Authentication method of terminal identity, electronic device, and storage medium

Abstract

The application discloses a terminal identity authentication method, an electronic device and a storage medium, and relates to the technical field of network communication security. The method comprises the following steps: authenticating the identity information of a target terminal through a first authentication operation and a second authentication operation; when it is detected that the identity information of the target terminal is successfully authenticated through the first authentication operation, triggering a backoff behavior of the second authentication operation, wherein the backoff behavior comprises: if it is detected that the second authentication operation has been authenticated, replacing the authentication result of the second authentication operation with the authentication result of the first authentication operation; ending the second authentication operation that has been started; when it is detected that the authentication of the identity information of the target terminal through the first authentication operation is timed out or failed, if it is detected that the authentication of the identity information of the target terminal through the second authentication operation is successful, maintaining the authentication state of the second authentication operation for the identity information of the target terminal. The application solves the problem of poor flexibility in selecting a terminal authentication mode.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network communication security, in particular to a terminal identity authentication method, an electronic device and a storage medium. BACKGROUND

[0002] In order to meet the access requirements of terminals, access control needs to be performed on the terminals, that is, to ensure that the terminals can access the network only after passing the security authentication. Therefore, as the security challenges continue to escalate, the security model needs to be changed from a passive mode to an active mode to completely solve the network security problem from the root (terminal) and improve the information security level of the entire network.

[0003] The NAC (Network Access Control) security solution provided in the related art starts from the security control of the terminal accessing the network, and combines the terminal security status and the network access control together. However, the authentication mode has the problems of complex process control, too single, and great difficulty in abnormal processing, thereby causing the technical problem of poor flexibility in selecting the terminal authentication mode.

[0004] At present, no effective solution has been proposed for the above problems. SUMMARY

[0005] Embodiments of the present application provide a terminal identity authentication method, an electronic device and a storage medium, to at least solve the technical problem of poor flexibility in selecting the terminal authentication mode in the related art.

[0006] According to an aspect of an embodiment of the present application, a terminal identity authentication method is provided, including: authenticating the identity information of a target terminal through a first authentication operation and a second authentication operation, wherein the authentication priority of the first authentication operation is higher than that of the second authentication operation, and the authentication time length of the first authentication operation is greater than that of the second authentication operation; when it is detected that the identity information of the target terminal is successfully authenticated through the first authentication operation, triggering a backoff behavior of the second authentication operation, wherein the backoff behavior includes: if it is detected that the second authentication operation has been authenticated, using the authentication result of the first authentication operation to replace the authentication result of the second authentication operation; ending the second authentication operation that has been started; and when it is detected that the identity information of the target terminal is authenticated by the first authentication operation, if it is detected that the identity information of the target terminal is successfully authenticated by the second authentication operation, maintaining the authentication state of the second authentication operation for the identity information.

[0007] According to another aspect of the embodiments of the present application, a terminal identity authentication apparatus is also provided, comprising: an authentication unit configured to authenticate identity information of a target terminal through a first authentication operation and a second authentication operation, wherein the authentication priority of the first authentication operation is higher than that of the second authentication operation, and the authentication duration of the first authentication operation is longer than that of the second authentication operation; a first processing unit configured to trigger a back-off behavior of the second authentication operation when it is detected that the identity information of the target terminal is successfully authenticated through the first authentication operation, wherein the back-off behavior comprises: if it is detected that the second authentication operation has been authenticated, using the authentication result of the first authentication operation to replace the authentication result of the second authentication operation; and ending the second authentication operation that has been started; and a second processing unit configured to maintain the authentication state of the second authentication operation for the identity information of the target terminal if it is detected that the identity information of the target terminal is successfully authenticated through the second authentication operation when it is detected that the identity information of the target terminal is timed out or fails to be authenticated through the first authentication operation.

[0008] According to another aspect of the embodiments of the present application, a computer readable storage medium is also provided, which stores a computer program, wherein the computer program, when executed, causes the device where the computer readable storage medium is located to perform the terminal identity authentication method.

[0009] According to another aspect of the embodiments of the present application, an electronic device is also provided, which comprises one or more processors and a memory configured to store one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to perform the terminal identity authentication method.

[0010] It should be noted that in the authentication process of terminal identity information, especially when the network environment is complex and the security requirement is high, a single authentication method may not be able to meet the security and timeliness of authentication at the same time. The traditional method usually adopts a fixed authentication process, which needs to complete the entire process once it starts, and even if there is a more secure authentication method, it cannot be dynamically adjusted during the authentication process.

[0011] The technical solution provided in the present application combines the first authentication operation and the second authentication operation, aiming to solve the problem that the terminal authentication method in the prior art cannot be flexibly switched. The first authentication operation, such as Dot1x-based authentication, has high security but long authentication duration; the second authentication operation, such as MAC address authentication, although the security is relatively low, but the authentication speed is fast. The authentication process is optimized through the state machine model, when the first authentication operation is successful, the back-off behavior of the second authentication operation is triggered immediately, avoiding redundant second authentication operation. The specific technical effect analysis is as follows:

[0012] Dynamic adjustment of authentication process: The state machine model allows the system to dynamically adjust the authentication process according to the real-time results of the first authentication operation, terminating the second authentication operation immediately when the first authentication operation is successful, avoiding unnecessary authentication processes and improving the flexibility of the overall authentication process.

[0013] Priority optimization: By setting the priority of the first authentication operation higher than that of the second authentication operation, the system can first perform the first authentication operation which is more secure but time-consuming, and stop the second authentication operation immediately after successful authentication, avoiding double authentication.

[0014] Resource conservation: In the case of successful first authentication operation, the backoff of the second authentication operation not only saves the processing resources of the authentication server, but also reduces the burden of the authentication device, achieving efficient use of network resources as a whole.

[0015] Security and efficiency: By using the high-security authentication result of the first authentication operation, the security of network access is guaranteed, and by using the fast response characteristics of the second authentication operation, the efficiency of the authentication process is ensured, achieving a balance between security and efficiency.

[0016] Abnormal processing capability: In the case of timeout or failure of the first authentication operation, the state machine model can detect and use the result of the second authentication operation in time, ensuring the continuity and stability of the authentication process, effectively avoiding authentication interruption due to failure of a single authentication method, and enhancing the abnormal processing capability of the system. BRIEF DESCRIPTION OF DRAWINGS

[0017] The accompanying drawings, which are included to provide a further understanding of the present application, constitute a part of the present application and illustrate the illustrative embodiments of the present application and its description, which serve to explain the present application, and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 is a flowchart of an optional terminal identity authentication method according to an embodiment of the present application;

[0019] Figure 2 is an optional user authentication state machine schematic diagram provided according to an embodiment of the present application;

[0020] Figure 3 is an optional authorized behavior state machine schematic diagram provided according to an embodiment of the present application;

[0021] Figure 4 is an optional delayed authentication state machine schematic diagram provided according to an embodiment of the present application;

[0022] Figure 5 is an optional online probing state machine schematic diagram provided according to an embodiment of the present application;

[0023] Figure 6 is an optional silent state machine schematic diagram provided by the embodiment of the present application;

[0024] Figure 7 is an optional re-authentication state machine schematic diagram provided by the embodiment of the present application;

[0025] Figure 8 is an optional server state machine schematic diagram provided by the embodiment of the present application;

[0026] Figure 9 is an optional terminal authentication control device interaction schematic diagram provided by the embodiment of the present application;

[0027] Figure 10 is an optional state machine linkage schematic diagram provided by the embodiment of the present application;

[0028] Figure 11 is an optional terminal identity authentication device schematic diagram provided by the embodiment of the present application. DETAILED DESCRIPTION

[0029] In order to enable persons skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by persons skilled in the art without creative labor should fall within the scope of protection of the present application.

[0030] It should be noted that the terms "first", "second", and the like in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily have to be used to describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units does not have to be limited to only those steps or units clearly listed, but can include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0031] For ease of description, the following describes some nouns or terms related to the embodiments of the present application:

[0032] NAC (Network Access Control) is a network security technology that implements security policies when terminal devices connect to the network, ensuring that only devices that meet certain security standards can access. By checking, isolating, repairing, and monitoring unauthorized devices, it protects the network from threats.

[0033] MAC (Media Access Control) is a network technology that controls data transmission between multiple devices on a shared medium, ensuring that data packets are sent in order and without conflict. The MAC address is a unique identifier for a device's network interface, used to identify and communicate in the network, and is the basis for network communication.

[0034] VLAN (Virtual Local Area Network) is a logical network built on a physical LAN, allowing a physical network to be divided into multiple logical networks, each of which can be independently managed and configured, improving network security and resource allocation efficiency, reducing broadcast domains, and optimizing network performance.

[0035] RADIUS (Remote Authentication Dial In User Service) is a network protocol for remote user authentication, authorization, and billing. Through communication between the client and the server, it ensures that network access rights are only granted to legitimate users, providing secure network access control.

