Dynamic isolation method and apparatus based on controller

Abstract

Embodiments of the present disclosure provide a dynamic isolation method and apparatus based on a controller. The method is applied to a network device, and comprises: configuring an access interface on a network device to allow only an authentication packet to pass through; by means of the access interface, receiving an authentication packet sent by a terminal device, the authentication packet being used for requesting an identity authentication; acquiring a terminal identity identifier of the terminal device on the basis of the authentication packet, so that an authentication server performs identity authentication on the terminal device on the basis of the terminal identity identifier, and if the authentication is passed, by means of a controller, configuring isolation information and an interface permission for the terminal device; and authorizing the access interface on the basis of the interface permission to allow a non-authentication packet to pass through, and generating an isolation flow table for the terminal device on the basis of the configured isolation information.

Description

A dynamic isolation method and device based on controller

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This disclosure is based on and claims the priority of Chinese patent application No. 202310875450.4 filed on July 14, 2023, and all the disclosed contents thereof are incorporated into this disclosure by reference. Technical Field

[0003] The embodiments of the present disclosure relate to the technical field of network communications, and in particular, to a controller-based dynamic isolation method and device. Background Art

[0004] In the field of network communications, VXLAN (Virtual eXtensible LAN) technology is widely used to achieve secure communication between virtual and physical networks. VXLAN is a Layer 2 VPN technology based on IP networks. By using "MAC in UDP" encapsulation, it expands the capabilities of large-scale virtual local area networks on existing IP networks.

[0005] Typically, VXLAN configuration requires pre-configuration on access devices (such as switches) by an administrator or controller (e.g., an SDN controller). Administrators must configure VXLAN information for terminals on the access devices to establish a mapping between terminals and virtual networks. The "interface + VLAN" approach is typically used to separate traffic flows and VXLANs. This configuration approach presents several issues.

[0006] First, pre-configuring VXLAN information complicates system management and lacks flexibility. Adding, deleting, or modifying VXLAN information for a terminal requires manually updating the access device configuration, which consumes time and effort. This manual configuration becomes cumbersome and difficult, especially in large-scale networks.

[0007] Secondly, because VXLAN terminals can access the network without identity authentication, there is a risk of terminal impersonation. In traditional VXLAN configurations, any terminal with legitimate network access rights can access the network using pre-configured VXLAN information, without authentication. This poses a potential threat to network security and can allow unauthorized terminals to enter the virtual network.

[0008] Furthermore, binding interfaces to VXLANs restricts terminal access methods and lacks dynamism. Once a terminal is bound to a specific interface, it can only access the network through that fixed interface. This static access method limits terminal flexibility and mobility, making it impossible to dynamically adjust terminal access locations based on actual needs and changes in network topology.

[0009] Therefore, in order to solve the above problems, a controller-based dynamic isolation method is needed.

[0010] Summary of the Invention

[0011] The embodiments of the present disclosure provide a controller-based dynamic isolation method and device to at least solve the problem that the static access method in the related art limits the flexibility and mobility of the terminal, and it is difficult to dynamically adjust the terminal's access location and information security according to actual needs and changes in network topology.

[0012] According to one embodiment of the present disclosure, a controller-based dynamic isolation method is provided, which is applied to a network device. The method includes:

[0013] Configuring the access interface on the network device to allow only authentication messages to pass;

[0014] receiving, via the access interface, an authentication message sent by a terminal device requesting identity authentication;

[0015] Obtaining a terminal identity identifier of the terminal device based on the authentication message, so that the authentication server performs identity authentication on the terminal device based on the terminal identity identifier, and if the authentication is successful, configuring isolation information and interface permissions for the terminal device through the controller;

[0016] The access interface is authorized based on the interface authority to allow non-authenticated messages to pass through, and an isolation flow table is generated for the terminal device according to the configured isolation information.

[0017] According to another embodiment of the present disclosure, a controller-based dynamic isolation method is provided, which is applied to an authentication server. The method includes:

[0018] receiving an authentication message forwarded by a network device for requesting identity authentication of a terminal device, wherein the access interface on the network device is configured to allow only the authentication message to pass;

[0019] Obtain the terminal identity of the terminal device;

[0020] The terminal device is authenticated based on the terminal identity identifier. If the authentication is successful, the controller configures isolation information and interface permissions for the terminal device, so that the network device authorizes the access interface based on the interface permissions to allow non-authenticated messages to pass through, and generates an isolation flow table for the terminal device according to the configured isolation information.

[0021] According to another embodiment of the present disclosure, a controller-based dynamic isolation method is provided, which is applied to the controller. The method includes:

[0022] receiving an authentication message from a terminal device forwarded by a network device, wherein an access interface on the network device is configured to allow only the authentication message to pass;

[0023] Obtaining a terminal identity based on the authentication message, so that the authentication server performs identity authentication on the terminal device based on the terminal identity, and generating an authentication success message if the authentication succeeds;

[0024] Based on the authentication success message, isolation information and interface permissions are configured for the terminal device, so that the network device authorizes the access interface based on the interface permissions to allow non-authenticated messages to pass through, and generates an isolation flow table for the terminal device according to the configured isolation information.

