Controller-Based User Terminal Access Control in Campus Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for controlling user terminal access in campus networks are either complex or compromise security, as they either require each access switching node to perform authentication, leading to high complexity, or rely on aggregation switching nodes for authentication, resulting in poor control over individual user terminals and security.
Innovation Solution
A method and system where a controller receives authentication packets from access switching nodes, determines the interface identifier for successfully authenticated user terminals, and sends this information through a control tunnel to enable the corresponding interfaces, allowing centralized control and improved security by maintaining a correspondence between MAC addresses and interface identifiers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If each access switching node implements authentication to check whether a user terminal is allowed to access the campus network, then security is improved, but device complexity increases
Solution Approach 1:
An aggregation switching node is introduced as an intermediary between access switching nodes and the network core. The aggregation switching node centralizes authentication functionality, allowing access switching nodes to forward authentication requests without implementing complex authentication logic themselves. This resolves the contradiction by maintaining security through centralized authentication while reducing device complexity at access switching nodes.
2Device complexity
If an aggregation switching node implements authentication on user terminals, then device complexity is reduced, but control over individual user terminals deteriorates and security is compromised
Solution Approach 1:
The authentication system is segmented into multiple functional components distributed across different switching nodes. Access switching nodes handle local interface management and forwarding, while the aggregation switching node performs centralized authentication. This segmentation allows each component to focus on specific tasks, maintaining security through centralized control while enabling fine-grained control over individual user terminals through interface-specific authentication decisions.
3Ease of operation
If centralized control is implemented through an aggregation switching node, then ease of operation is improved, but control precision over individual user terminals deteriorates
Solution Approach 1:
The system implements local quality by allowing different interface identifiers on access switching nodes to have different authentication requirements and access permissions. Each interface can be individually configured with specific authentication policies, enabling precise control over individual user terminals while maintaining centralized management through the aggregation switching node. This resolves the contradiction by enabling both centralized ease of operation and local control precision.
Data Source
AI summary
A method, an apparatus, and a system for controlling access of a user terminal, where the method includes receiving, by a controller, an authentication packet sent by an access switching node through an established data tunnel; obtaining, by the controller, a source media access control (MAC) address of the authentication packet; after access authentication implemented on a user terminal, determining, from a maintained correspondence between MAC addresses of user terminals and interface identifiers, an interface identifier corresponding to the MAC address of the successfully-authenticated user terminal, where the interface identifier identifies an interface connected to the user terminal; and sending, by the controller, the determined interface identifier to the access switching node through an established control tunnel, and instructing the access switching node to enable the interface corresponding to the interface identifier.