CN1486032A - Method and apparatus for VLAN based network access control - Google Patents
Method and apparatus for VLAN based network access control Download PDFInfo
- Publication number
- CN1486032A CN1486032A CNA021317836A CN02131783A CN1486032A CN 1486032 A CN1486032 A CN 1486032A CN A021317836 A CNA021317836 A CN A021317836A CN 02131783 A CN02131783 A CN 02131783A CN 1486032 A CN1486032 A CN 1486032A
- Authority
- CN
- China
- Prior art keywords
- user
- access
- vlan
- eap
- port
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Landscapes
- Small-Scale Networks (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention refers to net access control method based on virtual LAN. The method is: configures the access authority of ports on LAN user access appliances, when a user access in LAN, user access appliance examines the authority state of application port; carries on the user LAN access control according to the authority state. The device includes: user access appliance, access control appliance and access identification server, the user accesses the net through user access appliance, and carries net access authentication through access control appliance and access authentication server.
Description
Technical field
The present invention relates to network communications technology field, relate in particular to a kind of access control method and device based on VLAN.
Background technology
Present Ethernet mainly is the 10Bast-T network of IEEE802.3 (institute of Electrical and Electronic Engineers's 802.3 standards) definition, and promptly wire rate is the network of 10Mbps; Ethernet technology commonly used mainly is MAC (medium access control) technology of IEEE802.3 definition, uses CSMA/CD (carrier sense multiple access with measuring ability) medium control protocol.Based on the network of CSMA/CD medium control protocol, because the existence of conflict and repeating transmission phenomenon causes the actual flow flux of Ethernet to be difficult to surpass wire rate 2.5Mbps.And this limited bandwidth also will all clients on the same local area network (LAN) share by being connected to, and are just lower for the available bandwidth of each client computer.
Wherein, existing crossover local area network (LAN) is compared with the local area network (LAN) of traditional shared medium, and performance is greatly improved.And, along with the rapid decline of local area network (LAN) exchange cost, for the realization of VLAN (VLAN) provides the foundation.VLAN provides a kind of alternative solution for router, still needs router among the VLAN, still exists broadcast traffic.But, after switching technology and virtual local area network technology combined,, even can have only a user though the user in the network segment can lack as much as possible, broadcast domain then can be greatly to the user who comprises more than 1000.
Present local area network technology can't provide access authentication, only needs user's energy access to LAN control appliance usually, and as LanSwitch (Ethernet switch), the user just can visit equipment or the resource in the local area network (LAN).Can not dock access customer and control, just be difficult to ensure the safety of user in the local area network (LAN); And a large amount of available network resource that also will cause each user through the user access networks of authentication can't guarantee that the user normally uses network very little.
For example, the local area network (LAN) of IEEE 802 lan protocols definition does not just provide access authentication, as long as the user is connected in the local area network (LAN), just can passes through DHCP (DHCP) server and obtain IP (Internet protocol) address.Even there are a lot of access users not prepare accesses network, taken the IP address resource too, be easy to cause the exhaustion of IP address pool like this, and local area network (LAN) is easy to also be attacked the exhaustion that causes the IP address pool, thereby makes the user can't normally use network.Therefore, for insert as telecommunications, application such as office building LAN (local area network (LAN)) and mobile office, the equipment supplier wishes and can control and dispose user's access.
Summary of the invention
The purpose of this invention is to provide a kind of access control method and device based on VLAN, this method can be controlled the number of users of access to LAN effectively, and it is managed, and can prevent that local area network (LAN) from being attacked simultaneously.
The object of the present invention is achieved like this: the access control method based on VLAN comprises:
A, the access authority to port on the access control equipment of local area network (LAN) are configured;
When b, user's access to LAN, access control equipment checks that the user inserts the access authority configuring condition of applied port;
The access authority configuring condition of c, the port that inserts according to the user carries out the network insertion control of local area network (LAN) to this user.
The network insertion that this user is carried out local area network (LAN) described in the step c is controlled to be: realize this user is carried out the network insertion control of local area network (LAN) based on EAP (Extensible Authentication Protocol).