[0036] dot1x authentication, also known as 802.1X authentication, is a port-based network access control protocol. 802.1X authentication uses the EAP (Extensible Authentication Protocol) protocol, which is an extensible authentication protocol, to authenticate user identity and provide encrypted user identity information transmission to ensure the security of the authentication process.

[0037] MAC address authentication is a network authentication method based on the MAC address of a device, which is different from dot1x authentication. MAC authentication relies on the MAC address of the device, which is easy to be forged or sniffed, so the security is relatively low.

[0038] According to the embodiments of the present application, an embodiment of a terminal identity authentication method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in a different order than here.

[0039] Figure 1 is a flowchart of an optional terminal identity authentication method according to an embodiment of the present application, as shown in the figure, the method comprises the following steps: Figure 1

[0040] Step S101, authenticating the identity information of the target terminal through a first authentication operation and a second authentication operation.

[0041] In an optional embodiment, a terminal authentication system can be the execution subject of the terminal identity authentication method of the embodiments of the present application, wherein the terminal authentication system can be a software system or a combination of software and hardware embedded system, for example, a system composed of multiple state machines. In addition, those skilled in the art should know that, in addition to the terminal authentication system, the execution subject of the terminal identity authentication method of the embodiments of the present application can also be other forms of expression, including but not limited to devices, apparatuses, etc. The present application does not particularly limit the form of expression of the execution subject. For the convenience of description, the terminal identity authentication method provided by the embodiments of the present application is described below with the terminal authentication system as the execution subject.

[0042] Optionally, in a computer network, in order to ensure the security of the network and the reasonable allocation of resources, it is usually necessary to authenticate the terminal trying to access the network. The authentication process involves verifying the identity of the terminal and whether it meets the security policy requirements of the network. In the technical solution of the present application, a method of authenticating the identity information of the target terminal by using two different authentication operations (first authentication operation and second authentication operation) is proposed, and the characteristics of the two authentication operations are complementary.

[0043] Optionally, the first authentication operation is usually a more complex authentication method with higher security of the authentication result. In the context of the present application, this authentication method can refer to 802.1X protocol-based authentication or similar client-server interaction-based authentication technology, for example, Dot1x authentication method. Among them, 802.1X authentication requires terminal devices (such as computers, mobile phones, etc.) to verify user identity through multiple rounds of interaction with the authentication server, which may involve password verification, certificate checking, etc., so the security of the authentication result is higher. However, due to the complexity of the interaction process, the authentication time is usually longer.

[0044] ​The second authentication operation is a relatively simple, fast authentication operation, but the authentication security is relatively low. For example, the second authentication operation can be a MAC address based authentication operation. In the MAC address authentication, the MAC address of the terminal device is checked to determine whether to allow access to the network. This method does not require client software, and the authentication speed is fast, and is suitable for environments where the security requirement is not very high. However, since the MAC address can be forged or tampered with, the security of the authentication result is lower than that of the first authentication operation.

[0045] The technical solution of the present application combines the two authentication operations and uses a state machine model to optimize the authentication process. At the beginning of authentication, the system can start the first authentication operation and the second authentication operation (the operation time of the two authentication operations can be simultaneous or sequential). However, since the authentication result of the first authentication operation is more secure, once the authentication is successful, the second authentication operation will trigger the backoff behavior regardless of whether the second authentication operation is completed.

[0046] In step S102, when it is detected that the identity information of the target terminal is authenticated successfully by the first authentication operation, the backoff behavior of the second authentication operation is triggered.

[0047] In step S102, the backoff behavior includes: if it is detected that the second authentication operation has been authenticated, the authentication result of the first authentication operation is used to replace the authentication result of the second authentication operation; and the second authentication operation that has been started is ended.

[0048] Optionally, the backoff behavior is explained as follows:

[0049] If the first authentication operation is successful and the second authentication operation is also completed, but since the security of the first authentication operation result is higher, the system will use the result of the first authentication operation to replace the result of the second authentication operation to ensure that the result with the highest security is used as the final authentication basis. In addition, when the system detects that the first authentication operation is successful, if the second authentication operation has not been completed, the second authentication operation will be immediately ended, avoiding unnecessary resource consumption and time waste.

[0050] For example, in the case where the first authentication operation is a Dot1x authentication operation and the second authentication operation is a MAC address based authentication operation, there are two scenarios as follows:

[0051] In scenario 1, when it is detected that the authentication result of the Dot1x authentication operation is authentication success, if it is also detected that the MAC address based authentication operation has been authenticated, regardless of the authentication result of the MAC address authentication operation, the authentication result of the Dot1x authentication operation (the result of authentication success) is used to replace the authentication result of the MAC address authentication operation.

[0052] Scenario 2, in the case where the authentication result of the Dot1x authentication operation is authentication success, if it is also detected that the MAC address based authentication operation has been initiated, then for the MAC address authentication operation that has been initiated, regardless of whether it has been authenticated or not, the MAC authentication operation is ended.

[0053] Optionally, the authentication result of the target terminal is from an authentication server to determine the legitimacy of the target terminal. The authentication process includes the interaction of the terminal authentication control device and the authentication server, and the authentication server performs the authentication of whether the MAC address is in the allowed list or is associated with the pre-stored identity information of the legitimate user. After the terminal authentication control device receives the authentication result, it can be determined whether the target terminal has passed the authentication.

[0054] Step S103, in the case where the authentication of the identity information of the target terminal by the first authentication operation is detected to be timed out or failed, if the authentication of the identity information of the target terminal by the second authentication operation is detected to be successful, the authentication state of the second authentication operation for the identity information is maintained.

[0055] Optionally, in the technical solution of the present application, a key design consideration is to achieve a balance between the first authentication operation (such as Dot1x authentication based on 802.1X, which has high security but a longer authentication time) and the second authentication operation (such as MAC address authentication, which has a faster authentication speed but lower security) to achieve flexible selection of the final authentication result. In the description of this part "in the case where the authentication of the target terminal by the first authentication operation is detected to be timed out or failed, if the second authentication operation has been successful, the second authentication state is maintained", the main problem to be solved is how to ensure the normal operation of the network and the access control of the terminal in the case where the first authentication operation fails to be completed successfully. This mechanism ensures that even if the first authentication operation fails to be completed within the expected time or fails due to some reasons, while the second authentication operation (MAC address authentication) has been successfully completed, the system will not clear or ignore the result of the second authentication operation, but will maintain this authentication state to allow the target terminal to continue to access the network. This is because, in the actual network environment, the failure or timeout of the first authentication operation can be caused by various reasons, such as terminal device problems, network delays, authentication server failures, etc., and these situations do not necessarily mean that the terminal should not be allowed to access the network. At this time, if the second authentication operation has been successful, it means that at least from the MAC address level, the terminal is recognized by the network and can temporarily maintain its access state.

[0056] For example, in high-traffic, high-user-density environments such as large enterprise office networks, public Wi-Fi networks, etc., the first authentication operation may time out due to network congestion or server overload, or fail due to temporary system failure. In this case, the fast response characteristic of the second authentication operation can ensure the continuity of the network and the normal access of the user, and at the same time, since the authentication state of the second authentication operation is maintained, unnecessary re-authentication processes can be avoided, reducing the network burden and the delay of terminal access.

[0057] Although the authentication security of the second authentication operation is lower than that of the first authentication operation, when the first authentication operation is not available, maintaining the state of the second authentication operation as a temporary solution can ensure the basic security and function of the network. At the same time, the system can further verify the security state of the terminal through subsequent monitoring and management, such as periodic re-authentication checks, online detection functions, etc., thereby maintaining the security of the network while not affecting the user experience.

[0058] It should be noted that the implementation of the hybrid authentication mechanism of the dual authentication operation relies on the state machine model, and through the linkage and state transition between the state machines, the system can automatically coordinate and decide between different authentication operations, ensuring that when the first authentication operation encounters problems, it can quickly and accurately switch to a state that relies on the second authentication operation, thereby maintaining the normal operation of the network and the access control of the terminal. When the first authentication operation times out or fails, maintaining the state of the second authentication operation avoids interruption of network access and improves user experience. Through the manner defined in step S103, unnecessary re-authentication processes are also reduced, reducing the load of network devices and authentication servers and improving the overall efficiency of the network. Through the flexible state transition mechanism, the system can better cope with changes in the network environment and improve the adaptability and processing capacity for sudden situations.

[0059] In summary, the above step S103 of the present application not only considers the security of authentication, but also optimizes in terms of efficiency and user experience, and by preserving the state of the second authentication operation when the first authentication operation is unreliable, the continuity of network access and the security control of the terminal are ensured.

[0060] In an optional embodiment, after the identity information of the target terminal is authenticated through the first authentication operation and the second authentication operation, the method further comprises: when it is detected that the authentication of the identity information of the target terminal through the first authentication operation times out or fails, if it is detected that the authentication of the identity information of the target terminal through the second authentication operation fails or times out, it is determined that the identity information has not passed this round of authentication.

