802.1 X certified escape method and device and storage medium

Abstract

The invention provides an escape method and device based on 802.1 X authentication and a storage medium, and relates to the technical field of communication control. Comprising the following steps: S1, setting an escape module and a local RADIUS service module in the wireless access point; the certificate information of the local RADIUS service module is consistent with that of the online RADIUS server; s2, in a normal state, an online RADIUS server provides an authentication service; s3, detecting whether the online RADIUS server is available or not, and if the detection result is that the online RADIUS server is unavailable, switching to a local RADIUS service module to provide an authentication service; and S4, detecting whether the online RADIUS server is available or not, and if the detection result is that the online RADIUS server is available, switching to provide the authentication service by the online RADIUS server. According to the method and the device, when the online RADIUS server is unavailable due to the network fault, the work of the local RADIUS service module is still not influenced.

Description

Technical Field

[0001] This application relates to the field of communication control technology, and in particular to an 802.1X certified escape method, device and storage medium. Background Technology

[0002] The 802.1X authentication system is a typical Client / Server architecture, consisting of three components: client, access device, and authentication server.

[0003] When a WLAN network uses 802.1X authentication, a typical network topology is as follows: Figure 1 As shown, in this diagram: Client corresponds to the client of the 802.1X authentication system, such as wireless terminals like mobile phones and laptops. AP is the Access Point, corresponding to the access device of the 802.1X authentication system, providing the conversion between wireless and wired networks. RADIUS Server corresponds to the authentication server (Remote Authentication Dial In User Service) of the 802.1X authentication system. Switch represents a switch; the AP connects to the wired network through a switch. AC is the Access Controller, responsible for managing the APs. IPnetwork represents the IP network.

[0004] 802.1X uses EAP (Extensible Authentication Protocol) to transmit authentication messages. EAP is a container protocol that can encapsulate different authentication methods (EAP-Methods), the most common being EAP-TLS (certificate-based) and EAP-PEAP (username-password-based). Among them, EAP-TLS is based on a TLS handshake and uses digital certificates for two-way authentication, making it the most secure and standardized EAP method currently available.

[0005] In actual network deployment, there is a many-to-one relationship between wireless terminals and access points (APs), and also a many-to-one relationship between APs and RADIUS servers. If the authentication server or network fails, the RADIUS service will become unavailable, resulting in a large number of wireless terminal users being unable to access the network.

[0006] Existing technologies typically employ a primary / backup RADIUS server approach to address authentication server failures. This means that when the primary RADIUS server is unavailable, a backup RADIUS server is used to complete the authentication process. However, this method still cannot prevent RADIUS service unavailability caused by network failures. Summary of the Invention

[0007] This application provides an 802.1X certified escape method, device, and storage medium to at least solve the above-mentioned technical problems existing in the prior art.

[0008] According to a first aspect of this application, an escape method for 802.1X authentication is provided, applied to an 802.1X authentication system, the 802.1X authentication system including a wireless access point with communication connection and an online RADIUS server, the escape method comprising the following steps: S1, An escape module and a local RADIUS service module are installed in the wireless access point; the certificate information of the local RADIUS service module is consistent with that of the online RADIUS server. S2, under normal circumstances, is provided with authentication services by an online RADIUS server; S3, during the process of providing authentication services on the online RADIUS server, the escape module periodically checks whether the online RADIUS server is available. If the detection result is that the online RADIUS server is unavailable, the authentication service is switched to be provided by the local RADIUS service module. S4. During the process of providing authentication services by the local RADIUS service module, the escape module periodically checks whether the online RADIUS server is available. If the detection result is that the online RADIUS server is available, the authentication service is switched back to be provided by the online RADIUS server.

[0009] In some embodiments of the first aspect of this application, the method by which the escape module periodically detects whether the online RADIUS server is available includes: The escape module initiates a status check every first cycle, and the status check includes port connectivity check and STATUS message interaction check. First, perform port connectivity testing; If the port connectivity test fails, the online RADIUS server is determined to be unavailable; otherwise, a STATUS message exchange test is performed. If the STATUS message exchange test fails, the online RADIUS server is still considered unavailable; if the STATUS message exchange test passes, the online RADIUS server is considered available.