Described port is the logic port among the VLAN (VLAN).
Described access authority to port is configured the three kinds of situations that comprise:
The strong pass control of logic port: the access request to the user is directly refused, and forbids that promptly this user inserts VLAN;
Logic port open control by force: the access request to the user is directly confirmed, promptly allows this user to insert VLAN;
The automatic control of logic port: the EAP authentication is carried out in user's access request, determined according to authentication result whether this user can insert VLAN.
Described step b is:
B1, user's access to LAN, and to access control equipment transmission DHCP (DHCP) request message;
B2, access control equipment check that the user inserts the access authority configuring condition of applied port.
Perhaps described step b directly initiates the EAP verification process for the user, and determines according to authentication result whether this user can insert VLAN.
Described step c comprises:
C1, access control equipment judge whether the access authority of the port that the user inserts is the strong control of closing, if, execution in step c2 then, otherwise, execution in step C3;
C2, access control equipment directly return DHCP refusal message to the user, forbid that promptly this user inserts VLAN;
C3, set up list item, and judge that port that the user inserts inserts authority whether for opening control by force, if, execution in step c4 then, otherwise the access right of the port that the user inserts is limited to automatic control, execution in step c5;
C4, access control equipment directly return the DHCP confirmation message to the user, promptly allow this user directly to insert VLAN;
C5, start this user's EAP verification process, and determine according to authentication result whether the user can insert VLAN.
Described step c5 comprises:
C51, access control equipment send EAP-Request/Identity (identity request of EAP authentication) message according to the EAPOL-Start message that receives to the user;
C52, access control equipment with EAP-Response/Identity (identity response of the EAP authentication) message transmission that receives to the access authentication server;
The EAP-Request/MD5Challenge that c53, access control equipment transparent transmission access authentication server send (password request of EAP authentication) message is given the user;
C54, access control equipment with EAP-Response/Password (the password response of the EAP authentication) message transmission that receives to the access authentication server;
The authentication result message that c55, access control equipment return according to the access authentication server judges that the user whether by the EAP authentication, if pass through, then allows this user to insert VLAN, otherwise forbids that this user inserts VLAN.
Described step c55 comprises:
Whether c551, customer access equipment receive EAP authentication result message in the time period of setting, if receive, and execution in step c552 then, otherwise, execution in step c553;
Whether the EAP authentication result message that c552, judgement receive is EAP-Success (the EAP authentication is passed through) message, if then the user authenticates by EAP, otherwise, execution in step c553;
C553, user do not authenticate by EAP.
Network insertion control device based on VLAN comprises:
Customer access equipment: the mode that various user's access to LAN are provided;
Access control equipment: the port of customer access equipment access to LAN is provided, customer access equipment is authenticated and inserts the control of authority;
Accessing control server: in store user's EAP authentication information, whether the EAP authentication that is used to cooperate access control equipment to judge the user can be passed through.
The port that described access control equipment is communicated by letter with customer access equipment comprises:
Controlled ports: the port that the user opens after authenticating by EAP;
Uncontrolled port: be in the port of open mode all the time, make customer access equipment can send or accept authentication.
Described access control equipment is the VLAN customer access equipment, and the port of the user's access to LAN that is provided is a logic port, promptly is based on the VLAN Control Network and inserts.
By technique scheme as can be seen, the present invention has adopted by the network insertion control technology of EAP (Extensible Authentication Protocol) realization based on port, and the network insertion control technology based on logic port among the VLAN also is provided.Thereby conveniently LAN access user is managed, control is by the resource in the user capture local area network (LAN) of authentication effectively.Simultaneously, when enforcement of the present invention makes user access network, have only, protected the IP address resource to exempt from disabled user's attack by just obtaining the IP address after the authentication.In addition,, expanded IEEE 802.1x agreement, strengthened local area network (LAN) butt joint access customer control based on this agreement based on the access control method of VLAN.
