Network switch security identity authentication method based on remote AAA service

Abstract

The invention relates to a network switch security identity authentication method based on a remote AAA service, and belongs to the field of network security management. The method provided by the invention comprises the following steps: step 1, networking: configuring network switches for interconnection and intercommunication, so that routing between devices is reachable; step 2, establishing an AAA server; step 3, configuring a strategy in the network switch; and step 4, a strategy is configured in the Active Direct. According to the method, the AAA server is established, remote access and identity authentication services are provided by utilizing AD + radius, login of the network switch is controlled in a remote management authentication mode, and the safety protection capability of the network switch is improved.

Description

Technical Field

[0001] The invention belongs to the field of network security management, and in particular relates to a network switch security identity authentication method based on remote AAA service. Background Art

[0002] According to the requirements of information security level protection, the software and hardware platforms in the information system should be authenticated and access controlled. The logged-in users should be identified and authenticated. The identification should be unique, and the identification information should have complexity requirements and be changed regularly. It should have a login failure processing function, and should configure and enable relevant measures such as ending the session, limiting the number of illegal logins, and automatically logging out when the login connection times out. When performing remote management, necessary measures should be taken to prevent the authentication information from being eavesdropped during network transmission. Accounts and permissions should be assigned to logged-in users. The minimum permissions required for management users should be granted to achieve permission separation for management users.

[0003] The traditional way of network switch identity authentication is to create system users locally and assign permissions, but it cannot meet the security requirements of regular password changes, limiting the number of illegal logins, and user identity uniqueness. The present invention builds an AAA (Authentication, Authorization, Accounting) server, uses Active Directory+radius to provide remote access and identity authentication services, and controls the login of the network switch through remote management authentication to improve the security protection capability of the network switch. Summary of the invention

[0004] 1. Technical issues to be resolved

[0005] The technical problem to be solved by the present invention is how to provide a network switch security identity authentication method based on remote AAA service to solve the problem that the traditional network switch identity authentication is to create system users locally and assign permissions, but cannot meet the security requirements such as regular password changes, limiting the number of illegal logins, and user identity uniqueness.

[0006] (II) Technical solution

[0007] In order to solve the above technical problems, the present invention proposes a network switch security identity authentication method based on remote AAA service, the method comprising:

[0008] Step 1: Networking, configure network switches to interconnect and make routes between devices reachable;

[0009] Step 2: Build the AAA server;

[0010] Install the Active Directory service; create a new group in the Active Directory service for 802.1X authentication, and set the group type to a security group;

[0011] Configure Active Directory Certificate Services;

[0012] Install RADIUS service, select network policy and access service as the policy; select 802.1X secure limited connection mode;

[0013] Step 3: Configure the policy in the network switch; configure the authentication point on the network switch interface;

[0014] Step 4: Configure policies in Active Directory;

[0015] Create and apply Group Policy Objects (GPOs) in Active Directory services to define user and computer settings and configure network switch authentication security policies, including password setting policies, account lockout policies, account password policies, and other security options.

[0016] (III) Beneficial effects

[0017] The present invention proposes a network switch security identity authentication method based on remote AAA service. The present invention builds an AAA server, uses Active Directory+radius to provide remote access and identity authentication services, and controls the login of the network switch through remote management authentication, thereby improving the security protection capability of the network switch. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 A schematic diagram of the network deployment architecture of the method of the present invention;

[0019] Figure 2 The figure is a flow chart of an embodiment of the method of the present invention. DETAILED DESCRIPTION

[0020] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below in conjunction with the drawings and examples.

[0021] The technical problem to be solved by the present invention is how to provide a network switch security identity authentication method based on remote AAA service to solve the security of identity authentication and access control of network switches in the prior art and improve the security protection of network switches.

[0022] In order to solve the above technical problems, the present invention proposes a network switch security identity authentication method based on remote AAA service, the method comprising the following steps:

[0023] Step 1: Networking, configure network switches to interconnect and make routes between devices reachable;

[0024] Step 2: Build the AAA server;

[0025] Install the Active Directory service; create a new group in the Active Directory service for 802.1X authentication, and set the group type to a security group.