[0025] According to another embodiment of the present disclosure, a network device is provided, including:

[0026] an acquisition module configured to receive, through an access interface, an authentication message sent by a terminal device for performing an identity authentication request, wherein the access interface on the network device is configured to allow only the authentication message to pass;

[0027] a processing module configured to obtain a terminal identity identifier of the terminal device based on the authentication message, so that the authentication server performs identity authentication on the terminal device based on the terminal identity identifier, and if the authentication is successful, configures isolation information and interface permissions for the terminal device through a controller; and

[0028] The access interface is authorized based on the interface authority to allow non-authenticated messages to pass through, and an isolation flow table is generated for the terminal device according to the configured isolation information.

[0029] According to another embodiment of the present disclosure, there is provided an authentication server, including:

[0030] an acquisition module configured to receive an authentication message forwarded by a network device to request identity authentication of a terminal device, wherein the access interface on the network device is configured to allow only the authentication message to pass; and obtain a terminal identity identifier of the terminal device;

[0031] A processing module is configured to perform identity authentication on the terminal device based on the terminal identity identifier. If the authentication is successful, isolation information and interface permissions are configured for the terminal device through the controller, so that the network device authorizes the access interface based on the interface permissions to allow non-authenticated messages to pass through, and generates an isolation flow table for the terminal device according to the configured isolation information.

[0032] According to another embodiment of the present disclosure, there is provided a controller, comprising:

[0033] an acquisition module configured to receive an authentication message of a terminal device forwarded by a network device, wherein the access interface on the network device is configured to allow only the authentication message to pass;

[0034] a processing module configured to obtain a terminal identity based on the authentication message, so that the authentication server performs identity authentication on the terminal device based on the terminal identity, and generates an authentication success message if the authentication is successful; and

[0035] Based on the authentication success message, isolation information and interface permissions are configured for the terminal device, so that the network device authorizes the access interface based on the interface permissions to allow non-authenticated messages to pass through, and generates an isolation flow table for the terminal device according to the configured isolation information.

[0036] According to another embodiment of the present disclosure, a computer-readable storage medium is provided, in which a computer program is stored. The computer program is configured to execute the steps of any one of the above method embodiments when running.

[0037] According to another embodiment of the present disclosure, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to perform the steps in any one of the above method embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] FIG1 is a hardware structure block diagram of a mobile terminal according to a controller-based dynamic isolation method according to an embodiment of the present disclosure;

[0039] FIG2 is a schematic diagram of a network architecture in which a controller-based dynamic isolation method according to an embodiment of the present disclosure is executed;

[0040] FIG3 is a flow chart of a controller-based dynamic isolation method according to an embodiment of the present disclosure;

[0041] 4 is a signaling diagram between terminals in a network architecture where a controller obtains a terminal identity according to an embodiment of the present disclosure;

[0042] 5 is a signaling diagram between various terminals in a network architecture where a network device obtains a terminal identity according to an embodiment of the present disclosure;

[0043] FIG6 is a schematic diagram of a process of a terminal device going offline according to an embodiment of the present disclosure;

[0044] FIG7 is a structural block diagram of a network device according to an embodiment of the present disclosure;

[0045] FIG8 is a structural block diagram of an authentication server according to an embodiment of the present disclosure;

[0046] FIG9 is a structural block diagram of a controller according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0047] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the accompanying drawings and in conjunction with the embodiments.

[0048] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0049] The method embodiments provided in the embodiments of the present disclosure can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking operation on a computer terminal as an example, FIG1 is a hardware structure block diagram of a computer terminal of a controller-based dynamic isolation method according to an embodiment of the present disclosure. As shown in FIG1 , the computer terminal may include one or more (only one is shown in FIG1 ) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the above-mentioned computer terminal may also include a transmission device 106 and an input and output device 108 for communication functions. It will be understood by those skilled in the art that the structure shown in FIG1 is only for illustration and does not limit the structure of the above-mentioned computer terminal. For example, the computer terminal may also include more or fewer components than those shown in FIG1 , or have a configuration different from that shown in FIG1 .

[0050] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the controller-based dynamic isolation method in the embodiment of the present disclosure. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, implementing the above-mentioned method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0051] The transmission device 106 is used to receive or send data via a network. A specific example of the aforementioned network may include a wireless network provided by the mobile terminal's communications provider. In one embodiment, the transmission device 106 includes a network interface controller (NIC), which can be connected to other network devices via a base station to enable communication with the Internet. In another embodiment, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0052] The embodiments of the present disclosure can operate on the network architecture shown in Figure 2. As shown in Figure 2, the network architecture includes: network device A, network device B, terminal device A, terminal device B, an authentication server, a controller, and an address allocation server. Network device A and network device B are connected via a network tunnel protocol to facilitate communication between network device A and network device B. Of course, multiple network devices can be connected, which will not be described in detail here. Terminal device A is connected to network device A to facilitate communication with network device A. The network device is in communication with the controller and the authentication server, and the terminal device is in communication with the address allocation server.

[0053] In this embodiment, a controller-based dynamic isolation method running on the above network architecture is provided. FIG3 is a flow chart of the controller-based dynamic isolation method according to an embodiment of the present disclosure. As shown in FIG3 , the flow chart includes the following steps:

[0054] Step S301: Configure the access interface on the network device to only allow authentication messages to pass through;

[0055] Specifically, you can set it as follows:

[0056] Determine the device model and manufacturer: Different network devices have different operating methods and command syntax. Determine the device model and manufacturer to correctly execute configuration commands;

[0057] Log in to the device: Use the appropriate management interface (for example, SSH, Telnet, or console) to log in to the command-line interface of the network device.

