Authentication method and apparatus, and electronic device and storage medium

Abstract

An authentication method and apparatus, and an electronic device and a storage medium. The method is applied to a network device, and the method comprises: receiving an authentication request from a user equipment by means of an access authentication domain; determining, by means of the access authentication domain, a single-packet authentication port set by means of a firewall, and sending an authentication message to a device management service domain by means of the single-packet authentication port, wherein the authentication message is used for authenticating the user equipment; and when the authentication of the user equipment succeeds, opening a random port on the firewall, and sending authentication success information to the user equipment by means of the random port, such that the user equipment accesses a network by means of the random port.

Description

Authentication method and device, electronic equipment and storage medium

[0001] The present application claims priority to the Chinese patent application No. 202410742903.0, filed on June 7, 2024, the content of which is incorporated herein by reference in its entirety. TECHNICAL FIELD

[0002] The present disclosure relates to the field of network security, and in particular, to an authentication method and device, electronic equipment and storage medium. BACKGROUND

[0003] The exposure protection of network devices (such as switches, routers, etc.) in an open network environment such as the Internet has always been an important content in the field of network security. With the increasing importance of network security, the secure access management of network devices is becoming more and more important. SUMMARY

[0004] In a first aspect, an authentication method is provided, applied to a network device. The network device includes an access authentication domain and a device management service domain, the access authentication domain and the device management service domain are isolated by a multi-layer network, and a firewall is further arranged between the access authentication domain and the device management service domain. The method comprises: receiving an authentication request from a user device through the access authentication domain; determining a single packet authentication port set by the firewall through the access authentication domain, and sending an authentication message to the device management service domain through the single packet authentication port, the authentication message being used to authenticate the user device; in the case that the user device is authenticated, opening a random port on the firewall and sending authentication pass information to the user device through the random port, so that the user device accesses the network through the random port.

[0005] In an implementation manner, the above-mentioned "determining a single packet authentication port set by the firewall through the access authentication domain" comprises: determining an authentication port number of the firewall through the access authentication domain, and determining the single packet authentication port set by the firewall according to the authentication port number.

[0006] In an implementation manner, the above-mentioned "the authentication message is an SPA message" comprises: using a preset encryption algorithm to encrypt a preset key and a random number to obtain an SPA key by the access authentication domain; encapsulating the SPA key and a preset parameter based on SPA to obtain the SPA message, the preset parameter comprising one or more of an identifier of the user device, the random number, a current time stamp of the device, an IP address of the user device, and the authentication port number.

[0007] In an implementation manner, the "the device management service domain has a single package authentication service and a management interface service, the single package authentication service is used for authenticating the user equipment, and the management interface service is used for providing the network access service for the user equipment; and the authentication message is sent to a knocking port corresponding to the single package authentication service through a single package authentication port" includes: the authentication message is sent to the knocking port through the single package authentication port, and the knocking port is a port set by the single package authentication service and used for receiving the authentication message.

[0008] In an implementation manner, the password is generated by using a time-based one-time password algorithm through the single package authentication port in the firewall, the first hash value is obtained by performing a hash operation on the password, the second hash value is obtained by performing a hash operation on the received authentication message by the single package authentication service, and the user equipment is determined to be authenticated successfully in a case where the first hash value is consistent with the second hash value.

[0009] In an implementation manner, the "opening a random port on the firewall in a case where the user equipment is authenticated successfully" specifically includes: sending indication information to the firewall in a case where the user equipment is authenticated successfully; the indication information is used for indicating that the user equipment is authenticated successfully; and receiving response information from the firewall, and the response information is used for indicating the random port.

[0010] In an implementation manner, the random port is closed after the user equipment access is ended.

[0011] In a second aspect, an authentication apparatus applied to a network device is provided, and the authentication apparatus can implement the authentication method in the aspects or designs. The authentication apparatus can have a function of executing the authentication method, and the function can be implemented by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the functions. The authentication apparatus includes a control unit and a processing unit.

[0012] The control unit is used for receiving an authentication request from the user equipment through an access authentication domain.

[0013] The control unit is further used for determining a single package authentication port set by the firewall through the access authentication domain, and sending an authentication message to a device management service domain through the single package authentication port, and the authentication message is used for authenticating the user equipment.

[0014] The processing unit is used for opening a random port on the firewall in a case where the user equipment is authenticated successfully, and sending authentication success information to the user equipment through the random port, so that the user equipment accesses the network through the random port.

