Network equipment authentication method, device, equipment and medium

Abstract

The embodiment of the invention discloses a network equipment authentication method and device, equipment and a medium, and the method comprises the steps that an authentication terminal sends an EAPOL-Start message to network equipment to initiate an authentication process, and receives an identity request message sent by the network equipment; the authentication terminal analyzes the identity request message to obtain an identity response message, and replies the identity response message to the network equipment; the authentication terminal receives an EAP-MD5 self-generation request sent by the network equipment, and sets an EAP message type as a preset MD5 encrypted word format; the authentication terminal generates a message in a preset MD5 encrypted word format based on the preset MD5 encrypted word format and MD5 authentication data generated by the authentication terminal, and sends the message in the preset MD5 encrypted word format to the network equipment, so that the message in the preset MD5 encrypted word format is sent to the authentication server through the network equipment, the MD5 authentication data is authenticated through the authentication server, and the message in the preset MD5 encrypted word format is sent to the network equipment through the authentication server. And if the MD5 authentication data certificate passes, notifying the network equipment that the authentication is successful, and completing the authentication of the network equipment.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a network device authentication method, apparatus, device and medium. Background Art

[0002] With the development of network technology, 802.1X authentication function has become one of the important means to ensure network security. The 802.1X authentication protocol implements the identity authentication of network access devices (i.e. network devices) through message interaction between the authentication terminal and the authentication server. In the authentication process, EAP-MD5 (MD5 authentication method in the Extensible Authentication Protocol) is a commonly used authentication method, which ensures the security of the authentication process through the MD5 encryption algorithm.

[0003] When the existing 802.1X authentication function uses EAP-MD5 for message interaction, the authentication server or network device usually generates an MD5 random string and transmits it to the authentication terminal. During the transmission of the MD5 random string to the authentication terminal, there is a risk of being intercepted and tampered, which may affect the subsequent authentication results. Summary of the invention

[0004] One or more embodiments of the present specification provide a network device authentication method, apparatus, device and medium, which are used to solve the technical problems raised by the background technology.

[0005] One or more embodiments of this specification adopt the following technical solutions:

[0006] One or more embodiments of this specification provide a network device authentication method, the method comprising:

[0007] The authentication terminal sends an EAPOL-Start message to the network device to initiate the authentication process, and receives an identity request message sent by the network device;

[0008] The authentication terminal parses the identity request message to obtain an identity response message, and replies the identity response message to the network device;

[0009] The authentication terminal receives the self-generated EAP-MD5 request sent by the network device, and sets the EAP message type to a preset MD5 encryption word format;

[0010] The authentication terminal generates a preset MD5 encryption word format message based on the preset MD5 encryption word format and the MD5 authentication data generated by the authentication terminal, and sends the preset MD5 encryption word format message to the network device, so that the preset MD5 encryption word format message is sent to the authentication server through the network device, and the MD5 authentication data is authenticated by the authentication server. If the MD5 authentication data passes the authentication, the network device is notified of the authentication success, and the network device authentication is completed.

[0011] It should be noted that the embodiments of this specification reduce the risk of man-in-the-middle attacks during the transmission process by allowing the authentication terminal to generate MD5 authentication data by itself. Because the MD5 authentication data is generated inside the authentication terminal, it is difficult for external attackers to intercept and tamper with it. At the same time, since the MD5 authentication data is generated in the authentication terminal, the dependence on the server or network equipment can be reduced, thereby improving the response speed and efficiency of the authentication.

[0012] Furthermore, before setting the EAP message type to a preset MD5 encryption word format, the method further includes:

[0013] The authentication terminal determines whether the self-generated EAP-MD5 is available;

[0014] If the authentication terminal determines that the self-generated EAP-MD5 is available, the step of setting the EAP message type to a preset MD5 encryption word format is executed.

[0015] It should be noted that the embodiments of this specification can avoid performing unnecessary encryption operations when the terminal cannot generate EAP-MD5 by first determining whether the terminal has the ability to self-generate EAP-MD5 before sending the EAP message, thereby reducing security risks. At the same time, if the terminal does not support self-generated EAP-MD5, this method avoids unnecessary calculation and encryption processes, saving processor resources of the terminal, especially on resource-constrained devices, this optimization is particularly important.

[0016] Further, if the authentication terminal determines that the self-generated EAP-MD5 is not available, the method further includes:

[0017] The authentication terminal replies EAP-NAK to the network device so that the network device applies for an MD5 encryption word from the authentication server, initiates an authentication request for the specified MD5 encryption word to the authentication terminal after receiving the specified MD5 encryption word, and authenticates the specified MD5 encryption word through the authentication terminal.

