A method and apparatus for authenticating user priority management

Abstract

The application discloses a kind of authentication user priority management method and device, belong to network communication technical field.Authentication user priority management method includes: when receiving the authentication request of access user, determine the dynamic priority of access user currently, according to dynamic priority processing the authentication request of access user;Wherein, determine the dynamic priority of access user currently includes: according to authentication request in priority queue is matched, corresponding priority of priority queue is configured as the dynamic priority of access user currently;According to the authentication data of access user in authentication procedure, dynamic priority is updated.The application introduces priority queue mechanism, breaks the mode of traditional using uniform queue FIFO form processing, when carrying out authentication to user, no longer according to the reception time of authentication request processing request, but according to the corresponding priority order of user configuration in priority queue, carries out authentication to user, realizes the regulation and control to user authentication order.

Description

Technical Field

[0001] This invention relates to the field of network communication technology, and specifically to a method and apparatus for managing the priority of authenticated users. Background Technology

[0002] 802.1X authentication is a port-based network access control protocol, also known as EAPOE (Extensible Authentication Protocol Over Ethernet) authentication. Its primary purpose is to solve the authentication problem for users accessing local area networks (LANs), and it is widely used, especially in scenarios with concentrated users or strict information security requirements, such as enterprise networks and campus networks. It is a typical client / server architecture, including a user client (Supplicant System), an access device (Authenticator System), and an authentication server (Authentication Server System).

[0003] The entire process of 802.1X certification is as follows: Figure 1 As shown, in Figure 1 In English, EAPoL stands for EAP over LAN (Extensible Authentication Protocol Encapsulation for Local Area Networks), used for authentication message transmission between clients and access devices (switches / APs); EAPoR stands for EAP over RADIUS (Extensible Authentication Protocol Encapsulation for RADIUS), used for authentication message transmission between access devices (switches / APs) and authentication servers (RADIUS servers).

[0004] The following example illustrates how authentication is triggered by the authentication client sending an EAPOL-Start message (EAPoL authentication start message):

[0005] ① When a user needs to access an external network, they open the 802.1X client, enter the username and password they have already applied for and registered, and initiate a connection request. At this time, the client will send an authentication start message (EAPoL-Start) to the access device to begin an authentication process.

[0006] ② After receiving the authentication request message, the access device will send an EAP identity request message (EAP-Request / Identity) of type Identity, requesting the user's client program to send the entered username.

[0007] ③ The client program responds to the request from the access device by sending the username information to the access device through an EAP identity response message (EAP-Response / Identity) of type Identity.

[0008] ④ The access device encapsulates the EAP identity response message sent by the client in a RADIUS access-Request message and sends it to the authentication server for processing.

[0009] ⑤ After receiving the username forwarded by the access device, the RADIUS server compares the username with the username list in the database, finds the password information corresponding to the username, encrypts the password with a randomly generated MD5 challenge code (MD5Challenge), and sends this MD5 Challenge to the access device through a RADIUS Access-Challenge message.

[0010] ⑥ The access device forwards the MD5 Challenge sent by the RADIUS server to the client via an EAP Challenge Request / MD5 Challenge message.

[0011] ⑦ After receiving the MD5 Challenge from the access device, the client uses the MD5 Challenge to encrypt the password, generates an EAP Challenge Response (EAP-Response / MD5 Challenge) message, and sends it to the access device.

[0012] ⑧ The access device encapsulates this EAP-Response / MD5 Challenge message in a RADIUS Access-Request message and sends it to the RADIUS server.

[0013] 9. The RADIUS server compares the received encrypted password with the locally encrypted password. If they match, the user is considered legitimate, and a RADIUS Access-Accept message is sent to the access device. If the RADIUS server finds that the received encrypted password and the locally encrypted password do not match, the user is considered illegitimate, and a RADIUS Access-Reject message is sent to the access device.

[0014] ⑩ Upon receiving an authentication success message, the access device sends an EAP authentication success message (EAP-Success) to the client and changes the port status to authorized, allowing the user to access the network through that port. Upon receiving an access rejection message, the access device sends an EAP authentication failure message (EAP-Failure) to the client and changes the port status to unauthorized, denying the user access to the network through that port.

[0015] The client can proactively request to go offline. First, it sends an EAPoL logoff message (EAPOL-Logoff) to the access device. The access device then sends the logoff information to the RADIUS server. The RADIUS server sends a response message to the access device. After responding to the client, the access device removes the client from the authentication port to complete the logoff function.

[0016] Based on the above complete authentication process, it can be seen that the access device needs to interact with the authentication client 6 times (①②③⑥⑦⑩) and with the authentication server 4 times (④⑤⑧⑨).

[0017] User clients, also known as authenticated users, can be critical devices such as servers and administrator devices, or temporary devices such as ordinary employee devices or visitor devices. Different devices among these authenticated users perform different tasks, each with varying importance. For example, a DHCP server is responsible for distributing IP addresses to devices on the network, administrator devices are responsible for granting access permissions to employees, and ordinary employee devices may have different levels of permissions depending on their department. In a production environment, employee devices must obtain an IP address via DHCP before they can access the operating system; otherwise, they will automatically shut down due to the inability to access the system, rendering them unusable. Therefore, when a DHCP server and an ordinary employee device are authenticating simultaneously, we prefer that the DHCP server prioritize successful authentication to enable service functionality.

[0018] The access device is a switch, which is responsible for receiving authentication requests from all user clients within the local area network. It then performs the task of sending and receiving authentication messages between the user clients and the authentication server. Therefore, the order in which it processes user clients will directly affect the authentication order.