[0015] In an implementation, the control unit is configured to determine an authentication port number of the firewall by accessing an authentication domain, and determine an open single packet authentication port of the firewall according to the authentication port number. The control unit is configured to encrypt a preset key and a random number using a preset encryption algorithm to obtain an SPA key, and encapsulate the SPA key and preset parameters based on SPA to obtain an SPA message, the preset parameters including one or more of an identifier of the user equipment, the random number, a current timestamp of the user equipment, an IP address of the user equipment, and the authentication port number. The control unit is configured to send the authentication message to a knock port corresponding to a guarantee authentication service through the open single packet authentication port, the knock port being a port set by the single packet authentication service and used for indicating reception of the authentication message.

[0016] In an implementation, the processing unit is configured to generate a password using a time-based one-time password algorithm through a single packet authentication port in the firewall, and obtain a first hash value by performing a hash operation on the password. The processing unit is configured to perform a hash operation on the received authentication message through the single packet authentication service to obtain a second hash value. The processing unit is configured to determine that the user equipment passes authentication in a case where the first hash value is consistent with the second hash value. In a case where the user equipment passes authentication, the processing unit is configured to send indication information to the firewall, the indication information being used to indicate that the user equipment passes authentication. The processing unit is configured to receive a response message from the firewall, the response message being used to indicate a random port. The processing unit is configured to close the random port after the user equipment access ends.

[0017] In a third aspect, an electronic device is provided. The electronic device can implement the functions performed in the aspects described above, which can be implemented by hardware. For example, in one design, the electronic device can include a processor and a communication interface. The processor can be configured to support the electronic device to implement the functions involved in the first aspect described above or any of the designs of the first aspect.

[0018] In another design, the electronic device can further include a memory configured to store computer-executable instructions and data necessary for the electronic device. When the electronic device is running, the processor executes the computer-executable instructions stored in the memory, so that the electronic device performs the authentication method involved in the first aspect described above or any of the designs of the first aspect.

[0019] In a fourth aspect, a computer-readable storage medium is provided. The computer-readable storage medium can be a readable nonvolatile storage medium, and the computer-readable storage medium stores computer instructions or programs. When the computer-readable storage medium is run on a computer, the computer can execute the authentication method involved in the first aspect described above or any of the designs of the first aspect.

[0020] In a fifth aspect, a computer program product containing instructions, which, when the computer program product runs on a computer, enables the computer to perform the authentication method of the first aspect or any of the aspects related thereto.

[0021] In a sixth aspect, a chip system is provided, which includes a processor and a communication interface, and can be used to implement the functions performed by the determination device of the first aspect or any of the aspects related thereto. In one design, the chip system further includes a memory for storing program instructions and / or data. The chip system can be composed of a chip, or can include a chip and other discrete devices, which are not limited in the present disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0022] FIG. 1 is a schematic diagram of a network device according to some embodiments of the present disclosure;

[0023] FIG. 2 is a schematic diagram of an electronic device according to some embodiments of the present disclosure;

[0024] FIG. 3 is a flowchart of an authentication method according to some embodiments of the present disclosure;

[0025] FIG. 4 is a flowchart of another authentication method according to some embodiments of the present disclosure;

[0026] FIG. 5 is a flowchart of yet another authentication method according to some embodiments of the present disclosure;

[0027] FIG. 6 is a flowchart of yet another authentication method according to some embodiments of the present disclosure;

[0028] FIG. 7 is a block diagram of an authentication device according to some embodiments of the present disclosure. DETAILED DESCRIPTION

[0029] In order to make the ordinary person skilled in the art better understand the technical solutions of the present disclosure, the technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings.

[0030] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above drawings are used to distinguish similar objects, and do not necessarily describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present disclosure described herein can be implemented in an order other than that illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Rather, they are merely examples of devices and methods consistent with some aspects of the embodiments of the present disclosure as detailed in the appended claims.

[0031] It should also be understood that the term "comprising" indicates the presence of the described features, integers, steps, operations, elements, and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, and / or components.

[0032] The system architecture and business scenarios described in the embodiments of the present disclosure are for more clearly illustrating the technical solutions of the embodiments of the present disclosure, and do not constitute a limitation on the technical solutions provided by the embodiments of the present disclosure. Those skilled in the art can know that, as new business scenarios appear, the technical solutions provided by the embodiments of the present disclosure are also applicable to similar technical problems.

[0033] The exposure protection of network devices (switches, routers, etc.) in an open network environment such as the Internet has always been a key content in the field of network security. With the increasing importance of network security, the secure access management of network devices is becoming more and more important.