[0010] In some embodiments of the first aspect of this application, the method for port connectivity detection is as follows: The escape module initiates a connection request to the authentication port of the online RADIUS server, and the online RADIUS server returns an ACK response message after receiving the connection request. If the escape module receives an ACK response message within the set first time period, the connection is considered successful; otherwise, the connection fails. If multiple connection failures occur consecutively, the port connectivity test is deemed unqualified; otherwise, the port connectivity test is deemed qualified.

[0011] In some embodiments of the first aspect of this application, the method for detecting STATUS message interactions is as follows: The escape module constructs and sends a Status-Server request message, which carries a code, an identifier, and a first timestamp. The message sending process sends the Status-Server request message to the online RADIUS server, while caching the code, identifier, and first timestamp in the wireless access point. After receiving the Status-Server request message, the online RADIUS server returns a Status-Server response message, which carries the code, identifier, and second timestamp. Message reception and parsing: Receive Status-Server response messages and parse the code, message identifier, and second timestamp in the received Status-Server response messages; The comparison and judgment process involves matching the code and message identifier in the received Status-Server response message with the code and identifier cached in the wireless access point. If at least one of the code or message identifier does not match, the Status-Server response message is discarded. If both the code and the message identifier match, then the first timestamp, the second timestamp, and the reception time of the Status-Server response message are combined to determine whether the Status-Server response message has timed out. If the timeout occurs, the STATUS message interaction check fails; otherwise, the STATUS message interaction check passes.

[0012] In some embodiments of the first aspect of this application, the method for determining whether the Status-Server response message has timed out by combining the first timestamp, the second timestamp, and the reception time of the Status-Server response message is as follows: The first time difference is obtained by subtracting the second timestamp from the first timestamp cached in the wireless access point. The second time difference is obtained by subtracting the receiving time from the second timestamp; The third time difference is obtained by subtracting the receiving time from the first timestamp; If the third time difference is greater than the set first time interval, and all first time differences and second time differences are greater than the set second time interval, the Status-Server response message reception is determined to have timed out; otherwise, the Status-Server response message reception does not time out.

[0013] In some embodiments of the first aspect of this application, during the process of providing authentication services by an online RADIUS server, the method for determining whether the Status-Server response message has timed out by combining the first timestamp, the second timestamp, and the reception time of the Status-Server response message is as follows: Within each cycle, the first time difference is obtained by subtracting the second timestamp from the first timestamp cached in the wireless access point; The second time difference is obtained by subtracting the receiving time from the second timestamp; The third time difference is obtained by subtracting the receiving time from the first timestamp; The judgment is made by combining the first time difference, the second time difference, and the third time difference within multiple periods. Specifically, when the following two conditions are met at the same time, the Status-Server response message reception is determined to have timed out; otherwise, the Status-Server response message reception does not time out. Condition 1: All third time differences are greater than the set first duration; Condition 2: All first time differences are greater than the set second duration, or all second time differences are greater than the set second duration.

[0014] In some embodiments of the first aspect of this application, during the process of providing authentication services by the local RADIUS service module, the method for determining whether the Status-Server response message has timed out by combining the first timestamp, the second timestamp, and the reception time of the Status-Server response message is as follows: Within each cycle, the first time difference is obtained by subtracting the second timestamp from the first timestamp cached in the wireless access point; The second time difference is obtained by subtracting the receiving time from the second timestamp; The third time difference is obtained by subtracting the receiving time from the first timestamp; The judgment is made by combining the first time difference, the second time difference, and the third time difference within multiple periods. Specifically, if the following two conditions are met at the same time, it is determined that the Status-Server response message reception has not timed out; otherwise, the Status-Server response message reception has timed out. Condition 1: All third time differences are less than the set first duration; Condition 2: All first time differences are less than the set second duration, or all second time differences are less than the set second duration.

[0015] In some embodiments of the first aspect of this application, during the process of providing authentication services by the local RADIUS service module, when the third time difference is less than the set first duration for the first time, the first period of status detection is modified to the second period, where the second period is less than the first period; and after switching back to providing authentication services by the online RADIUS server, the second period of status detection is restored to the first period.

