A secure identity authentication method for network switches based on remote AAA service

Abstract

This invention relates to a secure identity authentication method for network switches based on remote AAA services, belonging to the field of network security management. The method includes the following steps: Step 1, network setup, configuring interconnection between network switches to ensure routing reachability between devices; Step 2, setting up an AAA server; Step 3, configuring policies in the network switches; Step 4, configuring policies in Active Directory. This invention establishes an AAA server, utilizes AD+RADIUS to provide remote access and identity authentication services, and controls network switch logins through remote management authentication, thereby improving the security protection capabilities of the network switches.

Description

Technical Field

[0001] This invention belongs to the field of network security management, and specifically relates to a secure identity authentication method for network switches based on remote AAA services. Background Technology

[0002] In accordance with information security level protection requirements, identity authentication and access control should be implemented for software and hardware platforms within the information system. Login users should be identified and authenticated, with unique identifiers, complexity requirements for authentication information, and regular updates. Login failure handling functions should be included, and measures such as terminating sessions, limiting unauthorized login attempts, and automatic logout upon connection timeout should be configured and enabled. When conducting remote management, necessary measures should be taken to prevent authentication information from being eavesdropped on during network transmission. Login users should be assigned accounts and permissions; administrative users should be granted the minimum necessary permissions to achieve separation of administrative user permissions.

[0003] Traditional network switch authentication relies on locally created system users and assigned permissions, but this fails to meet security requirements such as regularly changing passwords, limiting unauthorized login attempts, and ensuring the uniqueness of user identities. This invention addresses this by establishing an AAA (Authentication, Authorization, Accounting) server, utilizing Active Directory + RADIUS to provide remote access and authentication services. It controls network switch logins through remote management authentication, thereby enhancing the network switch's security capabilities. Summary of the Invention

[0004] (a) Technical problems to be solved

[0005] The technical problem to be solved by this invention is how to provide a secure identity authentication method for network switches based on remote AAA service, so as to solve the problem that the traditional method of identity authentication of network switches is to create system users locally and assign permissions, but cannot meet the security requirements such as regular password changes, limiting the number of illegal logins, and the uniqueness of user identity.

[0006] (II) Technical Solution

[0007] To address the aforementioned technical problems, this invention proposes a secure identity authentication method for network switches based on remote AAA services. This method includes...

[0008] Step 1: Network setup. Configure network switches to interconnect and ensure routing reachability between devices.

[0009] Step 2: Set up the AAA server;

[0010] Install Active Directory service; create a new group in Active Directory service for 802.1X authentication, and set the group type to security group;

[0011] Configure certificate services for Active Directory;

[0012] Install the RADIUS service, select the policy as Network Policy and Access Service; select the 802.1X secure limited connection method;

[0013] Step 3: Configure policies in the network switch; configure authentication points on the network switch interfaces;

[0014] Step 4: Configure policies in Active Directory;

[0015] Create and apply Group Policy Objects (GPOs) in Active Directory services to define user and computer settings and configure security policies for network switch authentication, including password setting policies, account lockout policies, account password policies, and other security options.

[0016] (III) Beneficial Effects

[0017] This invention proposes a secure identity authentication method for network switches based on remote AAA services. This invention establishes an AAA server and utilizes Active Directory+RADIUS to provide remote access and identity authentication services. By controlling network switch logins through remote management authentication, the security protection capabilities of network switches are improved. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of the network construction and deployment architecture of the method of the present invention;

[0019] Figure 2 This is a flowchart illustrating an embodiment of the method of the present invention. Detailed Implementation

[0020] To make the objectives, contents, and advantages of the present invention clearer, the specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples.

[0021] The technical problem to be solved by this invention is how to provide a secure identity authentication method for network switches based on remote AAA service, so as to solve the security issues of identity authentication and access control of network switches in the prior art and improve the security protection of network switches.

[0022] To address the aforementioned technical problems, this invention proposes a secure identity authentication method for network switches based on remote AAA services. This method includes the following steps:

[0023] Step 1: Network setup. Configure network switches to interconnect and ensure routing reachability between devices.

