request message. Correspondingly, the terminal receives the EAP-Request message.

[0358] The EAP-Request message is encapsulated with the Server-EAP-Message4 attribute, which carries the user identity request message encrypted by TLS.

[0359] After receiving the Access-Reject message from authentication server 2, the access device records the authentication result of authentication server 2 as authentication failure and does not send any Access-Request messages to authentication server 2 subsequently.

[0360] S724: The terminal sends an EAP-Response message to the access device. Correspondingly, the access device receives the EAP-Response message.

[0361] The EAP-Response message carries the user identity information encrypted by TLS, that is, the inner user name (real user name).

[0362] S725: The access device sends an Access-Request message to the authentication server 1. Correspondingly, the authentication server 1 receives the Access-Request message.

[0363] The Access-Request message carries the Client-EAP-Message attribute and the Server-EAP-Message4 attribute. The Client-EAP-Message attribute encapsulates the EAP-Response message in S724.

[0364] S726: Authentication server 1 sends an Access-Challenge message to the access device. Correspondingly, the access device receives the Access-Challenge message.

[0365] Authentication server 1 parses the Client-EAP-Message attribute and the Server-EAP-Message4 attribute. Since the authentication information in the Server-EAP-Message4 attribute is the same as the authentication information recorded locally on authentication server 1, it is not replaced subsequently.

[0366] The Access-Challenge message includes TLS-encrypted authentication sub-method negotiation information. For example, the authentication sub-method negotiation information is MS-CHAPv2.

[0367] S727: The access device sends an EAP-Request message to the terminal. Correspondingly, the terminal receives the EAP-Request message.

[0368] The EAP-Request message carries the authentication sub-method negotiation information encrypted by TLS.

[0369] S728: The terminal sends an EAP-Response message to the access device. Correspondingly, the access device receives the EAP-Response message.

[0370] After receiving the authentication sub-method negotiation information, if the terminal confirms that the authentication sub-method can be adopted, it replies with an EAP-Response message indicating that the authentication sub-method can be adopted.

[0371] S729: The access device sends an Access-Request message to the authentication server 1. Correspondingly, the authentication server 1 receives the Access-Request message.

[0372] S730: Authentication server 1 sends an Access-Challenge message to the access device. Correspondingly, the access device receives the Access-Challenge message.

[0373] Authentication server 1 may generate and record MS-CHAPv2Challenge information, and encapsulate it into the Access-Challenge message.

[0374] It is understandable that if authentication server 2 does not fail in the above process, the access device needs to record the EAP-EAP-Message attribute in the Access-Challenge message as the Server-EAP-Message attribute so that the Server-EAP-Message attribute can be synchronized with authentication server 2 later.

[0375] S731: The access device sends an EAP-Request message to the terminal. Correspondingly, the terminal receives the EAP-Request message.

[0376] The EAP-Request message carries the TLS-encrypted MS-CHAPv2Challenge information.

[0377] S732: The terminal sends an EAP-Response message to the access device. Correspondingly, the access device receives the EAP-Response message.

[0378] After parsing the MS-CHAPv2Challenge, the terminal randomly generates a Peer-Challenge and uses its own user name, password, MS-CHAPv2Challenge, and Peer-Challenge to generate the NT-Response1 message. It then encrypts the Peer-Challenge and NT-Response1 message with TLS, encapsulates them in an EAP-Response message, and sends it to the access device.

[0379] S733: The access device sends an Access-Request message to the authentication server 1. Correspondingly, the authentication server 1 receives the Access-Request message.

[0380] S734: Authentication server 1 sends an Access-Challenge message to the access device. Correspondingly, the access device receives the Access-Challenge message.

[0381] Authentication server 1 parses the Peer-Challenge and NT-Response 1 messages, and combines the MS-CHAPv2Challenge it has recorded with the username and password to generate the NT-Response 2 message. It then compares NT-Response 1 with NT-Response 2. If they match, user authentication is successful. It then generates Auth-String 1 based on the username, password, MS-CHAPv2Challenge, Peer-Challenge, and NT-Response 2, and encapsulates this Auth-String 1 message in an Access-Challenge message.

[0382] S735: The access device sends an EAP-Request message to the terminal. In response, the terminal receives the EAP-Request message. The EAP-Request message carries Auth-String1 information.

[0383] S736: The terminal sends an EAP-Response message to the access device. Correspondingly, the access device receives the EAP-Response message.

[0384] The terminal uses the same method to generate Auth-String2 using the recorded NT-Response1, user name, password, MS-CHAPv2Challenge, and Peer-Challenge, and compares it with the parsed Auth-String1. If they are consistent, the terminal has successfully verified authentication server 1.

[0385] The EAP-Response packet carries Auth-String2.

[0386] S737: The access device sends an Access-Request message to the authentication server 1. Correspondingly, the authentication server 1 receives the Access-Request message.

[0387] The Access-Request message includes a Client-EAP-Message attribute, and the Client-EAP-Message attribute carries the EAP-Response message in S736.

[0388] S738: Authentication server 1 sends an Access-Accept message to the access device. Correspondingly, the access device receives the Access-Accept message.