[0058] Entering interface configuration mode: Entering interface configuration mode through commands. The specific command may vary depending on the device, but it is usually entered by entering commands such as "configure terminal" or "config";

[0059] Select the interface to be configured: Use the command to select the interface to be configured. For example, "interface GigabitEthernet 0 / 1" selects GigabitEthernet interface 0 / 1 for configuration;

[0060] Configure authentication: Configure the appropriate authentication mechanism based on the device's support and configuration options. Common authentication mechanisms include 802.1X authentication and MAC address authentication. The specific configuration commands depend on the device and the selected authentication mechanism.

[0061] Configure the authentication server: Connect the device to the authentication server to verify the authentication request. The specific configuration commands can be set according to the type of device and authentication server;

[0062] Apply Configuration: Saves and applies configuration changes. Use the appropriate command to apply configuration changes to the interface. For example, the "exit" command exits interface configuration mode, and the "write" or "copy running-config startup-config" command saves the changes to the device's persistent configuration.

[0063] Of course, the permission to configure the access interface can be burned into the network device, and the permission to configure the access interface of the network device can also be burned into the controller.

[0064] Step S302: receiving an authentication message sent by a terminal device through an access interface to request identity authentication;

[0065] Specifically, after the terminal device is connected to the access interface of the network device, the terminal device establishes a connection with the network device, and the terminal device sends an authentication message for performing identity authentication to the network device through the access interface.

[0066] Step S303: obtaining a terminal identity of the terminal device based on the authentication message, so that the authentication server performs identity authentication on the terminal device based on the terminal identity. If the authentication is successful, the controller configures isolation information and interface permissions for the terminal device.

[0067] Specifically, the terminal device's terminal identity can be obtained by the controller based on the authentication message, or by the network device based on the authentication message. The controller then sends the terminal identity to the authentication server, or the network device sends the terminal identity to the authentication server. The authentication server then authenticates the terminal device based on the identity terminal identity. If the authentication server passes, the controller configures isolation information and interface permissions for the terminal device.

[0068] The isolation information can be a VXLAN ID. A VXLAN ID (Virtual Extensible LAN Identifier) ​​is an identifier used in VXLAN (Virtual Extensible LAN) network virtualization technology. VXLAN is a network virtualization technology used to expand the number and scale of virtual local area networks (VLANs). It creates a logical network on top of the existing network infrastructure, enabling virtualized devices such as virtual machines (VMs) and containers to communicate across the physical network while providing isolation and flexibility.

[0069] In VXLAN, the VXLAN ID is used to isolate and identify virtual networks. It is a 24-bit identifier, also known as the VNI (VXLAN Network Identifier). The VXLAN ID extends the Ethernet frame header and carries VXLAN network identification information in the data packet.

[0070] Specifically, VXLAN IDs are used to isolate virtual machine network traffic into different virtual networks. Each virtual network has a unique VXLAN ID to ensure that packets between different virtual networks are not mixed or crossed within the extended virtual network. By using VXLAN IDs, virtual machines can communicate across different hosts over the underlying physical network while maintaining logical isolation between virtual networks.

[0071] The VXLAN ID ranges from 1 to 16,777,215 (0xFFFFFF). It can be assigned and configured by network administrators to meet specific network needs and deployment requirements.

[0072] In short, the VXLAN ID is a unique identifier used to identify and isolate virtual networks in VXLAN network virtualization technology. It transmits VXLAN network identification information in data packets by extending the header of the Ethernet frame.

[0073] Step S304: Authorize the access interface based on the interface authority to allow non-authenticated messages to pass through, and generate an isolation flow table for the terminal device according to the configured isolation information.

[0074] After an access interface is authorized, it allows non-authenticated messages to pass through, facilitating information exchange between the terminal device and the network device. Non-authenticated messages can include control messages, routing protocol messages, network protocol messages, and broadcast and multicast messages.

[0075] In one implementation, the isolation flow table is a MAC table entry, which includes isolation information, terminal MAC, interface, and interface authority.

[0076] Specifically, a MAC table entry is a record used in a network switch to maintain the mapping between MAC addresses and corresponding ports. It is used to implement the switch's forwarding function, forwarding data packets from the input port to the correct output port to ensure that the data packets can reach the target device correctly. Whenever a network switch receives a data frame, it checks the source MAC address in the data frame. The switch then associates the source MAC address with the input port and creates or updates the corresponding MAC table entry. When the switch needs to forward a data frame, it looks up the entry for the destination MAC address in the MAC table and forwards the data frame to the output port associated with the destination MAC address.

[0077] MAC table entries typically include: 1. MAC address: Each MAC table entry contains a MAC address that uniquely identifies the device. 2. Port number: The MAC table entry also contains the port number associated with the MAC address, indicating which port the data packet should be forwarded from. 3. Timestamp: In order to keep the MAC table up to date, the MAC table entry typically contains a timestamp that records the time of the last activity (such as receipt of a data packet). When an entry has been inactive for a long time, the switch may delete it to free up resources. 4. Other attributes: Some switches may include other attributes in the MAC table entry, such as a virtual local area network (VLAN) identifier, which is used to implement VLAN isolation and forwarding.