Description of drawings
Fig. 1 is the flow chart of method of the present invention;
Fig. 2 is the structure chart of device of the present invention;
Fig. 3 is the EAP flow diagram of authentication procedures in the method for the present invention.
Embodiment
The embodiment of method of the present invention is as follows, referring to Fig. 1:
Step 1: at first, need the access authority to each port be configured in access control equipment, to realize the different user of access interface, it inserts authority and also has nothing in common with each other; The concrete configuration method can be according to the operation demand of the Virtual network operator that has this customer access equipment, the port of access control can be a physical port, it also can be logic port, customer access equipment with VLAN is an example, adopt the VLAN mark to insert user's logic port, by the network insertion of different logic ports is controlled, with realization different VLAN users' network insertion to be controlled, customer access equipment can be set to its each logic port respectively:
The strong pass control of logic port: the DHCP that sends when the user is inserted (DHCP) request message directly returns the refusal message, forbids that promptly this user inserts VLAN;
Logic port open control by force: the DHCP request message that sends when the user is inserted directly returns confirmation message, promptly just allows this user to insert VLAN without the EAP authentication, and flow process after this inserts the same with traditional VLAN; For the user who inserts by the logic port of opening control by force, can use traditional binding authentication and the WEB authentication mode is distinguished each user;
The automatic control of logic port: the DHCP request message that sends when the user is inserted, need carry out EAP authentication after, determine according to authentication result whether this user can insert VLAN again, and reply the corresponding message of user;
Step 2: as user during by a certain port access to LAN, access control equipment is checked the access authority configuring condition of this port;
When a certain logic port of user by access control equipment inserted VLAN, then the VLAN access control equipment checked that at first the authority of this logic port is configured to the strong control of closing, and still for opening control by force, or controlled automatically;
Step 3: the user who inserts is realized access control according to the result who checks;
User for the logic port by the control of strong pass inserts forbids access to LAN;
User for being inserted by the logic port of opening control by force directly allows access to LAN;
For the user that the logic port by automatic control inserts, then need by after the EAP authentication, can access to LAN.
Based on the network insertion of port control is that port at LAN (local area network (LAN)) equipment authenticates and controls access device.If the subscriber equipment that is connected on this generic port can just can be visited the resource in the LAN by authentication; If can not then can't visit the resource in the LAN by authentication, be equivalent to physically disconnect connection.
IEEE 802.1x has defined the network insertion control protocol based on port, so device of the present invention as shown in Figure 2, comprising: Supplicant (customer access equipment), Authenticator (access control equipment) and Authentication Sever (certificate server).
The EAPOL (based on the Extensible Authentication Protocol of local area network (LAN)) of operation IEEE 802.1x definition between Supplicant and Authenticator; Same operation EAP agreement between Authenticator and Authentication Sever, encapsulated verify data in the EAP frame, this agreement is carried in other high-level agreements, as Radius, arrive Authentication Server, i.e. EAP Relay (EAP relaying) so that pass through complicated network.
Authenticator inside comprises controlled ports (Controlled Port) and uncontrolled port (Uncontrolled Port).Uncontrolled port is in the diconnected state all the time, is mainly used to transmit the EAPOL protocol frame, can guarantee that Supplicant can send or accept authentication all the time.Controlled ports is only just opened under the state that authentication is passed through, and is used for the delivery network resource and provides services on the Internet.That controlled ports can be configured to is bi-direction controlled, only import controlled dual mode, to adapt to different applied environments.