[0026] Configure Certificate Services for Active Directory.

[0027] Install RADIUS service, select Network Policy and Access Service as the policy, and select 802.1X secure limited connection mode.

[0028] Step 3: Configure the policy in the network switch; configure the authentication point on the network switch interface;

[0029] Step 4: Configure policies in Active Directory;

[0030] Create and apply Group Policy Objects (GPOs) in Active Directory services to define user and computer settings and configure network switch authentication security policies, including password setting policies, account lockout policies, account password policies, and other security options.

[0031] Furthermore, in step 1, when configuring the network switch, it is necessary to ensure that the user can pass the 802.1X authentication, and the 802.1X message transparent transmission function needs to be configured on the switch.

[0032] Furthermore, in the step 2, when configuring the certificate service of Active Directory, the role service selects the certificate authority Web enrollment, selects the root certificate, and adds a private key.

[0033] Furthermore, in step 2, when installing the RADIUS service, the RADIUS authentication and accounting keys configured on the RADIUS server must be consistent with the shared key of the RADIUS server configured on the network switch. The authentication method is configured as a certificate.

[0034] Furthermore, in step 3, when configuring the policy in the network switch, AAA authentication is enabled on the network switch, and 802.1X authentication is enabled globally. The IP address, port number and key for communicating with the RADIUS server are specified to be consistent.

[0035] Furthermore, in step 4, when creating and applying security policies in the Active Directory service, it is necessary to configure password setting policies for setting security policies such as password complexity requirements, password expiration time, and the number of password histories to be retained.

[0036] Account lockout policy, which configures the number of failed logon attempts and the lockout duration.

[0037] Account password policy, used to configure password reset and password change requirements.

[0038] Security options are used to configure and disable automatic administrator login, disable the Guest account, and force the use of encryption for network communications.

[0039] Furthermore, when configuring the password setting policy, the system user name and password must not be the same, the user password should be a mixed combination of numbers, letters, and characters; the user password length should be no less than 8 characters; configure the user password regular update cycle and the number of non-repetitions.

[0040] Furthermore, when configuring the account lockout policy, set the number of consecutive login failures for the same user to 20; if the number of login failures exceeds the specified number, the user account should be locked for 10 minutes.

[0041] Furthermore, when configuring the account password policy, configure the password reset and password change requirements.

[0042] Furthermore, when configuring the mandatory use of encryption for network communication, configure secure remote management methods such as SSH, Https, and VPN.

[0043] Embodiment 1:

[0044] The schematic diagram of the network deployment architecture involved in the embodiment of the present invention is as follows Figure 1 As shown in the figure. The structure diagram includes 1 RADIUS server, 1 Active Directory server, 1 management terminal and a backup network switch. The RADIUS server and Active Directory server are used for remote management and identity authentication of the network switch, and the management terminal is used for remote user configuration management.

[0045] Based on the above deployment architecture schematic diagram structure, an embodiment of the network switch security identity authentication method of the present invention is proposed.

[0046] Reference Figure 2 , Figure 2 The present invention is a flowchart of a method embodiment of the present invention, and proposes a method embodiment of a network switch security identity authentication method based on a remote AAA service of the present invention.

[0047] In an embodiment, a network switch security identity authentication method based on an AAA server comprises the following steps:

[0048] Step 1: Set up the network and configure network switches to interconnect and make the routes between devices reachable.

[0049] It should be noted that to ensure that users can pass 802.1X authentication, the 802.1X message transparent transmission function needs to be configured on the switch.

[0050] Step 2: Set up the AAA server.

[0051] Install the Active Directory service on the Active Directory server; create a new group in the Active Directory service for 802.1X authentication, and set the group type to a security group.

[0052] Configure Certificate Services for Active Directory.

[0053] It should be noted that the role service selects the certification authority Web enrollment, selects the root certificate, and adds the private key.

[0054] Install RADIUS service on the RADIUS server, select the policy as Network Policy and Access Service, and select the 802.1X secure limited connection mode.