[0034] At present, user equipment can access network devices through an open network. However, in an open network environment, when the user equipment accesses the network device, the port information of the network device is easy to be leaked, which may cause other devices to continue to access using the port, thereby bringing security risks to the network device.

[0035] The secure access management scheme for network devices in the related art mainly includes the following categories:

[0036] (1) Only the service interface in the open network environment such as the Internet is opened, and the management interface and the service interface of the network device are physically isolated in the open network environment. The user must access the network device management network inside the network device management network or through a virtual private network (VPN) or the like to access the management interface of the network device.

[0037] (2) The management interface is opened in the open network environment such as the Internet, but strict security measures are adopted, for example, an Internet Protocol (IP) white list is set, a secure certificate login is used, or the like.

[0038] The above schemes have certain limitations:

[0039] (1) The method of only being able to access in the network device management network limits the convenience of managing and collecting information of the network device;

[0040] (2) Using VPN access devices to manage the network increases investment costs and requires network management users to install VPN software, which is inconvenient. In addition, if business management regulations do not allow VPN access in the network management network, this method cannot be used.

[0041] (3) The approach of opening the management interface but strengthening the access security policy is problematic because the management interface is exposed in the open network, which poses a greater risk of network security threats. In most cases, this approach is restricted by business management regulations and cannot be adopted.

[0042] In view of this, some embodiments of this disclosure provide an authentication method applied to a network device, the method comprising:

[0043] The system receives authentication requests from user devices through the access authentication domain; determines the single-packet authentication port configured on the firewall through the access authentication domain, and sends an authentication message to the device management service domain through the single-packet authentication port. The authentication message is used to authenticate the user device; if the user device is successfully authenticated, a random port is opened on the firewall, and authentication success information is sent to the user device through the random port, so that the user device can access the network through the random port.

[0044] Thus, when a user device authenticates through the access authentication domain, the firewall authenticates the user device's authentication request through a dynamic single packet authentication port. Since the single packet authentication service does not return any data packets to the interface proxy service program and the user when single packet authentication (SPA) fails, this allows network devices to not expose any network ports to the outside world in the absence of authentication. During the authentication process, the network isolation between the device's core system and the authentication program is guaranteed. After authentication is completed, the security and controllability of user access are guaranteed.

[0045] In one example, Figure 1 is a schematic diagram of a network device according to some embodiments of the present disclosure. As shown in Figure 1, the network device may include an access authentication domain and a device management service domain. The access authentication domain and the device management service domain are isolated by two layers of network, and a firewall is also provided between the access authentication domain and the device management service domain.

[0046] The access authentication domain can be used to receive authentication requests from user devices and determine the single-packet authentication port configured in the firewall.

[0047] The Device Management Service domain can be used to authenticate user devices through received authentication messages, and provide management interface services for users to access if the user device is successfully authenticated.

[0048] In an example, as shown in FIG. 1, the access authentication domain can include an interface agent service.

[0049] The interface agent service can be used to calculate a SPA key using user account and password information through a preset key and a random number when the user is authenticated, the SPA key is used for the SPA authentication service to compare whether the authentication is passed, and the SPA key is packaged into an authentication message together with the identification of the user equipment, the random number, the current timestamp of the equipment, and the authentication port number, and is sent to the single package authentication service in the device management service domain.

[0050] In an example, as shown in FIG. 1, the device management service domain can include a single package authentication service and a management interface service.

[0051] The single package authentication service can be used to authenticate the user equipment, and determine whether the user equipment authentication is passed by receiving the authentication message through the knock port. The management interface service can be used to provide network access service for the user equipment.

[0052] The network device shown in FIG. 1 can adopt the constituent structure shown in FIG. 2, or include the components shown in FIG. 2. FIG. 2 is a schematic diagram of an electronic device according to some embodiments of the present disclosure, which can be a chip or a system on chip in a server. As shown in FIG. 2, the electronic device 200 includes a processor 201, a communication interface 202, and a communication line 203.

[0053] Further, the electronic device 200 can further include a memory 204. The processor 201, the memory 204, and the communication interface 202 can be connected through the communication line 203.

[0054] The processor 201 is a central processing unit (CPU), a general processor, a network processor (NP), a digital signal processing (DSP), a microprocessor, a microcontroller, a programmable logic device (PLD), or any combination thereof. The processor 201 can also be other devices with processing functions, such as a circuit, a device, or a software module, which are not limited in the present disclosure.

[0055] The communication interface 202 is configured to communicate with other devices or other communication networks. The other communication networks can be an Ethernet, a radio access network (RAN), a wireless local area network (WLAN), or the like. The communication interface 202 can be a module, a circuit, a communication interface, or any device capable of communication.