[0389] Authentication server 1 can parse Auth-String2 from the Access-Request message and compare it with the recorded Auth-String1. If they are consistent, it determines that the user authentication is successful and replies with an Access-Accept message.

[0390] After receiving the Access-Accept message, the access device records the authentication result of authentication server 1 as successful.

[0391] S739: The access device sends an EAP-Success message to the terminal. Correspondingly, the terminal receives the EAP-Success message.

[0392] In addition, the access device allows terminal traffic to pass through, allowing the terminal to access network resources.

[0393] It should be noted that the embodiments of the present application are not limited to the EAP authentication process based on 802.1X. The method provided in the embodiments of the present application is also applicable to the EAP relay authentication process of Web / portal users based on Http / Https.

[0394] It should be noted that, in the processes of FIG6 and FIG7, if the authentication server also generates private data for verifying the access device, the authentication server may encapsulate the standard Radius attribute in the Access-challenge message.

[0395] The attribute name of the standard Radius attribute may be the State attribute, the attribute number may be 24, the data type may be octets, and the value of the State attribute may be the private data.

[0396] The access device can record the State attribute value carried in the Access-Challenge message sent by each authentication server. The access device can also encapsulate the standard RADIUS attribute in the messages it subsequently sends to each authentication server, along with the State attribute value of the authentication server. This allows the authentication server to verify the legitimacy of the access device based on the State attribute, preventing counterfeit access devices from performing illegal authentication and improving network security.

[0397] In another embodiment of the present application, if the Server-EAP-Message attribute is not used to synchronize authentication parameters, an EAP termination mechanism can be used instead of an EAP relay mechanism, so that only a single interaction is required between the access device and the authentication server. This eliminates the need to switch authentication servers during the access authentication process, and also avoids authentication failures caused by unsynchronized authentication parameters after a server switch.

[0398] The following describes in detail how to implement the EAP termination processing mechanism instead of the EAP relay processing mechanism.

[0399] Based on Figure 7, the EAP relay processing mechanism can be changed to the EAP termination processing mechanism. In this way, the access device does not need to use the Server-EAP-Message attribute to synchronize authentication parameters. As shown in Figure 8, the specific steps include:

[0400] S801. User logs in.

[0401] S802: The terminal sends an EAP-Start message to the access device. Correspondingly, the access device receives the EAP-Start message.

[0402] S803: The access device sends an EAP-Request-Identity (EAP identity request) message to the terminal. Correspondingly, the terminal receives the EAP-Request-Identity message.

[0403] S804: The terminal sends an EAP-Response-Identity (EAP identity reply) message to the access device. Correspondingly, the access device receives the EAP-Response-Identity message.

[0404] In S805-S816, the messages sent by the access device to the terminal are all EAP-Request (EAP request) messages, and the messages sent by the terminal to the access device are all EAP-Response (EAP reply) messages.

[0405] In S805 , the EAP-Request message is specifically a Request-EAP-PEAP message, which is used to notify the terminal of the PEAP authentication method.

[0406] In S806, the EAP-Response message is specifically a Response-TLS-Client-Hello message. If the terminal's authentication method matches the PEAP authentication method announced in the Request-EAP-PEAP message, the terminal replies with the Response-TLS-Client-Hello message. The Response-TLS-Client-Hello message is used to trigger negotiation with the authentication server to establish a TLS tunnel and carries the random number information generated by the client.

[0407] After receiving the Response-TLS-Client-Hello message, the access device parses the TLS Client Hello message encapsulated in the Access-Request message, establishes a TLS session, generates a random number 1, and records the random number in the TLS session information.

[0408] In S807, the EAP-Request message includes a Server Hello message, a Server Certificate message, and a Server Hello Done message. The Server Hello message includes a random number 1.

[0409] In S808 , the EAP-Response message includes a TLS Client Key Exchange message, a Change Cipher Spec message, and an Encrypted Handshake Message, thereby performing algorithm and key exchange with the access device.

[0410] In S809, the EAP-Request message includes the Hange Cipher Spec message and the Encrypted Handshake Message message.

[0411] In S810, the EAP-Response message is an EAP-PEAP response message. At this point, the TLS tunnel between the terminal and the access device is established in the first phase of PEAP authentication. Subsequently, the second phase of MSCHAPv2 authentication begins.

[0412] In S811, the EAP-Request message carries a user identity request message encrypted by TLS.

[0413] In S812, the EAP-Response message carries the user identity information encrypted by TLS, that is, the inner user name (real user name).

[0414] In S813, the EAP-Request message carries the authentication sub-method negotiation information encrypted by TLS. For example, the authentication sub-method negotiation information is MS-CHAPv2.

[0415] In S814, the EAP-Response message is used to indicate that the terminal can adopt the authentication sub-method in S813.

[0416] In S815 , the EAP-Request message carries the MS-CHAPv2-Challenge information encrypted by TLS.

[0417] In S816, the EAP-Response message carries the TLS-encrypted Peer-Challenge and NT-Response1 information. The Peer-Challenge is randomly generated by the terminal, and the NT-Response1 information is generated by the terminal based on the user name, password, MS-CHAPv2-Challenge, and Peer-Challenge.