[0019] The inventors recognized that current access devices, after enabling 802.1X authentication, use a unified queue FIFO approach, meaning the authentication process is executed according to the order in which authentication messages are received. Therefore, the order in which user client messages are received determines the authentication order, making it impossible to control the authentication order of users and thus failing to achieve the function of prioritizing authentication for specific users. Summary of the Invention

[0020] The present invention mainly addresses the technical problem that current access devices cannot control the authentication order of authenticated users.

[0021] According to the first aspect, one embodiment provides an authentication user priority management method, including:

[0022] When an authentication request from an access user is received, the current dynamic priority of the access user is determined, and the authentication request is processed according to the dynamic priority. The determination of the current dynamic priority of the access user includes: matching the authentication request in a priority queue, and using the corresponding priority configured in the priority queue as the current dynamic priority of the access user.

[0023] The dynamic priority is updated based on the authentication data of the access user in the authentication process.

[0024] In one embodiment, the step of matching authentication requests in a priority queue and using the corresponding priority configured in the priority queue as the current dynamic priority of the access user includes:

[0025] Obtain the authentication information of the accessing user from the authentication request message;

[0026] Based on the authentication information and preset matching conditions, the access users are compared and matched in the priority queue;

[0027] If a match is successful, the corresponding priority configured in the priority queue that meets the matching conditions will be used as the current dynamic priority of the access user.

[0028] If a match fails, the access user will be added to the specified priority queue, and the corresponding priority will be configured for the access user as the current dynamic priority of the access user.

[0029] The matching conditions include at least one of the following: identity-related matching conditions, device-related matching conditions, network-related matching conditions, time-related matching conditions, security-related matching conditions, and priority configuration-related matching conditions.

[0030] In one embodiment, the priority queue includes multiple priority queues with different priority levels; the initial priority of each access user in each priority queue is calculated based on the inter-queue priority of the priority queue in which the access user is located and the corresponding internal priority of the access user in the priority queue.

[0031] The method further includes:

[0032] The access users in each priority queue are dynamically adjusted periodically according to the current dynamic priority of each access user, so that the priority of each access user is adapted to the priority level of the priority queue in which it belongs, and the load is balanced among the multiple priority queues with different priority levels.

[0033] In one embodiment, updating the dynamic priority based on the authentication data of the access user in the authentication process includes:

[0034] Calculate the dynamic adjustment factor based on the authentication data of the access user in the authentication process;

[0035] The dynamic priority is updated using the dynamic adjustment factor.

[0036] In one embodiment, the authentication data includes at least one of authentication frequency, execution duration, and network environment parameters. The authentication frequency is the average number of authentication attempts made by the access user within a time window. The execution duration is the time interval between receiving an authentication request from the access user and sending the authentication result to the access user. The network environment parameters include the network conditions between the access device, the client, and the authentication server.

[0037] The step of calculating the dynamic adjustment factor based on the authentication data of the access user in the authentication process includes:

[0038] Calculate the certification frequency factor based on the certification frequency;

[0039] Calculate the execution duration factor based on the execution duration;

[0040] Calculate the network quality factor based on network environment parameters;

[0041] The dynamic adjustment factor is calculated based on the execution duration factor, authentication frequency factor, and network quality factor.

[0042] In one embodiment, the dynamic adjustment factor is calculated in the following manner:

[0043] The dynamic adjustment factor bonus = frequency_factor × duration_factor × network_factor × weight_factor, where frequency_factor is the authentication frequency factor, duration_factor is the execution duration factor, network_factor is the network quality factor, and weight_factor is the weight.

[0044] The dynamic priority is updated in the following way:

[0045] The updated dynamic priority is calculated as base_priority + bonus, where base_priority is the current dynamic priority and bonus is the dynamic adjustment factor.

[0046] In one embodiment, the method further includes:

[0047] Based on the processing time between the access device and the access user, and the processing time between the access device and the authentication server during each authentication, the client-side and server-side round-robin time slice sizes in the priority queue during the authentication process are adjusted respectively.

[0048] In one embodiment, adjusting the client-side round-robin time slice size and the server-side round-robin time slice size in the priority queue during the authentication process based on the processing time between the access device and the access user, and the processing time between the access device and the authentication server during each authentication, includes:

[0049] Based on the processing time data between the access device and the access user during each authentication, and the processing time data between the access device and the authentication server, the statistical feature counts of the client processing time data and the statistical feature counts of the server processing time data are calculated respectively.

[0050] Based on the statistical characteristics of the client-side processing time data and the statistical characteristics of the server-side processing time data, calculate the client-side stability adjustment factor and the server-side stability adjustment factor respectively.

[0051] Based on the proportion of outliers in the processing time data between the access device and the access user, and the proportion of outliers in the processing time data between the access device and the authentication server, calculate the client-side outlier adjustment factor and the server-side outlier adjustment factor respectively.

[0052] Based on the client stability adjustment factor, the client outlier adjustment factor, the server stability adjustment factor, and the server outlier adjustment factor, the optimal time slice size for the client and the optimal time slice size for the server are calculated respectively. The client round-robin time slice size and the server round-robin time slice size in the priority queue during the authentication process are then set to the calculated optimal time slice size.

[0053] In one embodiment, the optimal time slice size for the client and the optimal time slice size for the server are calculated in the following manner:

[0054] The optimal time slice size, timer_value, is calculated as σ × stability_factor × anomaly_factor. For the client, σ is the standard deviation of the statistical features of the client's processing time data, stability_factor is the client's stability adjustment factor, and anomaly_factor is the client's outlier adjustment factor. For the server, σ is the standard deviation of the statistical features of the server's processing time data, stability_factor is the server's stability adjustment factor, and anomaly_factor is the server's outlier adjustment factor.