[0056] The communication line 203 is configured to transmit information between components included in the electronic device 200.

[0057] The memory 204 is configured to store instructions. The instructions can be a computer program.

[0058] The memory 204 can be a read-only memory (ROM) or other type of static storage device that can store static information and / or instructions, or can be a random access memory (RAM) or other type of dynamic storage device that can store information and / or instructions, or can be an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disk storage, a magneto-optical disk, a magnetic disk storage or other magnetic storage devices, and the like, without limitation.

[0059] It should be noted that the memory 204 can exist independently of the processor 201, or can be integrated with the processor 201. The memory 204 can be configured to store instructions, program codes, or some data, and the like. The memory 204 can be located in the electronic device 200, or can be located outside the electronic device 200, without limitation. The processor 201 is configured to execute instructions stored in the memory 204, to implement the field configuration method provided by some embodiments of the present disclosure.

[0060] In an example, the processor 201 can include one or more CPUs, for example, CPU0 and CPU1 in FIG. 2.

[0061] As an implementation manner, the electronic device 200 includes a plurality of processors 201, for example, as shown in FIG. 2, the electronic device 200 includes two processors 201.

[0062] As an implementation manner, as shown in FIG. 2, the electronic device 200 further includes an output device 205 and an input device 206. For example, the input device 206 is a device such as a keyboard, a mouse, a microphone, or a joystick, and the output device 205 is a device such as a display screen or a speaker.

[0063] It should be noted that the electronic device 200 can be a desktop computer, a laptop computer, a network server, a mobile phone, a tablet computer, a wireless terminal, an embedded device, a chip system, or a device including a similar structure as shown in FIG. 2. In addition, the constituent structure shown in FIG. 2 does not constitute a limitation on the devices in FIG. 1. In addition to the components shown in FIG. 2, the devices in FIG. 1 can include more or fewer components than shown, or combine certain components, or different component arrangements.

[0064] In some embodiments, the chip system can include a chip, and can also include a chip and other discrete devices.

[0065] In addition, the actions, terms, and the like involved among the embodiments of the present disclosure can be mutually referred to, and the present disclosure does not limit this. The message name or parameter name in the message between the devices in the embodiments of the present disclosure is only an example, and other names can also be used in the implementation, which is not limited.

[0066] In order to clearly describe the technical solutions of some embodiments of the present disclosure, in some embodiments of the present disclosure, the same items or similar items with basically the same functions and roles are distinguished by using “first”, “second”, and the like. Those skilled in the art can understand that “first”, “second”, and the like do not limit the quantity and execution order, and “first”, “second”, and the like do not necessarily mean different.

[0067] It should be noted that in some embodiments of the present disclosure, the words “exemplary” or “for example” are used to mean serving as an example, instance, or illustration. Any embodiment or design presented as “exemplary” or “for example” in some embodiments of the present disclosure should not be interpreted as being more preferred or advantageous than other embodiments or design solutions. Rather, the use of “exemplary” or “for example” is intended to present concepts in a concrete manner.

[0068] The authentication method provided by some embodiments of the present disclosure is described below in combination with the network device shown in FIG. 1. The actions involved in the embodiments of the present disclosure are only an example, and other names can also be used in the specific implementation, such as: “including” in some embodiments of the present disclosure can be replaced by “carried on” or “carried in” and the like.

[0069] It should be noted that the execution subject of some embodiments of the present disclosure can be the network device in FIG. 1, or a device in the network device, such as a chip or a system on chip. The method provided by some embodiments of the present disclosure will be described below taking the network device as an example.

[0070] FIG. 3 is a flowchart of an authentication method according to some embodiments. As shown in FIG. 3, the authentication method includes steps S301-S303.

[0071] In S301, the network device receives an authentication request from a user device through an access authentication domain.

[0072] The access authentication domain is a separate layer network in the network device; the access authentication domain has the following characteristics: completely isolated from the device management service domain on a two-layer network; communicates with the device management service domain and is isolated by a firewall; only runs an interface proxy service in the access authentication domain, which can proxy the access of the user device to the network device to the device management service domain; and the access authentication domain does not save any data and configuration information.

[0073] The authentication request is an authentication request of the user device to the network device through an open network.

[0074] In an example, the user device initiates an authentication request to the network device in an open network, for example, the user inputs a username and a password from the user device; the access authentication domain receives the authentication request through the interface proxy service.

[0075] In S302, the network device determines a single packet authentication port of the firewall setting through the access authentication domain, and sends an authentication packet to the device management service domain through the single packet authentication port.