[0024] Step 2: Set up the AAA server;

[0025] Install the Active Directory service; create a new group in the Active Directory service for 802.1X authentication, and set the group type to security group.

[0026] Configure certificate services for Active Directory.

[0027] Install the RADIUS service, selecting the policy as Network Policy and Access Service. Choose the 802.1X secure limited connection method.

[0028] Step 3: Configure policies in the network switch; configure authentication points on the network switch interfaces;

[0029] Step 4: Configure policies in Active Directory;

[0030] Create and apply Group Policy Objects (GPOs) in Active Directory services to define user and computer settings and configure security policies for network switch authentication, including password setting policies, account lockout policies, account password policies, and other security options.

[0031] Furthermore, in step one, when configuring the network switch, it is necessary to ensure that users can pass 802.1X authentication and to configure the 802.1X packet pass-through function on the switch.

[0032] Furthermore, in step two, when configuring the certificate service of Active Directory, the role service selects Certificate Authority Web Registration, selects the root certificate, and adds a private key.

[0033] Furthermore, in step two, when installing the RADIUS service, the RADIUS authentication and accounting keys configured on the RADIUS server must be consistent with the shared key of the RADIUS server configured on the network switch. The authentication method is configured as a certificate.

[0034] Furthermore, in step three, when configuring policies in the network switch, AAA authentication is enabled on the network switch, and 802.1X authentication is enabled globally. The IP address, port number, and communication key for the RADIUS server are specified to be consistent.

[0035] Furthermore, in step four, when creating and applying security policies in the Active Directory service, it is necessary to configure password setting policies to set security policies such as password complexity requirements, password expiration time, and the number of passwords to retain in the past.

[0036] Account lockout policy, used to configure the number of failed login attempts and the lockout duration.

[0037] Account password policy, used to configure the requirements for password reset and password change.

[0038] Security options are used to configure disabling automatic administrator login, disabling the Guest account, and forcing the use of encrypted methods for network communication.

[0039] Furthermore, when configuring password setting policies, the system's username and password must not be the same, and the user password should be a combination of numbers, letters, and characters; the user password length should not be less than 8 characters; configure the user password's regular update cycle and the number of times it cannot be repeated.

[0040] Furthermore, when configuring the account lockout policy, the limit for consecutive failed login attempts for the same user is set to 20; if the number of failed login attempts exceeds the limit, the user account should be locked for 10 minutes.

[0041] Furthermore, when configuring account password policies, configure the requirements for password reset and password change.

[0042] Furthermore, when configuring to force the use of encrypted methods for network communication, configure secure remote management methods such as SSH, HTTPS, and VPN.

[0043] Example 1:

[0044] The network component deployment architecture diagram involved in the example scheme of this invention is as follows: Figure 1 As shown in the diagram, this architecture includes one RADIUS server, one Active Directory server, one management terminal, and a backup network switch. The RADIUS server and Active Directory server are used for remote management and authentication of the network switch, while the management terminal is used for remote configuration and management by users.

[0045] Based on the above deployment architecture diagram, an embodiment of the network switch security authentication method of the present invention is proposed.

[0046] Reference Figure 2 , Figure 2 This is a flowchart illustrating an embodiment of the method of the present invention, which proposes an embodiment of the network switch security identity authentication method based on remote AAA service.

[0047] In this embodiment, the network switch security authentication method based on an AAA server includes the following steps:

[0048] Step 1: Network setup. Configure network switches to interconnect and ensure that routing between devices is reachable.

[0049] It should be noted that to ensure users can pass 802.1X authentication, the 802.1X packet pass-through function needs to be configured on the switch.

[0050] Step 2: Set up the AAA server.

[0051] Install the Active Directory service on the Active Directory server; create a new group in the Active Directory service for 802.1X authentication, and set the group type to a security group.

[0052] Configure certificate services for Active Directory.

[0053] It should be noted that when selecting the role service, you should choose Certificate Authority Web Registration, select the root certificate, and add a private key.

