Websocket communication management method, platform and system based on RADIUS authentication

Abstract

The invention discloses a Websocket communication management method, platform and system based on RADIUS authentication, and relates to the field of network authentication. The Websocket communication management method comprises the following steps: in response to a Websocket communication request initiated by a network user at a front end, performing USB Key authentication on the front end by a server, and keeping handshake connection with the front end after the authentication is passed; the server side randomly generates an account number and a password and stores the account number and the password into the RADIUS server; the server side sends the account number and the password to asset equipment in an SSH mode; the asset equipment initiates authentication to the RADIUS server through the account number and the password; and if the authentication succeeds, keeping handshake connection with the server. According to the WebSocket communication management system and method, by means of the combination of USB Key authentication, SSH and RADIUS protocols, flexible and safe WebSocket communication management can be achieved, and the risk of certificate leakage is completely eradicated.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of network authentication and authorization, and particularly relates to a WebSocket communication management method, platform and system based on RADIUS authentication. BACKGROUND

[0002] WebSocket is a network communication protocol that provides full-duplex (bidirectional) communication capabilities through a single TCP connection, enabling the server to actively push data to the browser. In the field of real-time communication, WebSocket has gradually become the mainstream protocol for full-duplex connection.

[0003] The core of the working principle of WebSocket is protocol upgrade. The client (browser) first sends an HTTP request with a special header, requesting the server to upgrade the protocol to WebSocket. If the server supports it, it will respond and switch protocols, and the subsequent communication will no longer follow the HTTP specification, but a lightweight frame protocol. As a result, the client and the server achieve full-duplex communication and can send data simultaneously. Moreover, once the connection is established between the two, the connection will persist until either party actively closes it. WebSocket is suitable for real-time chat, online games, real-time monitoring, financial market push, and other scenarios, with the advantages of extremely low latency, server-initiated push, and low bandwidth occupation.

[0004] However, traditional WebSocket does not have mandatory authentication and usually relies on cookies or JWT, which is vulnerable to token leakage. Although there are subsequent solutions to add RADIUS protocol authentication, they still generally use fixed account + password login authentication methods, which pose the following security risks: (1) fixed credentials: the same device uses the same login credentials for a long time, which is easy to steal or crack; (2) credential sharing risk: multiple people share the same set of device login credentials, and it is difficult to trace the responsible person; (3) coarse-grained permission management: lack of fine-grained device access control mechanism; (4) single authentication method: relying only on account and password, which is not secure enough, especially when the password is short and simple, it is easy to be broken by constantly trying different passwords with a decoder; (5) according to the protection requirements of information security level, the account and password need to be changed every certain period of time, and in this scenario, it is particularly cumbersome and easy to miss the change.

[0005] In order to uniformly manage the use of WebSocket communication by users within a certain range and to manage them differently (determine permissions and billing, etc.), a new WebSocket communication management method and system need to be developed to solve the current defects and shortcomings. SUMMARY

[0006] In view of this, the main objective of the present invention is to provide a Websocket communication management method, platform and system based on RADIUS authentication, in order to at least partially solve the above-mentioned technical problems.

[0007] To achieve the above objectives, as a first aspect of the present invention, a WebSocket communication management method based on RADIUS authentication is proposed, comprising the following steps: The front end initiates a WebSocket communication request; the server sends a random number to the front end's USB Key to initiate USB Key authentication; the USB Key generates a client digest based on the random number and its stored USB Key seed code using a HASH algorithm and sends it to the server. The server generates a server digest using the same random number and USB key seed code, and performs a consistency check with the client digest. If they do not match, access is denied; if they match, the server queries the user's permissions on the front end. When the user has the asset device for WebSocket communication, the server and the front end maintain a handshake connection and randomly generate an account and password for communicating with the asset device, which are then stored in the RADIUS server. The server sends the account and password to the authorized asset device via SSH; The asset device initiates authentication with the RADIUS server using the aforementioned account and password; if authentication is successful, it maintains a WebSocket communication connection with the server.

[0008] As a second aspect of the present invention, a WebSocket communication management platform based on RADIUS authentication is also proposed, comprising a platform security authentication module, an input module, a random generation module, and a connection module; wherein: The platform security authentication module is used to verify whether the Websocket communication management platform has passed security authentication via USB Key authentication. Only after passing the authentication is the other module allowed to be called. The input module is used to receive WebSocket communication requests initiated by the front end and to verify the user's permissions. The random generation module is used to randomly generate accounts and passwords for communicating with asset devices based on the user's permissions at the front end, and store the accounts and passwords in the RADIUS server. The connection module is used to establish a handshake connection with the front-end when the user's permissions allow, send the randomly generated account and password to the asset device via SSH, and establish a WebSocket communication connection with the asset device after the asset device initiates RADIUS authentication and passes the authentication.