[0061] Optionally, in the technical solution of the present application, a mechanism is proposed to combine the first authentication operation and the second authentication operation to authenticate the identity information of the target terminal. The first authentication operation here generally refers to an authentication method with high security but a longer authentication time, such as Dot1x authentication based on 802.1X protocol. The second authentication operation refers to an authentication method with faster authentication speed but relatively lower security, such as MAC address authentication. The combination of the two authentication operations aims to balance the security and efficiency of network access, but at the same time, a mechanism is needed to handle the case when both authentication operations fail to complete successfully.

[0062] For example, if the identity information of the target terminal encounters a timeout or authentication failure in the first authentication operation, it means that the terminal fails to pass this strict security check. At the same time, if the second authentication operation also fails, i.e., authentication failure or timeout, it can be determined that the identity information of the target terminal does not pass the verification of any authentication method in this round of authentication. This indicates that the target terminal fails to meet the requirements of the network's security policy in the current network access attempt, and there is a potential risk, so it is not allowed to access the network.

[0063] In actual application scenarios, such as enterprise internal networks or data centers, this mechanism can effectively prevent unauthorized or suspicious terminals from accessing the network, thereby protecting network resources from being misused and preventing potential security threats.

[0064] In an optional embodiment, the identity information of the target terminal is authenticated by the first authentication operation and the second authentication operation, comprising: setting the first authentication operation to authenticate the identity information of the target terminal at a first time; setting the second authentication operation to authenticate the identity information of the target terminal at a second time, wherein the first time is earlier than the second time.

[0065] Optionally, the first authentication operation generally refers to a more complex and secure authentication method with longer authentication time, such as Dot1x authentication based on 802.1X protocol. The first time refers to the time point when the first authentication operation is triggered immediately after the start of the authentication process. The purpose of this design is to start the high-security authentication verification as early as possible without affecting the overall authentication efficiency, so as to ensure that the network access control can reach the highest level of security standard. The second authentication operation refers to an authentication method with faster authentication speed but lower security, such as MAC address authentication. The second time is set to be later than the first time, i.e., the second authentication operation is started after a period of time after the start of the first authentication operation. This delayed start design is to take advantage of the security of the first authentication operation, while avoiding unnecessary second authentication operation in the case where the first authentication operation has already succeeded, thereby saving authentication resources and time.

[0066] Through the above design, the first authentication operation and the second authentication operation complement each other in security and speed. The first authentication operation is started immediately at the beginning of authentication, for in-depth verification, while the second authentication operation is started later, so as to provide a quick verification result when the first authentication operation fails to complete within the expected time.

[0067] It should be noted that the setting that the first time is earlier than the second time mentioned in the above technical solution is an optional delay operation mode, but the user can customize the start time of the two authentication operations according to the actual network environment and security requirements. For example, in some network environments, the user may consider that the fast response of MAC address authentication is more important, and therefore can set the MAC address authentication to start at an earlier time point, or even start before the first authentication operation, so as to further optimize the authentication process. The user can also set the first authentication operation and the second authentication operation to start at the same time.

[0068] In summary, the user can flexibly adjust the start time of the first authentication operation and the second authentication operation according to the characteristics of the network, the type of the terminal, the requirements of the security policy, and other factors. This customization capability makes the technical solution better adapt to different scenarios and requirements, improving its applicability and flexibility.

[0069] In an optional embodiment, in the case that the authentication result of the first authentication operation represents that the identity information authentication of the target terminal fails, and the authentication result of the second authentication operation represents that the identity information authentication of the target terminal fails or authentication timeout, the authentication system adds the target terminal to the first local area network; in the case that the authentication result of the first authentication operation represents that the identity information authentication of the target terminal times out, and the authentication result of the second authentication operation represents that the identity information authentication of the target terminal fails or authentication timeout, the authentication system adds the target terminal to the second local area network, wherein the network resources allowed to be accessed by the first local area network are less than the network resources allowed to be accessed by the second local area network; in the case that the authentication result of the second authentication operation represents that the identity information authentication of the target terminal succeeds, or the authentication result of the first authentication operation represents that the identity information authentication of the target terminal succeeds, the authentication system adds the target terminal to the third local area network, wherein the network resources allowed to be accessed by the third local area network are more than the network resources allowed to be accessed by the second local area network.

[0070] Optionally, when the target terminal attempts to access the network, the authentication system starts the first authentication operation and the second authentication operation to verify the identity information of the target terminal at the same time. According to different authentication results, the terminal will be distributed to local area networks with different permissions and different resource access restrictions.

[0071] In the first scenario, if the result of the first authentication operation indicates that the authentication of the target terminal fails, and the second authentication operation also fails to complete successfully (authentication fails or times out), it indicates that the terminal has potential security problems or its authentication information can be inaccurate. In this case, the authentication system adds the target terminal to the first local area network (e.g., guest-vlan), which has lower permissions and only allows access to limited network resources, such as specific services for terminal management, help documents, or emergency contact information, to reduce potential security risks.

[0072] In the second scenario, the first authentication operation fails to complete within the specified time (times out), and the second authentication operation also fails to complete successfully (authentication fails or times out). At this time, the authentication system can add the target terminal to the second local area network (e.g., critical-vlan). The second local area network has higher permissions than the first local area network, allowing the terminal to access more but still limited network resources, such as part of the internal database, non-sensitive internal web pages, etc., to meet the basic needs of the terminal while limiting its access to sensitive resources.

[0073] In the third scenario, if either the second authentication operation or the first authentication operation successfully completes the authentication of the target terminal, it indicates that the terminal meets the security requirements of the network and has a high level of trust. In this case, the authentication system adds the target terminal to the third local area network (e.g., user-vlan), which has the highest permissions and allows the terminal to access extensive network resources, including enterprise internal applications, databases, file sharing, etc., to support the normal work and activities of the user.

[0074] It should be noted that the above local area network access control design based on authentication results effectively balances the security and availability of the network by assigning terminals to different permission networks, including:

[0075] Limiting terminals that fail authentication or time out to a local area network with lower permissions reduces the potential threat to sensitive network resources and improves the overall security of the network;

[0076] For terminals that successfully authenticate, more extensive and in-depth access to network resources is provided to support their efficient work, while for terminals that fail authentication or time out, necessary services are provided through a lower permission network, avoiding complete network access isolation and maintaining some network availability;

[0077] By assigning different permissions through different local area networks, fine-grained management of network resources is achieved, protecting important resources from illegal access while reasonably allocating resources and avoiding excessive restrictions or misuse of resources.

[0078] Therefore, by subdividing the authentication result and the response strategy, the fine management of the network resource is realized, and the security and user experience of the network are effectively improved. This mechanism is particularly suitable for enterprise internal networks, data centers and other environments that require high security control.

[0079] Optionally, the authentication system can also release the target terminal from the restricted VLAN if the duration of the target terminal joining the restricted VLAN (the first local network or the second local network) is greater than a predetermined duration.

[0080] For example, the authentication system can provide an aging mechanism, that is, a timer with a first duration is set for the terminal device joining the restricted VLAN. If the target terminal has not passed the authentication after the timer expires (that is, the first duration is greater than the first predetermined duration), it will be automatically released from the restricted VLAN, thereby releasing the network resource and preventing the resource from being occupied for a long time to affect the network experience of normal authentication users. At the same time, this also helps to maintain the network security and avoid the unlimited existence of non-authentication devices. By introducing the aging mechanism, it is helpful to automatically clean up the terminal that has not passed the authentication for a long time, avoid the waste of network resources, and provide convenience for network maintenance and management.

[0081] In an optional embodiment, in the present application, the first authentication operation, the second authentication operation, and the triggering of the backoff behavior can be performed by N state machines, where N is an integer greater than 2, and the interaction between the N state machines is realized by a timer polling timing method. The N state machines at least include:

[0082] A user authentication state machine for managing the authentication state of the identity information of the target terminal;

[0083] A delayed authentication state machine for controlling the execution time of the first authentication operation and the execution time of the second authentication operation, and determining whether to trigger the backoff behavior of the second authentication operation according to the authentication result of the first authentication operation;

[0084] A re-authentication state machine for controlling the re-authentication of the identity information, and uploading the authentication result of the re-authentication to the user authentication state machine.

[0085] Optionally, the technical solution of the present application utilizes the cooperation of multiple state machines to optimize and control the execution process of the first authentication operation, the second authentication operation, and the backoff behavior. Through the interaction of N state machines (N is an integer greater than 2), the system can more flexibly and efficiently manage the authentication process of the identity information of the target terminal, realize the reasonable allocation of resources, and improve the security. The following is a detailed explanation and description of the three key state machines involved in this scheme and the interactive interaction mechanism realized by the timer polling timing method between them:

[0086] First, the user authentication state machine is the core of the entire authentication process, responsible for managing the authentication status of the target terminal's identity information. It updates the terminal's authentication status according to the results of the first and second authentication operations and decides the terminal's access rights in the network accordingly. For example, when the terminal passes either authentication operation, the user authentication state machine changes the terminal's authentication status to "authentication success" and notifies the system to add the terminal to a local area network with higher access rights, such as the third local area network mentioned earlier. Conversely, if both authentication operations fail or time out, the user authentication state machine updates the terminal's status to "authentication failure" and notifies the system to take appropriate restrictive measures, such as adding the terminal to the first or second local area network. In addition, the user authentication state machine is also responsible for receiving and processing events from the delay authentication state machine and the re-authentication state machine to dynamically adjust the authentication process.