[0418] After receiving the Peer-Challenge and NT-Response information, the access device encapsulates an EAP-Request message. This EAP-Request message contains two RADIUS attributes: the MS-CHAP-Challenge attribute and the MS-CHAP2-Response attribute. The MS-CHAP-Challenge attribute encapsulates the MS-CHAPv2-Challenge, while the MS-CHAP2-Response attribute encapsulates the Peer-Challenge and NT-Response information. Compared to the process in Figure 7, the process in Figure 8 does not require the EAP-Message attribute to be extended in the Access-Request message. The access device then executes S817 and S818.

[0419] S817: The access device sends an Access-Request message to the authentication server 1. Correspondingly, the authentication server 1 receives the Access-Request message.

[0420] Authentication server 1 parses the Peer-Challenge and NT-Response 1 messages, then compares NT-Response 1 with its own NT-Response 2. If they match, authentication is successful. It then generates Auth-String 1 based on the user name, password, MS-CHAPv2-Challenge, Peer-Challenge, and NT-Response 2. It then encapsulates this Auth-String 1 in an Access-Challenge message, and then executes S820.

[0421] S818: The access device sends an Access-Request message to the authentication server 2. Correspondingly, the authentication server 2 receives the Access-Request message.

[0422] Assuming that an internal component of the authentication server 2 fails and the terminal authentication is rejected, an Access-Reject message will be encapsulated and S819 will be executed.

[0423] S819: Authentication server 2 sends an Access-Reject message to the access device. Correspondingly, the access device receives the Access-Reject message.

[0424] S820: Authentication server 1 sends an Access-Accept message to the access device. Correspondingly, the access device receives the Access-Accept message.

[0425] S821: The access device sends an EAP-Request message to the terminal. In response, the terminal receives the EAP-Request message. The EAP-Request message carries Auth-String1 information.

[0426] S822: The terminal sends an EAP-Response message to the access device. Correspondingly, the access device receives the EAP-Response message.

[0427] The terminal uses the same method to generate Auth-String2 using the recorded NT-Response1, user name, password, MS-CHAPv2Challenge, and Peer-Challenge, and compares it with the parsed Auth-String1. If they are consistent, the terminal has successfully verified authentication server 1.

[0428] The Access-Request message carries Auth-String2. The access device parses Auth-String2 from the Access-Request message and compares it with the recorded Auth-String1. If they match, the user authentication is successful.

[0429] S823: The access device sends an EAP-Success message to the terminal. Correspondingly, the terminal receives the EAP-Success message.

[0430] In addition, the access device allows terminal traffic to pass through, allowing the terminal to access network resources.

[0431] By using the above method, the access device can replace the authentication server to establish a TLS tunnel with the terminal. During the authentication process, only one interaction is required between the access device and the authentication server, so there is no need to interact with different authentication servers multiple times. There is no need to synchronize authentication parameters between authentication servers, which can avoid the problem of terminal online failure caused by server failure.

[0432] It should be noted that the processes of Figures 7 and 8 are two exemplary processes provided in the embodiments of this application. In Figure 7, the addition of the Server-EAP-Message attribute enables synchronization of authentication parameters between authentication servers. In Figure 8, multiple interactions between the access device and the authentication server are avoided by establishing a TLS tunnel between the access device and the terminal instead of the authentication server.

[0433] In Figures 7 and 8, after the authentication server, access device, and terminal obtain the information used for authentication, the specific authentication method can refer to the provisions of the PEAP-MSCHAPv2 related protocols, and the embodiments of the present application do not limit this.

[0434] Based on the same concept, an embodiment of the present application provides a terminal authentication device, as shown in FIG9 . The device is applied to an access device and includes:

[0435] The sending module 901 is configured to send a first message to each of the multiple authentication servers respectively, where the first message is used to request the authentication server to perform access authentication on the terminal.

[0436] The receiving module 902 is used to trigger the sending module 901 to send a third message to the terminal if a second message sent by any authentication server is received and the second message is the first second message sent by multiple authentication servers after receiving the first message. Both the second message and the third message are used to indicate that the terminal access authentication is successful.

[0437] Optionally, the receiving module 902 is further used to trigger the sending module 901 to send a fifth message to the terminal if a fourth message sent by any authentication server is received and the fourth message is the first fourth message sent by multiple authentication servers after receiving the first message. The fifth message includes authentication parameters, and the authentication parameters are carried by the EAP message included in the fourth message.

[0438] The receiving module 902 is further configured to receive a sixth message sent by the terminal, where the sixth message includes user identity information, and the user identity information is encrypted using authentication parameters.

[0439] The sending module 901 is further configured to send a seventh message to each authentication server respectively, where the seventh message includes the sixth message and the EAP message, so that the authentication server verifies the user identity information based on the authentication parameters.

[0440] Optionally, the device further includes a recording module:

[0441] The receiving module 902 is also used to trigger the recording module to record the authentication result of each server for the terminal as access authentication failure if it receives the same number of eighth messages as the number of multiple authentication servers within the first preset time period, and the authentication results carried by each eighth message indicate that the terminal access authentication failed.

[0442] The sending module 901 is further configured to send a ninth message to the terminal, where the ninth message is used to indicate that the terminal access authentication fails.