Based on the described device of the invention described above, for the user's who inserts VLAN EAP verification process referring to Fig. 2, when promptly the authority that inserts the applied logic port of VLAN as the user is set to control automatically, EAP verification process that will the startup user:
1, Supplicant sends EAPOL-Start (beginning EAP authentication) message to Authenticator;
2, Supplicant sends EAP-Response/Identity (identity response of EAP authentication) message according to receiving EAP-Request/Identity (identity request of the EAP authentication) message that Authenticator sends to Authentication Sever;
3, Supplicant sends EAP-Response/Password (the password response of EAP authentication) message according to the EAP-Request/MD5 Challenge that receives (password request of EAP authentication) message to Authentication Sever;
4, Authenticator receives the authentication result message that Authentication Sever sends, and judges that the user whether by the EAP authentication, if pass through, then allows this user to insert VLAN, otherwise, forbid that this user inserts VLAN;
Authenticator judges that the process whether user authenticates by EAP is: judge whether Authenticator receives EAP authentication result message in the time period of setting, if receive, continue then to judge whether the EAP authentication result message that receives is EAP-Success (the EAP authentication is passed through) message, if, then the user authenticates by EAP, otherwise the user does not authenticate by EAP.
After the user passes through the EAP authentication success, initiate DHCP request application IP address,, like this, the user has just passed through the EAP authentication and has also successfully inserted VLAN.
User's EAP verification process also can at first be initiated by access control equipment, the user directly sends out DHCP request message application IP address to access control equipment, access control equipment is checked the logic port configuration that the user inserts, if the access right of logic port is limited to automatic control, then send the EAP-Request/Identity message to the user and carry out the EAP authentication, the flow process of corresponding EAP authentication is identical with above-mentioned 2 to 4 process.
Claims (12)
1, a kind of access control method based on VLAN is characterized in that comprising:
A, the access authority to port on the access control equipment of local area network (LAN) are configured;
When b, user's access to LAN, access control equipment checks that the user inserts the access authority configuring condition of applied port;
The access authority configuring condition of c, the port that inserts according to the user carries out the network insertion control of local area network (LAN) to this user.
2, the access control method based on VLAN according to claim 1 is characterized in that the network insertion that this user is carried out local area network (LAN) described in the step c is controlled to be: realize this user is carried out the network insertion control of local area network (LAN) based on EAP (Extensible Authentication Protocol).
3, the access control method based on VLAN according to claim 2 is characterized in that described port is the logic port among the VLAN (VLAN).
4, the access control method based on VLAN according to claim 3 is characterized in that described access authority to port is configured the three kinds of situations that comprise:
The strong pass control of logic port: the access request to the user is directly refused, and forbids that promptly this user inserts VLAN;
Logic port open control by force: the access request to the user is directly confirmed, promptly allows this user to insert VLAN;
The automatic control of logic port: the EAP authentication is carried out in user's access request, determined according to authentication result whether this user can insert VLAN.
5, the access control method based on VLAN according to claim 4 is characterized in that described step b is:
B1, user's access to LAN, and to access control equipment transmission DHCP (DHCP) request message;
B2, access control equipment check that the user inserts the access authority configuring condition of applied port.
6, the access control method based on VLAN according to claim 5 is characterized in that described step c comprises:
C1, access control equipment judge whether the access authority of the port that the user inserts is the strong control of closing, if, execution in step c2 then, otherwise, execution in step C3;
C2, access control equipment directly return DHCP refusal message to the user, forbid that promptly this user inserts VLAN;
C3, set up list item, and judge that port that the user inserts inserts authority whether for opening control by force, if, execution in step c4 then, otherwise the access right of the port that the user inserts is limited to automatic control, execution in step c5;
C4, access control equipment directly return the DHCP confirmation message to the user, promptly allow this user directly to insert VLAN;
C5, start this user's EAP verification process, and determine according to authentication result whether the user can insert VLAN.
7, the access control method based on VLAN according to claim 4 is characterized in that described step b directly initiates the EAP verification process for the user, and determines according to authentication result whether the user can insert VLAN.
8, according to claim 6 or 7 described access control methods, it is characterized in that described step c5 comprises based on VLAN:
C51, access control equipment send EAP-Request/Identity (identity request of EAP authentication) message according to the EAPOL-Start message that receives to the user;
C52, access control equipment with EAP-Response/Identity (identity response of the EAP authentication) message transmission that receives to the access authentication server;
The EAP-Request/MD5Challenge that c53, access control equipment transparent transmission access authentication server send (password request of EAP authentication) message is given the user;
C54, access control equipment with EAP-Response/Password (the password response of the EAP authentication) message transmission that receives to the access authentication server;
The authentication result message that c55, access control equipment return according to the access authentication server judges that the user whether by the EAP authentication, if pass through, then allows this user to insert VLAN, otherwise forbids that this user inserts VLAN.
