Authentication method, apparatus and device, and computer readable storage medium

Abstract

The invention discloses an authentication method, device and equipment and a computer readable storage medium, and belongs to the technical field of communication. The method comprises: in response to an authentication request from a client device, a control device obtains authentication information of the client device, the authentication information comprising any one of access authentication information, resource access authentication information or dual authentication information, the access authentication information being used for performing network access authentication on the client device, and the resource access authentication information being used for performing resource access authentication on the client device; the resource access authentication information is used for performing resource access authentication on the client device, and the dual authentication information is used for performing network access authentication and resource access authentication on the client device; and the control device performs network access authentication and resource access authentication on the client device according to the authentication information to obtain an access authentication result and a resource access authentication result of the client device. The control device obtains the authentication information through one-time interaction with the client device, two kinds of authentication are achieved, and two kinds of authentication results are obtained flexibly and efficiently.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to authentication methods, devices, equipment, and computer-readable storage media. Background Art

[0002] In the field of communication technology, before a client device accesses resources in a network, it must not only pass the network access authentication, but also the resource access authentication corresponding to the resource. Only after passing both authentications can the client device access the network and negotiate to establish a communication tunnel between the client device and the service device providing the resource. The client device then completes access to the resource through the established tunnel. Summary of the Invention

[0003] This application provides an authentication method, apparatus, device, and computer-readable storage medium to improve the flexibility of the authentication process. The technical solution is as follows:

[0004] In a first aspect, an authentication method is provided, the method comprising: in response to an authentication request from a client device, a control device obtains authentication information of the client device, the authentication information comprising any one of access authentication information, resource access authentication information, or dual authentication information, the access authentication information being used to perform network access authentication for the client device, the resource access authentication information being used to perform resource access authentication for the client device, and the dual authentication information being used to perform network access authentication and resource access authentication for the client device; the control device performing network access authentication and resource access authentication for the client device based on the authentication information, thereby obtaining an access authentication result and a resource access authentication result of the client device.

[0005] When a control device receives an authentication request from a client device, the control device can automatically obtain a type of authentication information and, based on the type of authentication information, perform network access authentication and resource access authentication on the client device, thereby obtaining two authentication results: an access authentication result and a resource access authentication result for the client device. This application achieves both authentication results through a single interaction between the control device and the client device, regardless of the type of authentication information obtained. This reduces the interaction cost required for authentication, simplifies the authentication process, and improves the flexibility and efficiency of authentication.

[0006] In one possible implementation, the control device performs network access authentication and resource access authentication on the client device based on the authentication information, thereby obtaining an access authentication result and a resource access authentication result of the client device, including: when the authentication information is access authentication information, the control device performs network access authentication on the client device based on the access authentication information, and obtains an access authentication result; when the access authentication result is that the access authentication is successful, the control device obtains resource access authentication information based on the access authentication information; the control device performs resource access authentication on the client device based on the resource access authentication information, and obtains a resource access authentication result.

[0007] The control device can perform a network access authentication on the client device based on the access authentication information, automatically obtain the resource access authentication information used for resource access authentication, and perform resource access authentication on the client device to obtain two authentication results, which can not only reduce the operations required by the user, but also improve the security and reliability of the authentication through two authentications.

[0008] In one possible implementation, the control device obtains resource access authentication information based on the access authentication information, including: the control device determines resource access registration information based on the access authentication information, and the resource access registration information is information generated by the control device during the process of resource access registration on the client device; the control device generates resource access authentication information based on the resource access registration information and the resource access authentication information template, and the resource access authentication information template includes content requirements and format requirements of the resource access authentication information.

[0009] In this application, resource access authentication information can be efficiently and automatically generated based on resource access registration information and resource access authentication information template to perform resource access authentication, making the authentication process more efficient and flexible.

[0010] In one possible implementation, the control device stores user group information, which includes the user names of each user group; the control device determines resource access registration information based on the access authentication information, including: the control device determines the user name of the client device based on the access authentication information; the control device determines the user group to which the client device belongs based on the user name and user group information of the client device; the control device determines the resource access registration information of the client device based on the resource access registration information corresponding to the user group to which the client device belongs.

[0011] The user name of the client device is determined based on the access authentication information, and then the user group to which the client device belongs is determined, so that the control device can determine the resource access registration information of the client device based on the resource access registration information corresponding to the user group, thereby achieving efficient acquisition of resource access registration information.

[0012] In one possible implementation, an access mapping relationship and a resource access mapping relationship are stored on the control device, where the access mapping relationship is a mapping relationship between the access authentication information of the client device and the first user name used by the client device in the process of access authentication registration, and the resource access mapping relationship is a mapping relationship between the resource access authentication information of the client device and the second user name used by the client device in the process of resource access registration; the control device obtains resource access authentication information based on the access authentication information, including: the control device determines the first user name corresponding to the access authentication information according to the access mapping relationship; the control device determines the second user name of the client device according to the first user name of the client device; the control device determines the resource access authentication information according to the resource access mapping relationship and the second user name.

[0013] The first user name of the client device can be accurately determined based on the access mapping relationship and the access authentication information. Since both the first user name and the second user name have a corresponding relationship with the client device, the second user name can be determined based on the first user name, and the resource access authentication information of the client device can be determined based on the second user name and the resource access mapping relationship, which can make the process of obtaining resource access authentication information simple and efficient.

[0014] In one possible implementation, after obtaining the access authentication result, it also includes: when the access authentication result is access authentication success, the control device determines that the resource access authentication result is resource access authentication success according to the first authentication policy, and when the first authentication policy indicates that the access authentication is successful, the resource access authentication is assumed to be successful.

[0015] According to the instruction of the first authentication policy, when the access authentication is successful, the resource access authentication is assumed to be successful, which can reduce the resource consumption required for authentication, speed up the authentication process, and unify the access authentication result and the resource access authentication result.

[0016] In one possible implementation, the control device performs network access authentication and resource access authentication on the client device based on the authentication information, thereby obtaining an access authentication result and a resource access authentication result of the client device, including: when the authentication information includes resource access authentication information, the control device performs resource access authentication on the client device based on the resource access authentication information, and obtains a resource access authentication result; when the resource access authentication result is that the resource access authentication is successful, the control device obtains access authentication information based on the resource access authentication information; the control device performs network access authentication on the client device based on the access authentication information, and obtains an access authentication result.

[0017] The control device can perform a resource access authentication based on the resource access authentication information, and then automatically obtain the access authentication information for network access authentication and perform network access authentication to obtain two authentication results, which can not only reduce the operations required by the user, but also improve the security and reliability of the authentication through two authentications.

[0018] In one possible implementation, the control device obtains access authentication information based on resource access authentication information, including: the control device determines access registration information based on the resource access authentication information, where the access registration information is information generated by the control device during access registration of the client device; the control device generates access authentication information based on the access registration information and the access authentication information template, where the access authentication information template includes content requirements and format requirements for the access authentication information.

[0019] In this application, access authentication information can be efficiently and automatically generated based on access registration information and access authentication information template to perform network access authentication, making the authentication process more efficient and flexible.

[0020] In one possible implementation, the control device stores user group information, which includes the user names of each user group; the control device determines the access registration information based on the resource access authentication information, including: the control device determines the user name of the client device based on the resource access authentication information; the control device determines the user group to which the client device belongs based on the user name and user group information of the client device; the control device determines the access registration information of the client device based on the access registration information corresponding to the user group to which the client device belongs.

[0021] The user name of the client device is determined based on the resource access authentication information, and then the user group to which the client device belongs is determined, so that the control device can determine the access registration information of the client device based on the access registration information corresponding to the user group, thereby achieving efficient acquisition of access registration information.

[0022] In one possible implementation, an access mapping relationship and a resource access mapping relationship are stored on the control device, where the access mapping relationship is a mapping relationship between the access authentication information of the client device and the first user name used by the client device during the access authentication registration process, and the resource access mapping relationship is a mapping relationship between the resource access authentication information of the client device and the second user name used by the client device during the resource access registration process; the control device obtains the access authentication information based on the resource access authentication information, including: the control device determines the second user name corresponding to the resource access authentication information according to the resource access mapping relationship; the control device determines the first user name of the client device according to the second user name of the client device; the control device determines the access authentication information based on the access mapping relationship and the first user name.

[0023] The second user name of the client device can be accurately determined based on the resource access mapping relationship and the resource access authentication information. Since both the first user name and the second user name have a corresponding relationship with the client device, the first user name can be determined based on the second user name, and the access authentication information of the client device can be determined based on the first user name and the access mapping relationship, which can make the process of obtaining the access authentication information simple and efficient.

[0024] In one possible implementation, after obtaining the resource access authentication result, it also includes: when the resource access authentication result is that the resource access authentication is successful, the control device determines that the access authentication result is that the access authentication is successful according to the second authentication policy, and when the second authentication policy indicates that the resource access authentication is successful, the access authentication is assumed to be successful.

[0025] According to the instruction of the second authentication policy, when the resource access authentication is successful, the access authentication is assumed to be successful, which can reduce the resource consumption required for authentication, speed up the authentication process, and unify the access authentication result and the resource access authentication result.

[0026] In one possible implementation, before the control device obtains the access authentication information based on the resource access authentication information, it also includes: the control device receives a first knocking request sent by the client device, the first knocking request includes the identification information of the client device encrypted by the certificate public key; the control device decrypts based on the private key corresponding to the certificate public key to obtain the identification information of the client device; in response to the release information including the identification information of the client device, the control device sends a knocking success message to the client device, the release information includes the identification information of the client device that has completed registration on the control device, and the knocking success message is used to instruct the client device to send resource access authentication information.

[0027] When the client device knocks successfully, a knock success message is sent to the client device, so that the client device sends resource access authentication information to the control device according to the instruction of the knock success message, thereby enabling the control device to successfully perform authentication according to the resource access authentication information.

[0028] In one possible implementation, the control device performs network access authentication and resource access authentication on the client device based on the authentication information, thereby obtaining the access authentication result and resource access authentication result of the client device, including: when the authentication information includes dual authentication information, the control device performs network access authentication and resource access authentication on the client device respectively based on the dual authentication information, and obtains the access authentication result and resource access authentication result of the client device.

[0029] In this application, dual authentication information can be used for both network access authentication and resource access authentication, thus achieving the unification of access authentication and resource access authentication, thereby reducing resource consumption during the authentication process.

[0030] In one possible implementation, the control device performs network access authentication and resource access authentication on the client device based on the authentication information, thereby obtaining the access authentication result and resource access authentication result of the client device. The method also includes: when both the network access authentication and the resource access authentication are successful, the control device sends a temporary working key of the client device and the address of a resource access verification device to the client device, sends authorization information of the network access authority of the client device to an access device used to control the network access authority of the client device, and sends a temporary working key to the resource access verification device. The resource access verification device is a device between the client device and the server to which the resource to be accessed belongs. The temporary working key and the address of the resource access verification device are used for tunnel negotiation between the client device and the resource access verification device for resource access.

[0031] When access authentication is successful and resource access authentication is successful, the control device authorizes the client device's network access and resource access needs by issuing authorization information, temporary working keys and the address of the resource access verification device, ensuring that the client device can successfully achieve network access and resource access.

[0032] In one possible implementation, the access device and the resource access verification device are deployed on the same device; or, the access device and the resource access verification device are deployed on different devices, and the client device and the resource access verification device are connected via the access device.

[0033] In this application, the access device and the resource access verification device can be deployed on the same device or on different devices. If the access device and the resource access verification device are deployed on different devices, the access device acts as a medium between the client device and the resource access verification device, enabling the client device and the resource access verification device to be connected.

[0034] In one possible implementation, the method also includes: the control device sends the knock key of the resource access verification device to the resource access verification device; the control device sends the knock key of the resource access verification device to the client device, and the knock key of the resource access verification device is used to encrypt the knock information during the process of negotiating the tunnel between the client device and the resource access verification device.

[0035] By encrypting the knock information with the knock key of the resource access verification device, the client device and the resource access verification device can perform encrypted interaction to ensure the security of the interaction.

[0036] In a second aspect, an authentication device is provided, which includes: a first acquisition module for obtaining authentication information of the client device in response to an authentication request from the client device, the authentication information including any one of access authentication information, resource access authentication information or dual authentication information, the access authentication information is used to perform network access authentication for the client device, the resource access authentication information is used to perform resource access authentication for the client device, and the dual authentication information is used to perform network access authentication and resource access authentication for the client device; a second acquisition module for performing network access authentication and resource access authentication for the client device based on the authentication information, thereby obtaining an access authentication result and a resource access authentication result of the client device.

[0037] In one possible implementation, the second acquisition module is used to, when the authentication information is access authentication information, perform network access authentication on the client device based on the access authentication information to obtain an access authentication result; when the access authentication result is that the access authentication is successful, obtain resource access authentication information based on the access authentication information; and perform resource access authentication on the client device based on the resource access authentication information to obtain a resource access authentication result.

[0038] In one possible implementation, the second acquisition module is used to determine resource access registration information based on access authentication information; based on the resource access registration information and the resource access authentication information template, the resource access registration information is information generated by the control device during the process of resource access registration of the client device, and the resource access authentication information is generated, and the resource access authentication information template includes content requirements and format requirements of the resource access authentication information.

[0039] In one possible implementation, the control device stores user group information, which includes user names of each user group; a second acquisition module is used to determine the user name of the client device based on the access authentication information; determine the user group to which the client device belongs based on the user name and user group information of the client device; and determine the resource access registration information of the client device based on the resource access registration information corresponding to the user group to which the client device belongs.

[0040] In one possible implementation, an access mapping relationship and a resource access mapping relationship are stored on the control device, where the access mapping relationship is a mapping relationship between the access authentication information of the client device and the first user name used by the client device in the process of access authentication registration, and the resource access mapping relationship is a mapping relationship between the resource access authentication information of the client device and the second user name used by the client device in the process of resource access registration; a second acquisition module is used to control the device to determine the first user name corresponding to the access authentication information based on the access mapping relationship; determine the second user name of the client device based on the first user name of the client device; and determine the resource access authentication information based on the resource access mapping relationship and the second user name.

