CN1889430A - Safety identification control method based on 802.1 X terminal wideband switching-in - Google Patents

Abstract

This invention relates to a safety authentication control method for terminal width band access based on 802.1X, usually, users are at the independent VLAN, when the 802.1X is accessed, the authentication server is the RADIUS server to store information of related users and takes the user binding of VLAN+MAC+IP as the logic port to set up an authentication flow of the user access network by the customer end, the authentication system and its server: 1, before the authentication, only 802.1X authentication messages of the EAPOL can pass the channel, 2, when the authentication is passed, the state of the channel is switched to authorized, this time, user information can be transmitted from a far end server, after the authentication, the flux of users will be monitored by said parameters and any messages can pass the channel and a DHCP process, the customer end should access the LAN, support the EAPOL protocol and operate the 802.1X software of the customer end, the authentication system is a network device supporting the 802.1X protocol and corresponding to different user ports.

Description

Safety identification control method based on the terminal broadband access of 802.1X

Technical field

The present invention relates to safety identification control method based on the terminal broadband access of 802.1X

Background technology

Broadband network is developed rapidly in recent years, and it is also very fast that number of users increases, and thing followed network security hidden danger is also very outstanding, and network also may transmitted virus when diffusing information, and this has become a more and more serious problem.The propagation of Control Network virus how effectively? generally believe and controlling effectively more from the near more position of user, promptly will effectively control virus and enter network.But still there are many problems at present:

Control provides solution at virus in some manufacturers, for example CISCO company proposes the notion from defending against network, but will adopt this defense system, and user's incoming end be unable to do without the equipment of CISCO, and the equipment of CISCO is used fewer and fewerily at incoming end at present, and home equipment is used more and more.

Microsoft also proposes the notion of territory management, and Microsoft is the pure software solution, though can realize certain authentification of user and strategy, has realized the unification of resource and the division of authority; But can't realize the isolation of user terminal, also be difficult to the control and the management of real realization network insertion.

Domestic also have many companies to release the desktop security system, but this software systems do not possess pressure effectiveness.The user does not install this safety system, has perhaps installed but keep to bring in constant renewal in subsequently, all can cause safe class to descend.

Existing safe practice can be network by residential gateway a comprehensive network security solution is provided, and comprises user rs authentication, mandate, data protection etc.The safe practice that residential gateway adopted comprises: many SSID and VLAN, 802.1X authentication, WEP and WPA, backup center, AAA, CA technology, packet filtering technology, address transition, VPN technologies, encryption and Internet Key Exchange, ASPF, safety management etc.

(1) many SSID and vlan technology

Wireless home gateway can carry out inner networking by 802.11X, and gateway supports many SSID can realize the virtual AP function.Different SSID can adopt different authentication modes and access rights, also can be mapped as different VLAN, realizes the Network Isolation between public hot spot and the household internal net

(2) WEP and WPA WEP are 802.11 standards, have defined link level security mechanism, support shared key mode authentication and MAC layer of data encryption, and key length is 40 or 104, use RC4 symmetric(al) flow cryptographic algorithm.A little less than the WEP fail safe was highly brittle, its key was easy to decode, and implements various attack such as DoS, playback etc. easily.WPAV1.0 adopts 802.1x authentication or shared key authentication, adopts the TKIP based on the WEP algorithm on cryptographic algorithm.TKIP has increased some new aided algorithm functions on the WEP basis, to support the encryption to MSDU, burst, functions such as the checking of data source and the anti-protection of replaying.

(3) aaa authentication

The high-end model home gateway of part has the function of authentication points, the function of can verifying, authorize and keep accounts the user who inserts the household internal network.

(4) packet filtering technology

Each territory of the IP header of IP message and upper-layer protocol (as the TCP) header that carried has comprised the information that can be handled by router.The following attribute of IP message is used in packet filtering usually:

● the source of IP, destination address and protocol domain;

● the source of TCP or UDP, destination interface;

● the type field of ICMP sign indicating number, ICMP;

● the mark domain of TCP;

● the independent SYN that the expression request connects;

● expression connects the SYN/ACK that confirms;

● the session connection that expression is being used;

● expression connects the FIN that cuts off.Time range allows the FTP message to enter to finish necessary service such as the 8:00～20:00 that can be provided with in the last example on every Mondays, and all the other times forbid that then FTP connects.Being provided with of time period, can adopt the absolute time section and cycle time section and continuous time section and the discrete time section be used, on using, have great flexibility.And such time period can offer other functional module easily and use, as address transition, IPSec etc.

(5) VPN technologies

Virtual Private Network (Virtual Private Network) abbreviates VPN as, is a kind of technology that develops rapidly along with the development of Internet in recent years.Mainly be divided into Access VPN and Intranet VPN.The long-distance user can insert home gateway by Access VPN, realizes safety remote access and control to home network.Home gateway can insert the vpn gateway of company by Intranet VPN, realizes Intranet.

(6) ASPF technology

ASPF is that a kind of high level communication filters.It checks that application layer protocol information and monitoring are based on the application layer protocol state that connects.For all connections, each connection state information all will be safeguarded by ASPF and be used for dynamically whether the determination data bag is allowed to by fire compartment wall or abandons.Home gateway provides the access control based on message content, and promptly ASPF can attack the part of application layer and be detected and take precautions against, and comprises for the detection of SMTP order, the detection of SYN flooding, Packet Injection.