[0018] It should be noted that the embodiments of this specification use MD5 encryption words for challenge response authentication, which can ensure the security of the authentication process even if the terminal cannot generate EAP-MD5 by itself. At the same time, when the terminal cannot generate EAP-MD5 by itself, it sends an EAP-NAK (negative acknowledgment) message to the network device, and then the network device applies for the MD5 encryption word from the authentication server. This process simplifies the authentication process and reduces the burden on the terminal.

[0019] Further, sending the preset MD5 encrypted word format message to the authentication server through the network device includes:

[0020] The preset MD5 encryption word format message is filled into the RADIUS message in the form of an Attribute field through the network device, and is sent to the authentication server through the RADIUS message.

[0021] It should be noted that the embodiments of this specification use the RADIUS protocol and the Attribute field to transmit the preset MD5 encrypted word format message, which ensures the standardization of communication between the network device and the authentication server and facilitates the integration and management of the system. At the same time, by embedding the MD5 encrypted word format message into the RADIUS message, the security of the data during the transmission process can be ensured, because the RADIUS protocol provides end-to-end data encryption and integrity verification. In addition, the preset MD5 encrypted word format message is directly sent to the authentication server through the network device, which simplifies the configuration process on the network device and reduces the possibility of errors in manual configuration.

[0022] Further, the authentication terminal generates a message in a preset MD5 encryption word format based on the preset MD5 encryption word format and the MD5 authentication data generated by the authentication terminal, including:

[0023] The authentication terminal generates a message in a preset MD5 encryption word format based on the preset MD5 encryption word format, the MD5 random word generated by the authentication terminal, and the encryption password of the authentication terminal;

[0024] The authenticating the MD5 authentication data by the authentication server, and if the MD5 authentication data passes the authentication, notifying the network device of the authentication success, comprises:

[0025] The authentication server authenticates the MD5 random word generated by the authentication terminal and the encrypted password of the authentication terminal. If both the MD5 random word generated by the authentication terminal and the encrypted password of the authentication terminal are authenticated, the network device is notified of successful authentication.

[0026] Further, the preset MD5 encryption word format is EAP-Request-Self-MD5, and the EAP-Request-Self-MD5 message includes EAP-MD5 Value-Size, EAP-MD5 Value and EAP-MD5 Extra Data, wherein EAP-MD5 Value-Size is 1 byte, EAP-MD5 Value stores the encrypted login password of the authentication terminal, and EAP-MD5 Extra Data includes an information element of Type-Len-Value, and the information element includes the MD5 random word.

[0027] One or more embodiments of this specification provide a network device authentication device, including:

[0028] The authentication unit, the authentication terminal sends an EAPOL-Start message to the network device to initiate the authentication process, and receives an identity request message sent by the network device;

[0029] A parsing unit, wherein the authentication terminal parses the identity request message to obtain an identity response message, and replies the identity response message to the network device;

[0030] A self-generating unit, wherein the authentication terminal receives a self-generated EAP-MD5 request sent by the network device and sets the EAP message type to a preset MD5 encryption word format;

[0031] An authentication unit, wherein the authentication terminal generates a preset MD5 encrypted word format message based on the preset MD5 encrypted word format and the MD5 authentication data generated by the authentication terminal, and sends the preset MD5 encrypted word format message to the network device, so that the preset MD5 encrypted word format message is sent to the authentication server through the network device, and the MD5 authentication data is authenticated by the authentication server. If the MD5 authentication data passes the authentication, the network device is notified of the authentication success, and the network device authentication is completed.

[0032] Furthermore, the self-generating unit is specifically used for:

[0033] The authentication terminal determines whether the self-generated EAP-MD5 is available;

[0034] If the authentication terminal determines that the self-generated EAP-MD5 is available, the step of setting the EAP message type to a preset MD5 encryption word format is executed.

[0035] One or more embodiments of this specification provide a network device authentication device, including:

[0036] at least one processor; and,

[0037] a memory communicatively connected to the at least one processor; wherein,

[0038] The memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to:

[0039] The authentication terminal sends an EAPOL-Start message to the network device to initiate the authentication process, and receives an identity request message sent by the network device;

[0040] The authentication terminal parses the identity request message to obtain an identity response message, and replies the identity response message to the network device;

[0041] The authentication terminal receives the self-generated EAP-MD5 request sent by the network device, and sets the EAP message type to a preset MD5 encryption word format;

[0042] The authentication terminal generates a preset MD5 encryption word format message based on the preset MD5 encryption word format and the MD5 authentication data generated by the authentication terminal, and sends the preset MD5 encryption word format message to the network device, so that the preset MD5 encryption word format message is sent to the authentication server through the network device, and the MD5 authentication data is authenticated by the authentication server. If the MD5 authentication data passes the authentication, the network device is notified of the authentication success, and the network device authentication is completed.