[0016] In some embodiments of the first aspect of this application, during the process of switching to authentication services provided by the local RADIUS service module, the authentication request currently in the authentication process is resent to the local RADIUS service module for authentication.

[0017] In some embodiments of the first aspect of this application, during the process of switching back to the online RADIUS server providing authentication services, the authentication request currently in the authentication process continues to be completed in the local RADIUS service module, and the next authentication request is sent to the online RADIUS server for authentication.

[0018] According to a second aspect of this application, an electronic device is provided, comprising: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method described in this application.

[0019] According to a third aspect of this application, a non-transitory computer-readable storage medium is provided storing computer instructions for causing the computer to perform the methods described in this application.

[0020] Compared with the prior art, this application has the following advantages: 1. This application sets up a local RADIUS service module within the wireless access point and monitors the status of the online RADIUS server through an escape module. When the online RADIUS server becomes unavailable, the authentication service is switched to the local RADIUS service module to ensure that users of wireless terminals can continue to access the network. Furthermore, since the local RADIUS service module is located inside the wireless access point, even if a network failure causes the online RADIUS server to become unavailable, it will not affect the operation of the local RADIUS service module.

[0021] 2. In the process of determining whether the Status-Server response message has timed out, this application uses three time differences to compare with a set duration, so as to more accurately judge the timeout response and filter out the moment of STATUS message interaction detection.

[0022] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this application, nor is it intended to limit the scope of this application. Other features of this application will become readily apparent from the following description. Attached Figure Description

[0023] The above and other objects, features, and advantages of exemplary embodiments of this application will become readily apparent from the following detailed description taken in conjunction with the accompanying drawings. Several embodiments of this application are illustrated in the drawings by way of example and not limitation, in which: In the accompanying drawings, the same or corresponding reference numerals indicate the same or corresponding parts.

[0024] Figure 1 A network topology diagram of the 802.1X authentication system is shown.

[0025] Figure 2 A schematic diagram of the method flow of this application is shown.

[0026] Figure 3 A schematic diagram of the newly added wireless access point module of this application is shown.

[0027] Figure 4 A schematic diagram of the authentication service communication under normal circumstances is shown in this application.

[0028] Figure 5 This diagram illustrates the authentication service communication when the online RADIUS server is unavailable.

[0029] Figure 6 A schematic diagram of the composition structure of an electronic device according to an embodiment of this application is shown. Detailed Implementation

[0030] To make the objectives, features, and advantages of this application more apparent and understandable, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0031] Example 1: This embodiment provides an 802.1X-authenticated escape method, applicable to situations such as... Figure 1The 802.1X authentication system shown includes a wireless access point (AP) and an online RADIUS server connected by communication, and the AP and the online RADIUS server communicate via a switch.

[0032] The authentication system also includes an access controller (AC) responsible for managing wireless access points (APs), and an IP network.

[0033] Please refer to Figure 2 The escape method includes the following steps: S1, as Figure 3 As shown, an escape module and a local RADIUS service module are set in the wireless access point; the certificate information of the local RADIUS service module is consistent with that of the online RADIUS server. Therefore, when switching between the local RADIUS service module and the online RADIUS server, the terminal can directly pass the legitimacy verification without additional configuration or user confirmation, achieving a seamless user experience during the switching process.

[0034] S2, please refer to Figure 4 Under normal circumstances, authentication services are provided by online RADIUS servers; S3, during the process of providing authentication services on the online RADIUS server, the escape module periodically checks whether the online RADIUS server is available. If the detection result is that the online RADIUS server is unavailable, then... Figure 5 As shown, the authentication service is switched to be provided by the local RADIUS service module.

[0035] In step S3, the method by which the escape module periodically checks whether the online RADIUS server is available includes: The escape module initiates a status check every first cycle, which includes port connectivity detection and STATUS message interaction detection. The first cycle can be set according to actual needs, generally 10s or 20s, preferably 10s.

[0036] First, perform a port connectivity test.

