Cross-switch access authentication method for multi-network-port link aggregation

Abstract

The invention discloses a cross-switch access authentication method for multi-network-port link aggregation, and solves the problems that the existing cross-switch aggregation depends on an LACP (Link Aggregation Control Protocol) or a manufacturer private protocol, the interoperability is poor and a single-point fault occurs. The system comprises a host and a switch, the host is provided with an authentication client, a logic aggregation interface, a physical interface, a state recording and retry module and a data transmission module, and the switch is provided with an access control module. According to the method, a plurality of physical interfaces are aggregated into a logic interface bond0 through static configuration at a host end, and a service IP is configured; and independently operating an authentication client on each physical interface, executing EAP-TLS authentication, and sending a message from the corresponding interface. The interface state is recorded during initialization, if an unauthenticated interface is found, retry is immediately carried out, and meanwhile forwarding of other authenticated links is kept; when the link or the switch fails, the bond0 is automatically switched to other effective links; when the authentication session expires, the host initiates re-authentication, ensuring session continuity.

Description

Technical Field

[0001] This invention relates to the field of computer network security access technology, and in particular to a cross-switch access authentication method for multi-port link aggregation. Background Technology

[0002] With the rapid development of cloud computing, data centers, and enterprise campus networks, host devices are increasingly demanding higher bandwidth and availability for network access. This is especially true in critical industry scenarios such as finance, government, and telecommunications, where business systems require network connections to have redundancy and backup capabilities. This means that when a link or switch fails, the system can automatically switch to a backup link to avoid business interruption.

[0003] In existing technologies, multi-port hosts typically employ link aggregation technology to combine multiple physical network ports into a single logical interface to achieve bandwidth aggregation and fault redundancy. The Link Aggregation Control Protocol (LACP) defined by the IEEE 802.3ad standard is the most commonly used implementation. However, the LACP protocol has significant limitations: it only supports port aggregation within the same switch and cannot achieve redundancy across multiple switches. If the switch fails, all aggregated ports will simultaneously become unusable, causing the entire host to go offline.

[0004] To address these issues, various switch manufacturers have successively launched proprietary cross-switch aggregation solutions, such as Cisco's vPC, Huawei's IRF, and Juniper's MC-LAG. These solutions enable two switches to work together, presenting themselves as a single logical switch, thereby supporting cross-device link aggregation. However, these solutions have significant drawbacks: first, they must use equipment from the same vendor, resulting in poor interoperability; second, they require establishing heartbeat links to maintain consistency, which is complex to configure, and an abnormal heartbeat could lead to "dual-master" splitting or a complete network outage; third, deployment and maintenance costs are high, making them difficult to widely apply in heterogeneous network environments.

[0005] Furthermore, existing technologies also carry the risk of relying on a single vendor. If all switches in the network are from the same vendor, a system defect in that vendor's equipment or a hacker attack could potentially cause multiple devices to fail simultaneously, resulting in network paralysis. In practical applications, network architectures often aim to deploy equipment from different vendors to enhance resilience, but traditional cross-switch aggregation solutions cannot support such heterogeneous deployments.

[0006] On the other hand, host access authentication mechanisms are typically based on 802.1X / EAP-TLS. In multi-port scenarios, the authentication client often runs on only a single network port. Even if other physical interfaces are connected normally, services cannot be allowed to pass due to the lack of authentication. This further diminishes the value of multi-port redundancy.

[0007] Therefore, existing technologies still have significant shortcomings in cross-switch high-availability access authentication, and there is an urgent need for a method that can achieve independent authentication of multiple network ports and cross-switch high-availability access on the host side without requiring the switch to support vendor-specific protocols. Summary of the Invention

[0008] The purpose of this invention is to provide a cross-switch access authentication method for multi-port link aggregation. By implementing independent authentication of multiple physical ports and static link aggregation on the host side, it supports mixed deployment of switches from different manufacturers and models, thereby solving the problems of cross-switch aggregation in the prior art, such as reliance on proprietary protocols, poor interoperability, complex configuration, and the risk of relying on a single manufacturer.