[0043] One or more embodiments of this specification provide a non-volatile computer storage medium storing computer executable instructions, which can achieve the following when executed by a computer:

[0044] The authentication terminal sends an EAPOL-Start message to the network device to initiate the authentication process, and receives an identity request message sent by the network device;

[0045] The authentication terminal parses the identity request message to obtain an identity response message, and replies the identity response message to the network device;

[0046] The authentication terminal receives the self-generated EAP-MD5 request sent by the network device, and sets the EAP message type to a preset MD5 encryption word format;

[0047] The authentication terminal generates a preset MD5 encryption word format message based on the preset MD5 encryption word format and the MD5 authentication data generated by the authentication terminal, and sends the preset MD5 encryption word format message to the network device, so that the preset MD5 encryption word format message is sent to the authentication server through the network device, and the MD5 authentication data is authenticated by the authentication server. If the MD5 authentication data passes the authentication, the network device is notified of the authentication success, and the network device authentication is completed.

[0048] At least one of the above technical solutions adopted in the embodiments of this specification can achieve the following beneficial effects:

[0049] The embodiments of this specification reduce the risk of man-in-the-middle attacks during the transmission process by allowing the authentication terminal to generate MD5 authentication data on its own. Because the MD5 authentication data is generated inside the authentication terminal, it is difficult for external attackers to intercept and tamper with it. At the same time, since the MD5 authentication data is generated in the authentication terminal, the dependence on the server or network equipment can be reduced, thereby improving the response speed and efficiency of the authentication. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the technical solutions in the embodiments of this specification or the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art description. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. In the drawings:

[0051] Figure 1 A flowchart of a network device authentication method provided for one or more embodiments of this specification;

[0052] Figure 2 An authentication terminal self-generated EAP-MD5 flow chart provided for one or more embodiments of this specification;

[0053] Figure 3 A schematic diagram of the structure of a network device authentication device provided for one or more embodiments of this specification;

[0054] Figure 4 A schematic diagram of the structure of a network device authentication device provided for one or more embodiments of this specification;

[0055] Figure 5 A schematic diagram of the structure of a self-generated EAP-MD5 response message replied by an authentication terminal according to one or more embodiments of this specification. DETAILED DESCRIPTION

[0056] The embodiments of this specification provide a network device authentication method, apparatus, device and medium.

[0057] The existing 802.1X authentication function usually generates an MD5 random string by the authentication server or network device when using EAP-MD5 for message interaction, and then transmits it to the authentication terminal, allowing the authentication terminal to encrypt its password using this MD5 encryption word. However, there is currently a lack of a method for the authentication terminal to generate an MD5 encryption word, encrypt the password, and then send it to the authentication server for verification.

[0058] The MD5 encryption key needs to expand the EAP Extra field in the EAP message. The message format is not clearly specified by the protocol standard in this field. However, the technology for generating the MD5 encryption key by the authentication terminal described in the present invention requires the use of this field. For this purpose, a set of EAP extra message field format designs is provided, which can also be used for the authentication terminal to send its own other information to realize the matching private design between the authentication terminal software and the authentication server.

[0059] The following are several authentication methods:

[0060] 1. EAP termination: The device terminates the EAP authentication process. The network device needs to generate an encryption key to encrypt the access authentication user password information. At the same time, the network device will send the user name, encryption key and other encrypted information to the authentication server through a RADIUS message for related authentication processing.

[0061] 2. EAP relay: EAP authentication networking can be abstracted as client-network device-RADIUS server, but the EAP relay process interaction process is only carried out between the client and the RADIUS server. The RADIUS server processes the client's EAP request as the EAP server. The network device in the middle is only equivalent to a relay. EAP messages are transmitted to the terminal using EAPOL and to the server using RADIUS. The characteristic of this method is that the device processing is relatively simple.

[0062] 3. EAP-TLS: EAP-TLS is an authentication method of EAP, which is implemented based on TLS (Transport Layer Security Protocol). It is mainly used for security authentication of wireless networks and point-to-point networks. It has a strong two-way authentication feature and requires both the client and the server to provide digital certificates for identity authentication.

[0063] Regarding the above authentication method, there are the following problems:

[0064] 1. EAP-TLS is implemented based on the TLS handshake protocol, which can realize information channel by verifying certificate information and safely authenticate information. This approach provides a high level of security, but it also increases the demand for certificate management and networking costs. It not only requires the deployment of additional certificate servers in the network environment, but also requires the adaptation of the corresponding network to allow unauthenticated terminals to access and apply for personal certificates, which is a large burden on the cost of the entire networking environment.