[0076] The authentication packet is used to authenticate the user device. The authentication packet is a SPA packet, which is calculated and generated based on a HMAC-based One-Time Password (HOTP) algorithm. For example, reference can be made to the description of the embodiment shown in FIG. 4, which will not be described here.

[0077] In an implementation manner, the network device can determine the authentication port number of the firewall through the access authentication domain, and determine the single packet authentication port of the firewall setting according to the authentication port number.

[0078] The authentication port number is used to indicate the single packet authentication port of the firewall setting. The single packet authentication port is used to send the authentication packet to the device management service domain.

[0079] In an example, the network device can use a preset encryption algorithm to generate a port number through the access authentication domain, and use the port number as the authentication port number of the firewall.

[0080] The preset encryption algorithm can be a Time-based One-Time Password (TOTP) algorithm.

[0081] In yet another implementation, after determining the authentication port number of the firewall, the network device can determine a single packet authentication port of the firewall based on the authentication port number, and send an authentication message to the single packet authentication port. After passing through the single packet authentication port, the firewall can send an authentication message to the device management service domain based on the preset knock port.

[0082] The knock port is set based on a single packet authentication service in the device management service domain.

[0083] In an example, the firewall can use the TOTP algorithm to operate on the current timestamp of the device, the IP address of the user device, etc., to generate a temporary password, and obtain a first hash value after Hashing Operation (HASH) on the temporary password. The first hash value can be used as the port number of the knock port.

[0084] It should be noted that, in some embodiments of the present disclosure, in order to ensure the security of the port, the temporary password and the port number in the single packet authentication port opened in the firewall can be updated periodically.

[0085] In S303, in the case that the user device authentication is passed, a random port is opened on the firewall, and authentication passing information is sent to the user device through the random port, so that the user device accesses the network through the random port.

[0086] The random port is used for the user device to access the device management interface in the device management service domain.

[0087] In an implementation, after the network device generates the first hash value through the firewall, the network device can perform Hashing Operation on the received authentication message through the single packet authentication service to obtain a second hash value. For example, the single packet authentication service can calculate an SPA key according to the current timestamp of the device, the IP address of the user device in the received SPA message, and a service password stored in the single packet authentication service, and perform Hashing Operation on the SPA key to obtain the second hash value.

[0088] In the case that the first hash value is consistent with the second hash value, the user device authentication is passed. In the case that the first hash value is not consistent with the second hash value, the user device authentication is not passed.

[0089] In an implementation, in the case that the user device authentication is passed, the network device sends indication information to the firewall through the device management service domain. Correspondingly, the network device receives a response message from the firewall through the device management service domain.

[0090] The indication information is used to indicate that the user equipment is authenticated; and the response message is used to indicate the random port.

[0091] In some embodiments of the present disclosure, in the case that the user equipment is authenticated, the network device can inform the firewall to open the random port, and send information indicating the random port to the access authentication domain through the knock port, so that subsequently, when the access authentication domain receives an access request of the user equipment, the access authentication domain can send the access request to the device management service domain through the random port.

[0092] In some embodiments of the present disclosure, the firewall can be provided with a white list. The white list includes address information of the access authentication domain. That is, when the firewall receives an access request forwarded by other domains, the firewall does not open a random port. Alternatively, based on the white list, the firewall only opens a single packet authentication port for the access authentication domain. In the case that the user equipment is authenticated, the firewall can open a random port for the access authentication domain.

[0093] In an example, an interface proxy service can be used to proxy a management port such as a Secure Shell (SSH) protocol / Hyper Text Transfer Protocol (HTTP) and the like. For example, the interface proxy service can proxy an access of the user equipment to the random port opened by the firewall, so that the user equipment can access a device management interface in the device management service domain through the random port.

[0094] In an example, in the case that the user equipment ends a management session or times out and exits, the management interface service can inform the firewall to close the opened random port.

[0095] As shown in FIG. 3, in some embodiments of the present disclosure, the network device receives an authentication request from the user equipment through the access authentication domain; the network device determines a single packet authentication port set by the firewall through the access authentication domain, and sends an authentication packet to the device management service domain through the single packet authentication port. In the case that the user equipment is authenticated, a random port is opened on the firewall, and authentication pass information is sent to the user equipment through the random port, so that the user equipment accesses the network through the random port. In this way, compared with the current access manner to the network device deployed in an open network, the technical solution of some embodiments of the present disclosure can more securely and accurately realize access to a device management interface in the device management service domain.

[0096] In some embodiments, as shown in FIG. 4, the authentication method of some embodiments of the present disclosure can further include S401-S402.