[0443] Optionally, the recording module is further configured to record the authentication result of each server on the terminal as unreachable authentication server if no message is received from any authentication server after the first preset time period has expired.

[0444] The sending module 901 is further configured to send a ninth message to the terminal, where the ninth message is used to indicate that the terminal access authentication fails.

[0445] Optionally, the receiving module 902 is also used to trigger the recording module to record the authentication results of the first number of authentication servers for the terminal as access authentication failure if the eighth message sent by the first number of authentication servers is received within the first preset time period, and the authentication results carried by each eighth message indicate that the terminal access authentication failed.

[0446] The recording module is further configured to record the authentication results of the second number of authentication servers on the terminal as unreachable authentication servers if no messages are received from the second number of authentication servers among the multiple servers after the first preset time has expired.

[0447] The sending module 901 is further used to send a ninth message or a tenth message to the terminal, the ninth message is used to indicate that the terminal access authentication fails, and the tenth message is used to indicate that the terminal access authentication succeeds. The sum of the first number and the second number is the same as the number of multiple authentication servers.

[0448] Optionally, the receiving module 902 is also used to trigger the recording module to record the authentication result of each server for the terminal as access authentication failure if the eighth message is received within the second preset time period, the number of which is the same as the number of multiple authentication servers, and the authentication results carried by each eighth message indicate that the terminal access authentication has failed.

[0449] The sending module 901 is further configured to send a ninth message to the terminal, where the ninth message is used to indicate that the terminal access authentication fails.

[0450] Optionally, the recording module is further configured to record the authentication result of each server on the terminal as unreachable authentication server if no message is received from any authentication server after the second preset time period has expired.

[0451] The sending module 901 is further configured to send a ninth message to the terminal, where the ninth message is used to indicate that the terminal access authentication fails.

[0452] Optionally, the receiving module 902 is also used to trigger the recording module to record the authentication results of the third number of authentication servers for the terminal as access authentication failure if the eighth message sent by the third number of authentication servers is received within the second preset time period, and the authentication results carried by each eighth message indicate that the terminal access authentication failed.

[0453] The recording module is further configured to record the authentication results of the fourth number of authentication servers on the terminal as unreachable authentication servers if no messages are received from the fourth number of authentication servers among the multiple servers after the second preset time has expired.

[0454] The sending module 901 is further configured to send a ninth message or a tenth message to the terminal, the ninth message being used to indicate that the terminal access authentication has failed, and the tenth message being used to indicate that the terminal access authentication has succeeded. The sum of the third quantity and the fourth quantity is the same as the number of the multiple authentication servers.

[0455] Optionally, the seventh message includes EAP message attributes, and the EAP message attributes are used to carry the EAP message.

[0456] Optionally, the length of the EAP message attribute is a preset length.

[0457] If the length of the EAP message is greater than the preset length, the seventh message includes multiple EAP message attributes, and the EAP message is carried in the multiple EAP message attributes in the form of fragments.

[0458] Optionally, the access device is connected to multiple groups of authentication servers.

[0459] The sending module 901 is further configured to select a group of authentication servers from multiple groups of authentication servers in a load sharing manner, and send a first message to the selected group of authentication servers; or

[0460] A preset number of authentication servers are selected from each group of authentication servers included in the multiple groups of authentication servers in a load sharing manner, and a first message is sent to the selected authentication servers.

[0461] Based on the same concept, an embodiment of the present application further provides an access device, as shown in FIG10 , which includes:

[0462] Processor 1001;

[0463] transceiver 1004;

[0464] A machine-readable storage medium 1002 stores machine-executable instructions that can be executed by the processor 1001; the machine-executable instructions prompt the processor 1001 to perform the following steps:

[0465] A first message is sent to each of the multiple authentication servers through the transceiver 1004, where the first message is used to request the authentication server to perform access authentication on the terminal.

[0466] If a second message sent by any authentication server is received through transceiver 1004 and the second message is the first second message sent by multiple authentication servers after receiving the first message, a third message is sent to the terminal through transceiver 1004. Both the second message and the third message are used to indicate that the terminal access authentication is successful.

[0467] Optionally, the machine executable instructions further cause the processor 1001 to perform the following steps:

[0468] If a fourth message sent by any authentication server is received through the transceiver 1004 and the fourth message is the first fourth message sent by multiple authentication servers after receiving the first message, a fifth message is sent to the terminal through the transceiver 1004, where the fifth message includes authentication parameters, and the authentication parameters are carried by the EAP message included in the fourth message.

[0469] The sixth message sent by the terminal is received through the transceiver 1004 , where the sixth message includes user identity information, and the user identity information is encrypted using the authentication parameters.

[0470] The seventh message is sent to each authentication server through the transceiver 1004, where the seventh message includes the sixth message and the EAP message, so that the authentication server verifies the user identity information based on the authentication parameters.

[0471] Optionally, the machine executable instructions further cause the processor 1001 to perform the following steps:

[0472] If within the first preset time period, the transceiver 1004 receives the same number of eighth messages as the number of multiple authentication servers, and the authentication results carried by each eighth message indicate that the terminal access authentication fails, then the authentication result of each server for the terminal is recorded as access authentication failure.