[0078] Through the above steps, since the terminal device can connect to any access interface of the network device, and then authenticate the identity of the terminal device, after successful authentication, the controller configures isolation information and interface permissions for the terminal device, and the network device creates and maintains the isolation flow table for traffic control and forwarding, solving the network trusted access of terminals in the physical environment and the dynamic isolation problem caused by terminal migration.

[0079] Therefore, isolation information no longer needs to be pre-configured on network devices; it is managed by a unified controller policy, reducing management complexity and increasing flexibility. Terminal device identity is authenticated before access interface isolation, preventing impersonation. The terminal identity, instead of the access interface, is bound to isolation information, freeing terminal access interfaces from restrictions. Even if a terminal device relocates, it can still be automatically isolated after network authentication, achieving dynamic isolation of terminal devices.

[0080] Refer to FIG. 4 , which is a signaling diagram between terminals in a network architecture in which a controller obtains terminal identity according to an embodiment of the present disclosure.

[0081] In one embodiment, obtaining a terminal identity of the terminal device based on the authentication message so that the authentication server performs identity authentication on the terminal device based on the terminal identity includes:

[0082] The network device sends an authentication message to the controller, so that the controller inquires the terminal device about the terminal identity based on the authentication message, and sends the terminal identity replied by the terminal device to the authentication server to authenticate the terminal device.

[0083] Specifically, a network device, such as a switch or wireless access point, sends an authentication message to the controller. The authentication message contains the relevant identity information of the terminal device and an authentication request. After receiving the authentication message, the controller will initiate a query to the terminal device based on the identity information contained therein, requesting the terminal device to provide its identity. After receiving the query from the controller, the terminal device provides its own identity and responds to the controller using an authentication method (such as a username, password, certificate, etc.). After receiving the identity of the terminal device, the controller forwards it to the authentication server for identity authentication. The authentication server verifies the validity and legitimacy of the identity provided by the terminal device.

[0084] Therefore, the above authentication process can effectively authenticate the identity of terminal devices. The network device sends an authentication message to the controller, which interacts with the terminal device to obtain the terminal device's identity and send it to the authentication server for verification. This process ensures that only authenticated terminal devices are allowed to access the network, thereby enhancing network security and access control capabilities.

[0085] Refer to FIG5 , which is a signaling diagram between various terminals in a network architecture in which a network device obtains a terminal identity according to an embodiment of the present disclosure.

[0086] In one embodiment, obtaining a terminal identity of the terminal device based on the authentication message so that the authentication server performs identity authentication on the terminal device based on the terminal identity includes:

[0087] The network device queries the terminal device for the terminal identity based on the authentication message, and sends the terminal identity replied by the terminal device to the authentication server to authenticate the terminal device.

[0088] Specifically, the network device obtains the terminal identity of the terminal device, which relieves the data processing pressure of the controller.

[0089] In one embodiment, the identity authentication request is one of the following: 802.1X authentication, Point-to-Point Protocol over Ethernet (PPPoE) authentication, and Portal authentication.

[0090] Specifically, 802.1X provides an authentication-based network access control method that requires terminal devices to undergo authentication before accessing the network, ensuring that only authenticated devices can access the network, thereby improving device access security. It can be combined with a variety of authentication methods, including username / password, digital certificates, and One-Time Password (OTP), providing flexible authentication methods. By utilizing encryption technologies and key exchange protocols, 802.1X protects the confidentiality and integrity of data transmitted during the authentication process, providing enhanced security.

[0091] PPPoE authentication assigns each user a unique username and password, achieving isolation between users and ensuring that their traffic does not interfere with each other. It supports dynamic IP address allocation, which can assign different IP addresses to each user as needed, providing more flexible address management and resource allocation. It provides a simple and effective authentication and authorization mechanism to authenticate users and limit their access rights according to authorization policies.

[0092] Portal authentication typically provides an authentication interface via a web page. Users authenticate using a username and password, providing a simple and intuitive user experience. Customizable authentication policies, such as restricting access to specific websites and limiting access times, can be implemented, providing more flexible authentication and access control. Portal authentication is often integrated with an identity authentication server to centrally manage and control user authentication and access rights, facilitating unified management for administrators.

[0093] Therefore, through the above authentication methods, comprehensive network access control and security can be provided.

[0094] In one embodiment, the network device sends an authentication message to the controller, so that the controller queries the terminal device for a terminal identity based on the authentication message, and sends the terminal identity replied by the terminal device to the authentication server to authenticate the terminal device. The specific process may be: obtaining an EAPOL Start message sent by the terminal device;

[0095] Forwarding the EAPOL_Start message to the controller, so that the controller sends an EAP Request / Identity message to the terminal device, so that the terminal device generates an EAP Response / Identity message based on the EAP Request / Identity message, and sends the EAP Response / Identity message to the controller, so that the controller obtains the terminal identity;

[0096] The controller generates a Radius Access Request message based on the EAP Response / Identity message, and sends the Radius Access Request message to the authentication server, so that the authentication server performs identity authentication with the terminal device.

[0097] Specifically, the authentication server and the terminal device may perform identity authentication by TLS authentication, MD5 authentication, PEAP authentication, etc. TLS authentication, MD5 authentication, PEAP authentication, etc. are all authentication methods in the prior art and will not be described in detail here.