[0097] In S401, the network device controls the access authentication domain to encrypt the preset key and the random number using a preset encryption algorithm to obtain an SPA key.

[0098] In an example, the interface proxy service in the access authentication domain calculates the SPA key according to the one-time password algorithm based on the random number by using the preset key and the random number when authenticating the user.

[0099] In S402, the network device encapsulates the SPA key and preset parameters based on the SPA to obtain the SPA message.

[0100] In an example, the interface proxy service in the access authentication domain encapsulates the SPA key and the preset parameters to obtain the SPA message.

[0101] The preset parameters include one or more of the identification of the user equipment, the random number, the current timestamp of the equipment, the IP address of the user equipment, and the authentication port number.

[0102] As shown in FIG. 4, in some embodiments of the present disclosure, the network device controls the access authentication domain to encrypt the preset key and the random number using a preset encryption algorithm to obtain an SPA key; and the network device encapsulates the SPA key and preset parameters based on the SPA to obtain the SPA message. In this way, the authentication request of the user equipment can be accurately obtained.

[0103] In an embodiment, as shown in FIG. 5, the authentication method provided by some embodiments of the present disclosure can include S501 to S504.

[0104] In S501, the user equipment sends an authentication request to the access authentication domain. Correspondingly, the access authentication domain receives the authentication request from the user equipment.

[0105] In S502, the access authentication domain encapsulates the received authentication request to obtain an SPA message, and sends the SPA message to the single packet authentication service through the single packet authentication port of the firewall. Correspondingly, the single packet authentication service receives the SPA message from the access authentication domain.

[0106] The SPA message includes related information of the user equipment, such as the IP address of the user equipment, the current timestamp of the equipment when the user equipment sends the authentication request, and the like.

[0107] In S503, the single packet authentication service analyzes the SPA message, and authenticates the user equipment based on the analyzed SPA message.

[0108] In S504, in the case that the user equipment passes the authentication, the single packet authentication service sends authentication pass information to the access authentication domain through a random port.

[0109] The implementation manners and technical effects of S501-S504 can refer to the descriptions of the above-described embodiments, and will not be described herein.

[0110] In an embodiment, as shown in FIG. 6, the authentication method provided by some embodiments of the present disclosure can further include the following steps.

[0111] In S601, the network device opens a single packet authentication port through the firewall.

[0112] In S602, the network device receives an authentication request from the user device through the access authentication domain.

[0113] In S603, the access authentication domain encapsulates the received authentication request to obtain an SPA message, and sends the SPA message to a single packet authentication service in the device management service domain through the single packet authentication port in the firewall. Correspondingly, the single packet authentication service receives the SPA message from the access authentication domain.

[0114] In S604, the single packet authentication service parses the SPA message, and authenticates the user device based on the parsed SPA message.

[0115] In S605, in the case that the user device passes the authentication, the network device sends first indication information to the firewall through the single packet authentication service; correspondingly, the firewall receives the first indication information from the single packet authentication service, and opens a random port.

[0116] The first indication information is used to instruct the firewall to open the random port.

[0117] In S606, the network device sends the random port number of the firewall to the access authentication domain through the single packet authentication service; correspondingly, the access authentication domain receives the random port number sent from the single packet authentication service.

[0118] In S607, the network device sends authentication passing information to the user device through the access authentication domain.

[0119] In S608, the user device accesses the management interface service in the device management service domain through the random port of the firewall.

[0120] In S609, the user device ends the access to the network device.

[0121] In S610, the network device sends second indication information to the firewall through the management interface service; correspondingly, the firewall receives the second indication information from the management interface service, and closes the random port.

[0122] The second indication information is used to instruct the firewall to close the random port.

[0123] The implementation manners and technical effects of S601-S610 can refer to the descriptions of the above-described embodiments, and will not be described herein.

[0124] Some embodiments of the present disclosure can divide the field query device into functional modules or functional units according to the above-described method examples. For example, each functional module or functional unit can be divided according to each function, or two or more functions can be integrated into one processing module. The integrated module can be implemented in the form of hardware or in the form of a software functional module or functional unit. The division of the modules or units in some embodiments of the present disclosure is illustrative, and is only a logical functional division. When actually implemented, another division manner can be used.

[0125] In the case of dividing each functional module according to each function, FIG. 7 shows a block diagram of an authentication device 70 that can be used to execute the authentication method in the above-described embodiments. The authentication device 70 shown in FIG. 7 can include a control unit 701 and a processing unit 702.

[0126] The control unit 701 is configured to receive an authentication request from a user device through an access authentication domain.