[0041] In one possible implementation, the device also includes a determination module, which is used to determine that the resource access authentication result is a resource access authentication success according to the first authentication policy when the access authentication result is a successful access authentication, and the resource access authentication success is assumed to be successful when the first authentication policy indicates that the access authentication is successful.

[0042] In one possible implementation, the second acquisition module is used to, when the authentication information includes resource access authentication information, perform resource access authentication on the client device based on the resource access authentication information to obtain a resource access authentication result; when the resource access authentication result is that the resource access authentication is successful, obtain access authentication information based on the resource access authentication information; and perform network access authentication on the client device based on the access authentication information to obtain an access authentication result.

[0043] In one possible implementation, the second acquisition module is used to determine the access registration information based on the resource access authentication information; generate the access authentication information based on the access registration information and the access authentication information template, the access registration information is the information generated by the control device during the access registration process of the client device, and the access authentication information template includes the content requirements and format requirements of the access authentication information.

[0044] In one possible implementation, the control device stores user group information, which includes user names of each user group; a second acquisition module is used to determine the user name of the client device based on resource access authentication information; determine the user group to which the client device belongs based on the user name and user group information of the client device; and determine the access registration information of the client device based on the access registration information corresponding to the user group to which the client device belongs.

[0045] In one possible implementation, an access mapping relationship and a resource access mapping relationship are stored on the control device, where the access mapping relationship is a mapping relationship between the access authentication information of the client device and the first user name used by the client device during the access authentication registration process, and the resource access mapping relationship is a mapping relationship between the resource access authentication information of the client device and the second user name used by the client device during the resource access registration process; a second acquisition module is used to determine the second user name corresponding to the resource access authentication information based on the resource access mapping relationship; determine the first user name of the client device based on the second user name of the client device; and determine the access authentication information based on the access mapping relationship and the first user name.

[0046] In one possible implementation, the determination module is further used to determine, when the resource access authentication result is resource access authentication success, the access authentication result is access authentication success according to the second authentication policy, and when the second authentication policy indicates that the resource access authentication is successful, the access authentication is assumed to be successful.

[0047] In one possible implementation, the control also includes a knock verification module, which is used to receive a first knock request sent by a client device, the first knock request including the identification information of the client device encrypted with the certificate public key; decrypt the identification information of the client device based on the private key corresponding to the certificate public key; in response to the release information including the identification information of the client device, send a knock success message to the client device, the release information including the identification information of the client device that has completed registration on the control device, and the knock success message is used to instruct the client device to send resource access authentication information.

[0048] In one possible implementation, the second acquisition module is configured to, when the authentication information includes dual authentication information, perform network access authentication and resource access authentication on the client device according to the dual authentication information, and obtain access authentication results and resource access authentication results of the client device.

[0049] In one possible implementation, the device also includes an authorization module, which is used to send a temporary working key of the client device and the address of a resource access verification device to the client device when both the network access authentication and the resource access authentication are successful, send authorization information of the network access authority of the client device to an access device used to control the network access authority of the client device, and send a temporary working key to the resource access verification device. The resource access verification device is a device between the client device and the server to which the resource to be accessed belongs. The temporary working key and the address of the resource access verification device are used for tunnel negotiation between the client device and the resource access verification device for resource access.

[0050] In one possible implementation, the access device and the resource access verification device are deployed on the same device; or, the access device and the resource access verification device are deployed on different devices, and the client device and the resource access verification device are connected via the access device.

[0051] In one possible implementation, the authorization module is also used to send the knock key of the resource access verification device to the resource access verification device; the control device sends the knock key of the resource access verification device to the client device, and the knock key of the resource access verification device is used to encrypt the knock information during the process of negotiating the tunnel between the client device and the resource access verification device.

[0052] In a third aspect, another communication device is provided, comprising: a network interface, a memory, and a processor. The network interface, the memory, and the processor communicate with each other via an internal connection path. The memory is configured to store instructions, and the processor is configured to execute the instructions stored in the memory to control the network interface to receive signals and to control the network interface to send signals. When the processor executes the instructions stored in the memory, the processor performs the method of the first aspect or any possible implementation of the first aspect.

[0053] Optionally, there are one or more processors and one or more memories.

[0054] Optionally, the memory may be integrated with the processor, or the memory may be provided separately from the processor.

[0055] In a fourth aspect, an authentication system is provided, which includes the device in the above-mentioned second aspect or any possible implementation of the second aspect.

[0056] In a fifth aspect, a computer program (product) is provided, which includes: computer program code, which, when run by a computer, enables the computer to execute the method in the above-mentioned first aspect or any possible implementation of the first aspect.

[0057] In a sixth aspect, a computer-readable storage medium is provided, which stores a program or instruction. When the program or instruction runs on a computer, the method in the above-mentioned first aspect or any possible implementation of the first aspect is executed.

[0058] In the seventh aspect, a chip is provided, comprising a processor for calling and executing instructions stored in a memory from a memory, so that a computer equipped with the chip executes the method in the above-mentioned first aspect or any possible implementation of the first aspect.

[0059] In an eighth aspect, another chip is provided, comprising: an input interface, an output interface, a processor and a memory, wherein the input interface, the output interface, the processor and the memory are connected through an internal connection path, and the processor is used to execute the code in the memory. When the code is executed, a computer equipped with the chip executes the method in the above-mentioned first aspect or any possible implementation of the first aspect.

[0060] It should be understood that the beneficial effects achieved by the technical solutions of the second to eighth aspects of this application and the corresponding possible implementation methods can be found in the above-mentioned technical effects of the first aspect and its corresponding possible implementation methods, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 A schematic diagram of an access authentication architecture provided for related technologies;

[0062] Figure 2 An implementation scenario diagram provided for an embodiment of the present application;

[0063] Figure 3 A flowchart of an authentication method provided in an embodiment of the present application;

[0064] Figure 4 A schematic diagram of a network access authentication process provided in an embodiment of the present application;

[0065] Figure 5 Another implementation scenario diagram provided for an embodiment of the present application;

[0066] Figure 6 A schematic diagram of a campus network scenario provided in an embodiment of the present application;

[0067] Figure 7 A schematic diagram of another campus network scenario provided in an embodiment of the present application;

[0068] Figure 8 A schematic diagram of relevant information of a trusted client device provided in an embodiment of the present application;

[0069] Figure 9 A schematic diagram of the structure of an authentication device provided in an embodiment of the present application;

[0070] Figure 10 A schematic diagram of the composition of a client device provided in an embodiment of the present application;

[0071] Figure 11 A schematic diagram of the composition of a resource verification device (Internet of Things gateway) provided in an embodiment of the present application;

[0072] Figure 12 A schematic diagram of the composition of a data platform provided in an embodiment of the present application;

[0073] Figure 13 A schematic diagram of the composition of an application system provided in an embodiment of the present application;

[0074] Figure 14 A schematic diagram of the structure of an authentication device provided in an embodiment of the present application;

[0075] Figure 15 A schematic diagram of the structure of another authentication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0076] The terms used in the implementation section of this application are only used to explain the specific embodiments of this application and are not intended to limit this application.

[0077] With the development of communication technology, various security threats such as viruses, Trojans, and network attacks in communication networks are also increasing. The degree and scope of damage caused by various security threats to networks continues to expand, easily causing network system crashes or network paralysis. For example, when users browse certain websites through their terminals, malware such as Trojan programs may be automatically downloaded to the terminal. When the user then accesses other networks through the terminal, the malware can spread to devices in other networks, thus creating serious security risks.

[0078] To reduce and avoid various security threats in communication networks, the field of communication technology generally uses authentication to perform security control on user access and connection establishment processes in communication networks, thereby protecting the security of communication networks. Different authentication requirements and scenarios require different authentication methods and architectures. For example, when performing security control on the user access process, a network admission control (NAC) architecture and corresponding authentication methods can be used for authentication. By performing security control on users accessing the network and the terminals used by users, terminal security status and network access control are combined. Furthermore, through inspection, isolation, reinforcement, and auditing technologies, the terminal's active defense capabilities are enhanced, thereby improving the security of the terminal and the network to which the terminal belongs.

[0079] See also Figure 1, showing a schematic diagram of a NAC architecture provided by the relevant technology. The access device and the terminal are connected to each other by wired or wireless means, and the access device and the access server are connected through the Internet. Among them, the access device can also be called an access device or a network access device. The access device is a network control point for the terminal to access the network, which is used to control the network access of the terminal. The access server is also called an access server. The access server includes but is not limited to an access control server, a management server, a virus database server and a patch server. The access server can perform user identity authentication, terminal security checks, etc. The terminal can be various types of end-side devices. For example, terminal 1 represents a laptop computer, terminal 2 represents a desktop computer, and terminal 3 represents a mobile video phone and other devices. The terminal is installed with client software that runs based on the client program. The terminal can interact with the user through the client software to perform authentication.

[0080] Under the NAC architecture, access servers can authenticate users using their registered usernames and passwords, performing network access authentication (also known as access authentication). This allows for security control of network users and the terminals they use, ensuring the security of these terminals. Furthermore, in addition to access authentication, in the communications technology field, resource access authentication is also used to securely control the connection between terminals and resource-providing servers, preventing them from accessing insecure resources through insecure connections and further improving the security of communications networks.

[0081] In related technologies, network access authentication and resource access authentication are two separate processes. Therefore, users need to log in and go online for both authentications separately. The terminal initiates two different authentication requests to the control device, and interacts with it two or more times to complete both authentications. This technology suffers from issues such as the need for users to log in repeatedly, cumbersome user operations, a poor user experience, and a complex and inflexible authentication process.

[0082] The embodiment of the present application provides an authentication method, which can avoid users from repeatedly going online, reduce the user's operation steps, and thus improve the user experience. In addition, the authentication process of this method is simple, efficient, and flexible.

[0083] For example, see Figure 2 , shows a schematic diagram of an implementation scenario provided by an embodiment of the present application, which can support the authentication method provided by an embodiment of the present application. Figure 2As shown, the implementation scenario includes a control device 11 and a client device 12. The control device 11 and the client device 12 can be connected to each other via wired or wireless communication. One control device 11 can be connected to multiple client devices 12, and one client device 12 can also be connected to multiple control devices 11.

[0084] The client device 12 may be a device with authentication requirements, such as a terminal device such as a computer or a mobile phone, or an endpoint detection and response (EDR) device. Alternatively, the client device 12 may be a hardware component, a software component, or a combination of hardware and software components on a device with authentication requirements. For example, the client device 12 may be a hardware component such as a network card or a central processing unit (CPU) on the terminal device, or client software for authentication installed on the terminal device, or a combination of a CPU and client software for authentication.

[0085] The control device 11 can be a device that can perform authentication based on authentication information, such as a device such as a controller or an authentication server, or a hardware component such as a chip or processor on the device, a software component such as authentication control software, or an authentication system. In the embodiment of the present application, the number of control devices 11 can be one or more. If the number of control devices 11 is multiple, the composition and function of different control devices 11 can be different. For example, if the control device 11 includes two servers, the two servers can perform different types of authentication respectively, that is, one server performs network access authentication, and the other server performs resource access authentication. The two servers can achieve communication connection through wired and wireless means, and the two servers run together to implement the authentication method provided in the embodiment of the present application.

[0086] See also Figure 3 , shows a flow chart of an authentication method, which includes but is not limited to the following S201 to S202.

[0087] S201, in response to an authentication request from a client device, the control device obtains authentication information of the client device, the authentication information includes any one of access authentication information, resource access authentication information or dual authentication information, the access authentication information is used to perform network access authentication for the client device, the resource access authentication information is used to perform resource access authentication for the client device, and the dual authentication information is used to perform network access authentication and resource access authentication for the client device.

[0088] The access authentication information includes information required for the control device to perform network access authentication. For example, the access authentication information may be the username and password used by the client device during access registration on the control device. In some cases, the access authentication information may include information specified by an access authentication protocol or access authentication framework supported by the control device. For example, if the access authentication protocol supported by the control device is the 802.1X protocol, the access authentication information may include information specified by the 802.1X protocol, including the username used by the client device during access registration and a non-plaintext password encrypted with a random code.

[0089] The resource access authentication information includes information required for the control device to perform resource access authentication. For example, the resource access authentication information may include the Internet Protocol (IP) address of the client device. In some cases, the content of the resource access authentication information may be the content specified by the resource access authentication protocol or resource access authentication framework supported by the control device. For example, if the resource access authentication framework supported by the control device is the Zero Trust security framework of the software-defined perimeter (SDP), the content of the resource access authentication information may be the content specified by the Zero Trust security framework of the SDP, including the identifier (ID) of the client device encrypted by the temporary working key of the client device, etc.

[0090] In one possible implementation, the dual authentication information may be information obtained by combining the access authentication information and the resource access authentication information, and the dual authentication information includes the access authentication information and the resource access authentication information. Alternatively, the dual authentication information may be information obtained by screening and calculating the access registration information and the resource access registration information. For example, the dual authentication information may include an encrypted username obtained by encrypting the username that completed the resource access registration (referred to as the resource access registration username) based on the username that completed the access registration (referred to as the access registration username), and an encrypted password obtained by encrypting the password used by the client device during the resource access registration process (referred to as the resource access registration password) based on the password used by the client device during the access registration process (referred to as the access registration password); accordingly, the dual authentication information may also include an encrypted username obtained by encrypting the access registration based on the resource access registration username, and an encrypted password obtained by encrypting the access registration password based on the resource access registration password. The resource access registration username and the access registration username may be the same or different, and the resource access registration password and the access registration password may be the same or different, and this embodiment of the present application does not limit this.