[0009] As a third aspect of the present invention, a Websocket communication management system based on RADIUS authentication is also proposed, including a front-end, a Websocket communication management platform as described above as a server, asset devices, and a RADIUS server; wherein, the Websocket communication management platform realizes Websocket communication between the front-end and the asset devices through the Websocket communication management method based on RADIUS authentication as described above.

[0010] As a fourth aspect of the present invention, a processor executable program is also proposed, which can be executed by a processor or compiled to be executed by a processor, for performing the RADIUS-authenticated Websocket communication management method as described above.

[0011] As a fifth aspect of the invention, a storage medium is also provided, wherein the storage medium stores non-volatile program code that can be executed by a processor or compiled and executed, the program code being used to execute the RADIUS-authenticated Websocket communication management method as described above.

[0012] Based on the above technical solutions, it can be seen that the RADIUS-authenticated Websocket communication management method, platform, and system of the present invention have at least one of the following beneficial effects compared with the prior art: 1. This invention, by combining the RADIUS protocol with random accounts and passwords, can achieve flexible and secure WebSocket communication management. It not only solves the problem of WebSocket communication not being subject to access control in the prior art, but also breaks through the limitation of the RADIUS protocol being used only for single-user dial-up Internet access and VPN authentication management. 2. This invention generates unique accounts using a random algorithm and combines it with generateRandomPassword to generate random passwords. This allows for the generation of entirely new and unpredictable temporary credentials each time a device is connected, which are then destroyed after use. This distinguishes the invention from the fixed credentials used by other platforms on the market and minimizes the risk of credential leakage. 3. The authentication of this invention is based on the RADIUS protocol (RFC 2865), which is compatible with all network devices that support RADIUS. It has strong applicability, good scalability, and can be supported by multiple vendors. 4. The Websocket communication management platform of the present invention adopts a zero-trust architecture, and re-authenticates for each connection, resulting in high security; the Websocket communication management platform of the present invention has a zero error rate, and templated configuration avoids manual input errors; 5. The Websocket communication management platform of this invention has an automated kernel. For scenarios that require regular changes to accounts and passwords, the Websocket communication management platform automatically generates suitable accounts and passwords, requiring minimal effort from the administrator and ensuring security and stability. In a specific instance, RADIUS configuration can be completed on 100 devices within 10 minutes, whereas manual configuration would take several hours. 6. The Websocket communication management platform of the present invention implements traceability function, records the identification and configuration process of each device, and supports backtracking. Attached Figure Description

[0013] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly described below.

[0014] Figure 1 This is a signal flow diagram of the RADIUS-authenticated Websocket communication method of the present invention. Figure 2 This is a framework diagram of the Websocket communication system based on RADIUS authentication of the present invention; Figure 3 This is a system architecture diagram of the Websocket communication system based on RADIUS authentication according to the present invention. Detailed Implementation

[0015] To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to specific embodiments and accompanying drawings.

[0016] The terminology used in this invention is for the purpose of describing particular embodiments only and is not intended to limit the embodiments of the invention. The singular forms “a,” “the,” and “the” as used in the embodiments of the invention and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise.

[0017] In this invention, some terms have the following meanings: RADIUS (Remote Authentication Dial-In User Service) is a network protocol used to authenticate user identities, authorize access permissions, and perform accounting and auditing (AAA). It employs a client / server model and centrally manages user access control network resources, such as VPNs, Wi-Fi, and dial-up servers, in a distributed manner.

[0018] FreeRADIUS is the most widely deployed RADIUS server implementation in the world. It's an open-source project (GPLv2) and the core authentication backend for many commercial network devices (such as Cisco, Juniper, and Aruba). FreeRADIUS is known for its modular design; the core daemon (radiusd) loads different modules to support databases, LDAP, EAP, and more. FreeRADIUS configuration files are primarily located in the ` / etc / freeradius / 3.0 / ` directory, while the Users file is a flat file similar to ` / etc / passwd` used to store user credentials.