[0098] In one embodiment, the network device queries the terminal device for a terminal identity based on the authentication message, and sends the terminal identity replied by the terminal device to the authentication server to authenticate the terminal device. Specifically, it can be:

[0099] Obtain the EAPOL_Start message sent by the terminal device and generate an EAP Request / Identity message;

[0100] Sending an EAP Request / Identity message to the terminal device so that the terminal device generates an EAP Response / Identity message;

[0101] Obtain the EAP Response / Identity message and generate a Radius access request message;

[0102] Send the Radius access request message to the authentication server so that the authentication server and the terminal device can perform identity authentication.

[0103] In one embodiment, after generating an isolation flow table for a terminal device according to the configured isolation information, the method further includes:

[0104] The network device sends an authentication success message to the terminal device to notify the terminal device of the authentication success, so that the terminal device can request and allocate an IP address with the address allocation server, which can be a DHCP server.

[0105] Refer to FIG6 , which is a schematic diagram of a process of a terminal device going offline according to an embodiment of the present disclosure.

[0106] In one embodiment, as shown in FIG6 , the process includes the following steps:

[0107] After the IP address request and allocation between the terminal device and the address allocation server, the following also occurs:

[0108] S601, receiving a logoff request message sent by a terminal device;

[0109] S602, forwarding the offline request message to the controller, so that the controller generates a deauthorization flow table;

[0110] S603: Cancel the access interface authorization according to the authorization cancellation flow table, and delete the corresponding MAC table entry, so that the access interface is configured to allow only authentication messages to pass through.

[0111] This embodiment also provides a controller-based dynamic isolation method, which is applied to the authentication server. The method includes:

[0112] receiving an authentication message forwarded by a network device for requesting identity authentication of a terminal device, wherein an access interface on the network device is configured to allow only the authentication message to pass;

[0113] Obtain the terminal identity of the terminal device;

[0114] The terminal device is authenticated based on the terminal identity. If the authentication is successful, the controller configures isolation information and interface permissions for the terminal device so that the network device authorizes the access interface based on the interface permissions to allow non-authenticated messages to pass through, and generates an isolation flow table for the terminal device based on the configured isolation information.

[0115] In one embodiment, obtaining a terminal identity of the terminal device based on the authentication message so that the authentication server performs identity authentication on the terminal device based on the terminal identity includes:

[0116] The network device sends an authentication message to the controller, so that the controller inquires the terminal device about the terminal identity based on the authentication message, and sends the terminal identity replied by the terminal device to the authentication server to authenticate the terminal device.

[0117] In one embodiment, obtaining a terminal identity of the terminal device based on the authentication message so that the authentication server performs identity authentication on the terminal device based on the terminal identity includes:

[0118] The network device queries the terminal device for the terminal identity based on the authentication message, and sends the terminal identity replied by the terminal device to the authentication server to authenticate the terminal device.

[0119] In one embodiment, the identity authentication request is one of the following: 802.1X authentication, Point-to-Point Protocol over Ethernet (PPPoE) authentication, and Portal authentication.

[0120] In one embodiment, after generating an isolation flow table for a terminal device according to the configured isolation information, the method further includes:

[0121] The network device sends an authentication success message to the terminal device to notify the terminal device that the authentication is successful, so that the terminal device can request and allocate an IP address with the address allocation server.

[0122] In one implementation, the isolation flow table is a MAC table entry, which includes isolation information, terminal MAC, interface, and interface authority.

[0123] In one embodiment, after the IP address request and allocation are performed between the terminal device and the address allocation server, the method further includes:

[0124] Receive an offline request message sent by a terminal device;

[0125] Forward the offline request message to the controller so that the controller generates a deauthorization flow table;

[0126] The access interface authorization is canceled according to the deauthorization flow table, and the corresponding MAC entry is deleted, so that the access interface is configured to allow only authentication packets to pass.

[0127] This embodiment also provides a controller-based dynamic isolation method, which is applied to the controller and includes:

[0128] receiving an authentication message from a terminal device forwarded by a network device, wherein an access interface on the network device is configured to allow only the authentication message to pass;

[0129] Obtaining the terminal identity based on the authentication message, so that the authentication server performs identity authentication on the terminal device based on the terminal identity. If the authentication succeeds, an authentication success message is generated;

[0130] Based on the successful authentication message, isolation information and interface permissions are configured for the terminal device, so that the network device authorizes the access interface based on the interface permissions to allow non-authenticated messages to pass through, and generates an isolation flow table for the terminal device according to the configured isolation information.

[0131] In one embodiment, obtaining a terminal identity of the terminal device based on the authentication message so that the authentication server performs identity authentication on the terminal device based on the terminal identity includes:

[0132] The network device sends an authentication message to the controller, so that the controller inquires the terminal device about the terminal identity based on the authentication message, and sends the terminal identity replied by the terminal device to the authentication server to authenticate the terminal device.

[0133] In one embodiment, obtaining a terminal identity of the terminal device based on the authentication message so that the authentication server performs identity authentication on the terminal device based on the terminal identity includes:

[0134] The network device queries the terminal device for the terminal identity based on the authentication message, and sends the terminal identity replied by the terminal device to the authentication server to authenticate the terminal device.

[0135] In one embodiment, the identity authentication request is one of the following: 802.1X authentication, Point-to-Point Protocol over Ethernet (PPPoE) authentication, and Portal authentication.