[0091] Optionally, the dual authentication information may further include encryption role information, which is used to indicate the types of the encrypted registered user name and the encrypted registered user name in the process of obtaining the encrypted user name, and to indicate the types of the encrypted registration password and the encrypted registration password. For example, if the dual authentication information includes encrypting the access registered user name based on the resource access registered user name to obtain the encrypted user name, then the type of the encrypted registered user name is the resource access registered user name, and the type of the encrypted registered user name is the access registered user name. Therefore, the encryption role information is information that can indicate that the encrypted registered user name is the resource access registered user name and the type of the encrypted registered user name is the access registered user name.

[0092] The embodiment of the present application does not limit the form and content of the encrypted role information. For example, the form of the encrypted role information can be A1~B1-A2~B2, where A1 is the type of encrypted registered user name, B1 is the type of encrypted registered user name, A2 is the type of encrypted registration password, and B2 is the type of encrypted registration password.

[0093] The embodiments of the present application do not limit the manner or type of authentication information that the control device obtains from the client device. The control device can obtain the authentication information by receiving an authentication request from the client device. For example, before the control device obtains the authentication information, the client device sends an authentication request to the control device. Thereafter, the client device obtains the authentication information in response to receiving the authentication request from the client device.

[0094] In one possible implementation, the authentication request sent by the client device to the control device may include authentication information of the client device. For example, if this is the first time the client device sends an authentication request to the control device, the authentication request sent by the client device may include the authentication information of the client device, so that the control device can obtain the authentication information of the client device from the authentication request and subsequently perform authentication based on the authentication information of the client device. For example, if the authentication information is access authentication information, the client device may send an authentication request including the access authentication information by sending an Extensible Authentication Protocol (EAP) message or an Address Resolution Protocol (ARP) message to the control device.

[0095] In some cases, if authentication information includes multiple elements, the client device may send the multiple elements to the control device in multiple separate messages. For example, if the authentication information is access authentication information, and the access authentication information includes two elements: a username and a password used for access registration, the client device may send two separate messages to the control device, one message containing the username and the other containing the password. For another example, if the authentication information includes three elements, the client device may send the three elements to the control device in two separate messages, or three separate messages. In other words, the number of elements in the authentication information may be the same as or different from the number of times the client device sends messages to the control device.

[0096] Optionally, the authentication request sent by the client device to the control device may not include the client device's authentication information, but instead include read instruction information, which is used to instruct the control device to read the client device's authentication information from at least one authentication information stored by the control device. For example, during the initial authentication process based on the client device's authentication information, the control device may store the client device's authentication information. Therefore, if the client device is disconnected after passing authentication, when the client device initiates authentication again, it may not repeatedly send an authentication request including the authentication information to the control device, but instead send an authentication request including the read instruction information, allowing the control device to read the client device's authentication information based on the read instruction information.

[0097] In one possible implementation, the read instruction information of the client device includes reference information that can correspond to the authentication information of the client device. The reference information can be a portion of the authentication information of the client device. For example, if the authentication information includes four elements: the username, password, IP address, and ID of the client device, the reference information can include the username and password elements, but not the IP address and ID elements. Alternatively, the reference information can include the IP address of the client device, but not the other three elements.

[0098] In addition, the read instruction information also includes key information that can instruct the control device to perform an authentication information reading action. The key information can be information in the form of a set flag or the like. The set flag can be identification information of a specified position in the read instruction information. If the identification information of the position is 1, it means that the read instruction information carries key information. If the identification information of the position is 0, it means that the read instruction information does not carry key information. Accordingly, the control device is configured with a read strategy that can instruct the control device to read the authentication information of the client device according to the read instruction information when the read instruction information is received. For example, after receiving the authentication request, the control device determines whether the authentication request includes key information. If the authentication request includes key information, it is determined that the authentication request includes the read instruction information and the read strategy is hit. The control device then performs the action of reading the authentication information in accordance with the read strategy, and completes the authentication information reading operation of the client device according to the reference information in the read instruction information.

[0099] Optionally, the authentication request may further include a type identifier for the authentication information, which is used by the control device to obtain different types of authentication information according to the type identifier. This allows the control device to select an authentication method that matches the type of authentication information based on the type identifier and perform authentication, thereby ensuring the accuracy of the authentication result. For example, if the type identifier for access authentication information is 1, the type identifier for resource access authentication information is 2, and the type identifier for dual authentication information is 3, then if the authentication request received by the control device includes type identifier 1, the client device can determine, based on type identifier 1, that the type of authentication information to be obtained is access authentication information.

[0100] In the embodiment of the present application, regardless of whether the authentication request sent by the client device includes authentication information or read instruction information, during a single authentication request by the client device, the client device only needs to send one type of authentication request, which is sufficient for the control device to obtain two authentication results based on that one type of authentication request. Therefore, this method can reduce the complexity of user operations, eliminating the need for users to request authentication multiple times and avoiding users having to log in repeatedly.

[0101] S202: The control device performs network access authentication and resource access authentication on the client device according to the authentication information, thereby obtaining an access authentication result and a resource access authentication result of the client device.

[0102] In the embodiments of the present application, the control device obtains different types of authentication information, and the methods for obtaining access authentication results and resource access authentication results for the client device based on the authentication information vary. Below, using Cases 1 to 3 as examples, we will describe the process and method for performing network access authentication and resource access authentication on a client device based on different types of authentication information, and obtaining access authentication results and resource access authentication results.

[0103] Case 1: The authentication information is access authentication information.

[0104] In situation 1, the control device performs network access authentication and resource access authentication on the client device based on the authentication information, thereby obtaining an access authentication result and a resource access authentication result of the client device, including: the control device performs network access authentication on the client device based on the access authentication information, and obtains an access authentication result; when the access authentication result is that the access authentication is successful, the control device obtains resource access authentication information based on the access authentication information; the control device performs resource access authentication on the client device based on the resource access authentication information, and obtains a resource access authentication result.

[0105] The embodiment of the present application does not limit the manner in which the client device performs network access authentication based on the access authentication information. For example, the control device may perform network access authentication in accordance with the manner of network access authentication specified by the supported access authentication protocol or framework. Figure 4 The network access authentication process diagram shown in FIG. 1 illustrates a method for performing network access authentication on a client device based on access authentication information.

[0106] See also Figure 4 When a user needs to access the network, they enter their previously registered username and password through the 802.1X client program on their client device, initiating a connection request between the client device and the control device. The client device then sends an authentication request frame to the access device to which it is connected, initiating an authentication process. The authentication request frame can be in the format specified by the Extensible Authentication Protocol over Local Area Networks (EAPoL).

[0107] In the embodiment of the present application, the access device may be: Figure 1 The access device shown in the figure may also be a partial hardware component, a software component, or a combination of hardware and software components on the access device. The type of access device may be a switch (SW), such as a local area network switch (LSW), or the access device may be any device that can support access to a wireless local area network (WLAN).

[0108] After receiving the authentication request frame sent by the client device, the access device returns an identity type request frame (for example, an EAP-Request / Identity frame) to the client device. The request frame is used to request a user name and instruct the relevant client program to send the user name entered by the user to the access device.

[0109] Continue to see Figure 4 After the client device receives an identity-type request frame, the client program on the client device responds to the identity-type request frame and adds the user name to the identity-type response frame. Afterwards, the client device sends an identity-type response frame (for example, an EAP-Response / Identity frame) to the access device. The access device encapsulates the EAP message in the received identity-type response frame into a remote authentication dial in user service (RADIUS) message (for example, a RADIUS access-request message), and then sends the RADIUS message to the control device for authentication processing. The user name in the RADIUS message is an element of the access authentication information.

[0110] The control device obtains the username in the RADIUS message, compares the username with the username list in the database, determines the password corresponding to the username, and then encrypts the password using a randomly generated message digest algorithm 5 challenge (MD5 Challenge) to obtain the encrypted password. The MD5 Challenge is then sent to the access device via a RADIUS Access-Challenge message.

[0111] The access device forwards the MD5 Challenge message to the client device via an EAP-Request / MD5 Challenge message. After receiving the MD5 Challenge message sent by the access device, the client device encrypts the password using the MD5 Challenge message to obtain the encrypted password, generates an EAP-Response / MD5Challenge message including the encrypted password, and sends the EAP-Response / MD5 Challenge message including the encrypted password to the access device.

[0112] The access device encapsulates the EAP-Response / MD5 Challenge message in a RADIUS Access-Request message and sends it to the control device. The encrypted password in the EAP-Response / MD5 Challenge message is another element in the access authentication information. The control device receives the username and encrypted password sent by the client device through the access device, thereby obtaining the username and encrypted password elements of the access authentication information.

[0113] The control device compares the received encrypted password with the locally calculated encrypted password and determines the access authentication result based on the comparison result. For example, if the comparison result shows that the encrypted password received by the control device is the same as the encrypted password calculated by the control device, the access authentication result can be determined to be successful. If the comparison result shows that the encrypted password received by the control device is different from the encrypted password calculated by the control device, the access authentication result can be determined to be unsuccessful.

[0114] In some cases, the process of implementing network access authentication through interaction between a control device and a client device based on access authentication information can also be referred to as the process of the control device obtaining compliance check items required for access by the client device and reporting the results of the compliance check items to the client device. The compliance check items are the information in the access authentication information, and the check results are the access authentication results.

[0115] The above process of performing network access authentication on a client device based on access authentication information is merely an example. In the embodiments of the present application, regardless of the method used to perform network access authentication on the client device, if the access authentication result obtained is a successful access authentication, the control device can further obtain resource access authentication information to continue resource access authentication, thereby obtaining a resource access authentication result. The embodiments of the present application do not limit the method by which the control device obtains resource access authentication information. Optionally, the method may include but is not limited to the acquisition method shown in the following case 11 or case 12.

[0116] Case 11: The control device determines the resource access registration information according to the access authentication information; the control device generates the resource access authentication information according to the resource access registration information and the resource access authentication information template.

[0117] The resource access registration information of the client device may be information generated by the control device during the resource access registration process of the client device. The resource access registration information may include, for example, a user name and password used by the client device during the resource access registration process.

[0118] The embodiments of the present application do not limit the method by which the control device generates resource access registration information. For example, the control device may receive a resource access registration request sent by a client device, and then obtain the user name and password of the client device based on the resource access registration request, and generate resource access registration information. Optionally, the control device may assign a user name and password to the client device, or the control device may send a user name and password request to the client device and receive the user name and password sent by the client device to obtain the user name and password of the client device. After obtaining the user name and password of the client device, the control device may generate resource access registration information including the user name and password to record relevant information about the resource access registration of the client device.

[0119] In an embodiment of the present application, a method for the control device to determine resource access registration information based on access authentication information may include but is not limited to the following situation 111 or situation 112.

[0120] Scenario 111: The control device stores user group information, which includes the user names of each user group. In scenario 111, the control device can determine the user name of the client device based on the access authentication information; determine the user group to which the client device belongs based on the user name and user group information of the client device; and determine the resource access registration information of the client device based on the resource access registration information corresponding to the user group to which the client device belongs.

[0121] Among them, a user group refers to a collection of a group of users with the same attributes. The attributes of the users can be, for example, the role of the users in the network, the user permissions, the geographical location of the users, or the user type. The control device can divide the users into different user groups according to the attributes of the users of the client devices. After the control device completes the division of the user groups, the user group information of each user group can be stored. One user group corresponds to one user group information, and one user group information includes the user name of each user in the user group corresponding to the user group information. Therefore, the control device can determine the user group to which the client device belongs based on the user name of the client device, and then accurately determine the resource access registration information of the client device in the resource access registration information corresponding to the user group.

[0122] The embodiments of the present application do not limit the manner in which the control device determines the user name of the client device based on the access authentication information. For example, if the access authentication information includes the user name of the client device, the control device can obtain the user name of the client device by reading the access authentication information. If the access authentication information does not include the user name of the client device but includes identification information of the client device, and the user name used by the client device for access registration and resource access registration is the same, the control device can determine the access registration information used for access registration based on the identification information, determine the user name in the access registration information, and thereby obtain the user name of the client device.

[0123] After determining the user name of the client device, the user group to which the user name belongs can be determined based on the user group information. The control device can then retrieve the resource access registration information corresponding to the user group and determine the resource access registration information of the client device from the resource access registration information corresponding to the user group.

[0124] Furthermore, the control device can determine the user group to which the client device belongs not only based on the client device's username but also based on other information in the access authentication information. For example, if the client device's access authentication information includes the client device's IP address, the control device can determine the client device's geographic location based on the client device's IP address, and further determine the user group to which the geographic location belongs. This user group is the user group to which the client device belongs.

[0125] Case 112: The access authentication information includes identification information of the client device, and the control device stores resource access registration information of the client device, which includes the identification information of the client device.

[0126] The identification information of the client device is information that can distinguish different client devices. For example, the identification information of the client device can be information such as the ID of the client device, the IP address of the client device, or the device serial number of the device to which the client device belongs.

[0127] Since the resource access registration information includes the identification information of the client device, and the access authentication information also includes the identification information of the client device, the control device can determine the resource access registration information that also includes the identification information of the client device in the resource access registration information stored on the control device based on the identification information of the client device in the access authentication information.

[0128] The authentication method provided in the embodiment of the present application can generate resource access authentication information based on resource access registration information and a resource access authentication information template. Therefore, before the control device generates resource access authentication information based on the resource access registration information and the resource access authentication information template, the control device can first obtain the resource access authentication information template. Optionally, the control device can autonomously generate the resource access authentication information template, for example, based on resource access authentication information received from other client devices, or based on resource access authentication requirements. In addition, the staff can also configure the resource access authentication information template on the control device based on experience or resource access authentication requirements.

[0129] In one possible implementation, the resource access authentication information template may include content requirements and format requirements for the resource access authentication information. The content requirements may include the types of elements included in the resource access authentication information, such as one or more of a username, password, client device identification information, or a random key. The format requirements may include the location of each element in the resource access authentication information or whether each element is encrypted.