[0055] It should be noted that the RADIUS authentication and accounting keys configured on the RADIUS server must be consistent with the shared key of the RADIUS server configured on the network switch. The authentication method is configured as certificate.

[0056] Step 3: Configure policies in the network switch; configure the authentication point on the network switch interface.

[0057] It should be noted that AAA authentication is enabled on the network switch, 802.1X authentication is enabled globally, and the IP address, port number, and key for communication with the RADIUS server are specified to be consistent.

[0058] Step 4: Configure policies in Active Directory.

[0059] Create and apply Group Policy Objects (GPOs) in Active Directory services to define user and computer settings and configure network switch authentication security policies, including password setting policies, account lockout policies, account password policies, and other security options.

[0060] It is understandable that the password setting policy can be used to set password complexity requirements, password expiration time, and the number of password histories to be retained.

[0061] It should be noted that the system user name and password must not be the same, and the user password should be a mixed combination of numbers, letters, and characters; the user password length should be no less than 8 characters; configure the user password regular update cycle and the number of non-repetitions.

[0062] It should be noted that the account lockout policy configures the number of failed login attempts and the lockout duration. The number of consecutive failed login attempts for the same user is set to 20; if the number of failed login attempts exceeds the specified number, the user account should be locked for 10 minutes.

[0063] It should be noted that the account password policy configures the requirements for password reset and password change.

[0064] It should be noted that the security options include disabling automatic administrator login, disabling the Guest account, and forcing encryption for network communications. Configure secure remote management methods such as SSH, Https, and VPN.

[0065] Embodiment 2:

[0066] A network switch security identity authentication method based on remote AAA service, the method comprising the following steps:

[0067] Step 1: Networking, configure network switches to interconnect and make routes between devices reachable;

[0068] Step 2: Build the AAA server;

[0069] Install the Active Directory service; create a new group in the Active Directory service for 802.1X authentication, and set the group type to a security group.

[0070] Configure Certificate Services for Active Directory.

[0071] Install RADIUS service, select Network Policy and Access Service as the policy, and select 802.1X secure limited connection mode.

[0072] Step 3: Configure the policy in the network switch; configure the authentication point on the network switch interface;

[0073] Step 4: Configure policies in Active Directory;

[0074] Create and apply Group Policy Objects (GPOs) in Active Directory services to define settings for users and computers and configure how network switches authenticate.

[0075] In step 1, to ensure that the user can pass 802.1X authentication, the 802.1X message transparent transmission function needs to be configured on the switch.

[0076] In step 2, when configuring the certificate service of Active Directory, select the certificate authority Web enrollment in the role service, select the root certificate, and add the private key.

[0077] In step 2, install the RADIUS service, select the policy as network policy and access service, and the RADIUS authentication and accounting keys configured on the RADIUS server must be consistent with the shared key of the RADIUS server configured on the network switch. Configure the authentication method as certificate.

[0078] In step 3, configure the policy in the network switch, enable AAA authentication on the network switch, and globally enable 802.1X authentication. Specify the IP address, port number, and key for communication with the RADIUS server to be consistent.

[0079] In the step 4, group policy objects (GPOs) are created and applied in the Active Directory service to define settings for users and computers, which is characterized in that password complexity requirements, password expiration time, and the number of password histories to be retained are set through password setting policies.

[0080] Account lockout policy, configure the number of failed login attempts and the lockout duration.

[0081] Account password policy, configure password reset and password change requirements.

[0082] Security options, configure to disable automatic administrator login, disable the Guest account, and force the use of encryption for network communications.

[0083] Through the password setting policy, set the password complexity requirements, password expiration time, and the number of password history to be retained. The system user name and password must not be the same. The user password should be a mixed combination of numbers, letters, and characters. The user password length should be no less than 8 characters. Configure the user password regular update cycle and the number of non-repetition times.

[0084] The account lockout policy configures the number of failed login attempts and the lockout duration, and is characterized in that the number of consecutive failed login attempts for the same user is configured to be 20; if the number of failed login attempts exceeds the specified number, the user account should be locked for 10 minutes.