[0055] According to a second aspect, one embodiment provides an authentication user priority management device, comprising:

[0056] Memory, used to store programs;

[0057] A processor for implementing the steps in the method involved in the first aspect by executing the program.

[0058] In the above-described method and apparatus for managing user authentication priorities, a priority queue mechanism is introduced, breaking the traditional FIFO processing mode using a unified queue. When authenticating users, the authentication request is no longer processed based on the time it is received, but rather according to the priority order configured by the user in the priority queue. This allows higher-priority users to receive authentication resources and have their authentication requests responded to first, while authentication requests from ordinary-priority users are processed sequentially after high-priority requests are completed. This priority-based authentication scheduling method enables control over the user authentication order. Furthermore, the invention dynamically adjusts priorities in real time based on user performance during the authentication process, avoiding low-priority task starvation and improving system fairness and resource utilization. Attached Figure Description

[0059] Figure 1 Flowchart of 802.1X certification process;

[0060] Figure 2 This is a flowchart of an authentication user priority management method in one embodiment;

[0061] Figure 3 This is a schematic diagram of a user matching module in one embodiment;

[0062] Figure 4 This is a schematic diagram illustrating the operation of the data collection module in one embodiment;

[0063] Figure 5 This is a schematic diagram illustrating the operation of the queue management module in one embodiment;

[0064] Figure 6 This is a schematic diagram illustrating the operation of the priority calculation module in one embodiment;

[0065] Figure 7 This is a schematic diagram of the operation of the adaptive processing time slice module in one embodiment;

[0066] Figure 8 This is a schematic diagram illustrating the operation of an authentication user priority management system in one embodiment;

[0067] Figure 9 This is a comparison chart of the effectiveness of priority queue management in one embodiment. Detailed Implementation

[0068] The present invention will now be described in further detail with reference to specific embodiments and accompanying drawings. Similar elements in different embodiments are referred to by associated similar element reference numerals. In the following embodiments, many details are described to facilitate a better understanding of the invention. However, those skilled in the art will readily recognize that some features may be omitted in different situations, or may be replaced by other elements, materials, or methods. In some cases, certain operations related to the present invention are not shown or described in the specification. This is to avoid obscuring the core parts of the invention with excessive description. For those skilled in the art, detailed description of these related operations is not necessary; they can fully understand the related operations based on the description in the specification and general technical knowledge in the art.

[0069] Furthermore, the features, operations, or characteristics described in the specification can be combined in any suitable manner to form various embodiments. At the same time, the steps or actions in the method description can be rearranged or adjusted in a manner obvious to those skilled in the art. Therefore, the various orders in the specification and drawings are only for the clear description of a particular embodiment and do not imply a necessary order, unless otherwise stated that a particular order must be followed.

[0070] The serial numbers assigned to components in this document, such as "first" and "second," are used only to distinguish the described objects and have no sequential or technical meaning. The terms "connection" and "linkage" used in this invention, unless otherwise specified, include both direct and indirect connections (linkages).

[0071] In the 802.1X LAN access authentication scenario, the current access device does not have the concept of user authentication priority, nor does it have the function to configure the authentication order and priority of users. After receiving the authentication request from the authentication client, it starts to execute the authentication process. Therefore, for users in the same batch of authentication, the order in which they pass authentication is completely unpredictable and unguaranteed, and it is impossible to control the authentication order of user devices.

[0072] Furthermore, in actual production environments, access devices typically need to enable multicast triggering to support user clients that cannot actively send EAPoL-Start messages, such as the 802.1X client included with Windows XP. In this case, the access device will actively send multicast authentication messages, and all user clients within the local area network will respond with authentication. Because the access device needs to send the authentication messages to the CPU and deliver them to the authentication module for subsequent authentication processing, when the number of authentication users within the local area network is large—that is, when the access device receives an excessive number of authentication request messages simultaneously—it will randomly discard some users' authentication request messages.

[0073] Based on the above, this invention aims to ensure that when the access device receives an excessive number of authentication request messages, the authentication messages of some users are not overwritten. It also hopes that the authentication order can be controlled, for example, some server devices can be authenticated first, followed by key devices such as administrator devices, and finally ordinary employee devices and temporary devices such as visitors.

[0074] To address this, embodiments of the present invention provide a method and system for managing authentication user priorities, enabling the control of the authentication order of authentication user devices triggered in the same batch on the access device. Specifically, it relates to an 802.1X authentication user management system and method based on dynamic priority and adaptive processing time slices, particularly suitable for large-scale user authentication scenarios such as campus networks and enterprise networks. Furthermore, through a dynamic priority algorithm, even without configuring user priorities on the device, the system can ensure the smooth authentication process for key users based on historical authentication data. Figure 2 As shown, the method includes:

[0075] S1, when an authentication request from an access user is received, determine the current dynamic priority of the access user and process the authentication request according to the dynamic priority; wherein, determining the current dynamic priority of the access user includes: matching the authentication request in the priority queue and taking the corresponding priority configured in the priority queue as the current dynamic priority of the access user.

[0076] As an optional implementation, matching is performed in a priority queue based on the authentication request, and the corresponding priority configured in the priority queue is used as the current dynamic priority of the access user, including:

[0077] Obtain the authentication information of the accessing user from the authentication request message;

[0078] Based on the authentication information and preset matching conditions, the access users are compared and matched in the priority queue;

[0079] If a match is successful, the corresponding priority configured in the priority queue that meets the matching conditions will be used as the current dynamic priority of the access user.

[0080] If a match fails, the access user will be added to the specified priority queue, and the corresponding priority will be configured for the access user as the current dynamic priority.