[0009] The present invention adopts the following technical solution: The host side includes a logical aggregation module, a physical interface module, and an authentication client module. The logical aggregation module combines multiple physical network interfaces (such as eth0, eth1, etc.) into a single logical interface, bond0, through static configuration, and configures the service IP address on this interface. The physical interface module manages the link status and data transmission / reception of each physical network interface. The authentication client module runs an access authentication protocol (such as EAP-TLS) independently on each physical network interface and ensures that authentication packets are sent from the designated interface through interface binding. During system initialization, the host records the status of all physical network interfaces. If an unauthenticated interface is detected, the host immediately re-initiates authentication while checking for other available links.

[0010] When initiating authentication, the authentication client explicitly identifies the physical egress interface to ensure that authentication messages are sent through the designated interface, thereby guaranteeing that each interface can independently establish an authentication relationship with the corresponding switch. During the authentication process, each physical interface can independently handshake with the switch and establish an authentication session; once any physical interface completes authentication, the switch allows communication on that port, and the host's logical interface bond0 can then carry service traffic. The authentication status of all physical interfaces is independent and maintained separately. When a link to one interface is interrupted or the connected switch fails, other authenticated interfaces remain valid, and bond0 automatically switches to an available interface to continue transmission, thus achieving high-availability access.

[0011] To ensure that authentication messages are correctly sent from each physical interface, this invention provides several optional implementation methods, including but not limited to: using raw sockets in conjunction with the SO_BINDTODEVICE parameter to implement interface binding; achieving isolation by establishing independent network namespaces for each physical interface and running authentication clients within them; or starting independent authentication processes for each physical interface and specifying the corresponding interface in the process configuration. These methods all ensure that each physical interface can independently complete authentication even when logical interfaces share an IP address.

[0012] Compared to existing technologies, this invention eliminates the need for switches to support the IEEE 802.3ad LACP protocol or vendor-specific cross-switch aggregation protocols, enabling high-availability access authentication across switch links on the host side. This solution not only supports combined deployments of switches from different models and vendors but also reduces network configuration complexity and improves authentication robustness and system versatility.

[0013] Beneficial effects This invention has the following characteristics and advantages: 1. High Availability: By implementing independent authentication for multiple ports on the host side, even if some links or switches fail, the authentication status of other interfaces remains valid, ensuring uninterrupted service. 2. Versatility: It does not rely on the IEEE 802.3ad LACP protocol or vendor-specific cross-switch aggregation solutions, and supports mixed deployment of switches from different vendors and models; 3. Simplified operation and maintenance: No additional configuration or status synchronization is required at the switch end, reducing network deployment and maintenance costs; 4. Security: The access authentication protocol runs independently on all physical interfaces, avoiding the security risks associated with single-port authentication; 5. Flexibility: Interface authentication can be implemented through various methods such as raw socket binding, network namespaces, or multi-process, adapting to different operating systems and application scenarios. Attached Figure Description

[0014] Figure 1 Here is a schematic diagram of the system topology of this invention: Among them are: host (101), logical interface bond0 (102), physical interface eth0 (103), physical interface eth1 (104), physical interface eth2 (105), switch A (106), switch B (107), and switch C (108).

[0015] Figure 2 Here is a diagram of the system module structure of this invention: These include: authentication client module (201), logical aggregation interface module (202), physical interface module (203), data transmission module (204), and access control module (206).

[0016] Figure 3 This is a schematic diagram of a fault scenario for the present invention: This includes: host, logical aggregation interface module, physical interface module, and switch. (Labels and symbols follow.) Figure 1 The same applies, so I won't repeat myself.

[0017] Figure 4 This is a flowchart of the method of the present invention. Detailed Implementation

[0018] like Figure 1 As shown, the system in this embodiment includes a host (101), switch A (106), switch B (107), and switch C (108). The host has three physical network ports: eth0 (103), eth1 (104), and eth2 (105), which are configured to form a logical interface bond0 (102) through static link aggregation. eth0 (103) is connected to switch A (106); eth1 (104) is connected to switch B (107); eth2 (105) is connected to switch C (108); bond0 (102) serves as the host's external logical communication interface and carries a unified IP address.

[0019] like Figure 2 As shown, the host (101) contains an authentication client module (201), a logical aggregation interface module (202), a physical interface module (203), a data transmission module (204), and a status recording and retry module (205); the switches (106, 107, 108) contain an access control module (206). The logical aggregation interface module (202) binds eth0 (103), eth1 (104), and eth2 (105) to bond0 (102); the physical interface module (203) manages the sending and receiving of each physical port; and the authentication client module (201) runs the access authentication protocol independently on each physical port.