9, the access control method based on VLAN according to claim 8 is characterized in that described step c55 comprises:
Whether c551, customer access equipment receive EAP authentication result message in the time period of setting, if receive, and execution in step c552 then, otherwise, execution in step c553;
Whether the EAP authentication result message that c552, judgement receive is EAP-Success (the EAP authentication is passed through) message, if then the user authenticates by EAP, otherwise, execution in step c553;
C553, user do not authenticate by EAP.
10, a kind of network insertion control device based on VLAN is characterized in that comprising:
Customer access equipment: the mode that various user's access to LAN are provided;
Access control equipment: the port of customer access equipment access to LAN is provided, customer access equipment is authenticated and inserts the control of authority;
Accessing control server: in store user's EAP authentication information, whether the EAP authentication that is used to cooperate access control equipment to judge the user can be passed through.
11, the network insertion control device based on VLAN according to claim 10 is characterized in that the port that described access control equipment is communicated by letter with customer access equipment comprises:
Controlled ports: the port that the user opens after authenticating by EAP;
Uncontrolled port: be in the port of open mode all the time, make customer access equipment can send or accept authentication.
12, the network insertion control device based on VLAN according to claim 10, it is characterized in that described access control equipment is the VLAN customer access equipment, the port of the user's access to LAN that is provided is a logic port, promptly is based on the VLAN Control Network and inserts.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN02131783.6A CN1225870C (en) | 2002-09-23 | 2002-09-23 | Method and apparatus for VLAN based network access control |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN02131783.6A CN1225870C (en) | 2002-09-23 | 2002-09-23 | Method and apparatus for VLAN based network access control |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN1486032A true CN1486032A (en) | 2004-03-31 |
| CN1225870C CN1225870C (en) | 2005-11-02 |
Family
ID=34145034
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN02131783.6A Expired - Lifetime CN1225870C (en) | 2002-09-23 | 2002-09-23 | Method and apparatus for VLAN based network access control |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN1225870C (en) |
Cited By (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1984032B (en) * | 2006-05-09 | 2010-06-02 | 华为技术有限公司 | Method and system for controlling user access in network access equipment |
| WO2011041964A1 (en) * | 2009-10-10 | 2011-04-14 | 中兴通讯股份有限公司 | Method, network system and network access node for network device management |
| CN101227468B (en) * | 2007-01-20 | 2011-08-03 | 国际商业机器公司 | Method, device and system for authenticating user to network |
| CN101227374B (en) * | 2007-12-21 | 2012-03-28 | 中国移动通信集团北京有限公司 | Apparatus, system and method for implementing business for transmitting as soon as shooting |
| US8270380B2 (en) | 2009-04-17 | 2012-09-18 | Ralink Technology Corporation | Method for selecting an access point and apparatus for using the same |
| CN108366083A (en) * | 2017-07-03 | 2018-08-03 | 新华三技术有限公司 | The method and apparatus for preventing subscriber network access from interrupting |
| CN109495431A (en) * | 2017-09-13 | 2019-03-19 | 华为技术有限公司 | Connection control method, device and system and interchanger |
| CN110191041A (en) * | 2019-05-05 | 2019-08-30 | 杭州迪普科技股份有限公司 | The management method and device of the equipment of local area network |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101453394B (en) * | 2007-12-03 | 2011-06-01 | 华为技术有限公司 | Method, system and equipment for access control |
-
2002
- 2002-09-23 CN CN02131783.6A patent/CN1225870C/en not_active Expired - Lifetime
Cited By (13)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1984032B (en) * | 2006-05-09 | 2010-06-02 | 华为技术有限公司 | Method and system for controlling user access in network access equipment |