[0019] The RADIUS server is the core system for performing AAA functions. It is responsible not only for authentication but also for recording and managing user access information. The RADIUS server maintains three key dictionary databases: a user database for storing accounts, passwords, group information, etc. (such as AD and LDAP); a client database for recording information about all network access servers (NAS) and shared keys; and a dictionary database for defining attribute-value pairs (AVPairs) to interpret information in messages. The RADIUS server communicates with network devices (such as switches and access points) via the UDP protocol (authentication port 1812, accounting port 1813).

[0020] The WebSocket protocol is a network protocol that enables full-duplex communication over a single TCP connection. It breaks through the limitations of the HTTP protocol, allowing bidirectional, real-time data transmission between clients (such as browsers) and servers.

[0021] Traditional WebSocket authentication lacks mandatory authentication and typically relies on cookies or JWTs, making it vulnerable to token leaks. While subsequent solutions have incorporated RADIUS protocol authentication, the common practice remains a fixed username and password login method, leading to various security vulnerabilities. Addressing the prevalent use of fixed username and password authentication in existing technologies, the ease with which passwords can be cracked, and the cumbersome process of regularly maintaining accounts and passwords for managing numerous users to enhance security, this invention leverages the RADIUS protocol and a random algorithm to resolve these user pain points. Existing technologies typically use the RADIUS protocol for single-user dial-up internet access and VPN authentication management; a search revealed no implementation of its use for authentication login in large-scale network devices such as data centers, nor has any existing technology recognized that combining the RADIUS protocol with random usernames and passwords can achieve flexible and secure WebSocket communication management.

[0022] Therefore, asFigure 1 As shown, this invention proposes a WebSocket communication management method based on RADIUS authentication, comprising the following steps: The front end initiates a WebSocket communication request; the server sends a random number to the front end's USB Key to initiate USB Key authentication; the USB Key generates a client digest based on the random number and its stored USB Key seed code using a HASH algorithm and sends it to the server. The server generates a server digest using the same random number and USB key seed code, and performs a consistency check with the client digest. If they do not match, access is denied; if they match, the server queries the user's permissions on the front end. When the user has the asset device for WebSocket communication, the server and the front end maintain a handshake connection and randomly generate an account and password for communicating with the asset device, which are then stored in the RADIUS server. The server sends the account and password to the authorized asset device via SSH; The asset device initiates authentication with the RADIUS server using the aforementioned account and password; if authentication is successful, it maintains a WebSocket communication connection with the server.

[0023] The front end is, for example, a web client, such as a browser client.

[0024] In this implementation, a hash algorithm is used to calculate the digest for authentication via USB Key, which further enhances the security of the entire system. The USB Key is a mandatory hardware device; the server only performs subsequent tasks when the USB Key is present. The specific verification process is as follows: The server generates a 32-byte random number (Base64 encoded) and sends it to the USB Key. The USB Key uses this random number plus a seed code to calculate the client digest using a hash (random number + seed code) method and sends the result to the server. The server uses the same random number plus a seed code to calculate the server digest using the hash (random number + seed code) method, verifying the consistency of the two digests. Only after successful verification is device connection allowed.

[0025] This setup gives the entire system a core advantage: even if the random credentials are intercepted, without a physical USB key, it is impossible to log in to the server (Websocket communication management platform). This distinguishes it from existing device management platforms on the market, which generally do not support hardware authentication. The Websocket communication management platform of this invention deeply integrates physical security and network security, further improving the security level.

[0026] In order to further improve the security level, the following measures were also taken: (1) The seed code of the USB Key was isolated, that is, the USB Key seed code was stored in the hardware security area and could not be read from the outside. Only the hardware could be called to perform digest calculation; (2) Random number anti-replay: different random numbers were used for each authentication, so even if the digest was intercepted, it could not be replayed; (3) Two-way verification: the local end and the server used the same seed code (UKey public key) to calculate the digest, ensuring the authenticity of the identities of both parties; (4) Status management: USB Key devices can be enabled / disabled, and stolen USB Keys can be remotely disabled.

[0027] The user permissions used by the front end are stored, for example, in a local database within the hardware security zone on the USB Key, or in a user database in the local Users file on the FreeRADIUS server. The user database is used to store the user's permissions to access different network devices.

[0028] The Websocket communication management method can, for example, implement multi-level permission management through different permission relationship tables. The final permission of each front-end user is obtained through a permission superposition algorithm, that is, the user's final permission = the set of directly authorized devices ∪ the set of all authorized devices of the user group.