[0087] Second, the delay authentication state machine is mainly used to control the execution time of the first and second authentication operations and trigger the backoff behavior of the second authentication operation when the first authentication operation succeeds. At the beginning of authentication, the delay authentication state machine first starts the first authentication operation and sets a delay time. If the first authentication operation is completed within the delay time and the result is successful, the delay authentication state machine will notify the second authentication operation to back off, i.e., not to execute the second authentication operation, to save resources and time. However, if the first authentication operation times out or fails, the delay authentication state machine will allow the second authentication operation to continue execution, thereby providing an alternative for fast authentication. The design of this state machine ensures the priority execution of high-security authentication (first authentication operation), while enabling low-security but high-speed authentication (second authentication operation) when necessary, improving the efficiency and security of the overall authentication process.

[0088] In addition, the re-authentication state machine is responsible for periodically re-authenticating the authenticated terminal identity information to ensure the terminal's ongoing compliance and security. When the user authentication state machine detects that the terminal's authentication status is "authentication success", the re-authentication state machine will be activated to start the periodic re-authentication process. If the re-authentication is successful, the terminal's authentication status remains unchanged; if the re-authentication fails or times out, the re-authentication state machine will upload the result to the user authentication state machine, which will update the terminal's status according to the new authentication result and take appropriate measures, such as re-allocating the terminal to a local area network with lower access rights. The existence of the re-authentication state machine improves the security and dynamic management capabilities of the network, ensuring that the network's control strategy can be adjusted in time even when the terminal's status changes, maintaining the security of the network.

[0089] In the present application, the interaction linkage between the N state machines is realized through the way of timer polling timing. Each state machine determines when to trigger the corresponding authentication operation or backoff behavior, and when to upload the authentication result by setting and monitoring specific timers. For example, the delay authentication state machine monitors the delay timer of the first authentication operation, the user authentication state machine monitors the timer of re-authentication and online detection, and the re-authentication state machine monitors its own periodic re-authentication timer. When the timer triggers or the state machine receives a specific event, it will notify the relevant state machine to perform state transition or execute specific operations, thereby realizing the automatic control and adjustment of the authentication process. This timer polling-based interaction linkage mechanism can realize efficient information transmission and state synchronization between different state machines, ensuring the continuity and consistency of the authentication process, and improving the overall operation efficiency and reliability of the system.

[0090] Through the above design, the technical scheme of the present application not only improves the authentication efficiency and security of network access, but also enhances the flexibility and self-adaptability of the system, which can better cope with changes in network environment and security threats, and provide a network environment that is both efficient and secure for users. In addition, through the linkage between state machines, the system can realize automatic and intelligent authentication management, reducing the need for manual intervention and further improving the efficiency of network management.

[0091] In an optional embodiment, the N state machines further include at least one of the following state machines:

[0092] An authorized behavior state machine is configured to determine the local area network corresponding to the target terminal according to the authentication result of the first authentication operation and the authentication result of the second authentication operation;

[0093] A silent state machine is configured to detect the number of authentication failures of the identity information of the target terminal within a first predetermined time length, and to prohibit responding to the protocol packet of the target terminal for triggering authentication within a second predetermined time length if the number of authentication failures is greater than a predetermined threshold;

[0094] An online detection state machine is configured to periodically check whether a message sent by the target terminal based on the identity information is received within a preset period if the authentication of the identity information of the target terminal is successful, and determine that the target terminal is in an offline state if the message is not received within the preset period;

[0095] A server state machine is configured to send an authentication request initiated by the re-authentication state machine and / or the user authentication state machine to an authentication server, and return the response information of the authentication server to the authentication request to the initiator of the authentication request.

[0096] Optionally, the present application can also optimize the network authentication process by introducing a more complex state machine model. In addition to the user authentication state machine, the delayed authentication state machine, and the re-authentication state machine, the scheme also designs an authorized behavior state machine, a silent state machine, an online detection state machine, and a server state machine to further enhance the reliability and security of authentication and achieve more precise network resource access control. The following is an explanation and description of these additional state machines and their functions:

[0097] Authorized behavior state machine: The role of the authorized behavior state machine is to determine which local area network the target terminal should be assigned to and the corresponding network resource access rights based on the results of the first authentication operation and the second authentication operation. This function ensures that network resource access control is closely related to the authentication state of the terminal, effectively distributing different network access rights according to the security level of the terminal. For example, terminals that successfully authenticate are assigned to local area networks with higher permissions, while terminals that fail to authenticate or time out are restricted to local area networks with lower permissions, thereby achieving hierarchical protection of network resources and improving the overall security of the network.

[0098] Silent state machine: The silent state machine is used to monitor and control the authentication attempt behavior of the target terminal within a specific time period. Specifically, the silent state machine detects the number of times the target terminal's identity information fails to authenticate within a first predetermined time period. If this number exceeds a predetermined threshold, the state machine will prohibit responding to the target terminal's protocol packets for triggering authentication within a second predetermined time period. This mechanism effectively prevents malicious attacks such as brute force cracking or continuous invalid authentication attempts, and can to some extent protect the authentication system from unnecessary load, improving its stability and security.

[0099] Online detection state machine: The online detection state machine is responsible for periodically checking whether a message based on the identity information of the target terminal is received within a preset period after the identity information is successfully authenticated. If no messages are received within the preset period, the state machine determines that the target terminal is offline. This function is crucial for ensuring the continuous online status of authenticated terminals. Since MAC address authentication cannot rely on client software to monitor the online status of the terminal, the online detection state machine periodically checks whether the forwarding table entry of the authenticated user is hit by a message from the user, enabling timely detection of terminal offline status, thereby releasing the occupied network resources and avoiding resource waste, and helping to maintain the health status of the network.

[0100] Server state machine: The server state machine is responsible for communication with the authentication server during the authentication process, acting as a bridge between the authentication system and the authentication server. Upon receiving an authentication request initiated by the re-authentication state machine and / or the user authentication state machine, the server state machine sends the request to the authentication server and receives the response information from the authentication server. This response information contains the authentication result of the terminal, which the server state machine returns to the corresponding authentication request initiator, i.e., the re-authentication state machine or the user authentication state machine. Through this mechanism, the server state machine ensures the security and timeliness of information transmission in the authentication process, enabling each state machine to make correct decisions based on the feedback from the authentication server, enhancing the automation and intelligence of the overall authentication process.

[0101] Through the coordinated work of these state machines, comprehensive optimization of the network authentication process is achieved, including response to authentication results, detection of abnormal behavior, monitoring of terminal online status, and management of authentication requests and responses. This not only improves the flexibility of MAC address authentication, but also enhances the security and stability of the system, providing network administrators with a more efficient and intelligent network access control method, thereby protecting network resources while ensuring normal use and experience for terminal users. By dividing these functions into different state machines, the system can more flexibly handle various authentication scenarios, improving the adaptability and expandability of the overall network authentication solution.

[0102] Optionally, Table 1 defines the states of the user authentication state machine, including the following 9 states: initialization state initialize, idle state idle, authentication in progress state authenticating, authentication passed state access, authentication failed state reject, authentication timeout state radius disconnect, authentication abort state abort, release user resources releasing, and release user released. NA means Not Available, indicating that certain information, functions or parameters are not applicable, unavailable or not required in the current process.

[0103]

[0104]

[0105] As shown in Table 1, the initialization state initialize is the starting state of the state machine. When the target terminal to be MAC authenticated first attempts to access the network, the user authentication state machine enters this state, but no operation is performed at this time, waiting for further input.

[0106] Idle: In case of the delay authentication function is enabled and dotlx authentication is preferred, the user authentication state machine is in the waiting state until it receives the "authentication abort" or "authentication start" signal from the delay authentication state machine. If the delay authentication state machine informs "authentication abort", the user authentication state machine jumps to the authentication abort state abort; if the delay authentication times out, the user authentication state machine jumps to the authenticating state start the MAC authentication procedure.

[0107] Abort: When receiving the "authentication abort" signal from the delay authentication state machine, the user authentication state machine will stop the current authentication attempt, release all related resources, and stop the network access billing. After receiving the "resources released" notification from the authorization behavior state machine, the user authentication state machine jumps back to the initialize state initialize, or the idle state.

[0108] Authenticating: The user authentication state machine jumps to the authenticating state from the idle state or directly from the initialize state, and starts sending the authentication request to the authentication server. If receiving the notification of authentication success, failure or timeout during the process, the user authentication state machine will jump to the corresponding authentication success state access, authentication failure state reject or authentication timeout state radius disconnect.