[0065] 2. Although EAP relay has lower requirements for network equipment, it requires the server to support the generation and encapsulation of MD5 encryption words. Compared with other authentication methods such as EAP termination, it requires two more message interactions with the server, which increases the pressure on the server and reduces the efficiency of message processing.

[0066] 3. EAP termination requires the network device to generate MD5 encryption words, and there are requirements for the support level of random word generation of the network device. At the same time, when the network device and the authentication terminal and server do not belong to the same system and lack private design for attribute checking and information alignment, the encryption words generated by the network device are more likely to have certain security risks.

[0067] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments of this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0068] Figure 1 A schematic diagram of a flow chart of a network device authentication method provided in one or more embodiments of this specification, the flow chart can be executed by a network device authentication system. Certain input parameters or intermediate results in the flow chart allow manual intervention and adjustment to help improve accuracy.

[0069] The method steps of the embodiment of this specification are as follows:

[0070] S101, the authentication terminal sends an EAPOL-Start message to a network device to initiate an authentication process, and receives an identity request message sent by the network device.

[0071] In an embodiment of the present specification, an authentication terminal (such as a laptop, a smart phone, etc.) is connected to a network device (such as a switch or a wireless access point AP) that supports 802.1x authentication. After the authentication terminal detects the connection, it immediately sends an EAPOL-Start message to the network device. EAPOL (an authentication protocol based on 802.1x) is a protocol used for port-level authentication in a local area network environment. The EAPOL-Start message contains basic information of the authentication terminal, such as a MAC address, etc. The network device receives the EAPOL-Start message and determines whether to continue the authentication process based on the configured authentication policy. If the network device requires further authentication, it will send an identity request message to the authentication terminal, which may be an EAP-Request / Identity message. The EAP-Request / Identity message is an EAP-type message that requests the authentication terminal to provide its identity information. After receiving the EAP-Request / Identity message, the authentication terminal starts processing the authentication process.

[0072] S102, the authentication terminal parses the identity request message to obtain an identity response message, and replies with the identity response message to the network device.

[0073] In the embodiments of this specification, after the authentication terminal receives the EAP-Request / Identity message, it will generate an EAP-Response / Identity message. The EAP-Response / Identity message usually contains user name information and is used for the initial step of identity authentication. After the network device receives the EAP-Response / Identity message, it caches the identity information of the authentication terminal in the network device and continues the authentication process according to the configured authentication method (such as EAP-MD5). The network device can select an appropriate authentication method based on the information in the EAP-Response / Identity message.

[0074] S103, the authentication terminal receives the self-generated EAP-MD5 request sent by the network device, and sets the EAP message type to a preset MD5 encryption word format.

[0075] In the embodiment of the present specification, after receiving the identity response message from the authentication terminal, the network device sends a self-generated EAP-MD5 request to the authentication terminal according to the configuration. The authentication terminal receives the self-generated EAP-MD5 request sent by the network device through the network interface. The authentication terminal prepares a response according to the preset MD5 encryption word format. The preset MD5 encryption word format can be a fixed string or a format containing specific information. For example, the preset MD5 encryption word format can be "the preset MD5 encryption word format is EAP-Request-Self-MD5".

[0076] S104, the authentication terminal generates a preset MD5 encryption word format message based on the preset MD5 encryption word format and the MD5 authentication data generated by the authentication terminal, and sends the preset MD5 encryption word format message to the network device, so that the preset MD5 encryption word format message is sent to the authentication server through the network device, and the MD5 authentication data is authenticated by the authentication server. If the MD5 authentication data passes the authentication, the network device is notified of the authentication success, and the network device authentication is completed.

[0077] In the embodiment of the present specification, the MD5 authentication data generated by the authentication terminal may include the MD5 random word generated by the authentication terminal and the encryption password of the authentication terminal. The authentication terminal generates a preset MD5 encryption word format message based on the preset MD5 encryption word format, the MD5 random word generated by the authentication terminal and the encryption password of the authentication terminal.

[0078] Furthermore, the MD5 authentication data is authenticated by the authentication server. If the MD5 authentication data passes the authentication, the network device is notified of the authentication success. The MD5 random word generated by the authentication terminal and the encrypted password of the authentication terminal can be authenticated by the authentication server. If both the MD5 random word generated by the authentication terminal and the encrypted password of the authentication terminal pass the authentication, the network device is notified of the authentication success.

[0079] Furthermore, before setting the EAP message type to the preset MD5 encryption word format, the authentication terminal determines whether the self-generated EAP-MD5 is available; if the authentication terminal determines that the self-generated EAP-MD5 is available, the EAP message type is set to the preset MD5 encryption word format.