[0020] To ensure that authentication messages can be sent from a designated interface when multiple physical interfaces (103, 104, 105) share a single IP address, this invention provides the following optional implementation methods: 1. Raw socket binding interface The authentication client module (201) sends EAPOL messages using raw sockets and binds them to a specified interface (such as eth0, eth1, or eth2) via the SO_BINDTODEVICE parameter, thereby ensuring that the authentication messages are sent only through that physical port and are independent of the IP layer.

[0021] 2. Network namespace isolation Create an independent network namespace (netns) for each physical interface (103, 104, 105) on the host (101), assign each interface to a different namespace, and run the authentication client module (201) independently in its respective namespace, so that the authentication message is naturally isolated and sent only through the corresponding port.

[0022] 3. Multi-process interface binding On the host (101), an independent authentication process is started for each physical interface (103, 104, 105). The physical interface to which the process is bound is specified in the process configuration, so as to ensure that each physical interface can complete the authentication process independently.

[0023] All three implementation methods described above can ensure the goal of "independent authentication for each physical interface". For example, in server deployments, network namespace isolation is recommended, while raw socket binding interfaces are more suitable for embedded devices or lightweight hosts.

[0024] Those skilled in the art can choose any of these methods according to the specific system environment, and all of them fall within the protection scope of this invention.

[0025] like Figure 3 As shown, even if the eth0 (103) link is interrupted and the switch B (107) also fails, bond0 (102) will automatically switch to eth2 (105) to carry service traffic, while the authentication status of eth2 (105) remains valid, and the host (101) remains connected to the network without re-authentication, thus achieving high availability access.

[0026] like Figure 4 As shown, the specific workflow of this invention is as follows: 1. System Initialization After the host starts up, it loads the link aggregation configuration and authentication certificate information, initializes the authentication client process, and establishes a status monitoring mechanism.

[0027] 2. Configure static aggregation The host uses static configuration to bind multiple physical interfaces (such as eth0, eth1, and eth2) to a logical interface bond0, and configures the service IP address on bond0. At this time, bond0 serves as a unified logical interface to the outside world, while the physical interfaces continue to operate independently.

[0028] 3. Start the authentication subprocess The host starts an authentication client subprocess on each physical interface, binds it to the corresponding interface, and prepares to perform the EAP handshake.

[0029] 4. Link detection and authentication handshake The host checks the link status of each physical interface one by one. If the link is UP, it initiates the EAP handshake process on that interface, including EAPOL-Start, identity request / response, certificate exchange and verification, and key negotiation. Each interface completes authentication independently and generates a corresponding authentication session.

[0030] 5. Valid link determination and re-authentication of unauthenticated interfaces After each physical interface completes its EAP handshake independently, the host checks for any unauthenticated interfaces. If one exists, re-authentication is immediately initiated on the corresponding interface. Simultaneously, the system determines in parallel whether at least one valid link exists. A valid link is defined as a physical interface with a link status of UP and that has completed authentication. If at least one valid link exists, the bond0 state is marked as UP, and services can continue to forward normally through that link. If no valid link exists, services cannot forward, and the system initiates re-authentication for the unauthenticated interface until at least one valid link is restored.

[0031] 6. Service forwarding and traffic distribution strategies When bond0 is marked as UP, the host forwards service data through bond0. Based on the aggregation mode, an available valid link is selected as the outgoing link to achieve data forwarding and distribution.

[0032] 7. Authentication status maintenance and heartbeat On a successfully authenticated link, the host maintains the authentication session state, periodically sending heartbeat messages or processing CoA (Change of Authorization) messages issued by the switch to ensure the authentication session remains valid.

[0033] 8. Fault detection and rapid switching If a link fails or a switch becomes unavailable, the corresponding link immediately becomes ineffective. The host will automatically switch to another valid link that is still in the authentication successful state, thus ensuring that bond0 continues to carry service traffic and avoids interruption.

[0034] 9. Recertification upon expiration When the authentication session reaches its preset validity period (e.g., the Session-Timeout issued by RADIUS or the key lifecycle), the host initiates re-authentication. If the re-authentication is successful, the original session is seamlessly updated; if the re-authentication fails, the link is determined to be invalid, and the process returns to step 5) to re-determine the valid link and re-authenticate the unauthenticated interface.