[0109] Access: When receiving the authentication success response from the authentication server, the user authentication state machine jumps to the authentication success state access. At this time, the user authentication state machine will inform the authorization behavior state machine to join the user_vlan (corresponding to the third local network described above), and start the timers related to re-authentication and online detection. At the same time, stop the activity of the silent state machine, and start the billing function.

[0110] Reject: When receiving the authentication failure response from the authentication server, the user authentication state machine jumps to the authentication failure state reject. The user authentication state machine will inform the authorization behavior state machine to join the target terminal to the guest_vlan (corresponding to the first local network described above), stop the re-authentication and online detection timers, increase the authentication failure statistical count, and stop the billing function.

[0111] As shown in Table 1, the authentication timeout state radius disconnect: when the timeout of receiving the authentication request from the authentication server occurs, the user authentication state machine jumps to the authentication timeout state radius disconnect. The user authentication state machine will notify the authorization behavior state machine to join the critical_vlan (corresponding to the second local area network described above), stop the re-authentication and online detection timers, and stop the charging function.

[0112] Optionally, Figure 2 is an optional user authentication state machine diagram provided according to an embodiment of the present application, as Figure 2 shown, the user authentication state machine is a core component of the terminal authentication control device for performing MAC address authentication, responsible for managing the authentication state and authentication process of the user. The user authentication state machine processing flow includes the following modes: when the MAC authentication device (i.e. the terminal authentication control device) first receives the protocol packet of the MAC authentication terminal (i.e. the target terminal), the user authentication state machine jumps from the initialization state initialize to the idle state idle (if the hybrid authentication function is turned on), and waits for the result of the dot1x authentication. If the dot1x authentication is successful, the MAC authentication will not be performed, and the state machine remains in the idle state idle; if the dot1x authentication is unsuccessful or the hybrid authentication function is turned off, the delay countdown state delay (belonging to the delay authentication state machine) is entered. If the delay timer times out, the user authentication state machine jumps from the delay countdown state delay to the authenticating state authenticating, and starts the MAC address authentication process. Once the authentication is successful, the user authentication state machine enters the authentication pass state access, and the target terminal obtains normal network access permission (i.e. can use the non-restricted state machine). If the authentication fails, the user authentication state machine enters the authentication failure state reject, and the target terminal is assigned to the guest vlan (corresponding to the first local area network described above), and has restricted network access permission. If the authentication times out, the user authentication state machine jumps to the authentication timeout state radius disconnect, and the target terminal is temporarily put into the critical_vlan (corresponding to the second local area network described above), and waits for further authentication attempts. At the end of any authentication process (whether pass, failure or timeout), the user authentication state machine will jump back to the idle or initialization state initialize, preparing for the next authentication attempt.

[0113] In this way, the user authentication state machine can efficiently and accurately process the authentication request of the user, and cooperates with all other state machines, ensuring the smooth progress of the entire authentication process and the network access control of the user.

[0114] Optionally, Table 2 is a state definition of the authorization behavior state machine, including the following 7 states: initialize state, unauthorized state, user_vlan state, guest_vlan state, critical_vlan state, abort state, and released state.

[0115] The initialize state is the starting state of the authorization behavior state machine, and the authorization behavior state machine is in this state when the authorization behavior state machine is initialized or the user resource is released.

[0116] The unauthorized state: after initialization, the authorization behavior state machine usually jumps to the unauthorized state, indicating that the user has not passed the authentication. At this time, the authorization behavior state machine will terminate all timers related to the old state related to the terminal and clear any authorization resources, ensuring that the terminal has no network access.

[0117] The released state: when the user authentication state machine sends a "release user resource" instruction, the authorization behavior state machine will jump to the released state regardless of the current state. Under the authorization behavior state machine, the user is removed from the current authorized VLAN, all timers related to the current state are terminated, and the authorization resources are cleared. Finally, the authorization behavior state machine will notify the user authentication state machine that the user resource has been released.

[0118] Table 2

[0119]

[0120]

[0121] Figure 3 is a schematic diagram of an optional authorization behavior state machine provided according to an embodiment of the present application, as Figure 3As shown, when a user first attempts to access the network or transitions from one state to another, the authorization behavior state machine jumps from the initialize state to the unauthorized state, waiting for the terminal authentication result. If the authentication is successful, the authorization behavior state machine jumps from the unauthorized state to the user_vlan state, authorizing the user to access all network resources. If the user authentication fails and access to the guest VLAN is allowed, the authorization behavior state machine jumps from the unauthorized state to the guest_vlan state, authorizing the user to access the guest VLAN resources. If the authentication times out and access to the critical VLAN is allowed, the authorization behavior state machine jumps from the unauthorized state to the critical_vlan state, authorizing the user to access the critical VLAN resources. When a "release user resources" instruction from the user authentication state machine is received, the authorization behavior state machine jumps to the released state regardless of the current state, and jumps back to the initialize state after cleaning up the user resources. If the user resource aging timer times out in the guest_vlan or critical_vlan state, the state machine jumps to the released state, releasing the user resources and re-initializing.

[0122] The authorization behavior state machine ensures that a user is dynamically assigned to a suitable VLAN according to the authentication result, while supporting periodic re-authentication and aging mechanisms for resources, improving the flexibility, security and management efficiency of the network.

[0123] Optionally, Table 3 defines the states of the delayed authentication state machine, including the following four states: the initialize state, the delay state, the delay timeout state, and the abort state.

[0124] The initialize state: the delayed authentication state machine checks whether the delayed authentication and hybrid authentication functions are configured. If the delayed authentication and hybrid authentication functions are not configured, the delayed authentication state machine will directly jump to the authentication process; if the delayed authentication and hybrid authentication functions are configured, the delayed authentication state machine will enter the delay waiting state.

[0125] The delay state: in the delay waiting state, the delayed authentication state machine starts a delay timer, and waits for the authentication state of the dotlx authentication for a predetermined time length. In this predetermined time length, the delayed authentication state machine will not initiate the MAC authentication process, but wait for the result of the dotlx authentication with higher priority.

[0126] If the 802.1X authentication is successful during the waiting period 802, the delayed authentication state machine will not trigger the MAC authentication process, but jump to the abort state, which informs the user authentication state machine of the corresponding result.

[0127] The delay timeout state: If the delay timer expires, and the dot1x authentication is not completed or not successful, the delayed authentication state machine will jump to the delay timeout state. In the delay timeout state, the delayed authentication state machine will inform the user authentication state machine to start the MAC authentication process, ensuring that the target terminal can access the network through the MAC authentication even if the dot1x authentication is not successful.

[0128] The abort state: When the dot1x authentication is successful, the delayed authentication state machine will jump to the abort state, which means that the MAC authentication will not be triggered because a higher priority authentication method has been successful, and the target terminal has obtained the network access right (non-restricted VLAN). The delayed authentication state machine will inform the user authentication state machine to stop any operation or timer related to the MAC authentication.

[0129] Table 3

[0130]

[0131] Figure 4 An optional delayed authentication state machine is provided according to an embodiment of the present application, as shown in Table 3. Figure 4 The delayed authentication state machine is specially designed to handle the case where multiple authentication methods (such as MAC authentication and dot1x authentication) are enabled in the network, and to ensure that the authentication of a higher priority authentication method is completed before the authentication of a lower priority authentication method. When a protocol packet triggering the authentication of the target terminal is received, and the mixed authentication and the delayed authentication are configured, the delayed authentication state machine will transition from the initialize state to the delay state. If the dot1x authentication is successful in the delay state, the delayed authentication state machine will jump to the abort state, and the MAC authentication will not be started. If the delay timer expires, the delayed authentication state machine will jump to the delay timeout state, and the MAC authentication process will be started. By dynamically adjusting the order of authentication according to the network environment and configuration, the network access can be more flexible and secure. The dot1x authentication is performed first, which can utilize a more secure authentication mechanism, and the delayed authentication state machine ensures that the MAC authentication can be used as an alternative in the case of dot1x authentication failure or inapplicability, thereby ensuring the availability of the network and the access efficiency of the terminal.

[0132] Optionally, Table 4 is the state definition of the online probing state machine, including the following 5 states: initialization state initialize, probing countdown state waiting, probing in progress state inspecting, probing timeout state timeout, and probing termination state disable.

[0133] Table 4

[0134]

[0135]

[0136] As shown in Table 4, the initialization state initialize: no online probing activity is performed until the instruction of starting the online probing timer is received from the user authentication state machine.

[0137] As shown in Table 4, the probing countdown state waiting: when the user authentication state machine sends the signal of “starting the online probing timer” to the online probing state machine, the online probing state machine will jump to the probing countdown state waiting. In the probing countdown state waiting, the online probing state machine starts the online probing timer and clears the probing times, and waits for the timer to time out to trigger the probing request.

[0138] As shown in Table 4, the probing in progress state inspecting: when the online probing timer times out, the online probing state machine jumps to the probing in progress state inspecting. In the probing in progress state inspecting, the online probing state machine sends a request to the forwarding chip of the authentication device to query the set state of the hit flag of the mac table.