[0029] The aforementioned server generates usernames and passwords randomly. The usernames are unique strings ranging from 8 to 512 characters, such as 8, 16, 32, 64, 128, or 256 characters. Methods for randomly generating usernames include random string generation, combinations from a pre-defined vocabulary (e.g., randomly selecting from adjective and noun dictionaries to create easily readable and memorable usernames), dedicated algorithms, and combination strategies. Dedicated algorithms include NANOID, ULID, CUID, and Snowflake. NANOID is a default 21-bit string (16-21 characters); it supports custom character sets; it's shorter than UUID and more secure than Snowflake; it has a moderate length, configurable character sets, and extremely low collision probability; suitable for web applications and API tokens. ULID is a 26-bit string (Base32), sortable chronologically; based on timestamps (Lexicographically Sortable), it combines the uniqueness and sortability of UUIDs; suitable for log systems and user IDs requiring time ordering. CUID algorithms have a fixed length and a format similar to ck1x3l1zu0001h6b5h7g8b2rc; designed for web scenarios, with a lower probability of collision than UUIDs, and include a timestamp; suitable for scenarios requiring the front-end to generate unique IDs. The Snowflake algorithm, for example, divides a 64-bit integer into three parts: a timestamp, a machine identifier, and a sequence number. The timestamp is 41 bits, a millisecond-level timestamp; the machine identifier is 10 bits, a 5-bit datacenter ID + a 5-bit worker ID; and the sequence number is 12 bits, a counter within the same millisecond range.

[0030] The combination strategy may include, for example, a prefix (such as “USER_”) + a random string or a timestamp (such as “20241105_”) + a random string.

[0031] The random password can be 6 to 128 bits, such as 8, 16, or 32 bits, and can be generated using the device's built-in generateRandomPassword function.

[0032] By using a random algorithm to generate unique accounts and combining them with generateRandomPassword to generate random passwords, a brand new, unpredictable temporary credential can be generated each time a device is connected. This credential is then destroyed after use, thus differentiating it from the fixed credentials used by other platforms on the market and fundamentally eliminating the risk of credential leakage.

[0033] When the server randomly generates the account and password, it inserts an authentication record into the radcheck table on the RADIUS server, such as FreeRADIUS deployed on the server side, and inserts authorization attributes into the radreply table for subsequent authentication using the RADIUS protocol. The radcheck table on the RADIUS server stores user authentication information, such as account, password, and authentication type; the radreply table stores authorization attributes, such as device permission level and AVPair (Attribute-Value Pair).

[0034] When assets and devices authenticate the account and password via the RADIUS protocol, they verify the credentials by querying the radcheck / radreply table on the RADIUS server and return the authentication result.

[0035] The WebSocket communication management method based on RADIUS authentication of the present invention has the following technical advantages: (1) Credential uniqueness: When using algorithms such as the snowflake algorithm, ensure that IDs are not duplicated in a distributed environment; (2) Password randomness: 16-bit random password (uppercase and lowercase letters + numbers), high strength; (3) Authentication standardization: Based on the RADIUS protocol (RFC 2865), compatible with all network devices that support RADIUS; (4) Zero Trust Architecture: Each connection is re-authenticated, which is highly secure. Even if temporary storage is used, the security is improved because the account and password have a storage period. (5) Kernel automation: For scenarios where accounts and passwords need to be changed regularly, the Websocket communication management platform automatically generates suitable accounts and passwords, which does not require too much attention from the administrator and can also ensure security and stability.

[0036] In a preferred embodiment, the RADIUS-authenticated WebSocket communication management method of the present invention also implements multi-level permission management, for example, through multiple different permission relationship tables, such as: 1. Direct authorization The administrator of the Websocket communication management platform, usually the owner of the USB key, has the management ability to directly assign permissions to different client users. The assigned permissions (i.e., the direct authorization relationship between users and devices) are usually recorded in the user_nas_auth table.

[0037] 2. User group authorization Administrators of the Websocket communication management platform can also manage the permissions of members in each group by specifying groups and setting different group leaders. The group leader records the permissions that the group leader is qualified to assign (such as the authorization relationship between user groups and devices) in the user_group_nas_auth table.