[0081] Specifically, the matching criteria include at least one of the following: identity-related matching criteria, device-related matching criteria, network-related matching criteria, time-related matching criteria, security-related matching criteria, and priority configuration-related matching criteria. Correspondingly, the authentication information also includes information such as user identity, device, network, and authentication time.

[0082] In other words, the access device includes a user matching module that matches users based on multiple dimensions such as identity, device, network, time, and security, supporting both exact and fuzzy matching. Additionally, the priority queue includes multiple priority queues with different priority levels: high, medium, low, and default. These four priority queues are managed through a queue management module.

[0083] The user matching module works synchronously with the queue management module. The queue management module has three priority queues: high, medium, and low, which support user addition. Operators can select a priority queue to add user matching conditions. The order in which users are added also represents the priority of the user in the current queue.

[0084] A typical 802.1X authentication request message contains basic information such as the user client's source MAC address, authentication username, and request number. When the access device receives this message, it also knows the port information, such as port number, VLAN ID, and port mode. Furthermore, the user client and the access device interact via the EAPoL protocol, which is an extensible message whose last field is customizable, allowing for the addition of user information, device information, certificate information, etc.

[0085] Therefore, based on these known or expandable contents, the method provided by the embodiments of the present invention supports a wide range of user matching conditions:

[0086] 1. Identity-based matching criteria: Username (supports exact match and wildcard match), Domain (supports multiple domain configurations), User group ID (supports group ID range configuration);

[0087] 2. Based on device-related matching conditions: MAC address (supports MAC address range and mask), device type (server, workstation, mobile device, etc.), trust level (high, medium, and low levels), device manufacturer (Cisco, Huawei, H3C, etc.);

[0088] 3. Based on network-related matching conditions: VLAN ID (supports VLAN range configuration), port mode (Access, Trunk, Hybrid), port priority (high, medium, and low levels), and network segment (IP address range configuration);

[0089] 4. Time-related matching conditions: Time range (supports time period configuration), Workday (distinguishes between workdays and rest days), Peak hours (supports peak hour configuration), Custom (supports custom time rules);

[0090] 5. Security-related matching conditions: Certificate requirements (whether a digital certificate is required), encryption level (AES-128, AES-256, etc.), multi-factor authentication (whether multi-factor authentication is enabled), security policy (associated security policy ID);

[0091] 6. Priority configuration related matching conditions: effective time (immediately effective or scheduled effective), expiration time (never expires or scheduled expiration).

[0092] User matching criteria can be further expanded. Currently, multi-dimensional user matching is supported, and 802.1X itself supports extended protocols. If content is added to the protocol in the future, corresponding user matching criteria can also be added accordingly.

[0093] These matching conditions reveal that administrators can set precise matching criteria for a specific user, or match a category of users using masks or ranges. They can also assign priorities to specific users or user categories, thereby controlling the authentication order of these users based on priority. This offers operators greater flexibility and usability, and the user matching module operates smoothly. Figure 3 As shown.

[0094] Preferably, the queue management module manages four priority queues: high, medium, low, and default. It supports dynamic adjustment of users between queues. The high, medium, and low queues can be configured with a maximum number of users, while the default queue has no limit. Operators can add a specific user or a category of users to the high, medium, and low priority queues. Users within the same queue also have different priorities, determined by their configuration order, i.e., their configuration priority.

[0095] In other words, the initial priority of each access user in each priority queue is calculated based on the inter-queue priority of the priority queue in which the access user belongs, and the corresponding internal priority of the access user in the priority queue. Specifically, the formula for calculating the user's base priority is base_priority = queue_priority + allocation_priority, where queue_priority is the inter-queue priority, and allocation_priority is the user's configured priority (internal priority) in that queue. This initial priority ensures that the lowest user priority value in the high-priority queue is still greater than the highest user priority value in the medium-priority queue.

[0096] After running, the access device matches users in the high, medium, and low priority queues in turn according to the received authentication request messages. If a match is successful, the user is added to the corresponding queue; if no match is found, the user is added to the default priority queue.

[0097] The number and depth of priority queues are scalable. The current system can be configured with three priority queues: high, medium, and low. If the production environment is more complex, more priority queues can be added to ensure more accurate priority division.

[0098] S2 updates the dynamic priority based on the authentication data of the access user in the authentication process.

[0099] As an optional implementation method, the dynamic priority is updated based on the authentication data of the access user in the authentication process, specifically including:

[0100] Calculate the dynamic adjustment factor based on the authentication data of the access user in the authentication process;

[0101] The dynamic priority is updated using a dynamic adjustment factor.

[0102] The authentication data includes at least one of authentication frequency, execution time, and network environment parameters. The authentication frequency is the average number of authentication attempts made by the access user within a time window. The execution time is the time interval between receiving the authentication request from the access user and sending the authentication result to the access user. The network environment parameters include the network conditions between the access device, the client, and the authentication server.

[0103] In other words, the access device includes a data collection module responsible for collecting data such as authentication frequency, execution time, and network environment parameters during the user authentication process. This module contains sub-components such as an authentication frequency statistician, an execution time collector, and a network environment monitor.

[0104] The authentication frequency counter records the number of times each user triggers authentication: the authentication count is incremented by 1 when the access device receives an authentication request message from the user device. The execution time collector collects the execution time for each user: the interval between the timestamp of the access device receiving the user device's authentication request message and the timestamp of sending the authentication result to the user device, i.e., the time to complete the entire process, is the execution time. The network environment monitor monitors the network conditions between the access device, the user client, and the authentication server in real time: the access device uses the heartbeat mechanism in the 802.1X extended protocol to monitor packet loss and network latency at both ends in real time.