[0473] A ninth message is sent to the terminal via the transceiver 1004 , where the ninth message is used to indicate that the terminal access authentication has failed.

[0474] Optionally, the machine executable instructions further cause the processor 1001 to perform the following steps:

[0475] After the first preset time has elapsed, if no message is received from any authentication server, the authentication result of each server on the terminal is recorded as unreachable authentication server.

[0476] A ninth message is sent to the terminal via the transceiver 1004 , where the ninth message is used to indicate that the terminal access authentication has failed.

[0477] Optionally, the machine executable instructions further cause the processor 1001 to perform the following steps:

[0478] If within the first preset time period, the eighth message sent by the first number of authentication servers is received through the transceiver 1004, and the authentication result carried by each eighth message indicates that the terminal access authentication fails, then the authentication results of the first number of authentication servers for the terminal are recorded as access authentication failure.

[0479] After the first preset time period has expired, if no messages are received from the second number of authentication servers among the multiple servers, the authentication results of the second number of authentication servers on the terminal are respectively recorded as unreachable authentication servers.

[0480] The ninth message or the tenth message is sent to the terminal through the transceiver 1004. The ninth message is used to indicate that the terminal access authentication fails, and the tenth message is used to indicate that the terminal access authentication succeeds. The sum of the first number and the second number is the same as the number of multiple authentication servers.

[0481] Optionally, the machine executable instructions further cause the processor 1001 to perform the following steps:

[0482] If within the second preset time period, the transceiver 1004 receives the same number of eighth messages as the number of multiple authentication servers, and the authentication results carried by each eighth message indicate that the terminal access authentication fails, then the authentication result of each server for the terminal is recorded as access authentication failure.

[0483] A ninth message is sent to the terminal via the transceiver 1004 , where the ninth message is used to indicate that the terminal access authentication has failed.

[0484] Optionally, the machine executable instructions further cause the processor 1001 to perform the following steps:

[0485] After the second preset time period has expired, if no message is received from any authentication server, the authentication result of each server on the terminal is recorded as unreachable authentication server.

[0486] A ninth message is sent to the terminal via the transceiver 1004 , where the ninth message is used to indicate that the terminal access authentication has failed.

[0487] Optionally, the machine executable instructions further cause the processor 1001 to perform the following steps:

[0488] If within the second preset time period, the eighth message sent by the third number of authentication servers is received through the transceiver 1004, and the authentication result carried by each eighth message indicates that the terminal access authentication fails, then the authentication results of the third number of authentication servers for the terminal are recorded as access authentication failure.

[0489] After the second preset time period has expired, if no messages are received from the fourth number of authentication servers among the multiple servers, the authentication results of the fourth number of authentication servers on the terminal are respectively recorded as unreachable authentication servers.

[0490] The ninth message or the tenth message is sent to the terminal through the transceiver 1004. The ninth message is used to indicate that the terminal access authentication fails, and the tenth message is used to indicate that the terminal access authentication succeeds. The sum of the third number and the fourth number is the same as the number of multiple authentication servers.

[0491] Optionally, the seventh message includes EAP message attributes, and the EAP message attributes are used to carry the EAP message.

[0492] Optionally, the length of the EAP message attribute is a preset length.

[0493] If the length of the EAP message is greater than the preset length, the seventh message includes multiple EAP message attributes, and the EAP message is carried in the multiple EAP message attributes in the form of fragments.

[0494] Optionally, the access device is connected to multiple authentication servers; the machine executable instructions cause the processor 1001 to perform the following steps:

[0495] Selecting a group of authentication servers from multiple groups of authentication servers in a load-sharing manner, and sending a first message to the selected group of authentication servers through the transceiver 1004; or,

[0496] A preset number of authentication servers are selected from each authentication server group included in the multiple authentication server groups in a load sharing manner, and a first message is sent to the selected authentication servers via the transceiver 1004 .

[0497] In Figure 10 , a communication bus 1003 may also be included. The processor 1001, the machine-readable storage medium 1002, and the transceiver 1004 communicate with each other via the communication bus 1003. The communication bus 1003 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. The communication bus may be divided into an address bus, a data bus, a control bus, and the like.

[0498] The transceiver 1004 may be a wireless communication module. Under the control of the processor 1001 , the transceiver 1004 exchanges data with other devices.

[0499] The machine-readable storage medium 1002 may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Alternatively, the machine-readable storage medium may be at least one storage device located remote from the processor.

[0500] Processor 1001 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, and discrete hardware components.

[0501] Based on the same inventive concept, according to the terminal authentication method provided in the above embodiment of the present application, the embodiment of the present application further provides a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions that can be executed by a processor. The processor is prompted by the machine-executable instructions to implement the steps of the above terminal authentication method.

[0502] In another embodiment provided by the present application, a computer program product including instructions is further provided, which, when executed on a computer, enables the computer to execute the steps of the terminal authentication method in the above embodiment.

[0503] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

[0504] Each embodiment in this specification is described in a related manner. Similar portions between the embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences from other embodiments. In particular, the device embodiments are generally similar to the method embodiments, so their description is relatively simple. For related portions, refer to the description of the method embodiments.