[0139] As shown in Table 4, the probing timeout state timeout: if the online probing state machine still does not receive the user's response when the probing request timeout timer expires, and the probing times reach or exceed the maximum allowed probing times, the online probing state machine will jump to the probing timeout state timeout. In the probing timeout state timeout, the online probing state machine will report “online probing failure” to the user authentication state machine, which means that the terminal may have been offline or the network connection is unstable, and further processing is required.

[0140] As shown in Table 4, the probing termination state disable: when the online probing state machine receives the “stop online probing timer” signal from the user authentication state machine, it will immediately jump to the probing termination state disable regardless of the current probing state. In the probing termination state disable, the current online probing timer and all probing activities are stopped, and the next trigger is waited.

[0141] Figure 5is an optional online detection state machine diagram provided by the embodiment of the present application, as shown in Figure 5 When the terminal is authenticated, the user authentication state machine informs the online detection state machine to start the online detection timer, and the online detection state machine jumps to the detection countdown state waiting. After the online detection timer expires, the online detection state machine jumps from the detection countdown state waiting to the detection implementation state inspecting. The detection state to the timeout state: when the online detection request times out and the detection times reach the maximum detection times, the online detection state machine jumps from the detection implementation state inspecting to the detection timeout state timeout, and reports the online detection failure to the user authentication state machine. Any state to the termination state: when the user authentication state machine sends the “stop online detection timer” instruction, no matter what state the online detection state machine is in, it will immediately jump to the detection termination state disable and stop all detection activities.

[0142] The processing flow of the online detection state machine ensures that whether the authenticated terminal is online can be detected in time. For a user who has not generated network activity for a long time, the network resources occupied by the user can be released in time, so as to improve the resource utilization efficiency and enhance the network security. If the detection fails, corresponding measures can be taken, such as re-authenticating the user or removing the user from the network, to maintain the health state of the network.

[0143] Optionally, Table 5 is a state definition of the silence state machine, including the following 5 states: initialization state initialize, silence statistics state statistics, silence implementation state underway, silence timeout state timeout, and silence termination state disable.

[0144] Table 5

[0145]

[0146]

[0147] Optionally, the silence state machine is responsible for detecting and processing the scenario that the terminal sends too many authentication trigger packets after authentication failure, and the purpose is to prevent potential attacks or unnecessary resource consumption through the silence mechanism.

[0148] Optionally, the initialization state initialize is the starting state of the silence state machine. When the state machine is started or receives the “release silence resource” signal of the user authentication state machine, the silence state machine returns to the initialization state from other states.

[0149] Optionally, statistics state statistics: When the user authentication state machine informs "authentication failure", the silence state machine jumps to the statistics state statistics, and starts to count the number of authentication failures and monitor the time of silence trigger. If the authentication failure statistics count has not reached the silence trigger threshold (i.e. the predetermined retry threshold), or the silence statistics timer has not expired, the silence state machine remains in the statistics state statistics.

[0150] Optionally, silence implementation state underway: When the authentication failure statistics count reaches the threshold and the silence statistics timer has not expired, or when the silence statistics timer expires and the authentication failure statistics count does not reach the threshold, the silence state machine does not jump to the silence implementation state underway. Only when the authentication failure statistics count reaches the silence trigger threshold, and the silence statistics timer also does not expire, the silence state machine jumps from the statistics state statistics to the silence implementation state underway, and starts the implementation of silence. The silence resource is applied until the silence end condition is met.

[0151] Optionally, silence timeout state timeout: When the silence statistics timer expires, but the authentication failure statistics count has not reached the silence threshold, the silence state machine jumps from the statistics state statistics to the silence timeout state timeout. This means that the number of authentication trigger messages sent by the MAC user within a specified time is insufficient to start the silence function, at which time the silence state machine releases the silence resource and jumps to the initialization state initialize.

[0152] Optionally, silence termination state disable: When the user authentication state machine informs "stop silence and statistics", regardless of the current state of the silence state machine, it will immediately jump to the silence termination state disable, the silence resource is released, and the state machine is ready to reset and return to the initial state initialize.

[0153] Figure 6 is an optional silence state machine diagram provided according to an embodiment of the present application, as shown in Figure 6As shown, when authentication fails, the silence state machine jumps from the initialize state to the statistics-in-silence state, and starts counting the number of authentication failures and timing. If the number of authentication failures reaches the threshold and the timing does not expire during the timing, the state machine jumps to the silence-underway state, and implements silence. If the timing expires but the number of authentication failures does not reach the threshold during the timing, the state machine jumps to the timeout state, and ends the silence statistics without implementing silence. When receiving the "stop silence and statistics" instruction of the user authentication state machine, the silence state machine jumps to the disable state regardless of the state, releases silence resources, and resets the state.

[0154] The flow of the above silence state machine ensures that the system can automatically identify and respond to the security risks that may be caused by repeated authentication failures, and limits the activities of malicious or abnormal MAC addresses through the silence mechanism, thereby enhancing the security and efficiency of the entire authentication system.

[0155] Optionally, Table 6 is a state definition of the reauthentication state machine, and there are four states, an initialize state, a waiting-for-reauthentication state, a reauthentication state, and a disable state.

[0156] Table 6

[0157]

[0158] Optionally, the reauthentication state machine maintains the validity and security of the network access permission of the authenticated terminal, mainly including the following stages: initialization, waiting for reauthentication, performing reauthentication, and processing reauthentication results.

[0159] Optionally, the initialize state is the starting state of the reauthentication state machine, and when the reauthentication state machine is started or the reauthentication process ends, it will be in this state to prepare to start a new reauthentication cycle.

[0160] Optionally, the waiting-for-reauthentication state jumps from the initialize state, and the reauthentication state machine starts the reauthentication timer and enters the waiting state. The timer is set to a periodic time interval for determining when to perform authentication checking on the terminal that fails to pass authentication again.

[0161] Optionally, reauthentication in progress state reauthentication: when the reauthentication timer expires, the reauthentication state machine jumps from the reauthentication countdown state waiting to the reauthentication in progress state reauthentication, which triggers the process of sending a reauthentication request to the authentication server to verify the validity of the terminal identity and network access right.

[0162] Optionally, process reauthentication result state: in the reauthentication in progress state reauthentication, the reauthentication state machine waits for the response of the authentication server, and leads to three possible result states: authentication passed access, if the authentication server responds that the authentication is successful, the reauthentication state machine jumps to the authentication passed access state, and the terminal continues to have its network access right, and the reauthentication state machine then returns to the initialization state initialize to prepare for the next reauthentication period. Authentication failed reject, if the authentication server responds that the authentication fails, the reauthentication state machine jumps to the reject state, and the user network access right is revoked, and the reauthentication state machine will inform the user authentication state machine and the authorization behavior state machine to process the authentication failure case. Timeout state timeout, if the response of the authentication server is not received within a specified time, the reauthentication state machine jumps to the timeout state, and the same triggers the processing flow of authentication failure, and the terminal can be temporarily isolated or reauthenticated.

[0163] Optionally, reauthentication termination state disable: whether the reauthentication countdown state waiting receives the instruction to stop reauthentication or the reauthentication in progress state reauthentication fails or times out, the reauthentication state machine jumps to the reauthentication termination state disable, closes the reauthentication timer, stops the ongoing reauthentication process, and waits for the next authentication or reauthentication instruction.

[0164] Optionally, Figure 7 is an optional reauthentication state machine schematic diagram provided according to an embodiment of the present application, as shown in Figure 7As shown, when the re-authentication cycle starts, the re-authentication state machine jumps from the initialize state to the re-authentication countdown state waiting, starting the re-authentication timer. After the timer expires, the state machine jumps from the re-authentication countdown state waiting to the re-authentication state, sending a re-authentication request. After receiving the response from the authentication server, the state machine jumps to the access, reject, or timeout state according to the authentication result. In the access state, the state machine confirms that the user authentication is valid, returns to the initialize state, and prepares for the next cycle. In the reject or timeout state, the state machine notifies the system to handle the authentication failure, and then jumps to the disable state until the next re-authentication instruction.

[0165] The flow design of the re-authentication state machine ensures that even when the network environment or terminal configuration state changes, the terminal that has passed the authentication will periodically re-verify its identity and authority, thereby improving the security and dynamic adaptability of the system. The terminal behavior or network policy updates can be responded to in a timely manner, ensuring that only terminals that meet the current security policy can access network resources.

[0166] Optionally, Table 7 defines the states of the server state machine, which has 7 states, an initialize state initialize, a server idle state idle, a send authentication request state request, an authentication pass state access, an authentication failure state reject, an authentication timeout state timeout, and a stop authentication state abort.

[0167] The role of the server state machine in the MAC address authentication system is to manage the communication and interaction with the authentication server. Its flow design ensures that the initiation of the terminal authentication request, the reception and processing of the authentication result, are orderly and reliable, which will be described in detail below.

[0168] The initialize state initialize is the starting state of the server state machine, which is in this state when it is started or the previous authentication process ends.