[0105] Furthermore, based on the authentication data of the access user during the authentication process, a dynamic adjustment factor is calculated, including:

[0106] Calculate the certification frequency factor based on the certification frequency;

[0107] Calculate the execution duration factor based on the execution duration;

[0108] Calculate the network quality factor based on network environment parameters;

[0109] The dynamic adjustment factor is calculated based on the execution duration factor, authentication frequency factor, and network quality factor.

[0110] Specifically, the authentication frequency factor for each user can be calculated using the authentication frequency statistician. The formula is: frequency_factor=min(1.0,auth_count / time_window), where auth_count is the user's authentication count and time_window is the window duration, which can be 10s. This formula can be used to calculate the frequency of authentication for the user per unit time, which is its authentication frequency factor.

[0111] The execution duration factor for each user can be calculated using the user execution duration collector. The calculation formula is: duration_factor=max(0.5,min(2.0,avg_duration / baseline_duration)), where avg_duration is the average execution duration of the user and baseline_duration is the baseline duration of 1 second. The execution duration period of a user calculated using this formula is its execution duration factor.

[0112] The network environment monitor can calculate the user's current network quality factor using the formula: network_factor = 1.0 - (packet_loss_rate + latency_factor), where packet_loss_rate is the packet loss rate and latency_factor is the network latency factor. The data collection module operates as follows... Figure 4 As shown.

[0113] As an optional implementation, the number of access users in each priority queue is dynamically adjusted periodically according to the current dynamic priority of each access user, so that the priority of each access user is adapted to the priority level of the priority queue in which it belongs, and the load is balanced among multiple priority queues with different priority levels.

[0114] In other words, as the system runs, each user's priority value is constantly updated, and the users in the priority queue are dynamically adjusted. For example, if a high-priority user has not been authenticated for a long time, their priority value will gradually decrease. When their value becomes lower than that of the user with the highest priority value in the medium-priority queue, the two users will be swapped in the queue. This dynamic adjustment ensures that inactive users do not occupy high priority for extended periods, while allowing users who need authentication to do so quickly.

[0115] The current dynamic adjustment period is 10 seconds, consistent with the window period of the aforementioned authentication frequency factor. Since the number of users in the priority queue may vary (e.g., a high-priority queue with only a few users, while a medium-priority queue has thousands), resources would be wasted during high-priority queue processing. Therefore, the method provided in this embodiment of the invention also employs a sliding window algorithm to achieve load balancing across the entire priority queue during dynamic adjustment.

[0116] Priority adjustments will be primarily based on user base priority, ensuring that users in the high, medium, and low priority queues are those configured by the operator. The queue management module operates as follows: Figure 5 As shown.

[0117] The access device is equipped with a priority calculation module, which calculates and updates the dynamic priority based on the user's current dynamic priority (initially the basic priority mentioned above), authentication frequency, execution time, and network quality.

[0118] Dynamic priority is updated in the following ways:

[0119] The updated dynamic priority is calculated as: priority = base_priority + bonus, where base_priority is the current dynamic priority (initially the base priority), and bonus is a dynamic adjustment factor. The user's base priority is determined after system startup, is configured by the queue user, and dominates the entire priority calculation.

[0120] The dynamic adjustment factor, bonus, is calculated from the authentication frequency, execution duration, and network quality. Its calculation formula is bonus = frequency_factor × duration_factor × network_factor × weight_factor, where frequency_factor is the authentication frequency factor, duration_factor is the execution duration factor, network_factor is the network quality factor, and weight_factor is the weight factor. This value can be a fixed value of 0.3.

[0121] Since the authentication frequency factor window is 10 seconds, the user priority refresh cycle is also 10 seconds. As mentioned above, with each update of a user's priority value, the order of users in the priority queue is adjusted accordingly to ensure the dynamic update effect of the entire system. The priority calculation module operates as follows: Figure 6 As shown.

[0122] This invention provides a dynamic priority queue management method, employing four priority queues: high, medium, low, and default. Authentication users can be configured in the high, medium, and low priority queues on the device. When the device receives an authentication request message from a user client, it sequentially matches the configured authentication users in the high, medium, and low priority queues. If a match is found, the user is assigned an initial priority value and added to the corresponding queue. If the user is not among the configured priority users, they are assigned to the default priority queue and assigned a default initial priority value. In subsequent authentication processes, the interaction order with the user client and authentication server is based on the priority of the users in the priority queues.

[0123] Within a certain timeframe, the system dynamically calculates the priority value of each user based on the data information in the authentication process. Then, it periodically reallocates queue users using a sliding window algorithm, ensuring that the high-priority queue always contains the users most in need of processing. This dynamic priority adjustment method not only guarantees the configured user authentication order but also avoids the problem of frequently used users being stuck in the priority queue due to unused "zombie" users occupying it for extended periods.

[0124] Furthermore, due to performance limitations, access devices cannot simultaneously process authentication messages from both user clients and authentication servers. Therefore, they typically use a time-slice rotation to process messages from both ends sequentially. This time slice is fixed at 1 second after system initialization. The inventors recognized that this processing method would lead to:

[0125] (1) When there are few users or the network environment is good, users can complete the process of this stage in a very short time. However, since the time slice has not yet arrived, they need to wait for the time slice to arrive before they can execute, which reduces the authentication efficiency.

[0126] (2) When the number of users is large or the network quality is low, the user has not completed the authentication process within the time slice, but since the time slice has ended, the user needs to switch the process to confirm the user status, thereby blocking the triggering of new users or the switching of authentication status, which may cause the user to re-authenticate due to timeout issues.

[0127] For access devices, the authentication server is relatively fixed, so the message exchange time between the access device and the authentication server is also relatively fixed. However, the network location of the user client is variable, so the message exchange time between the user client and the access device is also variable. Because this invention uses a priority queue method, users in each queue largely come from the same local area network or are kept relatively consistent after dynamic priority adjustments. Therefore, for a user in a priority queue, the message exchange time between the user and the access device is also relatively consistent.