[0037] The method for port connectivity detection is as follows: The escape module initiates a connection request to the authentication port (port 1812) of the online RADIUS server, and the online RADIUS server returns an ACK response message after receiving the connection request. If the escape module receives an ACK response message within the set first time period (e.g., 3 seconds), the connection is considered successful; otherwise, the connection fails. If multiple connection failures occur consecutively, the port connectivity test is deemed unqualified; otherwise, the port connectivity test is deemed qualified. Preferably, the number of consecutive connection failures is 3.

[0038] If the port connectivity test fails, the online RADIUS server is determined to be unavailable; otherwise, a STATUS message exchange test is performed.

[0039] Specifically, the method for detecting STATUS message interactions is as follows: In the message construction and transmission process, the escape module immediately constructs a Status-Server request message after the TCP port connectivity test is passed. This Status-Server request message carries a code, an identifier, and a first timestamp. If the TCP port connectivity test fails, this construction step is skipped, and the online RADIUS server is determined to be unavailable.

[0040] The Status-Server request message consists of a header (20 bytes) and attribute fields (variable length). The specific construction rules for the Status-Server request message are as follows:

[0041] The message sending process involves sending the Status-Server request message to the online RADIUS server, while simultaneously caching the code, identifier, and first timestamp in the wireless access point. Upon receiving the Status-Server request message, the online RADIUS server returns a Status-Server response message, which carries the code, identifier, and second timestamp.

[0042] The second timestamp represents the generation time of the Status-Server response message.

[0043] Message reception and parsing: Receive Status-Server response messages and parse the code, message identifier, and second timestamp in the received Status-Server response messages; The comparison and judgment process involves matching the code and message identifier in the received Status-Server response message with the code and identifier cached in the wireless access point. If at least one of the code or message identifier does not match, the Status-Server response message is discarded. If both the code and the message identifier match, then the first timestamp, the second timestamp, and the reception time of the Status-Server response message are combined to determine whether the Status-Server response message has timed out.

[0044] In this embodiment, the method for determining whether the Status-Server response message has timed out by combining the first timestamp, the second timestamp, and the reception time of the Status-Server response message is as follows: The first time difference Δt1 is obtained by subtracting the second timestamp t2 from the first timestamp t1 cached in the wireless access point. The second time difference Δt2 is obtained by subtracting the receiving time t3 from the second timestamp t2. The third time difference Δt3 is obtained by subtracting the receiving time t3 from the first timestamp t1; If the third time difference Δt3 is greater than the set first duration (the first duration here is the same as the first duration in the port connectivity detection), and all first time differences Δt1 and second time differences Δt2 are greater than the set second duration, the Status-Server response message reception is determined to have timed out; otherwise, the Status-Server response message reception does not time out.

[0045] Based on the above, if the Status-Server response message reception times out, the STATUS message interaction detection fails; otherwise, the STATUS message interaction detection passes.

[0046] If the STATUS message exchange test fails, the online RADIUS server is still considered unavailable; if the STATUS message exchange test passes, the online RADIUS server is considered available.

[0047] It should be noted that the values ​​of the three time differences are used together to determine whether the reception of the Status-Server response message has timed out. Since the third time difference Δt3 actually includes two processes, its time is roughly composed of: the time when the Status-Server request message is sent (first time difference Δt1), and the time when the Status-Server response message is sent (second time difference Δt2).

[0048] During the switch to authentication services provided by the local RADIUS service module, the online RADIUS server became unavailable, and the ongoing authentication request could not be completed in time. Therefore, the authentication request that was currently in the authentication process needed to be resent to the local RADIUS service module for authentication.

[0049] This process undoubtedly consumes more service resources and increases the overall system load. Therefore, the determination of whether the Status-Server response message reception times out needs to be more cautious. If only a single process times out, it is considered an acceptable network fluctuation. Only by combining all three time differences can network faults be screened out, thus enabling subsequent switchover.

[0050] S4. During the process of providing authentication services by the local RADIUS service module, the escape module periodically checks whether the online RADIUS server is available. If the detection result is that the online RADIUS server is available, the authentication service is switched back to be provided by the online RADIUS server.