| CN101227468B (en) * | 2007-01-20 | 2011-08-03 | 国际商业机器公司 | Method, device and system for authenticating user to network |
| CN101227374B (en) * | 2007-12-21 | 2012-03-28 | 中国移动通信集团北京有限公司 | Apparatus, system and method for implementing business for transmitting as soon as shooting |
| US8270380B2 (en) | 2009-04-17 | 2012-09-18 | Ralink Technology Corporation | Method for selecting an access point and apparatus for using the same |
| WO2011041964A1 (en) * | 2009-10-10 | 2011-04-14 | 中兴通讯股份有限公司 | Method, network system and network access node for network device management |
| CN102045307B (en) * | 2009-10-10 | 2014-08-13 | 中兴通讯股份有限公司 | Method for managing network equipment and corresponding network system |
| CN108366083A (en) * | 2017-07-03 | 2018-08-03 | 新华三技术有限公司 | The method and apparatus for preventing subscriber network access from interrupting |
| CN108366083B (en) * | 2017-07-03 | 2021-02-26 | 新华三技术有限公司 | Method and device for preventing user network access from being interrupted |
| CN109495431A (en) * | 2017-09-13 | 2019-03-19 | 华为技术有限公司 | Connection control method, device and system and interchanger |
| US10917406B2 (en) | 2017-09-13 | 2021-02-09 | Huawei Technologies Co., Ltd. | Access control method and system, and switch |
| CN109495431B (en) * | 2017-09-13 | 2021-04-20 | 华为技术有限公司 | Access control method, device and system and switch |
| CN110191041A (en) * | 2019-05-05 | 2019-08-30 | 杭州迪普科技股份有限公司 | The management method and device of the equipment of local area network |
| CN110191041B (en) * | 2019-05-05 | 2021-03-23 | 杭州迪普科技股份有限公司 | Management method and device for equipment of local area network |
Also Published As
| Publication number | Publication date |
|---|---|
| CN1225870C (en) | 2005-11-02 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| EP2090063B1 (en) | Apparatus and methods for authenticating voice and data devices on the same port | |
| CN100512109C (en) | Access authentication system and method by verifying safety of accessing host | |
| CN1186906C (en) | Wireless LAN safety connecting-in control method | |
| US7568107B1 (en) | Method and system for auto discovery of authenticator for network login | |
| CN1845491A (en) | Access authentication method of 802.1x | |
| CN105915550B (en) | A kind of Portal/Radius authentication method based on SDN | |
| CN1925399A (en) | Distributed authentication functionality | |
| CN101068183A (en) | Network invitation to enter controlling method and network invitation to enter controlling system | |
| CN1567868A (en) | Authentication method based on Ethernet authentication system | |
| CN102185840B (en) | A kind of authentication method, equipment and system | |
| CN1142662C (en) | Authentication method for supporting network switching in based on different devices at same time | |
| CN1225870C (en) | Method and apparatus for VLAN based network access control | |
| US20080034407A1 (en) | Apparatus and methods for supporting 802.1X in daisy chained devices | |
| CN100591068C (en) | Method of transmitting 802.1X audit message via bridging device | |
| EP1244265A2 (en) | Integrated policy implementation service for communication network | |
| KR100819942B1 (en) | Method for access control in wire and wireless network | |
| CN1266889C (en) | Method for management of network access equipment based on 802.1X protocol | |
| CN101516091A (en) | Wireless local area network access control system and method based on ports | |
| CN1658553A (en) | Strong discrimination method of enciphered mode by public key cryptographic algorithm | |
| CN101499993A (en) | Authentication method, equipment and system | |
| CN1265579C (en) | Method for network access user authentication | |
| CN102710422B (en) | Node authentication method for avoiding authentication congestion | |
| CN1625103A (en) | Strong authentication method for digital signature mode using public key encrgption algorithm | |
| CN1274124C (en) | Method for realizing 802.1X verification | |
| CN1625101A (en) | Strong authentication method based on symmetric encryption algorithm |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| CX01 | Expiry of patent term |
Granted publication date: 20051102 |
|
| CX01 | Expiry of patent term |