[0128] Based on these characteristics, time-slice rotation can be performed at the queue level, adjusting the time slice size at both ends according to the processing time between the user and the access device in each queue, and the processing time between the access device and the authentication server. Since the processing time at both ends will inevitably fluctuate with network conditions, adaptively adjusting the time slice size by calculating the processing time at each end in real time will significantly improve the authentication efficiency throughout the process.

[0129] In other words, as an optional implementation, the method provided by the present invention further includes:

[0130] Based on the processing time between the access device and the access user, and the processing time between the access device and the authentication server during each authentication, the client-side and server-side round-robin time slice sizes in the priority queue during the authentication process are adjusted respectively.

[0131] The processing time between the access device and the access user includes the time interval between the access device sending an EAP-Request / Identity message to the client and receiving an EAP-Response / Identity message from the client; it also includes the time interval between the access device sending an EAP-Request / MD5-Challenge message to the client and receiving an EAP-Response / MD5-Challenge message from the client.

[0132] The processing time between the access device and the authentication server includes the time interval between the access device sending a RADIUS Access-Request message to the server and receiving a RADIUS Access-Challenge message from the server; it also includes the time interval between the access device sending a RADIUS Access-Request message to the server and receiving a RADIUS Access-Accept / Access-Reject message from the server.

[0133] In other words, the processing time is calculated for each information exchange and message round trip between the access device and the client or authentication server.

[0134] In other words, an adaptive processing time slice module is set up in the access device to adjust the response time slice value in real time according to the processing time of users in each priority queue, and to adjust the time slice size at both ends according to the processing time between users and the access device in each queue and the processing time between the access device and the authentication server.

[0135] Furthermore, based on the processing time between the access device and the access user during each authentication, and the processing time between the access device and the authentication server, the client-side round-robin time slice size and the server-side round-robin time slice size of the priority queue during the authentication process are adjusted respectively, including:

[0136] Based on the processing time data between the access device and the access user during each authentication, and the processing time data between the access device and the authentication server, the statistical feature counts of the client processing time data and the statistical feature counts of the server processing time data are calculated respectively.

[0137] Based on the statistical characteristics of the client-side processing time data and the statistical characteristics of the server-side processing time data, calculate the client-side stability adjustment factor and the server-side stability adjustment factor respectively.

[0138] Based on the proportion of outliers in the processing time data between the access device and the access user, and the proportion of outliers in the processing time data between the access device and the authentication server, calculate the client-side outlier adjustment factor and the server-side outlier adjustment factor respectively.

[0139] Based on the client stability adjustment factor, the client outlier adjustment factor, the server stability adjustment factor, and the server outlier adjustment factor, the optimal time slice size for the client and the optimal time slice size for the server are calculated respectively. The client round-robin time slice size and the server round-robin time slice size in the priority queue during the authentication process are then set to the calculated optimal time slice size.

[0140] Specifically, the client-side stability adjustment factor and the server-side stability adjustment factor are calculated in the following ways:

[0141] The stability adjustment factor is set to stability_factor = 1.0 + (σ² / μ - A) × B, where A and B are constants greater than 0 and less than 1, and A and B can be 0.1. For the client-side stability adjustment factor, σ² is the variance of the client-side processing time data, and μ is the average processing time of the client-side processing time data. For the server-side stability adjustment factor, σ² is the variance of the server-side processing time data, and μ is the average processing time of the server-side processing time data.

[0142] The client-side outlier adjustment factor and the server-side outlier adjustment factor are calculated in the following ways:

[0143] The outomaly adjustment factor is calculated as follows: anomaly_factor = 1.0 - (outlier_ratio - C) × D, where outlier_ratio is the proportion of outomas on the client or server side; C and D are constants, where C can be 0.05 and D can be 0.2.

[0144] The optimal time slice size for the client and the optimal time slice size for the server are calculated as follows:

[0145] The optimal time slice size, timer_value, is calculated as σ × stability_factor × anomaly_factor. For the client, σ is the standard deviation of the statistical features of the client's processing time data, stability_factor is the client's stability adjustment factor, and anomaly_factor is the client's outlier adjustment factor. For the server, σ is the standard deviation of the statistical features of the server's processing time data, stability_factor is the server's stability adjustment factor, and anomaly_factor is the server's outlier adjustment factor.

[0146] In other words, the processing time between the authenticated user and the access device recorded by the execution time collector is recorded as the client processing time, and the processing time between the access device and the authentication server is recorded as the server processing time. Taking the client processing time collected per unit time (same as the dynamic priority update time of 10 seconds) as an example, the average processing time μ, standard deviation σ, and variance σ² of these data are calculated, and then the stability adjustment factor is calculated: stability_factor = 1.0 + (σ² / μ - 0.1) × 0.1. The same applies to the server processing time.

[0147] However, there may be abnormal situations in these processes. For example, if the message sent to the authentication server is lost in the network, the server processing time may become abnormally long. Such a value is called an outlier. The ratio of outliers to the processing time data collected by the end (client processing / server) per unit time (10s) is called outlier_ratio. Then, the outlier adjustment factor can be calculated: anomaly_factor = 1.0 - (outlier_ratio - 0.05) × 0.2.

[0148] Finally, the optimal time slice size for both the client and server can be calculated using the formula: timer_value = σ × stability_factor × anomaly_factor. Its update duration is consistent with the priority queue update duration mentioned above. This allows setting the optimal time slice rotation size after the priority queue update, ensuring that the two work together to achieve the best authentication effect. The adaptive time slice processing module operates as follows: Figure 7 As shown.