[0051] The method used by the escape module to periodically check whether the online RADIUS server is available is the same as step S3.

[0052] It is worth mentioning that since there is no network failure in the local RADIUS service module, during the process of switching back to the online RADIUS server to provide authentication services, the authentication request that is currently in the authentication process can continue to be completed in the local RADIUS service module without being resent to the online RADIUS server, and the next authentication request can be sent directly to the online RADIUS server for authentication.

[0053] Example 2: In the scheme of Embodiment 1, the determination of whether the online RADIUS server is available is specifically based on the STATUS message interaction detection, which is directly determined by the data of a single status detection. Therefore, there is still a large possibility of misjudgment.

[0054] This second embodiment further improves the comparison and judgment part of the STATUS message interaction detection method based on the first embodiment. Specifically, it improves the STATUS message interaction detection method by combining data from multiple periods during the authentication process provided by the online RADIUS server and the authentication process provided by the local RADIUS service module.

[0055] The method for detecting the interaction of STATUS messages during the online RADIUS server's authentication service is as follows: The escape module constructs and sends a Status-Server request message, which carries a code, an identifier, and a first timestamp. The message sending process sends the Status-Server request message to the online RADIUS server, while caching the code, identifier, and first timestamp in the wireless access point. After receiving the Status-Server request message, the online RADIUS server returns a Status-Server response message, which carries the code, identifier, and second timestamp. Message reception and parsing: Receive Status-Server response messages and parse the code, message identifier, and second timestamp in the received Status-Server response messages; The comparison and judgment process involves matching the code and message identifier in the received Status-Server response message with the code and identifier cached in the wireless access point. If at least one of the code or message identifier does not match, the Status-Server response message is discarded. If both the code and the message identifier match, then the first timestamp, the second timestamp, and the reception time of the Status-Server response message are combined to determine whether the Status-Server response message has timed out.

[0056] The above steps are the same as in Example 1, and will not be described in detail again.

[0057] The new method for determining whether the Status-Server response message has timed out by combining the first timestamp, the second timestamp, and the reception time of the Status-Server response message is as follows: In each cycle, the first time difference Δt1 is obtained by subtracting the second timestamp t2 from the first timestamp t1 cached in the wireless access point; The second time difference Δt2 is obtained by subtracting the receiving time t3 from the second timestamp t2. The third time difference Δt3 is obtained by subtracting the receiving time t3 from the first timestamp t1; The judgment is made by combining the first time difference Δt1, the second time difference Δt2, and the third time difference Δt3 within multiple cycles (such as 3 cycles). Specifically, the Status-Server response message reception is judged to have timed out when both of the following conditions are met at the same time; otherwise, the Status-Server response message reception does not time out.

[0058] Condition 1: All third time differences Δt3 are greater than the set first duration; Condition 2: All first time differences Δt1 are greater than the set second duration, or all second time differences Δt2 are greater than the set second duration.

[0059] If the timeout occurs, the STATUS message interaction check fails; otherwise, the STATUS message interaction check passes.

[0060] This method focuses on considering the timeout of response message reception within a continuous period and requires that the sending time of a single process (Status-Server request message or Status-Server response message) be continuously timed out, thus more strictly limiting the timeout conditions of Status-Server response messages.

[0061] The method for detecting STATUS message interactions during the authentication service provided by the local RADIUS service module differs from that used during the authentication service provided by the online RADIUS server, as detailed below: The escape module constructs and sends a Status-Server request message, which carries a code, an identifier, and a first timestamp. The message sending process sends the Status-Server request message to the online RADIUS server, while caching the code, identifier, and first timestamp in the wireless access point. After receiving the Status-Server request message, the online RADIUS server returns a Status-Server response message, which carries the code, identifier, and second timestamp. Message reception and parsing: Receive Status-Server response messages and parse the code, message identifier, and second timestamp in the received Status-Server response messages; The comparison and judgment process involves matching the code and message identifier in the received Status-Server response message with the code and identifier cached in the wireless access point. If at least one of the code or message identifier does not match, the Status-Server response message is discarded. If both the code and the message identifier match, then the first timestamp, the second timestamp, and the reception time of the Status-Server response message are combined to determine whether the Status-Server response message has timed out.