[0136] In one embodiment, after generating an isolation flow table for a terminal device according to the configured isolation information, the method further includes:

[0137] The network device sends an authentication success message to the terminal device to notify the terminal device that the authentication is successful, so that the terminal device can request and allocate an IP address with the address allocation server.

[0138] In one implementation, the isolation flow table is a MAC table entry, which includes isolation information, terminal MAC, interface, and interface authority.

[0139] In one embodiment, after the IP address request and allocation are performed between the terminal device and the address allocation server, the method further includes:

[0140] Receive an offline request message sent by a terminal device;

[0141] Forward the offline request message to the controller so that the controller generates a deauthorization flow table;

[0142] The access interface authorization is canceled according to the deauthorization flow table, and the corresponding MAC entry is deleted, so that the access interface is configured to allow only authentication packets to pass.

[0143] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present disclosure is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), including a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present disclosure.

[0144] Refer to FIG. 7 , which is a structural block diagram of a network device according to an embodiment of the present disclosure.

[0145] This embodiment further provides a network device, including:

[0146] an acquisition module 71 configured to receive, via an access interface, an authentication message sent by a terminal device for performing identity authentication, wherein the access interface on the network device is configured to allow only authentication messages to pass;

[0147] The processing module 72 is configured to obtain a terminal identity identifier of the terminal device based on the authentication message, so that the authentication server performs identity authentication on the terminal device based on the terminal identity identifier. If the authentication is successful, the controller configures isolation information and interface permissions for the terminal device; and

[0148] Authorize access interfaces based on interface permissions to allow unauthenticated packets to pass through, and generate isolation flow tables for terminal devices based on configured isolation information;

[0149] The output module 73 is configured to output the terminal identity.

[0150] In one embodiment, the network device is further configured to:

[0151] Obtaining a terminal identity identifier of the terminal device based on the authentication message, so that the authentication server performs identity authentication on the terminal device based on the terminal identity identifier, including:

[0152] The network device sends an authentication message to the controller, so that the controller inquires the terminal device about the terminal identity based on the authentication message, and sends the terminal identity replied by the terminal device to the authentication server to authenticate the terminal device.

[0153] In one embodiment, the network device is further configured to:

[0154] Obtaining a terminal identity identifier of the terminal device based on the authentication message, so that the authentication server performs identity authentication on the terminal device based on the terminal identity identifier, including:

[0155] The network device queries the terminal device for the terminal identity based on the authentication message, and sends the terminal identity replied by the terminal device to the authentication server to authenticate the terminal device.

[0156] In one embodiment, in the network device:

[0157] The identity authentication request is one of the following: 802.1X authentication, PPPoE authentication, or Portal authentication.

[0158] In one embodiment, the network device is further configured to:

[0159] After generating an isolation flow table for the terminal device based on the configured isolation information, the following steps are also performed:

[0160] The network device sends an authentication success message to the terminal device to notify the terminal device that the authentication is successful, so that the terminal device can request and allocate an IP address with the address allocation server.

[0161] In one embodiment, in the network device: the isolation flow table is a MAC table entry, and the MAC table entry includes isolation information, terminal MAC, interface, and interface permission.

[0162] In one embodiment, the network device is further configured to:

[0163] After the IP address request and allocation between the terminal device and the address allocation server, the following also occurs:

[0164] Receive an offline request message sent by a terminal device;

[0165] Forward the offline request message to the controller so that the controller generates a deauthorization flow table;

[0166] The access interface authorization is canceled according to the deauthorization flow table, and the corresponding MAC entry is deleted, so that the access interface is configured to allow only authentication packets to pass.

[0167] Refer to FIG8 , which is a structural block diagram of an authentication server according to an embodiment of the present disclosure.

[0168] This embodiment also provides an authentication server, including:

[0169] The acquisition module 81 is configured to receive an authentication message forwarded by a network device to request identity authentication of a terminal device, wherein the access interface on the network device is configured to allow only the authentication message to pass; and obtain a terminal identity identifier of the terminal device;

[0170] The processing module 82 is configured to authenticate the terminal device based on the terminal identity identifier. If the authentication is successful, the controller configures isolation information and interface permissions for the terminal device, so that the network device authorizes the access interface based on the interface permissions to allow non-authenticated packets to pass through, and generates an isolation flow table for the terminal device based on the configured isolation information.

[0171] The output module 83 is configured to output the result of the identity authentication.

[0172] In one embodiment, the authentication server is further configured to:

[0173] Obtaining a terminal identity identifier of the terminal device based on the authentication message, so that the authentication server performs identity authentication on the terminal device based on the terminal identity identifier, including:

[0174] The network device sends an authentication message to the controller, so that the controller inquires the terminal device about the terminal identity based on the authentication message, and sends the terminal identity replied by the terminal device to the authentication server to authenticate the terminal device.

[0175] In one embodiment, the authentication server is further configured to:

[0176] Obtaining a terminal identity identifier of the terminal device based on the authentication message, so that the authentication server performs identity authentication on the terminal device based on the terminal identity identifier, including:

[0177] The network device queries the terminal device for the terminal identity based on the authentication message, and sends the terminal identity replied by the terminal device to the authentication server to authenticate the terminal device.

[0178] In one embodiment, in the authentication server, the identity authentication request is one of the following: 802.1X authentication, Ethernet Point-to-Point Protocol PPPoE authentication, and Portal authentication.