[0149] In the method provided in this embodiment of the invention, the algorithm for dynamic priority and adaptive time slice size is scalable. It can be extended according to the network conditions of the actual production environment and the processing power of the system's CPU or chip, and the current algorithm parameters can be optimized based on the actual environment. This method can be applied to common network devices such as Layer 2 and Layer 3 switches and routers; besides being used for the 802.X authentication protocol, it can also be used for other authentication protocols such as MAC authentication.

[0150] In other words, in this embodiment of the invention, the data collection module, user matching module, queue management module, priority calculation module, and adaptive processing time slice module constitute an authentication user priority management system, which will now be described in terms of the overall system flow:

[0151] (1) System initialization, creating four priority queues: high, medium, low, and default;

[0152] (2) Load the user matching configuration and add it to the specified priority queue according to the user matching conditions configured by the operator;

[0153] (3) Receive user authentication request messages, match them in the priority queue according to user characteristics, add the user to the corresponding priority queue and set the initial priority of the user after a successful match;

[0154] (4) Execute the authentication process sequentially according to queue priority;

[0155] (5) The collection module collects data such as execution time, authentication frequency, and network environment during the user authentication process;

[0156] (6) Calculate the user priority value based on the data in the collection module, and dynamically adjust the priority queue of the user according to the user priority order;

[0157] (7) Calculate the time slice size of the client and server based on the data in the collection module, and adjust the adaptive time slice accordingly;

[0158] (8) The subsequent steps in 3-7 are continuously and dynamically adjusted to improve authentication efficiency. User priority queue information in this system is periodically stored to ensure continued use after power outages or restarts. The entire system operation process is as follows: Figure 8 As shown, the effectiveness of priority queue management in authentication tests using this system is compared to... Figure 9 As shown.

[0159] In summary, the method provided by the embodiments of the present invention has the following advantages:

[0160] 1. Dynamic Priority Management: Employs a dynamic priority algorithm to adjust priorities in real time based on user authentication performance, avoiding starvation of low-priority tasks and improving system fairness and resource utilization.

[0161] 2. Adaptive Timer Optimization: The timer value is dynamically adjusted according to the processing time of each queue, which improves authentication efficiency when the number of users is small and avoids authentication timeout when the number of users is large.

[0162] 3. Multi-dimensional user matching: Supports matching conditions based on identity, device, network, time, security, etc., accurately identifies and classifies users, and provides flexible priority configuration.

[0163] 4. Intelligent queue adjustment: The system periodically reallocates queue users using a sliding window algorithm to ensure that high-priority queues always contain the users who need the most priority processing.

[0164] 5. Improved system stability: Through dynamic adjustment and adaptive optimization, the overall stability and response performance of the authentication system are improved.

[0165] 6. High scalability: The modular design supports functional expansion, and the matching conditions and priority algorithms can be adjusted according to actual needs.

[0166] The method provided by this invention can perform ordered authentication of users by configuring user priorities in any scenario; it has rich user priority matching condition settings, which can accurately match a single user or fuzzily match a class of users, and can meet the needs of various scenarios, with higher flexibility; the user priority is configured through a configuration file, which is imported by the authentication system and used for queue initialization. The number of users that can be configured in this way can be expanded infinitely, which is completely determined by the user, making it more convenient and highly scalable.

[0167] The method provided in this invention introduces a priority queue mechanism, breaking away from the traditional FIFO processing mode using a unified queue. When authenticating users, the authentication request is no longer processed based on the time it is received, but rather according to the priority order configured by the user in the priority queue. This allows higher-priority users to be allocated authentication resources and have their authentication requests responded to first, while authentication requests from ordinary-priority users are executed sequentially after high-priority requests have been processed. This priority-based authentication scheduling method enables the control of the user authentication order. Furthermore, this invention dynamically adjusts priorities in real time based on the user's performance during the authentication process, avoiding starvation of low-priority tasks and improving system fairness and resource utilization.

[0168] This invention also provides an authentication user priority management device, comprising:

[0169] Memory, used to store programs;

[0170] A processor is used to execute a program to implement all or part of the processes in the authentication user priority management method provided in the above embodiments.

[0171] In the above embodiments, implementation can be achieved, in whole or in part, by software, hardware, firmware, or any combination thereof. Furthermore, as those skilled in the art will understand, the principles herein can be reflected in a computer program product on a computer-readable storage medium pre-loaded with computer-readable program code. Any tangible, non-transitory computer-readable storage medium may be used, including magnetic storage devices (hard disks, floppy disks, etc.), optical storage devices (CDs, DVDs, Blu-ray discs, etc.), flash memory, and / or the like. These computer program instructions can be loaded onto a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to form a machine, such that instructions executing on the computer or other programmable data processing apparatus can generate means for performing a specified function. These computer program instructions can also be stored in a computer-readable storage medium that can instruct the computer or other programmable data processing apparatus to operate in a particular manner, such that instructions stored in the computer-readable storage medium can form an article of manufacture, including means for implementing the specified function. The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to perform a series of operational steps on the computer or other programmable apparatus to produce a computer-implemented process, such that instructions executing on the computer or other programmable apparatus can provide steps for implementing the specified function.

[0172] This document describes various exemplary embodiments with reference to them. However, those skilled in the art will recognize that changes and modifications can be made to the exemplary embodiments without departing from the scope of this document. For example, various operational steps and components for performing operational steps can be implemented in different ways depending on the specific application or considering any number of cost functions associated with the operation of the system (e.g., one or more steps can be deleted, modified, or combined with other steps).