[0505] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A terminal authentication method, characterized in that: The method is applied to an access device, and the method includes: Sending a first message to each authentication server of the multiple authentication servers, wherein the first message is used to request the authentication server to perform access authentication on the terminal; If a second message sent by any authentication server is received and the second message is the first second message sent by the multiple authentication servers after receiving the first message, a third message is sent to the terminal, and the second message and the third message are both used to indicate that the terminal access authentication is successful.

2. The method according to claim 1, characterized in that After sending the first message to the multiple authentication servers, the method further includes: If a fourth message sent by any authentication server is received and the fourth message is the first fourth message sent by the multiple authentication servers after receiving the first message, a fifth message is sent to the terminal, where the fifth message includes authentication parameters, and the authentication parameters are carried by the EAP message included in the fourth message; receiving a sixth message sent by the terminal, wherein the sixth message includes user identity information, and the user identity information is encrypted by the authentication parameter; A seventh message is sent to each authentication server respectively, where the seventh message includes the sixth message and the EAP message, so that the authentication server verifies the user identity information based on the authentication parameters.

3. The method according to claim 2, characterized in that After sending the first message to the multiple authentication servers, the method further includes: If within the first preset time period, the same number of eighth messages as the plurality of authentication servers are received, and the authentication result carried by each eighth message indicates that the terminal access authentication fails, then the authentication result of each server for the terminal is recorded as access authentication failure; A ninth message is sent to the terminal, where the ninth message is used to indicate that the terminal access authentication fails.

4. The method according to claim 2, characterized in that: After sending the first message to the multiple authentication servers, the method further includes: After the first preset time has elapsed, if no message sent by any authentication server is received, the authentication result of each server on the terminal is recorded as unreachable authentication server; A ninth message is sent to the terminal, where the ninth message is used to indicate that the terminal access authentication fails.

5. The method according to claim 2, characterized in that: After sending the first message to the multiple authentication servers, the method further includes: If within the first preset time period, the eighth message sent by the first number of authentication servers is received, and the authentication result carried by each eighth message indicates that the terminal access authentication fails, then the authentication results of the first number of authentication servers for the terminal are respectively recorded as access authentication failure; After the first preset time is reached, if no message sent by the second number of authentication servers among the multiple servers is received, then the authentication results of the second number of authentication servers on the terminal are respectively recorded as unreachable authentication servers; A ninth message or a tenth message is sent to the terminal, wherein the ninth message is used to indicate that the terminal access authentication fails, and the tenth message is used to indicate that the terminal access authentication succeeds, and the sum of the first number and the second number is the same as the number of the multiple authentication servers.

6. The method according to claim 1, characterized in that After sending the first message to the multiple authentication servers, the method further includes: If within the second preset time length, the same number of eighth messages as the plurality of authentication servers are received, and the authentication result carried by each eighth message indicates that the terminal access authentication fails, then the authentication result of each server for the terminal is recorded as access authentication failure; A ninth message is sent to the terminal, where the ninth message is used to indicate that the terminal access authentication fails.

7. The method according to claim 1, characterized in that After sending the first message to the multiple authentication servers, the method further includes: After the second preset time has elapsed, if no message sent by any authentication server is received, the authentication result of each server on the terminal is recorded as unreachable authentication server; A ninth message is sent to the terminal, where the ninth message is used to indicate that the terminal access authentication fails.

8. The method according to claim 1, characterized in that After sending the first message to the multiple authentication servers, the method further includes: If within the second preset time period, an eighth message sent by a third number of authentication servers is received, and the authentication result carried by each eighth message indicates that the terminal access authentication fails, then the authentication result of the third number of authentication servers for the terminal is respectively recorded as access authentication failure; After the second preset time is reached, if no message sent by a fourth number of authentication servers among the multiple servers is received, then the authentication results of the fourth number of authentication servers on the terminal are respectively recorded as access authentication failure; A ninth message or a tenth message is sent to the terminal, the ninth message is used to indicate that the terminal access authentication fails, the tenth message is used to indicate that the terminal access authentication succeeds, and the sum of the third number and the fourth number is the same as the number of the multiple authentication servers.

9. The method according to claim 2, characterized in that: The seventh message includes an EAP message attribute, and the EAP message attribute is used to carry the EAP message.

10. The method according to claim 9, characterized in that The length of the EAP message attribute is a preset length; If the length of the EAP message is greater than the preset length, the seventh message includes a plurality of EAP message attributes, and the EAP message is carried in the plurality of EAP message attributes in a fragmented form.

11. The method according to claim 1, characterized in that: The access device is connected to multiple groups of authentication servers; and the sending of the first message to the multiple authentication servers includes: selecting a group of authentication servers from the multiple groups of authentication servers in a load sharing manner, and sending the first message to the selected group of authentication servers; or, A preset number of authentication servers are selected from each group of authentication servers included in the multiple groups of authentication servers in a load sharing manner, and the first message is sent to the selected authentication servers.

12. A terminal authentication device, characterized in that: The device is applied to an access device, and the device includes: A sending module, used to send a first message to each of the multiple authentication servers, wherein the first message is used to request the authentication server to perform access authentication on the terminal; The receiving module is used to trigger the sending module to send a third message to the terminal if a second message sent by any authentication server is received and the second message is the first second message sent by the multiple authentication servers after receiving the first message. The second message and the third message are both used to indicate that the terminal access authentication is successful.