[0080] It should be noted that the embodiments of this specification can avoid performing unnecessary encryption operations when the terminal cannot generate EAP-MD5 by first determining whether the terminal has the ability to self-generate EAP-MD5 before sending the EAP message, thereby reducing security risks. At the same time, if the terminal does not support self-generated EAP-MD5, this method avoids unnecessary calculation and encryption processes, saving processor resources of the terminal, especially on resource-constrained devices, this optimization is particularly important.

[0081] Furthermore, if the authentication terminal determines that it does not have the self-generated EAP-MD5, the authentication terminal replies EAP-NAK to the network device so that the network device applies for an MD5 encryption word from the authentication server, and after receiving the specified MD5 encryption word, initiates an authentication request for the specified MD5 encryption word to the authentication terminal, and authenticates the specified MD5 encryption word through the authentication terminal.

[0082] It should be noted that the embodiments of this specification use MD5 encryption words for challenge response authentication, which can ensure the security of the authentication process even if the terminal cannot generate EAP-MD5 by itself. At the same time, when the terminal cannot generate EAP-MD5 by itself, it sends an EAP-NAK (negative acknowledgment) message to the network device, and then the network device applies for the MD5 encryption word from the authentication server. This process simplifies the authentication process and reduces the burden on the terminal.

[0083] Furthermore, when the preset MD5 encrypted word format message is sent to the authentication server through the network device, the preset MD5 encrypted word format message can be filled into the RADIUS message in the form of an Attribute field through the network device, and sent to the authentication server through the RADIUS message.

[0084] It should be noted that the embodiments of this specification use the RADIUS protocol and the Attribute field to transmit the preset MD5 encrypted word format message, which ensures the standardization of communication between the network device and the authentication server and facilitates the integration and management of the system. At the same time, by embedding the MD5 encrypted word format message into the RADIUS message, the security of the data during the transmission process can be ensured, because the RADIUS protocol provides end-to-end data encryption and integrity verification. In addition, the preset MD5 encrypted word format message is directly sent to the authentication server through the network device, which simplifies the configuration process on the network device and reduces the possibility of errors in manual configuration.

[0085] Further, the preset MD5 encryption word format is EAP-Request-Self-MD5, and the EAP-Request-Self-MD5 message includes EAP-MD5 Value-Size, EAP-MD5 Value and EAP-MD5 Extra Data, wherein EAP-MD5 Value-Size is 1 byte, EAP-MD5 Value stores the encrypted login password of the authentication terminal, and EAP-MD5 Extra Data includes an information element of Type-Len-Value, and the information element includes the MD5 random word.

[0086] It should be noted that the embodiment of this specification proposes a method for generating MD5 random encryption words by the authentication terminal software, which can verify the encryption words generated by the client through the binding system between the authentication terminal and the authentication server to improve security. The authentication terminal generates MD5 encryption words, which can avoid the server performance occupation and traffic occupation caused by the authentication server generating encryption words and redundant RADIUS interactions, and can also avoid the security risks caused by the network device directly providing the encryption words to the authentication terminal for use after generating them.

[0087] It should be noted that the embodiments of this specification utilize the Extra field of the EAP message to store and carry some data in the form of TLV, which can avoid the problem of username length caused by adding a prefix to the EAP username to carry information, and can also carry the MD5 encryption word generated by the authentication terminal to the Extra field, so as to facilitate one-time message interaction through the EAP message, and can carry the MD5 encryption word generation and encryption information of the authentication terminal for authentication at the same time.

[0088] It should be noted that the 802.1x authentication method in which the authentication terminal generates the MD5 encryption word is also called the method in which the authentication terminal generates the EAP-MD5 by itself. It needs to comply with the 802.1x authentication protocol specification. The message is transmitted between the authentication terminal and the network device through the EAP message. In order to distinguish the present invention from other authentication methods from the message type, it is necessary to extend the EAP message type option. Two types of EAP Request / Response message types are defined here: EAP-Request-Self-MD5 and EAP-Response-Self-MD5.

[0089] The overall authentication process is similar to the 802.1x authentication process, except that the process in which the MD5 encryption key is generated by the network device is replaced, or the MD5 encryption key of the server is transmitted between the authentication server and the network device through the RADIUS message, and then the network device forwards it to the authentication terminal.

[0090] The request message structure sent by the network device in the self-generated EAP-MD5 process is relatively simple, where EAP code is Request, indicating that this is an EAP request message, and Type is Self-MD5, indicating that the message type is self-generated EAP-MD5. No other content needs to be added after Type.

[0091] The self-generated EAP-MD5 response message replied by the authentication terminal is similar to the MD5 challenge request response message. Its structure is as follows: Figure 5 The structure diagram of the self-generated EAP-MD5 response message replied by the authentication terminal is shown.