[0035] 10. Cyclic Maintenance Steps 4) through 9 form a loop: while maintaining existing valid links to carry services, the system continuously initiates re-authentication for unauthenticated interfaces; when authentication is successful, the corresponding link is restored to a valid link. Through this parallel mechanism, the system can gradually restore the authentication and availability of all links without interrupting services.

Claims

1. A cross-switch access authentication method for multi-port link aggregation, characterized in that, Includes the following steps: (1) The host (101) loads the link aggregation configuration and authentication certificate during system initialization and records the link status and authentication status of each physical interface (103, 104, 105); (2) Statically aggregate multiple physical interfaces (103, 104, 105) into a logical interface bond0 (102) through the logical aggregation interface module (202), and configure the service IP address on bond0; (3) Run the authentication client module (201) on each physical interface (103, 104, 105). When an unauthenticated interface is detected, immediately trigger the authentication retry and explicitly specify the physical exit interface when initiating authentication so that the authentication message is sent through the corresponding interface. While retrying the unauthenticated interface, if there are other authenticated links, the service forwarding is kept uninterrupted through the links. (4) The host (101) detects the link status of each physical interface (103, 104, 105). If the link is UP, it initiates an EAP handshake on the interface to complete identity authentication and key negotiation and generate an independent authentication session. (5) Determine whether there is at least one valid link. A valid link is a physical interface whose link status is UP and which has been successfully authenticated. If it exists, bond0 is marked as UP, and the service is forwarded and split through the data transmission module (204); if it does not exist, it enters the waiting and rollback process, re-detects the link and initiates authentication again until it is restored. (6) During operation, when a link or switch (106, 107, 108) fails, the corresponding interface authentication status will be invalidated, and bond0 (102) will automatically switch to other authenticated links to continue transmission, so as to keep the service uninterrupted; (7) When the authentication session expires, the host will actively initiate re-authentication before the preset time Δt. If successful, the session will be seamlessly updated. If it fails, the corresponding link will be determined to be invalid and a valid link determination will be performed again.

2. The cross-switch access authentication method for multi-port link aggregation according to claim 1, characterized in that: include: The host (101) includes an authentication client module (201) which is used to run the access authentication program independently on each physical interface and to explicitly identify the physical exit interface when initiating authentication; The logical aggregation interface module (202) is used to aggregate multiple physical interfaces into a logical interface bond0 (102) through static configuration and configure the service IP address; the physical interface module (203) is used to detect link status and send and receive packets, and supports authentication packet interface binding; the status recording and retry module (205) is used to record the status of each physical interface during system initialization and trigger a retry when an unauthenticated interface is detected; the data transmission module (204) is used for forwarding, splitting and fault switching of service data; The switches (106, 107, 108) include an access control module (206) which performs access control on authentication messages from the host physical interface and allows service traffic to pass through after successful authentication.

3. The cross-switch access authentication method for multi-port link aggregation according to claim 1, characterized in that, The authentication client module (201) implements interface binding in the following ways: using raw sockets in combination with the SO_BINDTODEVICE parameter; or by establishing an independent network namespace for each physical interface (103, 104, 105) and running the authentication client in it; or by starting an independent authentication process for each physical interface (103, 104, 105) and specifying the corresponding interface in the process configuration.

4. The cross-switch access authentication method for multi-port link aggregation according to claim 2, characterized in that, The effective link is defined as an interface whose physical interface link status is UP and has completed authentication.

5. The cross-switch access authentication method for multi-port link aggregation according to claim 1, characterized in that, The host (101) actively initiates re-authentication within a preset time Δt before the authentication session expires, so as to ensure seamless session updates and avoid session interruption.

6. The cross-switch access authentication method for multi-port link aggregation according to claim 1, characterized in that, The access authentication protocol is EAP-TLS, and it is compatible with PEAP or TTLS protocols.

7. The cross-switch access authentication method for multi-port link aggregation according to claim 2, characterized in that, The data transmission module (204) further includes a fault detection and switching function, which is used to quickly switch to other valid links when a link or switch fault is detected.

8. The cross-switch access authentication method for multi-port link aggregation according to claim 1, characterized in that, When an unauthenticated interface is detected, the system initiates re-authentication for the unauthenticated interface while determining whether there is at least one valid link. If there is, the service will continue to be forwarded through that valid link.

Images