[0130] In this implementation, after obtaining the resource access registration information, the control device may determine the elements in the resource access registration information and determine the elements that meet the content requirements. Based on the elements that meet the content requirements and the format requirements, the control device may generate resource access authentication information that conforms to the resource access authentication information template. For example, if the content requirements of the resource access authentication information template include elements of the type of user name, password, and random key, and the format requirements require that the user name and password be encrypted with the random key, the control device may obtain the user name and password from the resource access registration information, generate a random key, encrypt the user name and password based on the random key, and obtain the encrypted user name and password to generate the resource access authentication information.

[0131] Case 12: The control device stores an access mapping relationship and a resource access mapping relationship. The access mapping relationship is a mapping relationship between the access authentication information of the client device and the first information, and the resource access mapping relationship is a mapping relationship between the resource access authentication information of the client device and the second information. In Case 12, the control device obtains the resource access authentication information based on the access authentication information, including: the control device determines the first information corresponding to the access authentication information based on the access mapping relationship; the control device determines the second information of the client device based on the first information of the client device; and the control device determines the resource access authentication information based on the resource access mapping relationship and the second information.

[0132] The first information of the client device may be any information that can be associated with the access authentication information of the client device. For example, the first information may include one or more elements in the access authentication information, allowing the control device to associate the first information with the access authentication information. Correspondingly, the second information may be any information that can be associated with the resource access authentication information of the client device. For example, the second information may include one or more elements in the resource access authentication information, allowing the control device to associate the second information with the resource access authentication information.

[0133] Optionally, a mapping relationship exists between the first information and the second information, enabling the control device to determine the second information based on the first information, or to determine the first information based on the second information. For example, the first information may be a first username used by the client device during access registration, and the second information may be a second username used by the client device during resource access registration. The first and second usernames may be the same or may have a specific relationship. For example, the first and second usernames may include the same identifier, and the identifier may be different for each client device. Alternatively, both the first and second information may be identification information of the client device.

[0134] An access mapping relationship can indicate a correspondence between first information and access authentication information of a client device. For example, the access mapping relationship can be represented by a table or line corresponding to the first information and the access authentication information. A resource access mapping relationship can indicate a correspondence between second information of a client device and resource access authentication information of the client device. The resource access mapping relationship can also be represented by a table or line corresponding to the second information and the resource access authentication information. The resource access mapping relationship and the access mapping relationship can be in the same or different form, and this is not limited in the embodiments of the present application.

[0135] The control device may obtain the access mapping relationship and the resource access mapping relationship in various ways. In one possible implementation, the client device may generate the access mapping relationship and the resource access mapping relationship based on historical authentication information, the first information, and the second information of the client device. The historical authentication information refers to authentication information obtained by the control device during a previous authentication process of the client device.

[0136] Taking the example of a control device generating a resource access mapping relationship through historical authentication information, the control device can first obtain historical authentication information of the type of resource access authentication information and the second information of the client device respectively, and then generate a resource access mapping relationship based on the historical authentication information of the type of resource access authentication information and the second information of the client device.

[0137] In the process of the control device obtaining historical authentication information of the type of resource access authentication information, the control device can receive an authentication request sent by the client device at a historical moment, and the authentication request includes historical authentication information of the type of resource access authentication information, or the control device can also generate historical authentication information of the type of resource access authentication information based on the resource access registration information and the resource access authentication information template.

[0138] When the control device obtains the second information of the client device, it may receive the second information sent by the client device to the control device, or, if the historical authentication information includes the second information of the client device, obtain the second information of the client device from the historical authentication information.

[0139] After the control device obtains historical authentication information of the resource access authentication information type and the second information of the client device, it can generate a resource access mapping relationship between the second information of the client device and the resource access authentication information. The method for the control device to generate an access mapping relationship using historical authentication information can refer to the method for the control device to generate a resource access mapping relationship using historical authentication information, and will not be repeated here.

[0140] Furthermore, after the control device completes the acquisition of the access mapping relationship and the resource access mapping relationship, it can store the access mapping relationship and the resource access mapping relationship, so that in the subsequent authentication process, the access authentication information or the resource access authentication information can be determined according to the access mapping relationship and the resource access mapping relationship, thereby improving the efficiency of obtaining the access authentication information or the resource access authentication information, and thereby improving the authentication efficiency.

[0141] In one possible implementation, since the access mapping relationships stored by the control device may include mapping relationships between access authentication information of multiple client devices and first information, the control device can determine the mapping relationship to which the currently received access authentication information belongs from the multiple mapping relationships included in the access mapping relationships, and then determine the first information corresponding to the currently received access authentication information. Thereafter, the control device can determine the second information of the client device based on the relationship between the first information and the second information. Correspondingly, the resource access mapping relationship may also include mapping relationships between resource access authentication information of multiple client devices and second information. The control device can determine the resource access authentication information corresponding to the second information based on the second information from the multiple mapping relationships included in the resource access mapping relationships.

[0142] For example, if the first information is the client device ID, the access mapping relationship is the mapping relationship between the access authentication information and the client device ID. If the second information is the client device IP address, the resource access mapping relationship is the mapping relationship between the resource access authentication information and the client device IP address. After receiving the access authentication information, the control device determines the client device ID in the access mapping relationship based on the access authentication information, then searches for the client device IP address based on the client device ID, and determines the client device's resource access authentication information in the resource access mapping relationship, thereby obtaining the resource access authentication information.

[0143] The mapping relationship between the client device ID and the client device IP address can be obtained by the control device during the client device's access registration or resource access registration process. For example, the control device can parse a message carrying an access registration request sent by the client device to obtain the source IP address of the access registration request and the ID of the client device that sent the access registration request. The source IP address is the IP address of the client device.

[0144] In another possible implementation, the control device may only store the access mapping relationship and resource access mapping relationship of the client device that sends the current access authentication information. In this implementation, the control device can more efficiently determine the resource access authentication information of the client device based on the access mapping relationship and resource access mapping relationship, thereby further improving the authentication efficiency.

[0145] Both Cases 11 and 12 described above involve obtaining resource access authentication information from a client device when the access authentication result is a successful access authentication. Obtaining the resource access authentication information from the client device can be used to control the device to perform resource access authentication based on the resource access authentication information, thereby obtaining a resource access authentication result. The present embodiment of the application does not limit the method and process for performing resource access authentication based on resource access authentication information. For instructions and examples regarding performing resource access authentication based on resource access authentication information, please refer to the relevant description in Case 2 below, which will not be elaborated on in detail here.

[0146] In an embodiment of the present application, in addition to being able to obtain resource access authentication information according to the methods exemplified by Cases 11 and 12 above, and performing resource access authentication based on the obtained resource access authentication information to obtain resource access authentication results, resource access authentication results can also be obtained through other methods. For example, after obtaining the access authentication result, the control device can also determine that the resource access authentication result is a resource access authentication success according to the first authentication policy when the access authentication result is an access authentication success, and the resource access authentication is assumed to be successful when the first authentication policy indicates that the access authentication is successful. The process of determining that the resource access authentication result is a resource access authentication success according to the first authentication policy is the process of the control device performing resource access authentication on the client device.

[0147] The first authentication policy can be configured on the control device by a staff member based on experience or authentication requirements, or can be generated autonomously by the control device. For example, the control device can generate the first authentication policy based on historical authentication records. Historical authentication records can be information recorded by the control device when performing historical authentication on a client device. Historical authentication records can include identification information of the client device and historical access authentication results and resource access authentication results for historical authentication of the client device. If the historical access authentication result for any client device is access authentication success, and the resource access authentication result for that client device is resource access authentication success, a first authentication policy corresponding to that client device can be generated.

[0148] In this embodiment of the present application, if the client device's access authentication result is access authentication success, the control device can, in accordance with the instructions of the first authentication policy, default the client device's resource access authentication result to resource access authentication success. This method can further improve the efficiency of the control device in obtaining registration authentication results and resource access authentication results, thereby improving authentication efficiency and reducing the number of interactions between the client device and the control device, thereby conserving interaction resources.

[0149] Case 2: The authentication information is resource access authentication information.

[0150] In situation 2, the control device performs network access authentication and resource access authentication on the client device based on the authentication information, thereby obtaining an access authentication result and a resource access authentication result of the client device, including: when the authentication information includes resource access authentication information, the control device performs resource access authentication on the client device based on the resource access authentication information, and obtains a resource access authentication result; when the resource access authentication result is that the resource access authentication is successful, the control device obtains access authentication information based on the resource access authentication information; the control device performs network access authentication on the client device based on the access authentication information, and obtains an access authentication result.

[0151] In one possible implementation, the control device performs resource access authentication through the resource access authentication service port. Therefore, before the control device obtains the resource access authentication information, the client device can knock through the knocking port of the control device, so that the control device opens the resource access authentication service port to ensure the smooth execution of the resource access authentication.

[0152] In this implementation, the control device can receive a first knock request sent by the client device, the first knock request including the identification information of the client device encrypted with the certificate public key; the control device decrypts the identification information of the client device based on the private key corresponding to the certificate public key; in response to the release information including the identification information of the client device, the control device sends a knock success message to the client device, the release information including the identification information of the client device that has completed registration on the control device, and the knock success message is used to instruct the client device to send resource access authentication information.

[0153] Before the client device knocks on the control device and after the client device completes resource access registration, the control device will send a certificate public key to the client device for the client device to encrypt the knocking packet. The certificate public key can be the certificate public key of the control device.

[0154] Taking the example of a client device performing UDP knocking through the User Datagram Protocol (UDP) knocking port of a control device, during the process of the client device knocking, the client device sends a first knocking request to the control device. The first knocking request includes a knocking package encrypted with the certificate public key. The knocking package contains the ID of the client device (such as the terminal ID) and user identity information (or user authentication information). The user identity information is, for example, the user name and password used by the client device in the process of resource access authentication and registration.

[0155] After receiving the first knock request sent by the client device, the control device decrypts the encrypted knock package in the first knock request according to the private key corresponding to the certificate public key, obtains an unencrypted knock package, and obtains the ID of the client device from the unencrypted knock package. The control device checks whether the ID of the client device has been stored in the release information. If the ID of the client device has been stored in the release information, the control device can open the resource access authentication service port for the client device, so that the client device performs resource access authentication through the resource access authentication service port; if the ID of the client device is not stored in the release information, the control device can verify the knock package according to the authentication method in the knock package. In response to the verification of the knock package being passed, the control device adds the ID of the client device to the release information and opens the resource access authentication service port for the client device.

[0156] The release information may be in the form of a release list, storing identification information of each client device that has completed resource access registration through the control device. The client device identification information in the release information may be the client device ID or the client device IP. If the client device identification information in the knock packet sent by the client device is the client device ID, and the release information stores the client device IP, the control device may first determine the client device IP based on the client device ID, and then confirm whether the client device identification information is stored in the release information based on the client device IP.

[0157] After the control device opens the resource access authentication service port and starts the resource access authentication service, the control device sends a knock success message to the client device, instructing the client device to send an authentication request to the resource access authentication service port of the control device. In some cases, when the client device is unable to connect to the SDP authentication service, that is, after the client device sends the first knock request and does not receive the knock success message, the client device can continuously send the first knock request to the control device according to the knock cycle until it receives the knock success message and stops sending the first knock request, so as to avoid the problem that the control device cannot receive the first knock request due to network packet loss, which causes the client device to be unable to complete the knock.

[0158] The successful knock information may include the address of the resource access authentication service port of the control device. Therefore, the client device can send an authentication request to the resource access authentication service port based on the address of the resource access authentication service port. In response to receiving the authentication request from the client device, the control device obtains resource access authentication information. The method for obtaining resource access authentication information by the control device can be similar to the method for obtaining access authentication information by the control device, and will not be further described here.

[0159] The process of the control device granting resource access to the client device based on the resource access authentication information may include: if the resource access authentication information includes identification information of the client device, the control device searches for the identification information of the client device in the release information; if the identification information of the client device matches the identification information in the release information, the result of the resource access authentication is that the resource access authentication is successful. Conversely, if the identification information of the client device does not match the identification information in the release information, the result of the resource access authentication is that the resource access authentication fails.

[0160] After completing resource access authentication, if the resource access authentication is successful, the control device can further obtain access authentication information to perform network access authentication for the client device based on the access authentication information. The embodiment of the present application does not limit the method by which the control device obtains access authentication information. Optionally, the method by which the control device obtains access authentication information may include, but is not limited to, the methods shown in the following cases 21 and 22.

[0161] Case 21: The control device determines the access registration information according to the resource access authentication information; the control device generates the access authentication information according to the access registration information and the access authentication information template.

[0162] In the embodiment of the present application, the method in which the control device determines the access registration information according to the resource access authentication information includes situation 211 or situation 212.

[0163] Scenario 211: The control device stores user group information, which includes the user names of each user group. In scenario 211, the control device determines the user name of the client device based on the resource access authentication information; determines the user group to which the client device belongs based on the user name and user group information of the client device; and determines the access registration information of the client device based on the access registration information corresponding to the user group to which the client device belongs.

[0164] For the description of the user group and the user group information, please refer to the description of the user group and the user group information in the above situation 111, which will not be repeated here.

[0165] The embodiments of the present application do not limit the manner in which the control device determines the user name of the client device based on the resource access authentication information. For example, if the resource access authentication information includes the user name of the client device, the control device can obtain the user name of the client device by reading the resource access authentication information. If the resource access authentication information does not include the user name of the client device, but includes identification information of the client device, and the user name used by the client device for access registration and resource access registration is the same, the control device can determine the resource access registration information for resource access registration based on the identification information, determine the user name in the resource access registration information, and thereby obtain the user name of the client device.

[0166] After determining the user name of the client device, the user group to which the user name belongs can be determined based on the user group information. The control device can then retrieve the access registration information corresponding to the user group and determine the access registration information of the client device in the access registration information.

[0167] Furthermore, the control device can determine the user group to which the client device belongs not only based on the client device's username but also based on other information in the resource access authentication information. For example, if the client device's resource access authentication information includes the client device's user type, the control device can determine the user group corresponding to the user type based on the client device's user type. This user group is the user group to which the client device belongs.