[0092] The message structure is similar to that of EAP-Response-MD5-Challenge, and consists of EAP-MD5 Value-Size, EAP-MD5Value, and EAP-MD5 Extra Data, where Value Size is 1 byte, representing the length of Value, and the value is usually 16 bytes as specified by the 802.1x protocol. The Value part stores the substring of the authentication terminal's password encrypted with the MD5 random word generated by itself, that is, the content stored is the encrypted login password of the authentication terminal. The last Extra part is composed of the information tuple of Type-Len-Value, referred to as TLV, which is composed of a 1-byte Type that specifies the field type, a 1-byte Len that represents the length of the entire TLV field, and the last Data part is the actual content carried.

[0093] In the embodiment of this specification, the MD5 encryption word generated by the authentication terminal itself needs to be saved in EAP-MD5 Extra in this form, that is, the Extra field in EAP-Self-MD5 must contain an 18-byte TLV, in which the content is the random word information generated by the terminal. Of course, in addition to the MD5 random word, the private implementation of the authentication terminal and the authentication server, the private field verification information, etc. can also be written into the EAP message in the form of TLV, and then the EAP information is sent to the authentication server for verification through the RADIUS message.

[0094] like Figure 2 The authentication terminal self-generates the EAP-MD5 flow chart shown as follows:

[0095] 1. The first half of the authentication process is consistent with the EAP identity request process of 802.1x authentication. The authentication terminal sends an EAPOL-Start message to initiate the authentication process, and then the network device sends an identity request message to the terminal, and the authentication terminal parses and replies with an identity response message.

[0096] 2. After receiving the identity response message from the authentication terminal, the network device caches the identity information of the authentication terminal in the device, and at the same time initiates a self-generated EAP-MD5 request to the authentication terminal, setting the EAP message type to the EAP-Request-Self-MD5 defined above.

[0097] 3. After receiving the self-generated EAP-MD5 request from the network device, the authentication terminal first confirms whether the terminal has this function. If it does not support the self-generated EAP-MD5 function, it needs to reply to the network device EAP-NAK, indicating that it does not support this authentication method and requests the network device to change the authentication method. Figure 2In the process of ①, the network device applies for the MD5 encryption key from the server according to the configuration, and then initiates the MD5 challenge authentication request to the authentication terminal after transmitting it through the RADIUS message. The network device can also directly generate the MD5 encryption key and initiate the MD5 challenge authentication request to the authentication terminal.

[0098] 4. If the terminal supports self-generated EAP-MD5 authentication, it replies to EAP-Response-Self-MD5 according to the process of ② in the figure, and adds the MD5 random word generated by the authentication terminal and the random word information generated by the authentication terminal encryption password to the EAP-Response-Self-MD5 message. At the same time, other verification information can also be stored in the EAP message. The network device receives the message and fills the EAP content into the RADIUS message in the form of the Attribute field. The message is also sent to the authentication server through the RADIUS message.

[0099] 5. The authentication server parses the EAP-Self-MD5 field carried in RADIUS, and needs to verify the legitimacy of the MD5 random word generated by the authentication terminal, the accuracy of the additional information carried by EAP Extra, and whether the encryption password of the authentication terminal is correct. After all the above checks are passed, the authentication server can notify the network device of successful authentication through the RADIUS Accept message, otherwise it will send a RADIUS Reject message to the network device terminal to indicate that the authentication failed.

[0100] It should be noted that the embodiments of this specification have the following beneficial effects:

[0101] 1. The self-generated EAP-MD5 authentication method does not require the authentication server and the network device to communicate, nor does it require obtaining the random string generated by the authentication server, which can effectively reduce the network load of the authentication server, reduce the system overhead of the authentication server, and improve the network quality between the network device and the authentication server. At the same time, this method does not require the network device to provide MD5 encryption words, avoiding the overhead of the authentication device and eliminating the potential safety hazards caused by the random words generated by the network device without verification by the authentication server and the terminal.

[0102] 2. Compared with EAP-TLS, self-generated EAP-MD5 does not require additional certificate server adaptation, saving the network overhead of the authentication server. In the authentication process, private attributes can be uploaded in EAP-MD5 Extra, and then the authentication server verifies the information. This not only expands the information carrying capacity of EAP messages, but also effectively improves the supervision of the authentication server on the authentication terminal, greatly improving the security of the network.

[0103] Figure 3A schematic diagram of the structure of a network device authentication apparatus provided for one or more embodiments of this specification includes: an authentication unit 301 , a parsing unit 302 , a self-generating unit 303 and an authentication unit 304 .