[0169] Server idle state idle: When there is no authentication request to be processed, it will jump to the server idle state idle. In the server idle state idle, the server state machine records the reason for the user authentication trigger (such as the type of authentication request received), clears any result markers related to the previous authentication, and prepares to receive a new authentication request.

[0170] Send authentication request state request: When the user authentication state machine sends a "send authentication request" signal to the server state machine, the server state machine jumps from the server idle state idle to the send authentication request state request. In the send authentication request state request, the server state machine generates an authentication request message, sends it to the authentication server, and starts an authentication request timeout timer, and waits for a response from the authentication server.

[0171] Authentication pass state access: If the server state machine receives an authentication pass response sent by the authentication server before the authentication request timeout, the server state machine jumps to the authentication pass state access. In the authentication pass state access, the service state machine informs the user authentication state machine that the authentication is successful, and can start a subsequent authorization process or periodic re-authentication, etc.

[0172] Authentication failure state reject: If the server state machine receives an authentication failure response from the authentication server, the state machine jumps to the authentication failure state reject. In the authentication failure state reject, the server state machine informs the user authentication state machine that the authentication fails, and can trigger the terminal to enter the guest_vlan or perform other failure processing processes.

[0173] Authentication timeout state timeout: If the authentication request timeout timer times out and the service state machine still does not receive a response from the authentication server, jump to the authentication timeout state timeout. In the authentication timeout state timeout, the server state machine informs the user authentication state machine that the authentication times out, and can perform user offline processing, such as adding the user to the critical vlan or performing other timeout processing processes.

[0174] Stop authentication state abort: When the user authentication state machine sends a "stop authentication" signal, regardless of the current state of the server state machine, it will jump to the stop authentication state abort. In the stop authentication state abort, the server state machine closes any authentication request timeout timer that is currently running, and terminates the current communication with the authentication server, in preparation for the next authentication request.

[0175] Table 7

[0176]

[0177]

[0178] Figure 8 An optional server state machine schematic diagram is provided according to an embodiment of the present application, as shown in Figure 8As shown, the server state machine is in the initialization state initialize, waiting for an authentication request. When receiving the "send authentication request" signal of the user authentication state machine, the state machine jumps to the server idle state idle, ready to process the request. Once the authentication request is processed, the server state machine jumps to the send authentication request state request, sends the request and waits for the response. If the authentication request is accepted by the server and returns an authentication pass response before the timeout, the state machine jumps from the send authentication request state request to the authentication pass state access, processing the successful authentication process. If the authentication request returns a failure or error response, the state machine jumps from the send authentication request state request to the authentication failure state reject, processing the failed authentication process. If the authentication request times out, the state machine jumps from the send authentication request state request to the authentication timeout state timeout, processing the timeout authentication process. When receiving the "stop authentication" signal, regardless of the current state, the state machine will jump to the stop authentication state abort, terminating the current authentication attempt, and preparing for the next authentication request.

[0179] The server state machine ensures that the communication with the authentication server is stable and controlled, can accurately and timely respond to the terminal authentication request, and processes the subsequent according to the authentication result. It is a key communication coordination component in the MAC address authentication system.

[0180] The application also provides an optional implementation of a terminal authentication control device, Figure 9 An optional interaction schematic diagram of a terminal authentication control device is provided according to an embodiment of the application, as shown in Figure 9 As shown, applied to the application scenario of MAC address authentication, the terminal authentication control device as the MAC authentication device can be a switch, which on one hand accepts the authentication request of the MAC authentication terminal (i.e. the target terminal), and on the other hand interacts with the authentication server to complete the authentication.

[0181] The MAC authentication terminal as various terminal devices triggers the authentication device responsible for network access control to initiate MAC address authentication by sending ARP / ND / DHCP protocol packets.

[0182] The MAC authentication device as a network access device is the control point of terminal access to the network and the implementer of network security policy, responsible for implementing corresponding access control (allow, reject, isolate or limit) according to the security policy formulated by the user network.

[0183] The authentication server as a key part of the access server (which can also include a management server, a virus library server and a patch server) performs identity authentication, authorization, charging and other work on MAC users by interacting with the MAC authentication device.

[0184] The following describes the main interaction of MAC address authentication: before a MAC authentication terminal attempts to access the network, it will send ARP / ND / DHCP protocol messages in preparation for sending data messages. The MAC authentication device receives these protocol messages and obtains the source MAC address. Since the MAC authentication online user list does not have this MAC user, the authentication device uses the MAC user information to construct an authentication request message and initiates an authentication request to the authentication server. After the authentication server receives the authentication request, it authenticates the MAC user identity according to the information in the administrator-configured user access control list, and sends the authentication result and related authorization information back to the MAC authentication device. After the MAC authentication device receives the server's authentication response, it authorizes the MAC user according to the authentication result and authorization information.

[0185] The MAC authentication terminal implements the authentication interaction function through multiple flow state machines. The above-mentioned MAC authentication terminal can include seven state machines, including a user authentication state machine, an authorization behavior state machine, a delayed authentication state machine, an online detection state machine, a silent state machine, a re-authentication state machine, and a server state machine. By defining the states of the flow state machines and the transition rules between the states, each function of the MAC authentication subdivision can be completed through the combination of several flow state machines. Through the linkage of the input / output between the flow state machines, the collaboration of the MAC authentication subdivision functions is achieved, significantly improving the user authentication efficiency and system reliability.

[0186] The MAC authentication terminal can implement the following authentication auxiliary functions, which can improve the security and reliability of MAC address authentication.

[0187] Hybrid authentication and delayed authentication function: after starting hybrid authentication, MAC address authentication and dot1x can process the authentication request of a user at the same time. The priority of the current dot1x is higher than that of the MAC address authentication, so when hybrid authentication is started, if a MAC user is successfully authenticated by dot1x, the MAC address authentication of the user will not be started, and the already started will be automatically backed off. If it is necessary to start dot1x explicitly, the delayed authentication function of MAC address authentication can be configured. Before the delay time expires, MAC address authentication will always wait, and after the timeout, the authentication process will start.

[0188] Re-authentication function of authenticated users: for a MAC user that has been successfully authenticated, this function periodically initiates authentication to the authentication server with the user information. If the authentication fails or times out, the MAC user will be offline. The purpose of this function is to ensure that after the user authentication information changes (such as changes in the username MAC address format, whether to carry the domain name, fixed password, etc.), or the user configuration of the authentication server changes, the authenticated user can automatically offline without manual cleaning.

[0189] Online detection function for authenticated user: MAC user who has been authenticated successfully, this function will periodically check whether the MAC user has sent a message in this period, if not, it is considered that the detection fails, and the MAC user will be offline. MAC address authentication does not require users to install clients, and it is impossible to determine whether the user is still online through the protocol message interaction between the client and the server. The online detection function can clean up the system resources occupied by the offline user in time.

[0190] Guest-vlan (corresponding to the first local network) and critical-vlan (corresponding to the second local network) functions of MAC address authentication: In the scenario of frequently receiving visitors, or network anomalies, or before the authentication configuration is perfect, in order to give unauthenticated users the necessary network access rights (such as external materials for visitors, system patches and virus libraries), the user who fails to authenticate can be authorized to access the resources deployed in the guest-vlan, and the user who fails to authenticate can be authorized to access the resources deployed in the critical-vlan.

[0191] Silence function of MAC address authentication: If a MAC user sends a large number of MAC authentication trigger protocol messages, the subsequent messages of the same MAC will not be processed after the first packet triggers authentication success or during the authentication timeout waiting period. In addition to the reject message delay sending function supported by some authentication servers, the silence function can also be used to prevent attacks caused by a large number of protocol messages triggering authentication failure. The method is to count the number of authentication failures of a MAC user within a specified time, and if the number is greater than a specified threshold, the protocol messages from the MAC in the next specified time will not trigger MAC authentication.

[0192] Aging function of non-authenticated users: MAC user authentication failure or authentication timeout will be authorized to join the guest-vlan or critical-vlan to support its temporary and emergency resource access requirements, but a large number of non-authenticated MAC users will occupy the system resources of authenticated MAC users if not cleaned up in time. Therefore, this function will start a timer for MAC users entering the guest-vlan or critical-vlan. The MAC user who has not been authenticated successfully after the timer expires will be cleaned up.

[0193] Re-authentication for MAC users within the guest VLAN: Unlike re-authentication for successfully authenticated users, MAC users within the guest VLAN are not yet successfully authenticated. If the system passively waits for users to send protocol messages that trigger authentication, the authentication time for these MAC users will be affected by various factors such as user terminals, network environment, and protocol behavior. Enabling this feature starts a periodic timer when a MAC user fails to authenticate and enters the guest VLAN. The device will automatically initiate an authentication request to the authentication server after the timer expires, without requiring the MAC user to actively send protocol messages again.

[0194] The above functions can be controlled using a state machine. The MAC authentication terminal can be set with 7 process state machines. Table 8 shows the process state machines for MAC address authentication.