[0062] The above steps are the same as the methods described above, and will not be repeated here.

[0063] The new method for determining whether the Status-Server response message has timed out by combining the first timestamp, the second timestamp, and the reception time of the Status-Server response message is as follows: In each cycle, the first time difference Δt1 is obtained by subtracting the second timestamp t2 from the first timestamp t1 cached in the wireless access point; The second time difference Δt2 is obtained by subtracting the receiving time t3 from the second timestamp t2. The third time difference Δt3 is obtained by subtracting the receiving time t3 from the first timestamp t1; The judgment is made by combining the first time difference Δt1, the second time difference Δt2, and the third time difference Δt3 within multiple periods. Specifically, if the following two conditions are met at the same time, it is determined that the Status-Server response message reception has not timed out; otherwise, the Status-Server response message reception has timed out.

[0064] Condition 1: All third time differences Δt3 are less than the set first duration; Condition 2: All first time differences Δt1 are less than the set second duration, or all second time differences Δt2 are less than the set second duration.

[0065] If the timeout occurs, the STATUS message interaction check fails; otherwise, the STATUS message interaction check passes.

[0066] Compared to the online RADIUS server providing authentication services, this method sets stricter conditions for not timeout, thereby ensuring the stability of the online RADIUS server in restoring its usability.

[0067] It is worth mentioning that, in order to switch the authentication service to online as soon as possible, when the third time difference Δt3 is less than the set first duration for the first time during the process of providing authentication service in the local RADIUS service module, the first cycle of status detection is modified to the second cycle, which is shorter than the first cycle, in order to shorten the detection cycle; and after switching back to providing authentication service by the online RADIUS server, the second cycle of status detection is restored to the first cycle.

[0068] Example 3: This embodiment also provides an electronic device and a readable storage medium.

[0069] Figure 6A schematic block diagram of an example electronic device that can be used to implement embodiments of this application is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the application described and / or claimed herein.

[0070] like Figure 6 As shown, the device includes a computing unit that can perform various appropriate actions and processes based on a computer program stored in read-only memory (ROM) or a computer program loaded from a storage unit into random access memory (RAM). The RAM can also store various programs and data required for device operation. The computing unit, ROM, and RAM are interconnected via a bus. Input / output (I / O) interfaces are also connected to the bus.

[0071] Multiple components in the device are connected to the I / O interface, including: input units such as keyboards and mice; output units such as various types of displays and speakers; storage units such as disks and optical discs; and communication units such as network interface cards (NICs), modems, and wireless transceivers. The communication unit allows the device to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0072] The computing unit can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of computing units include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit performs the various methods and processes described above, such as the 802.1X authentication escape method described in Embodiment 1. For example, in some embodiments, the 802.1X authentication escape method can be implemented as a computer software program tangibly contained in a machine-readable medium, such as a storage unit. In some embodiments, part or all of the computer program can be loaded and / or installed on the device via ROM and / or a communication unit. When the computer program is loaded into RAM and executed by the computing unit, one or more steps of the 802.1X authentication escape method described above can be performed. Alternatively, in other embodiments, the computing unit can be configured to perform the 802.1X authentication escape method by any other suitable means (e.g., by means of firmware).

[0073] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0074] The program code used to implement the methods of this application may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing device, such that when executed by the processor or controller, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0075] In the context of this application, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable media can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0076] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0077] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0078] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, servers in distributed systems, or servers incorporating blockchain technology.

[0079] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this application can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this application can be achieved, and this is not limited herein.

[0080] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "a plurality of" means two or more, unless otherwise explicitly specified.

[0081] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. An escape method using 802.1X authentication, applied to an 802.1X authentication system, wherein the 802.1X authentication system includes a wireless access point with communication connection and an online RADIUS server, characterized in that, The escape method includes the following steps: S1, An escape module and a local RADIUS service module are installed in the wireless access point; the certificate information of the local RADIUS service module is consistent with that of the online RADIUS server. S2, under normal circumstances, is provided with authentication services by an online RADIUS server; S3. During the process of providing authentication services on the online RADIUS server, the escape module periodically checks whether the online RADIUS server is available. If the detection result is that the online RADIUS server is unavailable, the authentication service is switched to be provided by the local RADIUS service module. S4. During the process of providing authentication services by the local RADIUS service module, the escape module periodically checks whether the online RADIUS server is available. If the detection result is that the online RADIUS server is available, the authentication service is switched back to be provided by the online RADIUS server.