[0104] Authentication unit 301, the authentication terminal sends an EAPOL-Start message to the network device to initiate the authentication process, and receives an identity request message sent by the network device;

[0105] The parsing unit 302, the authentication terminal parses the identity request message to obtain an identity response message, and replies the identity response message to the network device;

[0106] The self-generating unit 303, the authentication terminal receives the self-generated EAP-MD5 request sent by the network device, and sets the EAP message type to a preset MD5 encryption word format;

[0107] The authentication unit 304, the authentication terminal generates a preset MD5 encryption word format message based on the preset MD5 encryption word format and the MD5 authentication data generated by the authentication terminal, and sends the preset MD5 encryption word format message to the network device, so that the preset MD5 encryption word format message is sent to the authentication server through the network device, and the MD5 authentication data is authenticated by the authentication server. If the MD5 authentication data passes the authentication, the network device is notified of the authentication success, and the network device authentication is completed.

[0108] Furthermore, the self-generating unit 303 is specifically used for:

[0109] The authentication terminal determines whether the self-generated EAP-MD5 is available;

[0110] If the authentication terminal determines that the self-generated EAP-MD5 is available, the step of setting the EAP message type to a preset MD5 encryption word format is executed.

[0111] Figure 4 A schematic diagram of the structure of a network device authentication device provided for one or more embodiments of this specification includes:

[0112] at least one processor; and,

[0113] a memory communicatively connected to the at least one processor; wherein,

[0114] The memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to:

[0115] The authentication terminal sends an EAPOL-Start message to the network device to initiate the authentication process, and receives an identity request message sent by the network device;

[0116] The authentication terminal parses the identity request message to obtain an identity response message, and replies the identity response message to the network device;

[0117] The authentication terminal receives the self-generated EAP-MD5 request sent by the network device, and sets the EAP message type to a preset MD5 encryption word format;

[0118] The authentication terminal generates a preset MD5 encryption word format message based on the preset MD5 encryption word format and the MD5 authentication data generated by the authentication terminal, and sends the preset MD5 encryption word format message to the network device, so that the preset MD5 encryption word format message is sent to the authentication server through the network device, and the MD5 authentication data is authenticated by the authentication server. If the MD5 authentication data passes the authentication, the network device is notified of the authentication success, and the network device authentication is completed.

[0119] One or more embodiments of this specification provide a non-volatile computer storage medium storing computer executable instructions, which can achieve the following when executed by a computer:

[0120] The authentication terminal sends an EAPOL-Start message to the network device to initiate the authentication process, and receives an identity request message sent by the network device;

[0121] The authentication terminal parses the identity request message to obtain an identity response message, and replies the identity response message to the network device;

[0122] The authentication terminal receives the self-generated EAP-MD5 request sent by the network device, and sets the EAP message type to a preset MD5 encryption word format;

[0123] The authentication terminal generates a preset MD5 encryption word format message based on the preset MD5 encryption word format and the MD5 authentication data generated by the authentication terminal, and sends the preset MD5 encryption word format message to the network device, so that the preset MD5 encryption word format message is sent to the authentication server through the network device, and the MD5 authentication data is authenticated by the authentication server. If the MD5 authentication data passes the authentication, the network device is notified of the authentication success, and the network device authentication is completed.

[0124] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device, equipment, and non-volatile computer storage medium embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

Claims

1. A network device authentication method, characterized in that: include: The authentication terminal sends an EAPOL-Start message to the network device to initiate the authentication process, and receives an identity request message sent by the network device; The authentication terminal parses the identity request message to obtain an identity response message, and replies the identity response message to the network device; The authentication terminal receives the self-generated EAP-MD5 request sent by the network device, and sets the EAP message type to a preset MD5 encryption word format; The authentication terminal generates a preset MD5 encrypted word format message based on the preset MD5 encrypted word format and the MD5 authentication data generated by the authentication terminal, and sends the preset MD5 encrypted word format message to the network device, so that the preset MD5 encrypted word format message is sent to the authentication server through the network device, and the MD5 authentication data is authenticated by the authentication server. If the MD5 authentication data passes the authentication, the network device is notified of the authentication success, and the network device authentication is completed.

2. The method according to claim 1, characterized in that Before setting the EAP message type to a preset MD5 encryption word format, the method further includes: The authentication terminal determines whether the self-generated EAP-MD5 is available; If the authentication terminal determines that the self-generated EAP-MD5 is available, the step of setting the EAP message type to a preset MD5 encryption word format is executed.

3. The method according to claim 1, characterized in that If the authentication terminal determines that the self-generated EAP-MD5 is not available, the method further includes: The authentication terminal replies EAP-NAK to the network device so that the network device applies for an MD5 encryption word from the authentication server, and after receiving the specified MD5 encryption word, initiates an MD5 challenge verification request to the authentication terminal, wherein the MD5 challenge verification request includes the specified MD5 encryption word.