[0038] Therefore, the final permissions of each client / user terminal are obtained through a permission stacking algorithm, that is, the user's final permissions = the set of directly authorized devices ∪ the set of all authorized devices of the user group. This enables all devices to support multi-level permission management, which can be precisely controlled down to the individual or authorized in batches by team. This also avoids the dilemma of traditional platforms where either everyone can access all devices or each user needs to be configured individually. The Websocket communication management platform of this invention can achieve flexible multi-level permission management by means of a flexible permission stacking model.

[0039] The user_nas_auth table and user_group_nas_auth table described in this invention can be stored as a local database, for example, in the hardware security area of ​​a secure and encrypted USB key, or in the user permission data table in the local Users file on FreeRADIUS.

[0040] This invention also discloses a WebSocket communication management platform, including a platform security authentication module, an input module, a random generation module, and a connection module; wherein: The platform security authentication module is used to verify whether the Websocket communication management platform has passed security authentication via USB Key authentication. Only after passing the authentication is the other module allowed to be called. The input module is used to receive WebSocket communication requests initiated by the front end and to verify the user's permissions. The random generation module is used to randomly generate accounts and passwords for communicating with asset devices based on the user's permissions at the front end, and store the accounts and passwords in the RADIUS server. The connection module is used to establish a handshake connection with the front-end when the user's permissions allow, send the randomly generated account and password to the asset device via SSH, and establish a WebSocket communication connection with the asset device after the asset device initiates RADIUS authentication and passes the authentication.

[0041] The WebSocket communication management platform implements its functions, for example, through software modules on the local or server side.

[0042] The present invention also discloses a Websocket communication management system, including a front-end, a Websocket communication management platform as described above (serving as a server), asset devices, and a RADIUS server; wherein, the Websocket communication management platform realizes Websocket communication between the front-end and the asset devices through the RADIUS authentication-based Websocket communication management method described above.

[0043] The present invention also discloses a computer executable program that, when executed, can perform the RADIUS authentication-based Websocket communication management method as described above.

[0044] Computer program code for performing operations of some embodiments of the present invention can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Python, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0045] The computer program product of the present invention includes a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowchart. In some embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device, or installed from a ROM. When the computer program is executed by a processing device, it performs the functions defined in some embodiments of the present disclosure.

[0046] The present invention also discloses a storage medium, such as a computer-readable medium, for storing the computer-executable program as described above.

[0047] It should be noted that the computer-readable medium described in this invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof.

[0048] In some embodiments of the present invention, the computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device. In some embodiments of the present invention, the computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof.

[0049] A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0050] In some implementations, clients and servers can communicate using any currently known or future-developed network protocol such as HTTP (Hypertext Transfer Protocol) and can interconnect with digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include local area networks (“LANs”), wide area networks (“WANs”), the Internet (e.g., the Internet of Things), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future-developed networks.

[0051] The present invention will be further illustrated below through specific embodiments. It should be noted that the following embodiments are merely illustrative and not intended to limit the present invention.

[0052] Example 1: This example discloses a WebSocket communication management method based on RADIUS authentication, including the following technical process: 1. The front-end (Web client) initiates a WebSocket communication request to the server; 2. The server sends a random number to the front-end USB Key to initiate USB Key authentication. Based on the random number and its stored USB Key seed code, the USB Key generates a client digest using a hash algorithm and sends it to the server. The server generates a server digest using the same random number and USB Key seed code. The two digests are compared; if they do not match, access is denied; if they match, the verification passes. 3. After successful verification, the server and frontend maintain a handshake connection; 4. The server uses the Snowflake algorithm to generate a 64-bit unique account and uses generateRandomPassword to generate a 16-bit random password. The account and password are then stored in the radcheck table on the RADIUS server. 5. The server sends the username and password to the asset device via SSH; 6. The asset device initiates authentication with the RADIUS server using the aforementioned account and password; if authentication fails, the process terminates; if authentication succeeds, the asset device maintains a handshake connection with the server. 7. The server can use Markdown rendering, that is, the server sends Markdown text, and the front end uses marked.js or showdown.js to render it into HTML, or directly render HTML, that is, the server sends HTML string, and the front end uses innerHTML rendering to achieve rich text display, such as displaying formatted text (such as bold, italics, code blocks, etc.) on the webpage.

[0053] 8. The server can also be configured with the SSHD library via Apache SSHD to enable the server to execute commands issued by the user.

[0054] 9. After the session ends, record the connection duration and disconnection time in the ssh_session table.