[0168] Case 212: The resource access authentication information includes identification information of the client device, and the control device stores access registration information of the client device, which includes the identification information of the client device.

[0169] In situation 212, the control device obtains access authentication information based on the resource access authentication information, including: the control device determines access registration information according to the identification information of the client device; the control device generates access authentication information according to the access registration information and the access authentication information template.

[0170] For the description of the identification information of the client device, please refer to the description of the identification information of the client device in situation 112, and will not be repeated here. Since the access registration information includes the identification information of the client device, and the resource access authentication information also includes the identification information of the client device, the control device can determine the access registration information that also includes the identification information of the client device from the access registration information stored on the control device based on the identification information of the client device in the resource access authentication information.

[0171] The authentication method provided in the embodiments of the present application can generate access authentication information based on access registration information and an access authentication information template. Therefore, before the control device generates access authentication information based on the access registration information and the access authentication information template, the control device can first obtain the access authentication information template. Alternatively, the control device can autonomously generate the access authentication information template, for example, based on access authentication information received from other client devices, or based on access authentication requirements. Furthermore, the access authentication information template can be configured on the control device by staff based on experience or access authentication requirements.

[0172] In one possible implementation, the access authentication information template may include content requirements and format requirements for the access authentication information. The content requirements may include the types of elements included in the access authentication information, such as one or more of a username, password, client device identification information, or a random key. The format requirements may include the location of each element in the access authentication information or whether each element is encrypted.

[0173] In this implementation, after obtaining the access registration information, the control device may determine the elements in the access registration information and determine the elements that meet the content requirements. Based on the elements that meet the content requirements, the control device may generate access authentication information that conforms to the access authentication information template. For example, if the content requirements of the access authentication information template include elements of the client device identification information and a random key, and the format requirements require that each element not be encrypted, the control device may obtain the client device identification information from the access registration information, generate a random key, and generate the access authentication information based on the client device identification information and the random key.

[0174] Scenario 22: The control device stores an access mapping relationship and a resource access mapping relationship. The access mapping relationship is a mapping relationship between the access authentication information of the client device and first information, and the resource access mapping relationship is a mapping relationship between the resource access authentication information of the client device and second information, where the first information corresponds to the second information. In Scenario 22, the control device obtains access authentication information based on the resource access authentication information, including: the control device determines the second information corresponding to the resource access authentication information based on the resource access mapping relationship; the control device determines the first information of the client device based on the second information of the client device; and the control device determines the access authentication information based on the access mapping relationship and the first information.

[0175] Case 22 corresponds to Case 12. The control device first determines the second information corresponding to the resource access authentication information based on the resource access authentication information and the resource access mapping relationship. Because the second information also has a mapping relationship with the first information, the control device can determine the corresponding first information based on the second information. After determining the first information, the control device determines the access authentication information corresponding to the first information from the access mapping relationship, thereby obtaining the access authentication information of the client device.

[0176] In addition, corresponding to the manner in which the control device obtains the resource access authentication result according to the first authentication policy, in an embodiment of the present application, when the resource access authentication result is a successful resource access authentication, the control device may also determine the access authentication result as a successful access authentication according to the second authentication policy. When the second authentication policy indicates a successful resource access authentication, the access authentication is assumed to be successful. In an embodiment of the present application, the process of obtaining the second authentication policy and the control device determining the access authentication result according to the second authentication policy can refer to the process of obtaining the first authentication policy and the control device determining the resource access authentication result according to the first authentication policy, and will not be repeated here. Accordingly, the process of determining that the access authentication result is a successful access authentication according to the second authentication policy is the process by which the control device performs network access authentication on the client device.

[0177] Case 3: The authentication information is double authentication information.

[0178] In situation 3, the control device performs network access authentication and resource access authentication on the client device based on the authentication information, thereby obtaining the access authentication result and resource access authentication result of the client device, including: when the authentication information includes dual authentication information, the control device performs network access authentication and resource access authentication on the client device respectively based on the dual authentication information, and obtains the access authentication result and resource access authentication result.

[0179] In the embodiments of the present application, the dual authentication information includes different contents, and the control device uses different methods to perform network access authentication and resource access authentication on the client device based on the dual authentication information. Below, using Cases 31 and 32 as examples, the process and principles of the control device performing network access authentication and resource access authentication based on dual authentication information with different contents are explained.

[0180] Case 31: Dual authentication information includes access authentication information and resource access authentication information.

[0181] In scenario 31, the control device can identify the access authentication information and the resource access authentication information from the dual authentication information, and perform network access authentication based on the access authentication information to obtain an access authentication result, and perform resource access authentication based on the resource access authentication information to obtain a resource access authentication result. The methods for the control device to perform network access authentication for the client device based on the access authentication information and to perform resource access authentication for the client device based on the resource access authentication information can be found in the previous description and are not further described here.

[0182] The embodiments of the present application do not limit the manner in which the control device identifies access authentication information and resource access authentication information from the dual authentication information. For example, if the dual authentication information includes independent access authentication information and resource access authentication information, and the dual authentication information includes location information that can indicate the location of the access authentication information in the dual authentication information, and location information that can indicate the location of the resource access authentication information in the dual authentication information, the control device can identify the access authentication information and resource access authentication information in the dual authentication information according to the two types of location information.

[0183] For another example, if the dual authentication information does not include independent access authentication information and resource access authentication information, but includes various elements within the access authentication information and resource access authentication information, the control device can filter and identify the dual authentication information according to the resource access authentication information template and the access authentication information template to obtain the access authentication information and resource access authentication information.

[0184] For example, the dual authentication information includes four elements: the identification information, user name, password and random key of the client device. The access authentication information template requires that the content of the access authentication information be the identification information, user name and password of the client device, and the format requires that each element does not need to be encrypted. The control device can then filter the elements in the dual authentication information, identify the identification information, user name and password of the client device, and obtain the access authentication information of the client device; the resource access authentication information template requires that the content of the resource access authentication information be the user password and random key of the client device, and the format requires that each element does not need to be encrypted. The control device can then filter the elements in the dual authentication information, identify the user name, password and random key of the client device, and obtain the resource access authentication information of the client device.

[0185] Case 32: The dual authentication information includes information screened and calculated based on the access registration information and the resource access registration information.

[0186] In situation 32, the control device can determine part of the information in the access registration information and part of the information in the resource access registration information based on the dual authentication information, and perform network access authentication and resource access authentication based on part of the information in the access registration information and part of the information in the resource access registration information to obtain the access authentication result and the resource access authentication result.

[0187] In an embodiment of the present application, the control device can obtain part of the information in the access registration information and part of the information in the resource access registration information based on the dual authentication information in different ways. Taking the dual authentication information including the encrypted username obtained by encrypting the access registration username based on the resource access registration username of the client device, the encrypted password obtained by encrypting the access registration password based on the resource access registration password of the client device, and the encrypted role information as an example, the control device can decrypt the dual authentication information according to the encrypted role information to obtain the access registration username, resource access registration username, access registration password, and resource access registration password. The encrypted registration username, encrypted registration username, encrypted registration password, and type of the encrypted registration password can also be determined based on the encrypted role information. Afterwards, the control device extracts the resource access registration username, resource access registration password, access registration username, and access registration password of the client device from the resource access registration information and access registration information of the client device stored in the control device.

[0188] When performing network access authentication and resource access authentication based on part of the information in the access registration information and part of the information in the resource access registration information, network access authentication can be directly performed on part of the information in the access registration information, and resource access authentication can be performed on part of the information in the resource access registration information to obtain access authentication results and resource access authentication results.

[0189] For example, the control device can encrypt the access registration password using the resource access registration password and encrypt the access registration username using the resource access registration username according to the encrypted role information, thereby obtaining an encrypted password and an encrypted username. If the encrypted username autonomously calculated by the control device is the same as the encrypted username in the received authentication information, and the encrypted password autonomously calculated by the control device is the same as the encrypted password in the received authentication information, then the access authentication result can be determined as access authentication success, and the resource access authentication result can be determined as resource access authentication success. If the encrypted username and encrypted password autonomously calculated by the control device differ from the encrypted username and encrypted password in the authentication information in at least one case, then the access authentication result can be determined as access authentication failure, and the resource access authentication result can be determined as resource access authentication failure.

[0190] In addition, in the process of performing network access authentication and resource access authentication based on partial information in the access registration information and partial information in the resource access registration information, it is also possible to first generate access authentication information based on partial information in the access registration information, and generate resource access authentication information based on the resource access registration information, and then perform network access authentication and resource access authentication based on the access authentication information and resource access authentication information to obtain access authentication results and resource access authentication results.

[0191] Among them, the process of generating access authentication information based on part of the information in the access registration information and the process of generating resource access authentication information based on part of the information in the resource access registration information, as well as the process of performing network access authentication based on the access authentication information and performing resource access authentication based on the resource access authentication information can all refer to the descriptions in the above-mentioned case 1 and case 2, and will not be repeated here.

[0192] Regardless of the method used to obtain the access authentication result and resource access authentication result of the client device, in the embodiment of the present application, access authentication authorization and resource access authentication authorization can be performed simultaneously on the legitimate user according to the access authentication result and resource access authentication result, so as to efficiently perform subsequent network access authorization and tunnel negotiation processes.

[0193] Exemplarily, when both the network access authentication and the resource access authentication are successful, the control device sends a temporary working key of the client device and the address of the resource access verification device to the client device, sends authorization information of the network access authority of the client device to the access device used to control the network access authority of the client device, and sends a temporary working key to the resource access verification device. The resource access verification device is a device between the client device and the server to which the resource to be accessed belongs. The temporary working key and the address of the resource access verification device are used for tunnel negotiation between the client device and the resource access verification device for resource access.

[0194] The resource access verification device may be a device with resource access verification or resource access control functions, or a software component, hardware component, or a combination of hardware and software components of the device. The resource access verification device may be, for example, a gateway, or a device with gateway-like functions.

[0195] In a possible implementation, the access device and the resource access verification device can be deployed on the same device. Figure 5 In the implementation scenario shown, a resource access verification device and an access device are deployed on device 1. In this implementation scenario, a client device can be connected to device 1, and a control device can also be connected to device 1. By interacting with device 1, the client device can interact with the access device and the resource access verification device.

[0196] In another possible implementation, the access device and the resource access device are deployed on different devices, and the client device and the resource access verification device are connected via the access device. Figure 6 In the implementation scenario shown, the access device is deployed on device 2 and the resource access verification device is deployed on device 3. Device 2 is located between the client device and device 3. The client device is connected to the access device on device 2, and the access device on device 2 is connected to the resource access verification device on device 3. Figure 6 In the illustrated implementation scenario, the control device can interact with the access device by interacting with device 2, and the control device can interact with the resource access verification device by interacting with device 3. The client device can interact with the access device by interacting with device 2, but the client device cannot interact directly with the resource access verification device or device 3 and must interact indirectly with the resource access verification device or device 3 through the access device or device 2.

[0197] Continue to see Figure 4 Continuing with the EAP relay authentication process as an example, a portion of the authorization process will be described. The control device sending authorization information regarding the client device's network access rights to the access device may include: the control device sending an authentication pass message (e.g., a RADIUS Access-Accept message) to the access device, with the authentication pass message carrying the authorization information. Upon receiving the authentication pass message, the access device sends an authentication success frame (EAP-Success) to the client device and changes the access device's port to an authorized state, allowing the client device to access the network through the authorized port.

[0198] Furthermore, after a user logs online through an authorized port, the access device can periodically send handshake request messages (also known as monitoring messages) to the client device based on a handshake timer to monitor the user's online status. The handshake request message period can be configured using the dot1x timer arp-detect command (a message configuration command). After receiving the handshake request message, the client device sends a handshake response message to the access device, indicating that the user is still online. If the access device fails to receive a response from the client device after two consecutive handshake messages, the client device logs the logged-in user offline to prevent the access device from being unaware of the user's abnormal offline behavior. The client device can then send an EAPOL-Logoff frame to the access device to proactively request a logoff. The access device changes the port state from authorized to unauthorized and sends an EAP-Failure message to the client device, notifying it of the change.

[0199] Accordingly, after determining that the resource access authentication of the client device is successful, the control device returns resource access information to the client device, enabling the client device to obtain the resource access information. The resource access information includes, but is not limited to, the resource access authentication result, information about the accessible resources of the client device (e.g., the IP address of the server to which the accessible resources belong or the uniform resource locator (URL) of the accessible resources), the IP address of the SDP resource access verification device accessible to the client device, the knock key of the SDP resource access verification device accessible to the client device (e.g., a gateway knock key (gw-knkey)), and the temporary working key of the client device (also known as a user temporary key, a user knock key (knkey), or a user identity certificate). All of this information can be used by the client device and the resource access verification device for tunnel negotiation.

[0200] Optionally, the resource information accessible to the client device can be determined based on the user group to which the client device belongs. The control device can determine the user group to which the client device belongs, and determine the accessible resource information corresponding to the user group as the accessible resource information of the client device.

[0201] In addition, when both the access authentication and the resource access authentication are successful, the control device sends the knock key of the resource access verification device to the resource access verification device; the control device sends the knock key of the resource access verification device to the client device, and the knock key of the resource access verification device is used to encrypt the knock information during the process of negotiating the tunnel between the client device and the resource access verification device.

[0202] Each resource access verification device has its own knock key, which is used to verify the knock information received by the resource access verification device. The knock key for each resource access verification device is generated by the control device, which then sends the generated knock key to each resource access verification device, allowing each resource access verification device to obtain the corresponding knock key.

[0203] After completing resource access authentication for the client device, the control device not only sends information for tunnel negotiation to the client device, but also sends information for tunnel negotiation to the corresponding resource access verification device, so that the client device and the resource access verification device can conduct tunnel negotiation based on this information. For example, the control device may send relevant information about the trusted client device to the resource access verification device, including identification information of the trusted client device, a temporary working key of the trusted client device, and accessible resource information (e.g., an accessible address) of the trusted client device.