4. The method according to claim 1, characterized in that: The sending of the preset MD5 encrypted word format message to the authentication server through the network device includes: The preset MD5 encryption word format message is filled into the RADIUS message in the form of an Attribute field through the network device, and is sent to the authentication server through the RADIUS message.

5. The method according to claim 1, characterized in that The authentication terminal generates a message in a preset MD5 encryption word format based on the preset MD5 encryption word format and the MD5 authentication data generated by the authentication terminal, including: The authentication terminal generates a message in a preset MD5 encryption word format by combining the MD5 random word generated by the authentication terminal with the encryption password of the authentication terminal based on the preset MD5 encryption word format; The authenticating the MD5 authentication data by the authentication server, and if the MD5 authentication data passes the authentication, notifying the network device of the authentication success, comprises: The authentication server authenticates the MD5 random word generated by the authentication terminal and the encrypted password of the authentication terminal. If both the MD5 random word generated by the authentication terminal and the encrypted password of the authentication terminal are authenticated, the network device is notified of successful authentication.

6. The method according to claim 5, characterized in that The preset MD5 encryption word format is EAP-Request-Self-MD5, and the EAP-Request-Self-MD5 message includes EAP-MD5Value-Size, EAP-MD5 Value and EAP-MD5 Extra Data, wherein EAP-MD5 Value-Size is 1 byte, EAP-MD5 Value stores the encrypted login password of the authentication terminal, and EAP-MD5Extra Data includes an information element of Type-Len-Value, and the information element includes the MD5 random word.

7. A network device authentication device, characterized in that: include: The authentication unit, the authentication terminal sends an EAPOL-Start message to the network device to initiate the authentication process, and receives an identity request message sent by the network device; A parsing unit, wherein the authentication terminal parses the identity request message to obtain an identity response message, and replies the identity response message to the network device; A self-generating unit, wherein the authentication terminal receives a self-generated EAP-MD5 request sent by the network device and sets the EAP message type to a preset MD5 encryption word format; An authentication unit, wherein the authentication terminal generates a preset MD5 encrypted word format message based on the preset MD5 encrypted word format and the MD5 authentication data generated by the authentication terminal, and sends the preset MD5 encrypted word format message to the network device, so that the preset MD5 encrypted word format message is sent to the authentication server through the network device, and the MD5 authentication data is authenticated by the authentication server. If the MD5 authentication data passes the authentication, the network device is notified of the authentication success, and the network device authentication is completed.

8. The device according to claim 7, characterized in that The self-generating unit is specifically used for: The authentication terminal determines whether the self-generated EAP-MD5 is available; If the authentication terminal determines that the self-generated EAP-MD5 is available, the self-generating unit sets the EAP message type to a preset MD5 encryption word format.

9. A network device authentication device, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to: The authentication terminal sends an EAPOL-Start message to the network device to initiate the authentication process, and receives an identity request message sent by the network device; The authentication terminal parses the identity request message to obtain an identity response message, and replies the identity response message to the network device; The authentication terminal receives the self-generated EAP-MD5 request sent by the network device, and sets the EAP message type to a preset MD5 encryption word format; The authentication terminal generates a preset MD5 encrypted word format message based on the preset MD5 encrypted word format and the MD5 authentication data generated by the authentication terminal, and sends the preset MD5 encrypted word format message to the network device, so that the preset MD5 encrypted word format message is sent to the authentication server through the network device, and the MD5 authentication data is authenticated by the authentication server. If the MD5 authentication data passes the authentication, the network device is notified of the authentication success, and the network device authentication is completed.

10. A non-volatile computer storage medium, characterized in that: Computer executable instructions are stored, and when the computer executable instructions are executed by a computer, the following can be achieved: The authentication terminal sends an EAPOL-Start message to the network device to initiate the authentication process, and receives an identity request message sent by the network device; The authentication terminal parses the identity request message to obtain an identity response message, and replies the identity response message to the network device; The authentication terminal receives the self-generated EAP-MD5 request sent by the network device, and sets the EAP message type to a preset MD5 encryption word format; The authentication terminal generates a preset MD5 encrypted word format message based on the preset MD5 encrypted word format and the MD5 authentication data generated by the authentication terminal, and sends the preset MD5 encrypted word format message to the network device, so that the preset MD5 encrypted word format message is sent to the authentication server through the network device, and the MD5 authentication data is authenticated by the authentication server. If the MD5 authentication data passes the authentication, the network device is notified of the authentication success, and the network device authentication is completed.

Images