2. The 802.1X-authenticated escape method according to claim 1, characterized in that, The method by which the escape module periodically checks whether the online RADIUS server is available includes: The escape module initiates a status check every first cycle, and the status check includes port connectivity check and STATUS message interaction check. First, perform port connectivity testing; If the port connectivity test fails, the online RADIUS server is determined to be unavailable; otherwise, a STATUS message exchange test is performed. If the STATUS message exchange test fails, the online RADIUS server is still considered unavailable; if the STATUS message exchange test passes, the online RADIUS server is considered available.

3. The 802.1X-authenticated escape method according to claim 2, characterized in that, The method for port connectivity detection is as follows: The escape module initiates a connection request to the authentication port of the online RADIUS server, and the online RADIUS server returns an ACK response message after receiving the connection request. If the escape module receives an ACK response message within the set first time period, the connection is considered successful; otherwise, the connection fails. If multiple connection failures occur consecutively, the port connectivity test is deemed unqualified; otherwise, the port connectivity test is deemed qualified.

4. The 802.1X-authenticated escape method according to claim 2, characterized in that, The method for detecting STATUS message interactions is as follows: The escape module constructs and sends a Status-Server request message, which carries a code, an identifier, and a first timestamp. The message sending process sends the Status-Server request message to the online RADIUS server, while caching the code, identifier, and first timestamp in the wireless access point. After receiving the Status-Server request message, the online RADIUS server returns a Status-Server response message, which carries the code, identifier, and second timestamp. Message reception and parsing: Receive Status-Server response messages and parse the code, message identifier, and second timestamp in the received Status-Server response messages; The comparison and judgment process involves matching the code and message identifier in the received Status-Server response message with the code and identifier cached in the wireless access point. If at least one of the code or message identifier does not match, the Status-Server response message is discarded. If both the code and the message identifier match, then the first timestamp, the second timestamp, and the reception time of the Status-Server response message are combined to determine whether the Status-Server response message has timed out. If the timeout occurs, the STATUS message interaction check fails; otherwise, the STATUS message interaction check passes.

5. The 802.1X-authenticated escape method according to claim 4, characterized in that, The method for determining whether the Status-Server response message has timed out by combining the first timestamp, the second timestamp, and the reception time of the Status-Server response message is as follows: The first time difference is obtained by subtracting the second timestamp from the first timestamp cached in the wireless access point. The second time difference is obtained by subtracting the receiving time from the second timestamp; The third time difference is obtained by subtracting the receiving time from the first timestamp; If the third time difference is greater than the set first time interval, and all first time differences and second time differences are greater than the set second time interval, the Status-Server response message reception is determined to have timed out; otherwise, the Status-Server response message reception does not time out.

6. The 802.1X-authenticated escape method according to claim 5, characterized in that, During the authentication service provided by the local RADIUS service module, when the third time difference is less than the set first duration for the first time, the first period of status detection is modified to the second period, which is shorter than the first period; and after switching back to the online RADIUS server to provide authentication service, the second period of status detection is restored to the first period.

7. The 802.1X-authenticated escape method according to claim 1, characterized in that, During the process of switching to authentication services provided by the local RADIUS service module, the authentication request that is currently in the authentication process is resent to the local RADIUS service module for authentication.

8. The escape method with 802.1X authentication according to claim 1, characterized in that, During the process of switching back to the online RADIUS server providing authentication services, the authentication request that is currently in the authentication process will continue to be completed in the local RADIUS service module, and the next authentication request will be sent to the online RADIUS server for authentication.

9. An electronic device, characterized in that, include: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-8.

10. A non-transitory computer-readable storage medium storing computer instructions, characterized in that, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-8.

Images