[0054] Install the RADIUS service on the RADIUS server, selecting the policy as Network Policy and Access Service. Choose the 802.1X secure limited connection method.

[0055] It should be noted that the RADIUS authentication and accounting keys configured on the RADIUS server must be consistent with the shared key of the RADIUS server configured on the network switch. The authentication method is configured as certificates.

[0056] Step 3: Configure policies in the network switch; configure authentication points on the network switch interfaces.

[0057] It should be noted that AAA authentication should be enabled on the network switch, and 802.1X authentication should be enabled globally. The IP address, port number, and communication key for the RADIUS server should be consistent.

[0058] Step 4: Configure the policy in Active Directory.

[0059] Create and apply Group Policy Objects (GPOs) in Active Directory services to define user and computer settings and configure security policies for network switch authentication, including password setting policies, account lockout policies, account password policies, and other security options.

[0060] Understandably, password setting policies can be used to set password complexity requirements, password expiration times, and the number of passwords that need to be retained in the past.

[0061] It should be noted that the system username and password must not be the same, the user password should be a combination of numbers, letters and characters; the user password length should not be less than 8 characters; the system should configure the user password update cycle and the number of times it can be repeated.

[0062] It should be noted that the account lockout policy allows configuration of the number of failed login attempts and the lockout duration. The limit for consecutive failed login attempts by the same user is 20; if the number of failed login attempts exceeds this limit, the user account should be locked for 10 minutes.

[0063] It should be noted that the account password policy specifies the requirements for configuring password reset and password change.

[0064] It should be noted that the security options include disabling automatic administrator login, disabling the Guest account, and forcing encrypted network communication. Secure remote management methods such as SSH, HTTPS, and VPN can also be configured.

[0065] Example 2:

[0066] A secure identity authentication method for network switches based on remote AAA service, the method comprising the following steps:

[0067] Step 1: Network setup. Configure network switches to interconnect and ensure routing reachability between devices.

[0068] Step 2: Set up the AAA server;

[0069] Install the Active Directory service; create a new group in the Active Directory service for 802.1X authentication, and set the group type to security group.

[0070] Configure certificate services for Active Directory.

[0071] Install the RADIUS service, selecting the policy as Network Policy and Access Service. Choose the 802.1X secure limited connection method.

[0072] Step 3: Configure policies in the network switch; configure authentication points on the network switch interfaces;

[0073] Step 4: Configure policies in Active Directory;

[0074] In Active Directory services, Group Policy Objects (GPOs) are created and applied to define user and computer settings and configure network switch authentication methods.

[0075] In step one, to ensure that users can pass 802.1X authentication, the 802.1X packet pass-through function needs to be configured on the switch.

[0076] In step two, when configuring the certificate service for Active Directory, select Certificate Authority Web Registration for the role service, select the root certificate, and add the private key.

[0077] In step two, install the RADIUS service, select network policy and access service as the policy, and ensure that the RADIUS authentication and accounting keys configured on the RADIUS server are consistent with the shared key of the RADIUS server configured on the network switch. Configure the authentication method as certificates.

[0078] In step three, configure policies in the network switch to enable AAA authentication and globally enable 802.1X authentication. Ensure that the IP address, port number, and communication key for the RADIUS server are consistent.

[0079] In step four, Group Policy Objects (GPOs) are created and applied in Active Directory services to define user and computer settings. The key feature is that password setting policies are used to set password complexity requirements, password expiration times, and the number of passwords to retain in the past.

[0080] Configure the account lockout policy, including the number of failed login attempts and the lockout duration.

[0081] Account password policy, configuring requirements for password reset and password change.

[0082] Security options include disabling automatic administrator login, disabling the Guest account, and forcing network communication to use encrypted methods.

[0083] By setting password policies, you can set password complexity requirements, password expiration time, and the number of passwords to retain in the past. Usernames and passwords in the system must not be the same. User passwords should be a combination of numbers, letters, and characters. User passwords should be at least 8 characters long. Configure the user password update cycle and the number of times they can be repeated.