[0127] The control unit 701 is further configured to determine a single packet authentication port of a firewall set through the access authentication domain, and send an authentication message to a device management service domain through the single packet authentication port, the authentication message being used to authenticate the user device.

[0128] The processing unit 702 is configured to open a random port on the firewall in the case that the user device passes the authentication, and send authentication passing information to the user device through the random port, so that the user device accesses the network through the random port.

[0129] In one implementation manner, the control unit 701 is configured to determine an authentication port number of the firewall through the access authentication domain, and determine a single packet authentication port of the firewall set according to the authentication port number. A preset encryption algorithm is used to encrypt a preset key and a random number through the access authentication domain, to obtain an SPA key. A preset parameter is encapsulated through SPA to obtain an SPA message, the preset parameter including one or more of the SPA key, an identifier of the user device, the random number, a current time stamp of the device, an IP address of the user device, and the authentication port number. The authentication message is sent to a knocking port corresponding to a guarantee authentication service through the single packet authentication port. The knocking port is a port set by the single packet authentication service and used to indicate that the authentication message is received.

[0130] In an implementation manner, the processing unit 702 is configured to generate a password by using a time-based one-time password algorithm through a single packet authentication port in the firewall, hash the password to obtain a first hash value; calculate an SPA key by using a current time stamp in the received authentication packet, an IP address of the user equipment and a service password stored in the single packet authentication service, hash the SPA key to obtain a second hash value; and determine that the user equipment authentication is passed when the first hash value is consistent with the second hash value. When the user equipment authentication is passed, send indication information to the firewall to indicate that the user equipment authentication is passed; receive a response message from the firewall, the response message being used to indicate a random port. After the user equipment access is ended, the random port is closed.

[0131] Some embodiments of the present disclosure further provide a computer readable storage medium. All or part of the flow of the above-mentioned method embodiments can be instructed by a computer program to relevant hardware to complete, the program can be stored in the above-mentioned computer readable storage medium, and the program can include the flow of the above-mentioned method embodiments when executed. The computer readable storage medium can be an internal storage unit of the authentication device (including at least one of the data sending end or the data receiving end) of any of the above-mentioned embodiments, such as a hard disk or a memory of the authentication device. The above-mentioned computer readable storage medium can also be an external storage device of the terminal device, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card and the like equipped on the terminal device. Further, the above-mentioned computer readable storage medium can include both the internal storage unit of the authentication device and the external storage device. The above-mentioned computer readable storage medium is used to store the above-mentioned computer program and other programs and data required by the authentication device. The above-mentioned computer readable storage medium can also be used to temporarily store data that has been output or will be output.

[0132] It should be noted that the terms "first" and "second" and the like in the specification, claims and drawings of the present disclosure are used to distinguish different objects, and are not used to describe a specific order. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device including a series of steps or units is not limited to the listed steps or units, but can optionally include steps or units not listed or can optionally include other steps or units inherent to the process, method, product or device.

[0133] It should be understood that, in the disclosure, "at least one" refers to one or more, "multiple" refers to two or more, "at least two" refers to two or three and three or more, and "and / or" is used to describe the association relationship of the associated objects, which means that there can be three relationships, for example, "A and / or B" can mean that there are three cases of only A, only B, and A and B at the same time, and A and B can be singular or plural. The character " / " generally represents an "or" relationship between the associated objects before and after it. "At least one of the following" or similar expressions means any combination of these items, including any combination of single or multiple items. For example, at least one of a, b or c, can mean a, b, c, "a and b", "a and c", "b and c", or "a and b and c", a, b, c can be single or multiple.

[0134] Through the description of the above embodiments, those skilled in the art can clearly understand that, for the convenience and brevity of description, only the above division of functional modules is taken as an example, and in actual application, the above functions can be completed by different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above.

[0135] In several embodiments provided by the disclosure, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only illustrative, for example, the division of the modules or units is only a logical function division, and actual implementation can have another division manner, for example, multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed each other can be through some interface, indirect coupling or communication connection between devices or units, which can be electrical, mechanical or other forms.

[0136] The units described as separate components can or can not be physically separated, and the components shown as units can be one physical unit or multiple physical units, that is, they can be located in one place, or they can be distributed to multiple different places. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0137] In addition, each functional unit in each embodiment of the disclosure can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of software functional unit.