[0085] The described mandatory use of encryption for network communication and configuration of secure remote management methods such as SSH, Https, and VPN.

[0086] The innovative features of the present invention are as follows:

[0087] 1. Use RADIUS service to provide remote login access authorization for the switch, encrypt the access channel, and prevent the authentication information from being eavesdropped during network transmission.

[0088] 2. Use Active Directory services to configure the switch's identity authentication strategy to meet security protection requirements.

[0089] Beneficial effects of the present invention:

[0090] The present invention proposes a network switch security identity authentication method based on remote AAA service. The present invention builds an AAA server, uses Active Directory+radius to provide remote access and identity authentication services, and manages the login of the network switch through remote management authentication to improve the security protection capability of the network switch.

[0091] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A network switch security identity authentication method based on remote AAA service, characterized in that: The method includes Step 1: Networking, configure network switches to interconnect and make routes between devices reachable; Step 2: Build the AAA server; Install the Active Directory service; create a new group in the Active Directory service for 802.1X authentication and set the group type to a security group; Configure Active Directory Certificate Services; Install RADIUS service, select network policy and access service as the policy; select 802.1X secure limited connection mode; Step 3: Configure the policy in the network switch; configure the authentication point on the network switch interface; Step 4: Configure policies in Active Directory; Create and apply Group Policy Objects (GPOs) in Active Directory services to define user and computer settings and configure network switch authentication security policies, including password setting policies, account lockout policies, account password policies, and other security options.

2. The network switch security identity authentication method based on remote AAA service as claimed in claim 1, characterized in that: In the step 1, when configuring the network switch, it is ensured that the user can pass the 802.1X authentication, and the 802.1X message transparent transmission function is configured on the switch.

3. The network switch security identity authentication method based on remote AAA service as claimed in claim 1, characterized in that: In step 2, when configuring the certificate service of Active Directory, select the certificate authority Web enrollment in the role service, select the root certificate, and add the private key.

4. The network switch security identity authentication method based on remote AAA service as claimed in claim 1, characterized in that: In step 2, when installing the RADIUS service, the RADIUS authentication and accounting keys configured on the RADIUS server must be consistent with the shared key of the RADIUS server configured on the network switch, and the authentication method is configured as a certificate.

5. The network switch security identity authentication method based on remote AAA service as claimed in claim 1, characterized in that: In the step 3, when configuring the policy in the network switch, AAA authentication is enabled on the network switch, 802.1X authentication is enabled globally, and the IP address, port number and key for communicating with the RADIUS server are specified to be consistent.

6. The network switch security identity authentication method based on remote AAA service as claimed in claim 1, characterized in that: In the step 4, Password setting policy, which is used to set password complexity requirements, password expiration time, and the number of password histories to be retained; Account lockout policy, which configures the number of failed login attempts and the lockout duration; Account password policies, which are used to configure password reset and password change requirements; Security options are used to configure and disable automatic administrator login, disable the Guest account, and force the use of encryption for network communications.

7. The network switch security identity authentication method based on remote AAA service as claimed in claim 6, characterized in that: When configuring the password setting policy, the system user name and password must not be the same. The user password should be a mixed combination of numbers, letters, and characters. The user password length should be no less than 8 characters. Configure the user password regular update cycle and the number of non-repetition times.

8. The network switch security identity authentication method based on remote AAA service as claimed in claim 6, characterized in that: When configuring the account lockout policy, set the number of consecutive failed login attempts for the same user to 20; if the number of failed login attempts exceeds the specified number, the user account should be locked for 10 minutes.

9. The network switch security identity authentication method based on remote AAA service as claimed in claim 6, characterized in that: When configuring account password policies, configure password reset and password change requirements.

10. The network switch security identity authentication method based on remote AAA service as claimed in claim 6, characterized in that: When configuring the mandatory encryption mode for network communication, the secure remote management modes include: SSH, HTTPS, and VPN.

Images