[0179] In one embodiment, the authentication server is further configured to:

[0180] After generating an isolation flow table for the terminal device based on the configured isolation information, the following steps are also performed:

[0181] The network device sends an authentication success message to the terminal device to notify the terminal device that the authentication is successful, so that the terminal device can request and allocate an IP address with the address allocation server.

[0182] In one embodiment, in the authentication server: the isolation flow table is a MAC table entry, and the MAC table entry includes isolation information, terminal MAC, interface, and interface authority.

[0183] In one embodiment, the authentication server is further configured to:

[0184] After the IP address request and allocation between the terminal device and the address allocation server, the following also occurs:

[0185] Receive an offline request message sent by a terminal device;

[0186] Forward the offline request message to the controller so that the controller generates a deauthorization flow table;

[0187] The access interface authorization is canceled according to the deauthorization flow table, and the corresponding MAC entry is deleted, so that the access interface is configured to allow only authentication packets to pass.

[0188] Referring to FIG. 9 , FIG. 9 is a structural block diagram of a controller according to an embodiment of the present disclosure.

[0189] In this embodiment, a controller is further provided, including:

[0190] an acquisition module 91 configured to receive an authentication message from a terminal device forwarded by a network device, wherein the access interface on the network device is configured to allow only the authentication message to pass;

[0191] The processing module 92 is configured to obtain a terminal identity based on the authentication message, so that the authentication server performs identity authentication on the terminal device based on the terminal identity, and generates an authentication success message if the authentication is successful; and

[0192] Based on the authentication success message, the terminal device is configured with isolation information and interface permissions, so that the network device authorizes the access interface based on the interface permissions to allow non-authenticated messages to pass through, and generates an isolation flow table for the terminal device according to the configured isolation information;

[0193] The output module 93 is configured to output the authentication message and the authentication success message.

[0194] In one embodiment, the controller is further configured to:

[0195] Obtaining a terminal identity identifier of the terminal device based on the authentication message, so that the authentication server performs identity authentication on the terminal device based on the terminal identity identifier, including:

[0196] The network device sends an authentication message to the controller, so that the controller inquires the terminal device about the terminal identity based on the authentication message, and sends the terminal identity replied by the terminal device to the authentication server to authenticate the terminal device.

[0197] In one embodiment, the controller is further configured to:

[0198] Obtaining a terminal identity identifier of the terminal device based on the authentication message, so that the authentication server performs identity authentication on the terminal device based on the terminal identity identifier, including:

[0199] The network device queries the terminal device for the terminal identity based on the authentication message, and sends the terminal identity replied by the terminal device to the authentication server to authenticate the terminal device.

[0200] In one embodiment, in the controller: the identity authentication request is one of the following: 802.1X authentication, Ethernet Point-to-Point Protocol PPPoE authentication, and Portal authentication.

[0201] In one embodiment, the controller is further configured to:

[0202] After generating an isolation flow table for the terminal device based on the configured isolation information, the following steps are also performed:

[0203] The network device sends an authentication success message to the terminal device to notify the terminal device that the authentication is successful, so that the terminal device can request and allocate an IP address with the address allocation server.

[0204] In one embodiment, in the controller: the isolation flow table is a MAC table entry, and the MAC table entry includes isolation information, terminal MAC, interface, and interface permission.

[0205] In a possible implementation manner, the controller is further configured to:

[0206] After the IP address request and allocation between the terminal device and the address allocation server, the following also occurs:

[0207] Receive an offline request message sent by a terminal device;

[0208] Forward the offline request message to the controller so that the controller generates a deauthorization flow table;

[0209] The access interface authorization is canceled according to the deauthorization flow table, and the corresponding MAC entry is deleted, so that the access interface is configured to allow only authentication packets to pass.

[0210] It should be noted that the above modules can be implemented through software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above modules are all located in the same processor; or the above modules are located in different processors in any combination.

[0211] An embodiment of the present disclosure further provides a computer-readable storage medium, in which a computer program is stored. The computer program is configured to execute the steps of any one of the above method embodiments when run.

[0212] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.

[0213] An embodiment of the present disclosure further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to perform the steps in any of the above method embodiments.

[0214] In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0215] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail here.

[0216] Obviously, those skilled in the art should understand that the modules or steps of the present disclosure described above can be implemented using a general-purpose computing device, they can be concentrated on a single computing device, or distributed across a network composed of multiple computing devices, they can be implemented using program code executable by the computing device, and thus, they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be performed in a different order than herein, or they can be fabricated into separate integrated circuit modules, or multiple modules or steps can be fabricated into a single integrated circuit module for implementation. Thus, the present disclosure is not limited to any particular combination of hardware and software.

[0217] The foregoing is merely an exemplary embodiment of the present disclosure and is not intended to limit the present disclosure. Those skilled in the art will readily appreciate that the present disclosure may be modified and altered in various ways. Any modifications, equivalent substitutions, or improvements made within the principles of the present disclosure shall be within the scope of protection of the present disclosure.

Claims

1. A controller-based dynamic isolation method, applied to a network device, the method comprising: Configuring the access interface on the network device to allow only authentication messages to pass; Receiving, through the access interface, an authentication message sent by a terminal device for requesting identity authentication; Acquire the terminal identity of the terminal device based on the authentication message, so that the authentication server performs identity authentication on the terminal device based on the terminal identity, and if the authentication is successful, configure isolation information and interface permissions for the terminal device through the controller; The access interface is authorized based on the interface authority to allow non-authenticated messages to pass through, and an isolation flow table is generated for the terminal device according to the configured isolation information.