[0204] Taking tunnel negotiation based on SDP as an example, when a user initiates an access request for accessible resources on a client device, the client device sends a knocking message to the resource access verification device. The knocking information can be carried in the first handshake message used to establish a transmission control protocol (TCP) connection. The first handshake message includes a synchronization request (SYN) packet, and in the custom options of the SYN packet, carries the knocking information encrypted with the knocking key of the resource access verification device. The knocking information includes the identification information of the client device.

[0205] The resource access verification device receives the first handshake message sent by the client device, obtains the encrypted knock information from it, and verifies the knock information. For example, the resource access verification device decrypts the knock information using the resource access verification device's knock key to obtain the client device's identification information contained in the knock information. The resource access verification device then searches for relevant information about the trusted client device to determine whether the client device's identification information matches that of the trusted client device. If so, the resource access verification device determines that the preliminary verification is successful. After the preliminary verification is successful, the resource access verification device returns a second handshake message to the client device, notifying the client device of the successful knock on the first packet. Furthermore, the resource access verification device may include volatile information such as an initial sequence number (ISN) or a timestamp of the second handshake message in the second handshake message to ensure more accurate tunnel negotiation between the resource access verification device and the client device. Furthermore, the resource access verification device also determines the client device's temporary working key from the relevant information about the trusted client device based on the client device's identification information for subsequent verification.

[0206] After receiving the second handshake message sent by the resource access verification device, the client device returns a third handshake message to the resource access verification device to complete the establishment of the TCP connection between the client device and the resource access verification device. On the basis of completing the TCP connection between the client device and the resource access verification device, the client device again sends a knock message to the resource access verification device, for example, sending a client hello message for a transport layer security (TLS) handshake to the resource access verification device, and again carrying the knock message in the options of the message. The knock message is encrypted with the temporary working key of the client device, and the knock message includes the identification information of the client device. Optionally, the knock message may also include volatile information returned by the resource access verification device when establishing the TCP connection.

[0207] The resource access verification device re-verifies the received knock information based on the client device's temporary working key. For example, the resource access verification device decrypts the knock information to obtain the client device's identification information in the knock information, and re-determines whether the client device's identification information matches the identification information of the trusted client device. If the client device's identification information matches the identification information of the trusted client device, the verification passes, and the client device is allowed to establish a tunnel through a Hypertext Transfer Protocol (HTTP) connection, thereby allowing the client device to access TCP or UDP intranet resources through the tunnel.

[0208] In some cases, the tunnel negotiation process between the client device and the resource access verification device is a two-way encrypted communication process. The resource access verification device can not only determine whether the client device meets the compliance requirements based on information such as the temporary working key issued by the control device, but can also remotely query the control device to determine whether the client device meets the compliance requirements, thereby determining whether to continue the tunnel negotiation between the resource access device and the client device. In addition, if the compliance check result of the client device changes, the control device sends a compliance check result change notification to the resource access verification device, which includes updated relevant information about the trusted client device, so that the resource access verification device refreshes the relevant information about the trusted client device stored locally in the resource access verification device based on the updated relevant information about the trusted client device. The resource access verification device performs resource access verification based on the updated relevant information about the trusted client device, thereby controlling the tunnel negotiation based on the result of the resource access verification and ensuring the accuracy of the tunnel negotiation.

[0209] After the client device establishes a tunnel with the server to which the resource to be accessed belongs, the client device can access the resource through the tunnel. The resources that the client device can access include the resources of various applications under the browser / server (B / S) architecture and the resources of various applications under the client / server (C / S) architecture. Among them, when the client device accesses the resources of various applications under the B / S architecture, it can access the resources through a browser. For example, it can log in to the education (EDU) wireless network through a browser and then access the resources in the EDU wireless network. When the client device accesses the resources of various applications under the C / S architecture, it needs to install the client software and the corresponding environment before it can access the resources in the server. For example, the client device can access the resources in the server under the C / S architecture through the dial-up software installed on the client device.

[0210] In addition, since the resources to be accessed by the client device may belong to a different network from the client device, the network to which the resources to be accessed belong also has a corresponding gateway. The client device can achieve cross-network communication with the server to which the resources belong through the resource access verification device and the gateway of the network to which the resources to be accessed belong, thereby achieving access to the resources by the client device.

[0211] In order to make the description of the authentication method provided in the embodiment of the present application more detailed, the following is combined with Figure 6 and Figure 7 Two implementation scenarios are used to illustrate two possible authentication processes.

[0212] See also Figure 6 , shows a schematic diagram of a campus network scenario provided by an embodiment of the present application. In this scenario, the control device is a campus controller (i.e., an SDP controller) for managing the campus network. The campus controller supports an authentication system that can implement the authentication method provided by an embodiment of the present application. The client device is an SDP client, the access device is a network access device, and the resource access verification device is an SDP access gateway. Appendix Figure 6 The situation 2 (authentication information is resource access authentication information) introduced in the above method embodiment is illustrated by way of example.

[0213] In step 61 , the campus controller generates a knock key for each registered SDP access gateway and sends the generated knock key to the SDP access gateway.

[0214] In step 62, the SDP client performs UDP knocking on the campus controller to ask the campus controller to open the authentication service port.

[0215] In step 63, the SDP client sends an authentication request to the campus controller. After obtaining the authentication information, the campus controller performs user authentication on the SDP client. User authentication includes network access authentication and resource access authentication. After successful authentication, the SDP client obtains a list of accessible resources, the address of the SDP access gateway, the SDP access gateway's knock key, and the SDP client's temporary working key.

[0216] In step 641, after the user successfully goes online (user authentication is passed and the user is deemed to have successfully gone online), the campus controller will send the temporary working key generated for each online user to the SDP access gateway, and may also send other relevant information of the trusted client device corresponding to the SDP client.

[0217] In step 642, after the user successfully goes online, authorization information is sent to the corresponding network access device to authorize the access rights of the SDP client.

[0218] In step 65, the SDP client knocks using the knock information carried in the custom option of SYN, wherein the knock information includes the ID of the SDP client, and the knock information is encrypted using the knock key of the SDP access gateway.

[0219] In step 66, the SDP access gateway verifies the knock information using the knock key of the SDP access gateway. After verification, the temporary working key corresponding to the SDP client can be found in the relevant information of the trusted client device based on the ID of the SDP client obtained by decryption.

[0220] In step 67, after the first packet passes the knock (i.e., after the verification in step 66 is passed), the SDP client sends the knock information again. This knock information, encrypted with the SDP client's temporary working key, is carried in the TLS options of the client hello message of the TLS handshake. This knock information includes the SDP client's ID and may also include volatile information (such as a sequence number or timestamp) returned by the SDP access gateway during tunnel negotiation. The volatile information can be used to prevent replay attacks.

[0221] In step 68, the SDP access gateway verifies the knock information again using the temporary working key of the SDP client, and allows the establishment of the tunnel connection to continue only after the verification is passed.

[0222] In step 69, the SDP client establishes a tunnel through HTTP connect and accesses the TCP / UDP intranet resource through the tunnel. When the SDP client accesses the TCP / UDP intranet resource, the SDP client can access the gateway and the gateway of the network to which the resource to be accessed belongs through the SDP access gateway ( Figure 6 The gateway for SDP access gateway connection is represented in the figure), which realizes cross-network communication with the server to which the resource to be accessed belongs, thereby realizing the access of the SDP client to the resource to be accessed. Among them, the resource to be accessed can be Figure 6 The resources corresponding to B / S application 1, C / S application 1 and C / S application 2 are shown in FIG.

[0223] See also Figure 7 , shows a schematic diagram of another campus network scenario provided by an embodiment of the present application, the composition of this scenario is similar to Figure 6 The components of the scenarios shown are the same, but the authentication methods performed within the scenarios are partially different. Figure 7 The situation 1 (authentication information is access authentication information) introduced in the above method embodiment is illustrated as an example.

[0224] In step 71 , the campus controller generates a knock key for each registered SDP access gateway and sends it to the SDP access gateway.

[0225] In step 72, the SDP client sends EAP messages, ARP messages, and other messages to the network access device to trigger campus access authentication, thereby sending an authentication request. Campus access authentication is a network access authentication used to access the campus network.

[0226] In step 731 , the network access device sends a RADIUS message to the campus controller for authentication.

[0227] In step 732, the user is authenticated (including network access authentication and resource access authentication), and the SDP client obtains the accessible resource list, the SDP access gateway address, the knock key of the SDP access gateway, and the temporary working key of the SDP client.

[0228] In step 741, after the user successfully goes online (user authentication is passed and the user is deemed to have successfully gone online), the campus controller will send the temporary working key generated for each online user to the SDP access gateway, and may also send other relevant information of the trusted client device corresponding to the SDP client.

[0229] In step 742, after the user successfully goes online, authorization information is sent to the corresponding network access device to authorize the access rights of the SDP client.

[0230] In step 75, the SDP client knocks using the knock information carried in the custom option of SYN, wherein the knock information includes the ID of the SDP client, and the knock information is encrypted using the knock key of the SDP access gateway.

[0231] In step 76, the SDP access gateway verifies the knock information using the knock key of the SDP access gateway. After verification, the temporary working key corresponding to the SDP client can be found in the relevant information of the trusted client device based on the ID of the SDP client obtained by decryption.

[0232] In step 77, after the first packet knock passes (i.e., after the verification in step 76 passes), the SDP client sends the knock information again. This knock information, encrypted with the SDP client's temporary working key, is carried in the TLS options of the client hello message of the TLS handshake. This knock information includes the SDP client's ID and may also include volatile information (such as a sequence number or timestamp) returned by the SDP access gateway during tunnel negotiation. The volatile information can be used to prevent replay attacks.

[0233] In step 78, the SDP access gateway verifies the knock information again using the temporary working key of the SDP client, and allows the establishment of the tunnel connection to continue only after the verification is passed.

[0234] In step 79, the SDP client establishes a tunnel through HTTP connect and accesses the TCP / UDP intranet resource through the tunnel. When the SDP client accesses the TCP / UDP intranet resource, the SDP client can access the gateway and the gateway of the network to which the resource to be accessed belongs through the SDP access gateway ( Figure 7 The gateway for SDP access gateway connection is represented in the figure), which realizes cross-network communication with the server to which the resource to be accessed belongs, thereby realizing the access of the SDP client to the resource to be accessed. Among them, the resource to be accessed can be Figure 7 The resources corresponding to B / S application 1, C / S application 1 and C / S application 2 are shown in FIG.

[0235] In addition, Figure 6 or Figure 7 In the implementation scenario shown, the content of the relevant information of the trusted client device obtained by the SDP access gateway can be referred to Figure 8 .like Figure 8 As shown, the relevant information of the trusted client device may include the client device ID, client device IP, accessible address, and temporary working key of each client device. In this implementation, since the SDP client is an authenticated trusted client device, the SDP access gateway can determine the temporary working key of the SDP client based on the SDP client ID.

[0236] As can be seen from the descriptions of steps 61 to 69, and steps 71 to 79, the SDP client sends a single authentication request, and the campus controller simultaneously completes network access authentication and resource access authentication for the SDP client, thereby implementing network access authorization and SDP access authorization (also known as resource access authorization). Furthermore, the campus controller can perform targeted authorization based on the network devices (including network access devices and SDP access gateways) to which the SDP client is connected, ensuring accurate authorization.

[0237] In summary, the embodiments of the present application can integrate network access authentication and resource access authentication, and obtain both access authentication results and resource access authentication results through an authentication interaction process that is perceptible to the user. This reduces the complexity of user operations, avoids users from repeatedly logging online, and makes the authentication process simple, flexible, and efficient. Furthermore, the present application superimposes the user compliance access policy with the terminal compliance authentication process to achieve a rationalized unification of the two authentication methods, making the process and method of user compliance access to the network and access to resources more flexible.

[0238] The above describes the authentication method provided by the embodiment of the present application. Corresponding to the above method, the embodiment of the present application also provides an authentication device. The device is a control device in the embodiment of the present application. The device is used to Figure 9The modules shown above perform the Figure 3 The authentication method executed by the control device. Figure 9 As shown, the authentication device provided in the embodiment of the present application includes the following modules.

[0239] The first acquisition module 601 is used to respond to an authentication request from the client device and obtain authentication information of the client device. The authentication information includes any one of access authentication information, resource access authentication information or dual authentication information. The access authentication information is used to perform network access authentication for the client device, the resource access authentication information is used to perform resource access authentication for the client device, and the dual authentication information is used to perform network access authentication and resource access authentication for the client device; the second acquisition module 602 is used to perform network access authentication and resource access authentication for the client device based on the authentication information, thereby obtaining the access authentication result and resource access authentication result of the client device.

[0240] In one possible implementation, the second acquisition module 602 is used to, when the authentication information is access authentication information, perform network access authentication on the client device based on the access authentication information to obtain an access authentication result; when the access authentication result is that the access authentication is successful, obtain resource access authentication information based on the access authentication information; and perform resource access authentication on the client device based on the resource access authentication information to obtain a resource access authentication result.

[0241] In one possible implementation, the second acquisition module 602 is used to determine resource access registration information based on access authentication information; based on the resource access registration information and the resource access authentication information template, the resource access registration information is information generated by the control device during the process of resource access registration of the client device, and the resource access authentication information is generated, and the resource access authentication information template includes content requirements and format requirements of the resource access authentication information.

[0242] In one possible implementation, the control device stores user group information, which includes the user names of each user group; the second acquisition module 602 is used to determine the user name of the client device based on the access authentication information; determine the user group to which the client device belongs based on the user name and user group information of the client device; and determine the resource access registration information of the client device based on the resource access registration information corresponding to the user group to which the client device belongs.

[0243] In one possible implementation, an access mapping relationship and a resource access mapping relationship are stored on the control device, where the access mapping relationship is a mapping relationship between the access authentication information of the client device and the first user name used by the client device in the process of access authentication registration, and the resource access mapping relationship is a mapping relationship between the resource access authentication information of the client device and the second user name used by the client device in the process of resource access registration; the second acquisition module 602 is used for the control device to determine the first user name corresponding to the access authentication information according to the access mapping relationship; determine the second user name of the client device according to the first user name of the client device; and determine the resource access authentication information according to the resource access mapping relationship and the second user name.