[0138] The integrated unit, if implemented in the form of a software function unit and sold or used as an independent product, can be stored in a readable storage medium. Based on such an understanding, the technical solutions of some embodiments of the present disclosure or the part that essentially contributes to the related art or the whole or part of the technical solutions can be embodied in the form of a software product, which is stored in a storage medium and includes a plurality of instructions for causing an apparatus (which can be a single-chip microcomputer, a chip, etc.) or a processor to execute all or part of the steps of the method described in various embodiments of the present disclosure. The aforementioned storage medium includes: a U disk, a mobile hard disk, a ROM, a RAM, a magnetic disk or an optical disk, and various storage medium capable of storing program codes.

[0139] The above is only a specific embodiment of the present disclosure, but the protection scope of the present disclosure is not limited thereto. Any change or replacement within the technical scope disclosed in the present disclosure should be covered within the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be subject to the protection scope of the claims.

Claims

1. An authentication method applied to a network device, the network device comprising an access authentication domain and a device management service domain, the access authentication domain and the device management service domain being isolated by a multi-layer network, and a firewall being further arranged between the access authentication domain and the device management service domain, the method comprising: receiving an authentication request from a user device through the access authentication domain; determining a single packet authentication port of the firewall through the access authentication domain, and sending an authentication message to the device management service domain through the single packet authentication port, the authentication message being used for authenticating the user device; and in the case that the user device is authenticated, opening a random port on the firewall, and sending authentication pass information to the user device through the random port, so that the user device accesses a network through the random port. The determining of the single packet authentication port of the firewall through the access authentication domain comprises: determining an authentication port number of the firewall through the access authentication domain, and determining the single packet authentication port of the firewall according to the authentication port number. The authentication message is a single packet authentication (SPA) message, and the method further comprises: controlling the access authentication domain to encrypt a preset key and a random number using a preset encryption algorithm to obtain an SPA key; and encapsulating the SPA key and a preset parameter based on the SPA to obtain the SPA message; wherein the preset parameter comprises one or more of an identifier of the user device, the random number, a current timestamp of the device, an IP address of the user device, and an authentication port number. The device management service domain has a single packet authentication service and a management interface service, the single packet authentication service being used for authenticating the user device, and the management interface service being used for providing network access service for the user device. The sending of the authentication message to the device management service domain through the single packet authentication port comprises: sending the authentication message to a knock port corresponding to the single packet authentication service through the single packet authentication port.

2. The method of claim 1, wherein, The knock port is a port set by the single packet authentication service for receiving the authentication message.

5. The method of any one of claims 1 to 4, further comprising: generating a password using a time-based one-time password algorithm through the single packet authentication port in the firewall, and obtaining a first hash value after a hash operation is performed on the password; performing the hash operation on the received authentication message through the single packet authentication service to obtain a second hash value; and in the case that the first hash value is consistent with the second hash value, determining that the user device is authenticated.

3. The method of claim 1 or 2, wherein, The opening of the random port on the firewall in the case that the user device is authenticated comprises: in the case that the user device is authenticated, sending indication information to the firewall, the indication information being used for indicating that the user device is authenticated; and receiving a response message from the firewall, the response message being used for indicating the random port.

7. The method of claim 6, further comprising: ​ ​ 4. The method of any one of claims 1 to 3, wherein, ​ ​ ​ ​ ​ ​ ​ ​ 6. The method of any one of claims 1 to 5, wherein, ​ ​ ​ ​ After the user equipment access ends, the random port is closed.

8. An authentication apparatus applied to a network device, wherein, The network device comprises an access authentication domain and a device management service domain, the access authentication domain and the device management service domain are isolated by a multi-layer network, and a firewall is arranged between the access authentication domain and the device management service domain, and the authentication device comprises: a control unit configured to receive an authentication request from a user equipment through the access authentication domain; the control unit is further configured to determine a single packet authentication port of the firewall through the access authentication domain, and send an authentication packet to the device management service domain through the single packet authentication port, the authentication packet being used for authenticating the user equipment; and a processing unit configured to, in a case that the user equipment passes the authentication, open a random port on the firewall, and send authentication passing information to the user equipment through the random port, so that the user equipment accesses the network through the random port.

9. An electronic device comprising: a processor, a memory and a communication interface; wherein the communication interface is configured to communicate for the authentication device; the memory is configured to store one or more programs, the one or more programs comprising computer execution instructions; when the authentication device is running, the processor executes the computer execution instructions stored in the memory, so that the authentication device executes the method according to any one of claims 1-7.

10. A computer readable storage medium, the computer readable storage medium storing instructions, when the instructions are executed, implementing the method according to any one of claims 1-7.

11. A computer program product comprising instructions, when the instructions are executed on a computer, the computer executing the method according to any one of claims 1 to 7.

Images