13. The device according to claim 12, characterized in that The receiving module is further configured to trigger the sending module to send a fifth message to the terminal if a fourth message sent by any authentication server is received and the fourth message is the first fourth message sent by the multiple authentication servers after receiving the first message, wherein the fifth message includes authentication parameters, and the authentication parameters are carried by the EAP message included in the fourth message; The receiving module is further used to receive a sixth message sent by the terminal, the sixth message including user identity information, and the user identity information is encrypted by the authentication parameter; The sending module is further used to send a seventh message to each authentication server respectively, where the seventh message includes the sixth message and the EAP message, so that the authentication server verifies the user identity information based on the authentication parameters.

14. The device according to claim 13, characterized in that The device also includes a recording module: The receiving module is further configured to trigger the recording module to record the access authentication of each of the plurality of authentication servers if, within a first preset time period, the receiving module receives the same number of eighth messages as the number of the plurality of authentication servers, and the authentication results carried by each eighth message indicate that the terminal access authentication fails. The authentication result of the server on the terminal is access authentication failure; The sending module is further used to send a ninth message to the terminal, where the ninth message is used to indicate that the terminal access authentication fails.

15. The device according to claim 13, characterized in that The recording module is further configured to record the authentication result of each server on the terminal as unreachable authentication server if no message sent by any authentication server is received after the first preset time has elapsed; The sending module is further used to send a ninth message to the terminal, where the ninth message is used to indicate that the terminal access authentication fails.

16. The device according to claim 13, characterized in that The receiving module is further configured to trigger the recording module to record respectively that the authentication results of the first number of authentication servers for the terminal are access authentication failures if an eighth message sent by the first number of authentication servers is received within a first preset time period, and the authentication results carried by each eighth message indicate that the terminal access authentication fails; The recording module is further configured to, if no message sent by a second number of authentication servers among the multiple servers is received after the first preset time period has expired, respectively record the authentication result of the second number of authentication servers on the terminal as an authentication server unreachable; The sending module is further used to send a ninth message or a tenth message to the terminal, the ninth message is used to indicate that the terminal access authentication fails, and the tenth message is used to indicate that the terminal access authentication succeeds, and the sum of the first number and the second number is the same as the number of the multiple authentication servers.

17. The device according to claim 12, characterized in that The receiving module is further configured to trigger the recording module to record the authentication result of each server for the terminal as access authentication failure if, within a second preset time period, eighth messages equal in number to the plurality of authentication servers are received, and the authentication result carried by each eighth message indicates that the terminal access authentication fails; The sending module is further used to send a ninth message to the terminal, where the ninth message is used to indicate that the terminal access authentication fails.

18. The device according to claim 12, characterized in that The recording module is further configured to record, respectively, the authentication result of each server on the terminal as unreachable authentication server if no message sent by any authentication server is received after the second preset time has elapsed; The sending module is further used to send a ninth message to the terminal, where the ninth message is used to indicate that the terminal access authentication fails.

19. The device according to claim 12, characterized in that The receiving module is further configured to trigger the recording module to respectively record that the authentication results of the third number of authentication servers for the terminal are access authentication failures if an eighth message sent by the third number of authentication servers is received within the second preset time period, and the authentication results carried by each eighth message indicate that the terminal access authentication fails; The recording module is further configured to, if no message sent by a fourth number of authentication servers among the multiple servers is received after the second preset time period has expired, respectively record the authentication result of the fourth number of authentication servers on the terminal as an authentication server unreachable; The sending module is further used to send a ninth message or a tenth message to the terminal, the ninth message is used to indicate that the terminal access authentication fails, and the tenth message is used to indicate that the terminal access authentication succeeds, and the sum of the third number and the fourth number is the same as the number of the multiple authentication servers.

20. The device according to claim 13, characterized in that The seventh message includes an EAP message attribute, and the EAP message attribute is used to carry the EAP message.

21. The device according to claim 20, characterized in that The length of the EAP message attribute is a preset length; If the length of the EAP message is greater than the preset length, the seventh message includes a plurality of EAP message attributes, and the EAP message is carried in the plurality of EAP message attributes in a fragmented form.

22. The device according to claim 12, characterized in that The access device is connected to multiple groups of authentication servers; the sending module is further used to select a group of authentication servers from the multiple groups of authentication servers in a load sharing manner, and send the first message to the selected group of authentication servers; or, A preset number of authentication servers are selected from each group of authentication servers included in the multiple groups of authentication servers in a load sharing manner, and the first message is sent to the selected authentication servers.

23. An access device, characterized in that: The access device comprises: processor; Transceiver; A machine-readable storage medium storing machine-executable instructions that can be executed by the processor; the machine-executable instructions prompt the processor to perform the following steps: Sending a first message to each authentication server of the plurality of authentication servers through the transceiver, wherein the first message is used to request the authentication server to perform access authentication on the terminal; If a second message sent by any authentication server is received through the transceiver and the second message is the first second message sent by the multiple authentication servers after receiving the first message, a third message is sent to the terminal through the transceiver, and the second message and the third message are both used to indicate that the terminal access authentication is successful.