[0244] In one possible implementation, the device also includes a determination module, which is used to determine that the resource access authentication result is a resource access authentication success according to the first authentication policy when the access authentication result is a successful access authentication, and the resource access authentication success is assumed to be successful when the first authentication policy indicates that the access authentication is successful.

[0245] In one possible implementation, the second acquisition module 602 is used to, when the authentication information includes resource access authentication information, perform resource access authentication on the client device based on the resource access authentication information to obtain a resource access authentication result; when the resource access authentication result is that the resource access authentication is successful, obtain access authentication information based on the resource access authentication information; and perform network access authentication on the client device based on the access authentication information to obtain an access authentication result.

[0246] In one possible implementation, the second acquisition module 602 is used to determine the access registration information based on the resource access authentication information; generate the access authentication information based on the access registration information and the access authentication information template, the access registration information is the information generated by the control device during the access registration process of the client device, and the access authentication information template includes the content requirements and format requirements of the access authentication information.

[0247] In one possible implementation, the control device stores user group information, which includes the user names of each user group; the second acquisition module 602 is used to determine the user name of the client device based on the resource access authentication information; determine the user group to which the client device belongs based on the user name and user group information of the client device; and determine the access registration information of the client device based on the access registration information corresponding to the user group to which the client device belongs.

[0248] In one possible implementation, an access mapping relationship and a resource access mapping relationship are stored on the control device, where the access mapping relationship is a mapping relationship between the access authentication information of the client device and the first user name used by the client device in the process of access authentication registration, and the resource access mapping relationship is a mapping relationship between the resource access authentication information of the client device and the second user name used by the client device in the process of resource access registration; the second acquisition module 602 is used to determine the second user name corresponding to the resource access authentication information based on the resource access mapping relationship; determine the first user name of the client device based on the second user name of the client device; and determine the access authentication information based on the access mapping relationship and the first user name.

[0249] In one possible implementation, the determination module is further used to determine, when the resource access authentication result is resource access authentication success, the access authentication result is access authentication success according to the second authentication policy, and when the second authentication policy indicates that the resource access authentication is successful, the access authentication is assumed to be successful.

[0250] In one possible implementation, the control also includes a knock verification module, which is used to receive a first knock request sent by a client device, the first knock request including the identification information of the client device encrypted with the certificate public key; decrypt the identification information of the client device based on the private key corresponding to the certificate public key; in response to the release information including the identification information of the client device, send a knock success message to the client device, the release information including the identification information of the client device that has completed registration on the control device, and the knock success message is used to instruct the client device to send resource access authentication information.

[0251] In a possible implementation, the second acquisition module 602 is configured to, when the authentication information includes dual authentication information, perform network access authentication and resource access authentication on the client device according to the dual authentication information to obtain access authentication results and resource access authentication results.

[0252] In one possible implementation, the device also includes an authorization module, which is used to send a temporary working key of the client device and the address of a resource access verification device to the client device when both access authentication and resource access authentication are successful, send authorization information of the client device's network access authority to an access device used to control the client device's network access authority, and send a temporary working key to the resource access verification device. The resource access verification device is a device between the client device and the server to which the resource to be accessed belongs. The temporary working key and the address of the resource access verification device are used for tunnel negotiation between the client device and the resource access verification device for resource access.

[0253] In one possible implementation, the access device and the resource access verification device are deployed on the same device; or, the access device and the resource access verification device are deployed on different devices, and the client device and the resource access verification device are connected via the access device.

[0254] In one possible implementation, the authorization module is also used to send the knock key of the resource access verification device to the resource access verification device; the control device sends the knock key of the resource access verification device to the client device, and the knock key of the resource access verification device is used to encrypt the knock information during the process of negotiating the tunnel between the client device and the resource access verification device.

[0255] It should be understood that the above Figure 9 The device provided has the following beneficial effects when realizing its function: Figure 3 The authentication method provided has the same beneficial effects and will not be described here in detail. Figure 9 The provided device is illustrated only by the division of the above-mentioned functional modules when implementing its functions. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the device and method embodiments provided in the above embodiments are based on the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0256] In addition, the embodiments of the present application also provide several other devices involved in the implementation scenario, as well as data platforms and application systems formed based on the several devices. Below, the composition of the several other devices, data platforms and application systems involved in the embodiments of the present application is exemplarily described.

[0257] See also Figure 10 , shows a schematic diagram of the composition of a client device provided by an embodiment of the present application. The client device comprises a system on chip (SOC), storage, an IoT physical layer (PHY), and a protocol stack. The SOC primarily performs task scheduling and data forwarding control, including control of network control plane communications and forwarding plane communications, such as data encapsulation and decapsulation, and querying traffic forwarding information. The IoT PHY is used to complete signal conversion for the IoT air interface.

[0258] In embodiments of the present application, the protocol stack of the client device can encapsulate information or data according to various protocols supported by the client device. For example, if the authentication request sent by the client device includes resource access authentication information, the protocol stack of the client device can encapsulate the resource access authentication information according to the format specified by the protocol corresponding to the resource access authentication information.

[0259] See also Figure 11 , shows a schematic diagram of the composition of a resource access verification device provided by an embodiment of the present application. The resource access verification device is an IoT gateway, and the resource access verification device includes components such as SOC, storage, IoT PHY, and IoT protocol stack.

[0260] In an embodiment of the present application, the SOC of the resource access verification device can be used to execute the authentication method provided in the embodiment of the present application. For example, the SOC of the resource access verification device can decrypt and verify the received knock information according to the temporary working key sent by the control device or the knock key of the resource access verification device. The storage component can store various types of information such as the temporary working key, the knock key of the resource access verification device, and related information of the trusted client device. The IoT PHY is used to complete the signal conversion of the IoT air interface. The protocol stack of the resource access verification device can encapsulate information or data according to various protocols or security frameworks supported by the resource access verification device. For example, if the resource access verification device supports the SDP zero-trust security framework, the resource access verification device can encapsulate the information or data according to the provisions of the SDP zero-trust security framework.

[0261] See also Figure 12 , showing a schematic diagram of the composition of a data platform. The data platform includes modules such as configuration management, alarm management, card management, security management, data distribution, message push, decentralization and domain division, and data display. Since the embodiments of the present application involve information that will not be used in various related technologies, the various modules in the embodiments of the present application are modified on the basis of the various modules of the data platform in the related technologies. Taking the data distribution module as an example, the modified data distribution module in the embodiment of the present application can support the distribution of various types of information involved in the embodiment of the present application, such as the distribution of dual authentication information and reading indication information, so as to ensure that the authentication method provided in the embodiment of the present application can be smoothly implemented based on the modified data distribution module.

[0262] See also Figure 13 , showing a schematic diagram of the composition of an application system. The application system includes an operating system, a database, a driver, and a software part, and the software part includes two parts: business and communication. Among them, the communication part has been modified according to the content and format of various types of information involved in the embodiments of this application, so that each device in the application system can interact based on various types of information in the embodiments of this application. For example, the communication part in the application system in this application can support the client device and the control device to interact based on information such as reading instruction information or dual authentication information to realize the communication function.

[0263] In an exemplary embodiment, an authentication system is provided, which includes an authentication device, the authentication device including a control device for executing Figure 3 The flowchart of the authentication method shown is an authentication method executed by the control device.

[0264] Optionally, the authentication system further includes a client device configured to execute Figure 3 The flowchart of the authentication method shown is an authentication method performed by the client device.

[0265] In an exemplary embodiment, a computer program (product) is provided, the computer program (product) comprising: a computer program code, when the computer program code is executed by a computer, causing the computer to execute Figure 3 The method in .

[0266] In an exemplary embodiment, a computer-readable storage medium is provided, which stores a program or instruction. When the program or instruction is executed on a computer, the computer executes the above Figure 3 The method in .

[0267] In an exemplary embodiment, a chip is provided, comprising a processor for calling and executing instructions stored in a memory, so that a computer equipped with the chip executes Figure 3 The method in .

[0268] In an exemplary embodiment, another chip is provided, including: an input interface, an output interface, a processor and a memory, wherein the input interface, the output interface, the processor and the memory are connected via an internal connection path, and the processor is used to execute the code in the memory. When the code is executed, the computer equipped with the chip executes Figure 3 The method in .

[0269] See also Figure 14 , Figure 14 1 shows a schematic structural diagram of an exemplary authentication device 2000 of the present application. The authentication device 2000 includes at least one processor 2001 , a memory 2003 , and at least one network interface 2004 .

[0270] The processor 2001 is, for example, a general-purpose central processing unit (CPU), a digital signal processor (DSP), a network processor (NP), a graphics processing unit (GPU), a neural-network processing units (NPU), a data processing unit (DPU), a microprocessor or one or more integrated circuits or application-specific integrated circuits (ASICs) for implementing the solution of the present application, a programmable logic device (PLD), other general-purpose processors or other programmable logic devices, discrete gates, transistor logic devices, discrete hardware components or any combination thereof. The PLD is, for example, a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof. The general-purpose processor can be a microprocessor or any conventional processor, etc. It is worth noting that the processor can be a processor that supports the advanced reduced instruction set machine (ARM) architecture. It can implement or execute various logic blocks, modules and circuits described in conjunction with the disclosure of this application. A processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like.

[0271] Optionally, the authentication device 2000 further includes a bus 2002. The bus 2002 is used to transmit information between the various components of the authentication device 2000. The bus 2002 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. The bus 2002 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 14 The fact that only one line is used does not mean that there is only one bus or one type of bus.

[0272] The memory 2003 may be, for example, a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memories. The nonvolatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache.

[0273] By way of example and not limitation, many forms of ROM and RAM are available. For example, ROM is a compact disc read-only memory (CD-ROM). RAM includes, but is not limited to, static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0274] The memory 2003 may also be other types of storage devices that can store static information and instructions. Alternatively, it may be other types of dynamic storage devices that can store information and instructions. Alternatively, it may be other optical disk storage, optical disk storage (including compact disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 2003 is, for example, independently existing and connected to the processor 2001 via the bus 2002. The memory 2003 may also be integrated with the processor 2001.

[0275] The network interface 2004 uses any transceiver-like device to communicate with other devices or communication networks. The communication network can be Ethernet, a radio access network (RAN), or a wireless local area network (WLAN). The network interface 2004 can include a wired network interface or a wireless network interface. Specifically, the network interface 2004 can be an Ethernet interface, such as a Fast Ethernet (FE) interface, a Gigabit Ethernet (GE) interface, an Asynchronous Transfer Mode (ATM) interface, a WLAN interface, a cellular network interface, or a combination thereof. The Ethernet interface can be an optical interface, an electrical interface, or a combination thereof. In some embodiments of the present application, the network interface 2004 can be used for the authentication device 2000 to communicate with other devices.

[0276] In a specific implementation, as some embodiments, the processor 2001 may include one or more CPUs, such as Figure 14 0 and CPU1 are shown in FIG. Each of these processors can be a single-core processor or a multi-core processor. A processor herein can refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0277] In a specific implementation, as some embodiments, the authentication device 2000 may include multiple processors, such as Figure 14 1 and 2005. Each of these processors can be a single-core processor or a multi-core processor. A processor herein can refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0278] In some embodiments, the memory 2003 is used to store program instructions 2010 for executing the solution of the present application, and the processor 2001 can execute the program instructions 2010 stored in the memory 2003. That is, the authentication device 2000 can implement the method provided by the method embodiment through the processor 2001 and the program instructions 2010 in the memory 2003, that is, Figure 3 The program instructions 2010 may include one or more software modules. Optionally, the processor 2001 itself may also store program instructions for executing the solution of the present application.

[0279] In the specific implementation process, the authentication device 2000 of the present application may correspond to a control device for executing the above method. The processor 2001 in the authentication device 2000 reads the instructions in the memory 2003, so that Figure 14 The authentication device 2000 shown is capable of executing all or part of the steps in the method embodiment.

[0280] The authentication device 2000 may also correspond to the above Figure 9 The device shown, Figure 9 Each functional module in the apparatus shown is implemented using software of the authentication device 2000. In other words, Figure 9 The functional modules included in the apparatus shown are generated after the processor 2001 of the authentication device 2000 reads the program instructions 2010 stored in the memory 2003 .

[0281] in, Figure 3 Each step of the illustrated method is performed by hardware integrated logic circuits or software instructions within the processor of authentication device 2000. The steps of the method embodiments disclosed herein can be directly implemented by a hardware processor, or by a combination of hardware and software modules within the processor. The software modules can be located in a storage medium well-established in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. The storage medium is located in a memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the aforementioned method embodiments. To avoid repetition, these steps are not described in detail here.

[0282] See also Figure 15 , Figure 15 FIG2 shows a schematic diagram of the structure of an exemplary authentication device 2100 of the present application. The authentication device 2100 includes: a main control board 2110 and an interface board 2130 . Figure 15 The authentication device 2100 shown is used to perform the above Figure 3 The authentication device 2100 is, for example, a switch, a router, a controller, etc. The authentication device 2100 may be an example of a first device or a second device.

[0283] Main control board 2110, also known as the main processing unit (MPU) or route processor card, is responsible for controlling and managing various components in authentication device 2100, including routing calculation, device management, device maintenance, and protocol processing. Main control board 2110 includes a central processing unit (CPU) 2111 and memory 2112.

[0284] Interface board 2130 is also known as a line processing unit (LPU), line card, or service board. It provides various service interfaces and implements data packet forwarding. Service interfaces include, but are not limited to, Ethernet interfaces and POS (Packet over SONET / SDH) interfaces. Ethernet interfaces, for example, are interfaces for flexible Ethernet clients (FlexE Clients). Interface board 2130 includes a central processing unit (CPU) 2131, a network processor (NPU) 2132, a forwarding table memory 2134, and a physical interface card (PIC) 2133.