[0084] The account lockout policy, which configures the number of failed login attempts and the lockout duration, is characterized in that the number of consecutive failed login attempts for the same user is configured to be 20; if the number of failed login attempts exceeds the specified number, the user account should be locked for 10 minutes.

[0085] The aforementioned method mandates the use of encrypted network communication and configures secure remote management methods such as SSH, HTTPS, and VPN.

[0086] The innovative aspects of this invention:

[0087] 1. Utilize RADIUS service to provide remote login access authorization for the switch and encrypt the access channel to prevent authentication information from being eavesdropped during network transmission.

[0088] 2. Configure the switch's authentication policy using Active Directory service to meet security protection requirements.

[0089] The beneficial effects of this invention are:

[0090] This invention proposes a secure identity authentication method for network switches based on remote AAA services. This invention establishes an AAA server and utilizes Active Directory+RADIUS to provide remote access and identity authentication services. By controlling network switch logins through remote management authentication, it enhances the security protection capabilities of the network switch.

[0091] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A secure identity authentication method for network switches based on remote AAA service, characterized in that, The method includes Step 1: Network setup. Configure network switches to interconnect and ensure routing reachability between devices. Step 2: Set up the AAA server; Install Active Directory service; create a new group in Active Directory service for 802.1X authentication, and set the group type to security group; Configure certificate services for Active Directory; Install the RADIUS service, select the policy as Network Policy and Access Service; select the 802.1X secure limited connection method; Step 3: Configure policies in the network switch; configure authentication points on the network switch interfaces; Step 4: Configure policies in Active Directory; Create and apply Group Policy Objects (GPOs) in Active Directory services to define user and computer settings and configure security policies for network switch authentication, including password setting policies, account lockout policies, account password policies, and other security options.

2. The network switch security authentication method based on remote AAA service as described in claim 1, characterized in that, In step one, when configuring the network switch, ensure that the user can pass 802.1X authentication and configure the 802.1X packet pass-through function on the switch.

3. The network switch secure identity authentication method based on remote AAA service as described in claim 1, characterized in that, In step two, when configuring the certificate service for Active Directory, select Certificate Authority Web Registration for the role service, select the root certificate, and add the private key.

4. The network switch secure identity authentication method based on remote AAA service as described in claim 1, characterized in that, In step two, when installing the RADIUS service, the RADIUS authentication and accounting keys configured on the RADIUS server must be consistent with the shared key of the RADIUS server configured on the network switch, and the authentication method should be certificates.

5. The network switch secure identity authentication method based on remote AAA service as described in claim 1, characterized in that, In step three, when configuring policies in the network switch, enable AAA authentication on the network switch and globally enable 802.1X authentication; specify that the IP address, port number, and communication key of the RADIUS server are consistent.

6. The network switch secure identity authentication method based on remote AAA service as described in claim 1, characterized in that, In step four, Password setting policy, used to set password complexity requirements, password expiration time, and the number of passwords to retain in the past; Account lockout policy, used to configure the number of failed login attempts and the lockout duration; Account password policy, used to configure the requirements for password reset and password change; Security options are used to configure disabling automatic administrator login, disabling the Guest account, and forcing the use of encrypted methods for network communication.

7. The network switch secure identity authentication method based on remote AAA service as described in claim 6, characterized in that, When configuring password settings, the system's username and password must not be the same, and the user password should be a combination of numbers, letters, and characters; the user password length should not be less than 8 characters; configure the user password's regular update cycle and the number of times it can be repeated.

8. The network switch secure identity authentication method based on remote AAA service as described in claim 6, characterized in that, When configuring an account lockout policy, set the limit for consecutive failed login attempts for the same user to 20. If the number of failed login attempts exceeds the limit, the user account should be locked for 10 minutes.

9. The network switch secure identity authentication method based on remote AAA service as described in claim 6, characterized in that, When configuring account password policies, configure the requirements for password reset and password change.

10. The network switch secure identity authentication method based on remote AAA service as described in claim 6, characterized in that, When configuring to force the use of encrypted methods for network communication, secure remote management methods include: SSH, HTTPS, and VPN.

Images