24. The access device according to claim 23, characterized in that: The machine executable instructions further cause the processor to perform the following steps: If a fourth message sent by any authentication server is received through the transceiver and the fourth message is the first fourth message sent by the multiple authentication servers after receiving the first message, a fifth message is sent to the terminal through the transceiver, where the fifth message includes authentication parameters, and the authentication parameters are carried by the EAP message included in the fourth message; receiving, by the transceiver, a sixth message sent by the terminal, wherein the sixth message includes user identity information, and the user identity information is encrypted by the authentication parameter; A seventh message is sent to each authentication server through the transceiver, wherein the seventh message includes the sixth message and the EAP message, so that the authentication server verifies the user identity information based on the authentication parameters.

25. The access device according to claim 24, characterized in that: The machine executable instructions further cause the processor to perform the following steps: If within the first preset time period, the transceiver receives the same number of eighth messages as the plurality of authentication servers, and the authentication results carried by each eighth message indicate that the terminal access authentication fails, then the authentication result of each server for the terminal is recorded as access authentication failure; A ninth message is sent to the terminal through the transceiver, where the ninth message is used to indicate that the terminal access authentication fails.

26. The access device according to claim 24, characterized in that: The machine executable instructions further cause the processor to perform the following steps: After the first preset time has elapsed, if no message sent by any authentication server is received, the authentication result of each server on the terminal is recorded as unreachable authentication server; A ninth message is sent to the terminal through the transceiver, where the ninth message is used to indicate that the terminal access authentication fails.

27. The access device according to claim 24, characterized in that: The machine executable instructions further cause the processor to perform the following steps: If within the first preset time period, the eighth message sent by the first number of authentication servers is received through the transceiver, and the authentication result carried by each eighth message indicates that the terminal access authentication fails, then the authentication results of the first number of authentication servers for the terminal are respectively recorded as access authentication failure; After the first preset time is reached, if no message sent by the second number of authentication servers among the multiple servers is received, then the authentication results of the second number of authentication servers on the terminal are respectively recorded as unreachable authentication servers; A ninth message or a tenth message is sent to the terminal through the transceiver, the ninth message is used to indicate that the terminal access authentication fails, and the tenth message is used to indicate that the terminal access authentication succeeds, and the sum of the first number and the second number is the same as the number of the multiple authentication servers.

28. The access device according to claim 23, characterized in that: The machine executable instructions further cause the processor to perform the following steps: If within the second preset time period, the transceiver receives the same number of eighth messages as the plurality of authentication servers, and the authentication results carried by each eighth message indicate that the terminal access authentication fails, then the authentication result of each server for the terminal is recorded as access authentication failure; A ninth message is sent to the terminal through the transceiver, where the ninth message is used to indicate that the terminal access authentication fails.

29. The access device according to claim 23, characterized in that: The machine executable instructions further cause the processor to perform the following steps: After the second preset time has elapsed, if no message sent by any authentication server is received, the authentication result of each server on the terminal is recorded as unreachable authentication server; A ninth message is sent to the terminal through the transceiver, where the ninth message is used to indicate that the terminal access authentication fails.

30. The access device according to claim 23, characterized in that: The machine executable instructions further cause the processor to perform the following steps: If within the second preset time period, an eighth message sent by a third number of authentication servers is received through the transceiver, and the authentication result carried by each eighth message indicates that the terminal access authentication fails, then the authentication results of the third number of authentication servers for the terminal are respectively recorded as access authentication failure; After the second preset time is reached, if no message is received from a fourth number of authentication servers among the multiple servers, then the authentication results of the fourth number of authentication servers on the terminal are respectively recorded as unreachable authentication servers; A ninth message or a tenth message is sent to the terminal through the transceiver, the ninth message is used to indicate that the terminal access authentication fails, and the tenth message is used to indicate that the terminal access authentication succeeds, and the sum of the third number and the fourth number is the same as the number of the multiple authentication servers.

31. The access device according to claim 24, characterized in that: The seventh message includes an EAP message attribute, and the EAP message attribute is used to carry the EAP message.

32. The access device according to claim 31, characterized in that: The length of the EAP message attribute is a preset length; If the length of the EAP message is greater than the preset length, the seventh message includes a plurality of EAP message attributes, and the EAP message is carried in the plurality of EAP message attributes in a fragmented form.

33. The access device according to claim 23, characterized in that: The access device is connected to multiple groups of authentication servers; the machine executable instructions prompt the processor to perform the following steps: selecting a group of authentication servers from the multiple groups of authentication servers in a load sharing manner, and sending the first message to the selected group of authentication servers through the transceiver; or, A preset number of authentication servers are selected from each group of authentication servers included in the multiple groups of authentication servers in a load sharing manner, and the first message is sent to the selected authentication servers through the transceiver.

34. A machine-readable storage medium, characterized in that Machine executable instructions are stored, and when called and executed by a processor, the machine executable instructions prompt the processor to implement any method described in claims 1-11.

35. A computer program product, characterized in that The computer program product causes the processor to implement the method according to any one of claims 1 to 11.

Images