[0285] The central processing unit 2131 on the interface board 2130 is used to control and manage the interface board 2130 and communicate with the central processing unit 2111 on the main control board 2110 .

[0286] The network processor 2132 is used to implement message forwarding processing. The network processor 2132 can be in the form of a forwarding chip. Specifically, the network processor 2132 is used to forward received messages based on the forwarding table stored in the forwarding table memory 2134. If the destination address of the message is the address of the authentication device 2100, the message is sent to the CPU (such as the central processing unit 2111) for processing; if the destination address of the message is not the address of the authentication device 2100, the next hop and outgoing interface corresponding to the destination address are searched in the forwarding table based on the destination address, and the message is forwarded to the outgoing interface corresponding to the destination address. The processing of uplink messages includes: processing of the message input interface, forwarding table search; processing of downlink messages: forwarding table search, etc.

[0287] The physical interface card 2133 implements the physical layer interconnection function. Raw traffic enters the interface board 2130 through this card, and processed packets are sent out from this physical interface card 2133. Physical interface card 2133, also known as a daughter card, can be installed on the interface board 2130. It is responsible for converting optical and electrical signals into packets, performing a validity check on these packets, and forwarding them to the network processor 2132 for processing. In some embodiments, a central processing unit can also perform the functions of the network processor 2132, such as implementing software forwarding based on a general-purpose CPU, thus eliminating the need for the network processor 2132 in the physical interface card 2133.

[0288] Optionally, the authentication device 2100 includes multiple interface boards. For example, the authentication device 2100 further includes an interface board 2140 . The interface board 2140 includes a central processing unit 2141 , a network processor 2142 , a forwarding table entry memory 2144 , and a physical interface card 2143 .

[0289] Optionally, authentication device 2100 also includes a switch fabric unit (SFU) 2120. This unit can also be referred to as a switch fabric unit (SFU). If the authentication device has multiple interface boards 2130, SFU 2120 is used to exchange data between the interface boards. For example, interface board 2130 and interface board 2140 can communicate via SFU 2120.

[0290] The main control board 2110 and the interface board 2130 are coupled. For example, the main control board 2110, the interface board 2130, the interface board 2140, and the switching network board 2120 are connected to the system backplane via a system bus to achieve intercommunication. In one possible implementation, an inter-process communication (IPC) channel is established between the main control board 2110 and the interface board 2130, and communication between the main control board 2110 and the interface board 2130 is performed via the IPC channel.

[0291] Logically, the authentication device 2100 comprises a control plane and a forwarding plane. The control plane includes a main control board 2110 and a central processing unit 2131. The forwarding plane includes various components that perform forwarding, such as a forwarding table entry memory 2134, a physical interface card 2133, and a network processor 2132. The control plane performs routing functions, generates forwarding tables, processes signaling and protocol messages, and configures and maintains device status. The control plane sends the generated forwarding tables to the forwarding plane. On the forwarding plane, the network processor 2132 forwards messages received by the physical interface card 2133 based on the forwarding tables sent by the control plane. The forwarding tables sent by the control plane can be stored in the forwarding table entry memory 2134. In some embodiments, the control plane and forwarding plane can be completely separate and not located on the same device.

[0292] It's worth noting that there may be one or more main control boards (SPUs), which can include both active and standby SPUs. There may also be one or more interface boards. The stronger the authentication device's data processing capabilities, the more interface boards it provides. Interface boards can also have one or more physical interface cards. There may be no SPUs, one or more SPUs, and multiple SPUs can be used to achieve load balancing and redundancy. In a centralized forwarding architecture, authentication devices may not require SPUs; the interface boards handle service data processing for the entire system. In a distributed forwarding architecture, authentication devices can have at least one SPU, which enables data exchange between multiple interface boards, providing high-capacity data exchange and processing capabilities. Therefore, authentication devices with a distributed architecture offer greater data access and processing capabilities than those with a centralized architecture. Alternatively, the authentication device can consist of a single card, without a switching network board. The functions of the interface board and the main control board are integrated on this single card. In this case, the central processing unit (CPU) on the interface board and the CPU on the main control board can be combined into a single CPU on this card to perform the combined functions. This type of device has lower data exchange and processing capabilities (for example, low-end communications equipment such as switches or routers). The specific architecture used depends on the specific network deployment scenario and is not specified here.

[0293] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware, or any combination thereof. When implemented using software, all or part of the embodiments may be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described herein are generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated therein. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive).

[0294] In this application, the terms "first," "second," and the like are used to distinguish between identical or similar items having substantially the same function or effect. It should be understood that "first," "second," and "nth" do not have a logical or temporal dependency, nor do they limit the quantity or order of execution. It should also be understood that although the following description uses the terms "first," "second," and the like to describe various elements, these elements should not be limited by these terms. These terms are simply used to distinguish one element from another.

[0295] It should also be understood that in the various embodiments of the present application, the size of the serial number of each process does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0296] In this application, the term "at least one" means one or more, and the term "plurality" means two or more. For example, "plurality of second devices" means two or more second devices. The terms "system" and "network" are often used interchangeably herein.

[0297] It should be understood that the terminology used in the description of the various examples herein is for the purpose of describing particular examples only and is not intended to be limiting. As used in the description of the various examples and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0298] It should also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the listed items. The term "and / or" describes an association between associated objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A exists alone, A and B exist simultaneously, or B exists alone. Furthermore, the character " / " in this application generally indicates that the associated objects are in an "or" relationship.

[0299] It should also be understood that the terms “if” and “if” may be interpreted to mean “when” or “upon” or “in response to determining” or “in response to detecting.” Similarly, the phrases “if it is determined that ” or “if [stated condition or event] is detected” may be interpreted to mean “upon determining ” or “in response to determining ” or “upon detecting [stated condition or event]” or “in response to detecting [stated condition or event],” depending on the context.

[0300] The above description is merely an embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the principles of the present application shall be included in the scope of protection of the present application.

Claims

1. An authentication method, characterized in that: The method comprises: In response to an authentication request from a client device, the control device obtains authentication information of the client device, the authentication information including any one of access authentication information, resource access authentication information, or dual authentication information, the access authentication information being used to perform network access authentication for the client device, the resource access authentication information being used to perform resource access authentication for the client device, and the dual authentication information being used to perform both the network access authentication and the resource access authentication for the client device; The control device performs the network access authentication and the resource access authentication on the client device according to the authentication information, thereby obtaining the access authentication result and the resource access authentication result of the client device.

2. The method according to claim 1, characterized in that The control device performs the network access authentication and the resource access authentication on the client device according to the authentication information, thereby obtaining the access authentication result and the resource access authentication result of the client device, including: In a case where the authentication information is the access authentication information, the control device performs the network access authentication on the client device according to the access authentication information to obtain the access authentication result; If the access authentication result is access authentication success, the control device obtains the resource access authentication information based on the access authentication information; The control device performs the resource access authentication on the client device according to the resource access authentication information to obtain the resource access authentication result.

3. The method according to claim 2, characterized in that The control device obtains the resource access authentication information based on the access authentication information, including: The control device determines resource access registration information based on the access authentication information, where the resource access registration information is information generated by the control device during the process of performing resource access registration on the client device; The control device generates the resource access authentication information according to the resource access registration information and a resource access authentication information template, wherein the resource access authentication information template includes content requirements and format requirements of the resource access authentication information.

4. The method according to claim 3, characterized in that The control device stores user group information, wherein the user group information includes user names of each user group; The control device determines resource access registration information according to the access authentication information, including: The control device determines the user name of the client device according to the access authentication information; The control device determines the user group to which the client device belongs according to the user name of the client device and the user group information; The control device determines the resource access registration information of the client device based on the resource access registration information corresponding to the user group to which the client device belongs.

5. The method according to claim 2, characterized in that The control device stores an access mapping relationship and a resource access mapping relationship, wherein the access mapping relationship is a mapping relationship between the access authentication information of the client device and a first user name used by the client device during access authentication and registration, and the resource access mapping relationship is a mapping relationship between the resource access authentication information of the client device and a second user name used by the client device during resource access and registration; The control device obtains the resource access authentication information based on the access authentication information, including: The control device determines the first user name corresponding to the access authentication information according to the access mapping relationship; The control device determines a second user name of the client device according to the first user name of the client device; The control device determines the resource access authentication information according to the resource access mapping relationship and the second user name.

6. The method according to claim 2, characterized in that After obtaining the access authentication result, the method further includes: When the access authentication result is access authentication success, the control device determines that the resource access authentication result is resource access authentication success according to a first authentication policy, and when the first authentication policy indicates that the access authentication is successful, the resource access authentication is assumed to be successful.

7. The method according to claim 1, characterized in that The control device performs the network access authentication and the resource access authentication on the client device according to the authentication information, thereby obtaining the access authentication result and the resource access authentication result of the client device, including: In a case where the authentication information includes the resource access authentication information, the control device performs the resource access authentication on the client device according to the resource access authentication information to obtain the resource access authentication result; If the resource access authentication result is that the resource access authentication is successful, the control device obtains the access authentication information based on the resource access authentication information; The control device performs the network access authentication on the client device according to the access authentication information to obtain the access authentication result.

8. The method according to claim 7, characterized in that The control device acquires the access authentication information based on the resource access authentication information, including: The control device determines access registration information according to the resource access authentication information, where the access registration information is information generated by the control device during access registration of the client device; The control device generates the access authentication information according to the access registration information and an access authentication information template, where the access authentication information template includes content requirements and format requirements of the access authentication information.

9. The method according to claim 8, characterized in that The control device stores user group information, wherein the user group information includes user names of each user group; The control device determines access registration information according to the resource access authentication information, including: The control device determines the user name of the client device according to the resource access authentication information; The control device determines the user group to which the client device belongs according to the user name of the client device and the user group information; The control device determines the access registration information of the client device based on the access registration information corresponding to the user group to which the client device belongs.

10. The method according to claim 7, characterized in that The control device stores an access mapping relationship and a resource access mapping relationship, wherein the access mapping relationship is a mapping relationship between the access authentication information of the client device and a first user name used by the client device during access authentication and registration, and the resource access mapping relationship is a mapping relationship between the resource access authentication information of the client device and a second user name used by the client device during resource access and registration; The control device acquires the access authentication information based on the resource access authentication information, including: The control device determines the second user name corresponding to the resource access authentication information according to the resource access mapping relationship; The control device determines the first user name of the client device according to the second user name of the client device; The control device determines the access authentication information according to the access mapping relationship and the first user name.

11. The method according to claim 7, characterized in that After obtaining the resource access authentication result, the method further includes: When the resource access authentication result is that the resource access authentication is successful, the control device determines that the access authentication result is the access authentication success according to a second authentication policy, and when the second authentication policy indicates that the resource access authentication is successful, the access authentication is assumed to be successful.

12. The method according to any one of claims 7 to 10, characterized in that: Before the control device acquires the access authentication information based on the resource access authentication information, the control device further includes: The control device receives a first knock request sent by the client device, where the first knock request includes identification information of the client device encrypted by a certificate public key; The control device decrypts the private key corresponding to the public key of the certificate to obtain the identification information of the client device; In response to the release information including the identification information of the client device, the control device sends a knock success message to the client device, the release information including the identification information of the client device that has completed registration on the control device, and the knock success message is used to instruct the client device to send the resource access authentication information.

13. The method according to claim 1, wherein The control device performs the network access authentication and the resource access authentication on the client device according to the authentication information, thereby obtaining the access authentication result and the resource access authentication result of the client device, including: In the case where the authentication information includes the dual authentication information, the control device performs the network access authentication and the resource access authentication on the client device according to the dual authentication information, and obtains the access authentication result and the resource access authentication result.

14. The method according to any one of claims 1 to 13, characterized in that: After the control device performs the network access authentication and the resource access authentication on the client device according to the authentication information, thereby obtaining the access authentication result and the resource access authentication result of the client device, the method further includes: When both the network access authentication and the resource access authentication are successful, the control device sends the temporary working key of the client device and the address of the resource access verification device to the client device, sends the authorization information of the network access authority of the client device to the access device used to control the network access authority of the client device, and sends the temporary working key to the resource access verification device. The resource access verification device is a device between the client device and the server to which the resource to be accessed belongs. The temporary working key and the address of the resource access verification device are used for tunnel negotiation between the client device and the resource access verification device for resource access.

15. The method according to claim 14, characterized in that The access device and the resource access verification device are deployed on the same device; Alternatively, the access device and the resource access verification device are deployed on different devices, and the client device is connected to the resource access verification device through the access device.

16. The method according to claim 14 or 15, characterized in that The method further comprises: The control device sends the knock key of the resource access verification device to the resource access verification device; The control device sends the knock key of the resource access verification device to the client device, where the knock key of the resource access verification device is used to encrypt knock information during the process of the client device and the resource access verification device negotiating the tunnel.

17. An authentication device, characterized in that: The device includes: a first acquisition module, configured to acquire authentication information of the client device in response to an authentication request from the client device, the authentication information including any one of access authentication information, resource access authentication information, or dual authentication information, the access authentication information being used to perform network access authentication for the client device, the resource access authentication information being used to perform resource access authentication for the client device, and the dual authentication information being used to perform both the network access authentication and the resource access authentication for the client device; The second acquisition module is configured to perform the network access authentication and the resource access authentication on the client device according to the authentication information, thereby obtaining an access authentication result and a resource access authentication result of the client device.

18. An authentication device, characterized in that: The device includes a processor coupled to a memory; the memory stores at least one instruction, and the at least one instruction is loaded and executed by the processor, so that the authentication device implements the authentication method described in any one of claims 1 to 16.

19. A computer-readable storage medium, characterized in that The computer-readable storage medium stores at least one instruction, which is loaded and executed by a processor to implement the authentication method according to any one of claims 1 to 16.

20. A computer program product, characterized in that The computer program product includes a computer program / instruction, and the computer program / instruction is executed by a processor to enable a computer to implement the authentication method according to any one of claims 1 to 16.

Images