[0173] While the principles herein have been illustrated in various embodiments, numerous modifications to the structures, arrangements, proportions, elements, materials, and components, particularly suited to specific environments and operational requirements, may be used without departing from the principles and scope of this disclosure. These modifications and other alterations or alterations will be included within the scope of this document. Those skilled in the art will recognize that many changes can be made to the details of the above embodiments without departing from the fundamental principles of the invention.

Claims

1. A method for managing the priority of authenticated users, characterized in that, include: When an authentication request from an access user is received, the current dynamic priority of the access user is determined, and the authentication request is processed according to the dynamic priority. The determination of the current dynamic priority of the access user includes: matching the authentication request in a priority queue, and using the corresponding priority configured in the priority queue as the current dynamic priority of the access user. The dynamic priority is updated based on the authentication data of the access user in the authentication process.

2. The authentication user priority management method as described in claim 1, characterized in that, The step of matching authentication requests in a priority queue and using the corresponding priority configured in the priority queue as the current dynamic priority of the access user includes: Obtain the authentication information of the accessing user from the authentication request message; Based on the authentication information and preset matching conditions, the access users are compared and matched in the priority queue; If a match is successful, the corresponding priority configured in the priority queue that meets the matching conditions will be used as the current dynamic priority of the access user. If a match fails, the access user will be added to the specified priority queue, and the corresponding priority will be configured for the access user as the current dynamic priority of the access user. The matching conditions include at least one of the following: identity-related matching conditions, device-related matching conditions, network-related matching conditions, time-related matching conditions, security-related matching conditions, and priority configuration-related matching conditions.

3. The authentication user priority management method as described in claim 1, characterized in that, The priority queue includes multiple priority queues with different priority levels; the initial priority of each access user in each priority queue is calculated based on the inter-queue priority of the priority queue in which the access user is located and the corresponding internal priority of the access user in the priority queue. The method further includes: The access users in each priority queue are dynamically adjusted periodically according to the current dynamic priority of each access user, so that the priority of each access user is adapted to the priority level of the priority queue in which it belongs, and the load is balanced among the multiple priority queues with different priority levels.

4. The authentication user priority management method as described in claim 1, characterized in that, The step of updating the dynamic priority based on the authentication data of the access user in the authentication process includes: Calculate the dynamic adjustment factor based on the authentication data of the access user in the authentication process; The dynamic priority is updated using the dynamic adjustment factor.

5. The authentication user priority management method as described in claim 4, characterized in that, The authentication data includes at least one of authentication frequency, execution time and network environment parameters. The authentication frequency is the average number of authentication attempts by the access user within a time window. The execution time is the time interval between receiving the authentication request from the access user and sending the authentication result to the access user. The network environment parameters include the network conditions between the access device, the client and the authentication server. The step of calculating the dynamic adjustment factor based on the authentication data of the access user in the authentication process includes: Calculate the certification frequency factor based on the certification frequency; Calculate the execution duration factor based on the execution duration; Calculate the network quality factor based on network environment parameters; The dynamic adjustment factor is calculated based on the execution duration factor, authentication frequency factor, and network quality factor.

6. The authentication user priority management method as described in claim 5, characterized in that, The dynamic adjustment factor is calculated in the following manner: The dynamic adjustment factor bonus = frequency_factor × duration_factor × network_factor × weight_factor, where frequency_factor is the authentication frequency factor, duration_factor is the execution duration factor, network_factor is the network quality factor, and weight_factor is the weight. The dynamic priority is updated in the following way: The updated dynamic priority is calculated as base_priority + bonus, where base_priority is the current dynamic priority and bonus is the dynamic adjustment factor.

7. The authentication user priority management method as described in claim 1, characterized in that, The method further includes: Based on the processing time between the access device and the access user, and the processing time between the access device and the authentication server during each authentication, the client-side and server-side round-robin time slice sizes in the priority queue during the authentication process are adjusted respectively.

8. The method for managing the priority of authenticated users as described in claim 7, characterized in that, The step of adjusting the client-side and server-side round-robin time slice sizes in the priority queue during the authentication process based on the processing time between the access device and the access user, and the processing time between the access device and the authentication server during each authentication, includes: Based on the processing time data between the access device and the access user during each authentication, and the processing time data between the access device and the authentication server, the statistical feature counts of the client processing time data and the statistical feature counts of the server processing time data are calculated respectively. Based on the statistical characteristics of the client-side processing time data and the statistical characteristics of the server-side processing time data, calculate the client-side stability adjustment factor and the server-side stability adjustment factor respectively. Based on the proportion of outliers in the processing time data between the access device and the access user, and the proportion of outliers in the processing time data between the access device and the authentication server, calculate the client-side outlier adjustment factor and the server-side outlier adjustment factor respectively. Based on the client stability adjustment factor, the client outlier adjustment factor, the server stability adjustment factor, and the server outlier adjustment factor, the optimal time slice size for the client and the optimal time slice size for the server are calculated respectively. The client round-robin time slice size and the server round-robin time slice size in the priority queue during the authentication process are then set to the calculated optimal time slice size.

9. The method for managing the priority of authenticated users as described in claim 8, characterized in that, The optimal time slice size for the client and the optimal time slice size for the server are calculated in the following way: The optimal time slice size, timer_value, is calculated as σ × stability_factor × anomaly_factor. For the client, σ is the standard deviation of the statistical features of the client's processing time data, stability_factor is the client's stability adjustment factor, and anomaly_factor is the client's outlier adjustment factor. For the server, σ is the standard deviation of the statistical features of the server's processing time data, stability_factor is the server's stability adjustment factor, and anomaly_factor is the server's outlier adjustment factor.

10. A device for managing the priority of authenticated users, characterized in that, include: Memory, used to store programs; A processor for implementing the method as described in any one of claims 1 to 9 by executing the program.

Images