[0055] The core technology components used include: (1) Server-side: Spring WebSocket + SSH + RADIUS; (2) Front-end: Web client, marked.js or showdown.js; (3) Protocol: WebSocket communication protocol + RADIUS protocol.

[0056] The USB Key authentication in step 2 above specifically includes the following steps: 1. Administrator registers USB Key: Opens the USB Key using the super password, generates a 32-bit server seed code and a 24-bit 3DES key, writes them to the USB Key secure storage area and saves them to the database; 2. When a user connects to a device, the front end detects the USB key insertion status; 3. Call the API to get a random number from the server: GET / device / ukey / generateRandom (returns a 32-byte Base64 encoded random number); 4. The front end calls the USB Key client SDK and uses the seed code within the hardware to calculate the digest: HASH (random number + seed code). 5. Submit the USB Key UID and client digest to the backend: POST / device / ukey / authenticate; 6. The backend queries the ukey_info table for the server seed code of the USB key and calculates the server digest: HASH (random number + seed code). 7. Compare whether the client-side digest and the server-side digest are consistent; 8. If the authentication matches, the authentication is successful, and the authentication log is recorded in the `ukey_auth_log` table, allowing the user to connect to the device; 9. If there is a discrepancy, authentication will fail, the connection will be rejected, and a failure log will be logged.

[0057] In step 7 above, the SSHD server is created using the following steps: SshServer sshd = SshServer.setUpDefaultServer(); sshd.setPort(22); sshd.setKeyPairProvider(new SimpleGeneratorHostKeyProvider()); sshd.setPasswordAuthenticator(new PasswordAuthenticator(){ @Override public boolean authenticate(String username, String password,ServerSession session){ return username.equals("admin")&&password.equals("secret"); } }); sshd.setCommandFactory(new ScpCommandFactory.Builder().withDelegate( new CommandFactory() { @Override public Command createCommand(String command) { return new ProcessShellFactory(command.split(" ")).create(); } }).build() ); sshd.start(); In the above technical process, ukey_info is used to store USB Key device information (UID, user ID, server seed code, 3DES key, status); ukey_auth_log is used to store authentication logs (UID, authentication result, client IP, digest information, authentication time).

[0058] The above technical process adopts the following security mechanisms: (1) Seed code isolation: The USB Key seed code is stored in the hardware security area and cannot be read from the outside. It can only call the hardware to perform digest calculation; (2) Random number anti-replay: Different random numbers are used for each authentication, so even if the digest is intercepted, it cannot be replayed; (3) Two-way verification: The client and the server use the same seed code to calculate the digest, ensuring the authenticity of both parties' identities; (4) Status management: Supports enabling / disabling USB Key devices, and stolen USB Keys can be remotely disabled.

[0059] Therefore, this embodiment has the following technical advantages: (1) Zero installation: No client software installation is required; simply open a browser to use it. (2) Cross-platform: It can be used on any device with a browser, such as Windows, Linux, Mac, and iPad; (3) Multi-session: Supports opening multiple device terminal windows simultaneously, which can be switched using the Tab key; (4) Session logging: Automatically logs SSH connection connections, supporting auditing and problem tracing.

[0060] Example 2, Scenario 1: Batch Authorization of User Groups like Figure 2 As shown, the Websocket communication management system in this embodiment uses the same Websocket communication management system as in Embodiment 1, and can perform the following operations: 1. The administrator creates a user group called "Network Administrators" and adds 5 members; 2. Authorize 100 devices for this user group and write the information to the user_group_nas_auth table; 3. Group members automatically inherit access permissions for 100 devices; 4. Adding a new administrator to the user group automatically grants them access to 100 devices.

[0061] Example 3, Scenario 2: Directly authorizing specific devices 1. Employee A from the business department needs temporary access to a core switch; 2. The administrator directly authorizes the device for employee A and writes the authorization to the user_nas_auth table; 3. When employee A accesses a device, the system calculates their permissions: direct device authorization + device authorization for their user group.