2. The method according to claim 1, wherein: Acquiring a terminal identity of the terminal device based on the authentication message so that the authentication server performs identity authentication on the terminal device based on the terminal identity, including: The network device sends the authentication message to the controller, so that the controller inquires the terminal device about the terminal identity based on the authentication message, and sends the terminal identity replied by the terminal device to the authentication server to authenticate the terminal device.

3. The method according to claim 1, wherein: Acquiring a terminal identity of the terminal device based on the authentication message so that the authentication server performs identity authentication on the terminal device based on the terminal identity, including: The network device inquires the terminal device about the terminal identity based on the authentication message, and sends the terminal identity replied by the terminal device to the authentication server to perform identity authentication on the terminal device.

4. The method according to claim 1, wherein: The identity authentication request is one of the following: 802.1X authentication, Ethernet Point-to-Point Protocol PPPoE authentication, and Portal authentication.

5. The method according to claim 1, wherein: After generating an isolation flow table for the terminal device according to the configured isolation information, the method further includes: The network device sends an authentication success message to the terminal device to notify the terminal device that the authentication is successful, so that the terminal device can perform IP address request and allocation with the address allocation server.

6. The method according to claim 1, wherein: The isolation flow table is a MAC table entry, and the MAC table entry includes isolation information, terminal MAC, interface, and interface authority.

7. The method according to claim 5, wherein: After the IP address request and allocation are performed between the terminal device and the address allocation server, the method further includes: Receiving an offline request message sent by the terminal device; forwarding the offline request message to the controller so that the controller generates a deauthorization flow table; The access interface authorization is canceled according to the deauthorization flow table, and the corresponding MAC table entry is deleted, so that the access interface is configured to allow only authentication messages to pass through.

8. A controller-based dynamic isolation method, applied to an authentication server, the method comprising: Receiving an authentication message forwarded by a network device to request identity authentication of a terminal device, wherein the access interface on the network device is configured to allow only the authentication message to pass; Obtain the terminal identity of the terminal device; The terminal device is authenticated based on the terminal identity identifier. If the authentication is successful, isolation information and interface permissions are configured for the terminal device through the controller, so that the network device authorizes the access interface based on the interface permissions to allow non-authenticated messages to pass through, and generates an isolation flow table for the terminal device according to the configured isolation information.

9. A controller-based dynamic isolation method, applied to a controller, the method comprising: Receiving an authentication message of a terminal device forwarded by a network device, wherein the access interface on the network device is configured to allow only the authentication message to pass; Obtaining a terminal identity based on the authentication message, so that the authentication server performs identity authentication on the terminal device based on the terminal identity, and generating an authentication success message if the authentication succeeds; Based on the authentication success message, isolation information and interface permissions are configured for the terminal device, so that the network device authorizes the access interface based on the interface permissions to allow non-authenticated messages to pass through, and generates an isolation flow table for the terminal device according to the configured isolation information.

10. A network device comprising: an acquisition module, configured to receive, through an access interface, an authentication message sent by a terminal device for identity authentication request, wherein the access interface on the network device is configured to allow only the authentication message to pass; a processing module, configured to obtain a terminal identity of the terminal device based on the authentication message, so that the authentication server performs identity authentication on the terminal device based on the terminal identity, and if the authentication is successful, configures isolation information and interface permissions for the terminal device through a controller; and The access interface is authorized based on the interface authority to allow non-authenticated messages to pass through, and an isolation flow table is generated for the terminal device according to the configured isolation information.

11. An authentication server, comprising: an acquisition module, configured to receive an authentication message forwarded by a network device to request identity authentication of a terminal device, wherein the access interface on the network device is configured to allow only the authentication message to pass; and to acquire a terminal identity identifier of the terminal device; A processing module is configured to perform identity authentication on the terminal device based on the terminal identity identifier. If the authentication is successful, isolation information and interface permissions are configured for the terminal device through a controller, so that the network device authorizes the access interface based on the interface permissions to allow non-authenticated messages to pass through, and generates an isolation flow table for the terminal device according to the configured isolation information.

12. A controller comprising: The acquisition module is configured to receive an authentication message of a terminal device forwarded by a network device, wherein the authentication message on the network device The access interface is configured to allow only the authentication message to pass; a processing module, configured to obtain a terminal identity based on the authentication message, so that the authentication server performs identity authentication on the terminal device based on the terminal identity, and generates an authentication success message if the authentication is successful; and Based on the authentication success message, isolation information and interface permissions are configured for the terminal device, so that the network device authorizes the access interface based on the interface permissions to allow non-authenticated messages to pass through, and generates an isolation flow table for the terminal device according to the configured isolation information.

13. A computer-readable storage medium having a computer program stored therein, wherein: When the computer program is executed by a processor, the computer program implements the steps of the method described in any one of claims 1 to 7, or implements the steps of the method described in claim 8, or implements the steps of the method described in claim 9.

14. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the processor implements the steps of the method described in any one of claims 1 to 7, or implements the steps of the method described in claim 8, or implements the steps of the method described in claim 9.

Images