[0195] Table 8

[0196]

[0197]

[0198] Figure 10 This is an optional state machine linkage diagram provided according to an embodiment of this application, such as... Figure 10 As shown, the delayed authentication state machine is linked to the user authentication state machine. The user authentication state machine is the core process state machine of the MAC authentication function and is linked to all other process state machines. The authorization behavior state machine is linked to the user authentication state machine, the silent state machine is linked to the user authentication state machine, the re-authentication state machine is linked to the server state machine and the user authentication state machine, the online detection state machine is linked to the user authentication state machine, and the server state machine is linked to the user authentication state machine and the re-authentication state machine.

[0199] The above method demonstrates the connection and data flow between state machines in the MAC authentication terminal. The output of each state machine can become the input of another state machine, forming a closed-loop control system. This linkage mechanism ensures the security and intelligent management of the MAC authentication process.

[0200] In an optional embodiment, this application also provides a terminal identity authentication device, wherein, Figure 11 This is a schematic diagram of an optional terminal identity authentication device according to an embodiment of this application, such as... Figure 11 As shown, the device includes: an authentication unit 1101, a first processing unit 1102, and a second processing unit 1103.

[0201] Optionally, the authentication unit 1101 is configured to authenticate the identity information of the target terminal through a first authentication operation and a second authentication operation, wherein the authentication priority of the first authentication operation is higher than that of the second authentication operation, and the authentication duration of the first authentication operation is longer than that of the second authentication operation; the first processing unit 1102 is configured to trigger a back-off behavior of the second authentication operation when it is detected that the identity information of the target terminal is authenticated successfully through the first authentication operation, wherein the back-off behavior comprises: if it is detected that the second authentication operation has been authenticated, using the authentication result of the first authentication operation to replace the authentication result of the second authentication operation; and ending the second authentication operation that has been started; and the second processing unit 1103 is configured to, when it is detected that the identity information of the target terminal is authenticated unsuccessfully through the first authentication operation, maintain the authentication state of the second authentication operation for the identity information of the target terminal if it is detected that the identity information of the target terminal is authenticated successfully through the second authentication operation.

[0202] The embodiment of the present application provides a nonvolatile storage medium, which stores a program, and the program is executed by a processor to implement the authentication method of terminal identity information.

[0203] The embodiment of the present application provides an electronic device, which comprises a processor, a memory, and a program stored in the memory and executable on the processor, and the processor implements the authentication method of terminal identity information provided by any of the embodiments when executing the program. The device in the present application can be a server, a PC, or the like.

[0204] The present application also provides a computer program product, which is adapted to execute the program initialized with the authentication method steps of terminal identity information provided by any of the embodiments when executed on a data processing device.

[0205] The above are merely embodiments of the present application and are not intended to limit the present application. The present application can have various modifications and changes for those skilled in the art. Any modification, equivalent replacement, improvement, etc. within the spirit and principle of the present application shall be included in the scope of claims of the present application.

Claims

1. A method of authenticating a terminal identity, characterized by, The method comprises: authenticating the identity information of the target terminal through a first authentication operation and a second authentication operation, wherein the authentication priority of the first authentication operation is higher than that of the second authentication operation, and the authentication duration of the first authentication operation is longer than that of the second authentication operation; when it is detected that the identity information of the target terminal is authenticated successfully through the first authentication operation, triggering a backoff behavior of the second authentication operation, wherein the backoff behavior comprises: if it is detected that the second authentication operation has been authenticated, using the authentication result of the first authentication operation to replace the authentication result of the second authentication operation; ending the second authentication operation that has been started; when it is detected that the identity information of the target terminal is authenticated unsuccessfully through the first authentication operation, if it is detected that the identity information of the target terminal is authenticated successfully through the second authentication operation, maintaining the authentication state of the second authentication operation for the identity information of the target terminal.

2. The method of claim 1, wherein, After authenticating the identity information of the target terminal through the first authentication operation and the second authentication operation, the method further comprises: when it is detected that the identity information of the target terminal is authenticated unsuccessfully through the first authentication operation, if it is detected that the identity information of the target terminal is authenticated unsuccessfully through the second authentication operation, determining that the identity information of the target terminal fails in the current round of authentication.

3. The method of claim 1, wherein, authenticating the identity information of the target terminal through a first authentication operation and a second authentication operation, comprising: setting to authenticate the identity information of the target terminal through the first authentication operation at a first time; setting to authenticate the identity information of the target terminal through the second authentication operation at a second time, wherein the first time is earlier than the second time.

4. The method of claim 1, wherein, The method further comprises: in the case that the authentication result of the first authentication operation indicates that the identity information of the target terminal is authenticated unsuccessfully, and the authentication result of the second authentication operation indicates that the identity information of the target terminal is authenticated unsuccessfully or authenticated unsuccessfully, adding the target terminal to a first local area network; in the case that the authentication result of the first authentication operation indicates that the identity information of the target terminal is authenticated unsuccessfully, and the authentication result of the second authentication operation indicates that the identity information of the target terminal is authenticated unsuccessfully or authenticated unsuccessfully, adding the target terminal to a second local area network, wherein the network resources allowed to be accessed by the first local area network are less than the network resources allowed to be accessed by the second local area network; in the case that the authentication result of the second authentication operation indicates that the identity information of the target terminal is authenticated successfully, or the authentication result of the first authentication operation indicates that the identity information of the target terminal is authenticated successfully, adding the target terminal to a third local area network, wherein the network resources allowed to be accessed by the third local area network are more than the network resources allowed to be accessed by the second local area network.

5. The method of claim 4, wherein, The method further comprises: re-authenticating the identity information of the target terminal according to a predetermined retry period, to obtain a re-authentication result; If the target terminal is in the first local area network, and the re-authentication result of the identity information of the target terminal by the first authentication operation is authentication timeout, and the re-authentication result of the identity information of the target terminal by the second authentication operation is authentication timeout or authentication failure, the target terminal is transferred from the first local area network to the second local area network; If the target terminal is in the second local area network, and the re-authentication result of the identity information of the target terminal by the first authentication operation is authentication failure, and the re-authentication result of the identity information of the target terminal by the second authentication operation is authentication timeout or authentication failure, the target terminal is transferred from the second local area network to the first local area network; If the target terminal is in the first local area network or the second local area network, and the re-authentication result of the identity information of the target terminal by the first authentication operation is authentication success, or the re-authentication result of the identity information of the target terminal by the second authentication operation is authentication success, the target terminal is transferred to the third local area network.

6. The method of claim 1, wherein, The method further comprises: The first authentication operation, the second authentication operation and the triggering of the back-off behavior are performed by N state machines, wherein N is an integer greater than 2, the N state machines interact with each other through timer polling timing, and the N state machines at least comprise: a user authentication state machine for managing the authentication state of the identity information of the target terminal; a delayed authentication state machine for controlling the execution time of the first authentication operation and the execution time of the second authentication operation, and determining whether to trigger the back-off behavior of the second authentication operation according to the authentication result of the first authentication operation; a re-authentication state machine for controlling the re-authentication of the identity information, and uploading the authentication result of the re-authentication to the user authentication state machine.

7. The method of claim 6, wherein, The N state machines further comprise at least one of the following state machines: an authorization behavior state machine for determining the local area network corresponding to the target terminal according to the authentication result of the first authentication operation and the authentication result of the second authentication operation; a silent state machine for detecting the number of authentication failures of the identity information of the target terminal within a first predetermined time length, and inhibiting the response to the protocol packet of the target terminal for triggering authentication within a second predetermined time length if the number of authentication failures is greater than a predetermined threshold; an online detection state machine for periodically checking whether the packet sent by the target terminal based on the identity information is received within a preset period if the authentication of the identity information of the target terminal is successful, and determining that the target terminal is in an offline state if the packet is not received within the preset period; a server state machine for sending the authentication request initiated by the re-authentication state machine and / or the user authentication state machine to an authentication server, and returning the response information of the authentication server to the authentication request to the initiator of the authentication request.

8. An authentication apparatus of a terminal identity, characterized by, comprise: An authentication unit is configured to authenticate identity information of a target terminal through a first authentication operation and a second authentication operation, wherein the first authentication operation has a higher authentication priority and a longer authentication duration than the second authentication operation; A first processing unit is configured to trigger a back-off behavior of the second authentication operation when it is detected that the identity information of the target terminal is authenticated successfully through the first authentication operation, wherein the back-off behavior includes: if it is detected that the second authentication operation has been authenticated, using the authentication result of the first authentication operation to replace the authentication result of the second authentication operation; and ending the second authentication operation that has been started; A second processing unit is configured to, when it is detected that the identity information of the target terminal is authenticated unsuccessfully through the first authentication operation, maintain the authentication state of the second authentication operation for the identity information of the target terminal if it is detected that the identity information of the target terminal is authenticated successfully through the second authentication operation.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, wherein the computer program, when executed, causes a device in which the computer readable storage medium is located to perform the terminal identity authentication method in any one of claims 1 to 7.

10. An electronic device, comprising: The device includes one or more processors and a memory configured to store one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to perform the terminal identity authentication method in any one of claims 1 to 7.

Images