[0062] In the above technical process, the following permission calculation algorithm is used to calculate permissions: SQL -- Query all device IDs accessible to the user SELECT DISTINCT nas_id FROM ( -- Directly licensed devices SELECT nas_id FROM user_nas_auth WHERE user_id = #{userId} UNION -- Devices authorized by the user group (associated through the user group member table) SELECT gna.nas_id FROM user_group_nas_auth gna INNER JOIN user_group_member ugm ON gna.group_id = ugm.group_id WHERE ugm.user_id = #{userId} AS accessible_devices ``` The above technical process uses the following key data tables stored locally on the WebSocket communication management platform or in local files on FreeRADIUS: (1) The nas_user_group table is used to store user group information, such as group name, description, status, etc.; (2) The user_group_member table is used to store user group membership relationships, such as user ID, group ID, etc.; (3) The user_nas_auth table is used to store direct user authorizations, such as user ID, device ID, etc.; (4) The user_group_nas_auth table is used to store user group authorizations, such as group ID, device ID, etc.

[0063] The above technical process involves the following access control points: (1) Device list filtering: Only display devices that you have permission to access; (2) Verification before connection; check whether the user has permission to access the target device; (3) SSH session logs: Record information such as account, device ID, and connection duration, and support auditing; (4) Permission changes take effect immediately: Once authorization is revoked, the device cannot be accessed immediately.

[0064] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for managing Websocket communication based on RADIUS authentication, characterized in that, Comprising the following steps: The front end initiates a WebSocket communication request; the server issues a random number to the front-end USB Key, initiates USB Key authentication; the USB Key generates a client digest based on the random number and its own stored USB Key seed code using the HASH algorithm and sends it to the server; The server generates a server digest using the same random number and USB key seed code; and performs consistency check with the client digest; If not consistent, access is denied; if consistent, the server queries the front-end user's permissions, and when the user has the asset device for WebSocket communication, the server maintains a handshake connection with the front end and randomly generates an account and password for communication with the asset device, which is stored in the RADIUS server; The server sends the account and password to the asset device in the form of SSH; The asset device initiates authentication to the RADIUS server with the account and password; If the authentication is successful, the WebSocket communication connection with the server is maintained.

2. The RADIUS authentication-based WebSocket communication management method of claim 1, wherein: The front end is a web client; and / or The permissions of the front-end user are stored in a local database in the hardware security area on the USB Key, or in a user database in the local Users file on the FreeRADIUS configured by the server.

3. The method of claim 2, wherein the RADIUS-based authentication is used to establish a WebSocket connection. The WebSocket communication management method implements multi-level permission management through different permission relationship tables, and the most basic permissions of each front-end user are obtained through a permission superposition algorithm, i.e., user most basic permissions = direct authorized device set ∪ all user group authorized device set.

4. The RADIUS authentication-based WebSocket communication management method of claim 1, wherein: The account is a unique string of 8-512 bits; and / or The method of randomly generating an account is selected from the following: random string method, combination generation method in a preset word library, NANOID algorithm, ULID algorithm, CUID algorithm, or snowflake algorithm.

5. The RADIUS authentication based Websocket communication management method of claim 1, wherein, The password is 6-128 bits, generated using the generateRandomPassword function. 6.A Websocket communication management platform based on RADIUS authentication, characterized in that, Comprising a platform security authentication module, an input module, a random generation module, and a connection module; wherein: The platform security authentication module is used to confirm whether the WebSocket communication management platform has passed security authentication through USB Key authentication, and only after passing the security authentication is the rest of the modules allowed to be called; The input module is used to receive the WebSocket communication request initiated by the front end and confirm the permissions of the front-end user; The random generation module is used to randomly generate an account and password for communication with the asset device based on the permissions of the front-end user, and store the account and password on the RADIUS server; The connection module is used for handshake connection with the front end when the permission of the user using the front end is allowed, and the account and password randomly generated by the random generation module are sent to the asset device in the form of SSH, and the WebSocket communication connection is established with the asset device after the asset device initiates the RADIUS authentication.

7. The RADIUS authentication based Websocket communication management platform of claim 6, wherein, The Websocket communication management platform realizes corresponding functions through a software module on the server side.

8. A WebSocket communication management system based on RADIUS authentication, characterized in that, The Websocket communication management platform adopts the RADIUS authentication-based Websocket communication management platform according to claim 6 or 7, and realizes the Websocket communication between the front end and the asset device through the RADIUS authentication-based Websocket communication management method according to any one of claims 1-5. 9.A processor executable program capable of being executed by a processor or compiled to be executed by a processor, for executing the RADIUS authentication-based Websocket communication management method according to any one of claims 1-5.

10. A storage medium, characterized by The storage medium stores non-volatile program codes capable of being executed by a processor or compiled to be executed by a processor, and the program codes are used for executing the RADIUS authentication-based Websocket communication management method according to any one of claims 1-5.

Images