(7) IDS technology

Intruding detection system (IDS) can remedy the deficiency of fire compartment wall, for network security provides real-time intrusion detection and takes corresponding preventive means, is used for following the tracks of, recovers, disconnects network connection etc. as taking of evidence.The intruding detection system full name is Intrus ion Detective System, its some key point acquisition of information from computer network system, and analyze these information, check whether behavior of violating security strategy and the sign that is attacked are arranged in the network.Intrusion detection is considered to the second road safety gate after the fire compartment wall.

Summary of the invention

The objective of the invention is:, proposed the strategy of employing terminal security gateway (TGATE) at above problem.Its basic thought is that 802.1x authentication and desktop security are bundled, and utilizes hardware device to conduct a compulsory examination user's safe class of user's control.

Safety identification control method based on the terminal broadband access of 802.1X, each user is among alone the VLAN at ordinary times, isolate each other, when the access of 802.1x, certificate server is a radius server, this server can be stored relevant user's information, such as the VLAN under the user, the CAR parameter, priority, user's Access Control List (ACL), the binding of VLAN+MAC+IP that it is characterized in that adopting the user is as logic port, utilize client (the PC/ network equipment), Verification System and certificate server are set up the identifying procedure of user access network: 1, before authentication was passed through, passage can only be by the 802.1X message identifying of EAPOL; When 2, authentication was passed through, the state of passage switched to authorized, and can transmit come user's information from the remote authentication server this moment, such as VLAN, CAR parameter, priority, user's Access Control List (ACL); 3, after authentication is passed through, user's flow just will be accepted the supervision of above-mentioned parameter, and this moment, this passage can pass through any message, and dhcp process is arranged; 4, client is that needs insert LAN, supports the EAPOL agreement, and operation 802.1X client software; Verification System is for supporting the network equipment of IEEE802.1x agreement, Verification System is corresponding to the port (physical port of different user, or the binding of the VLAN+MAC+IP of subscriber equipment is as logic port, above-mentioned two logic ports: controlled ports and unconfined end mouth, the unconfined end mouth is in the diconnected state all the time, be mainly used to transmit the EAPOL protocol frame, can guarantee that client can send or accept authentication all the time; Controlled ports is only just opened under the state that authentication is passed through, and is used for delivery network resource and service; That controlled ports can be configured to is bi-direction controlled, only import controlled dual mode, to adapt to different applied environments.If by authentication, then controlled ports is not in un-authenticated state to the user, the then service that can't access authentication system provides of user; After the user was by authentication, certificate server can pass to Verification System to user's relevant information, makes up dynamic Access Control List (ACL) by Verification System, and user's follow-up flow just will be accepted the supervision of above-mentioned parameter; Communicate by the EAP agreement between certificate server and the radius server.Before access network, initiate authentication request with above-mentioned 802.1x.This moment, TGATE not only will authenticate user's identity, and also will check the safe class of terminal:

Do not pass through as authenticating user identification, then do not allow access network.

Pass through as authenticating user identification, but safe class is undesirable, the user can only visit a very limited coverage so, can only remove to install patch etc. to that coverage, goes to promote safe class.

All pass through as authentication and safe class inspection, can go to visit the resource that allows separately according to user's authority so.Structure of this programme and flow process are referring to accompanying drawing.

Characteristics of the present invention are: adopt terminal security authentication mechanism, not only solved the control of user access to netwoks based on 802.1x, and with the important indicator of terminal security as control.Work compound by hardware and software reaches flexibility, fail safe and validity.

Because the uniqueness of 802.1x, TGATE can be placed on the convergence-level of network, and disposing this scheme does not need network is done extensive the adjustment.The existing two-layer equipment of network there is not special requirement yet.

Description of drawings

Fig. 1 is a block diagram of the present invention

Fig. 2 is a terminal safety information transparent transmission flow chart of the present invention

Embodiment

1. user's agent client safe in utilization carries out the checking and the integrity checking of identity.The user inputs user name in client software, password authenticates, and contains user name password, client release number and safety inspection result in the EAP message that the TSM Security Agent client sends.

2. the user sends to access server (access way can be 802.1x) by the network insertion client with solicited message, and user security information transparent transmission flow process as shown in Figure 1.

3. access server sends to certification authority server with user's solicited message by standard Radius agreement

4. certification authority server is checked user profile and the security information in the user request information:

If user profile is incorrect, return authentication refusal information.

If user profile is correct, the security information inspection is not passed through, and then adds limited domain name and patch download message in authentication by in responding.

If corresponding user name has the network access authority configuration, then in response, add corresponding access control rule.

Certificate server to the inspection flow process of user profile as shown in Figure 2.

5. notice access client network inserts successfully/refuse information.

6. for the unsanctioned user of safety inspection, access server is forced its access security server by access control, and the notice client is opened corresponding security patch downloading page.

7. for the user who has disposed access rule, access server is by realizing corresponding access control rule, the network access authority of limited subscriber.

8. for normal user, allow its normal accesses network.

Embodiment:

● example 1: the subscription client version is lower than server requirement

Terminal configuration: security client is installed, and version is 0x00000001;

The certificate server configuration: requiring user's minimum version is 0x00000002, and configuration client release update service device is Http:// www.lianchuang.com/policv

The authentification of user result: the user can be by authentication, but normal accesses network, the client positive opening version updating page: Http:// www.lianchuang.com/policv

● example 2: the user terminal safety inspection is not passed through

Terminal configuration: lack on the PC of patch KB000001 security client is installed;

The certificate server configuration: configuration security patch Download Server is

http：//www.lianchuang.com/ServicePack

The authentification of user result: the user can be by authentication, but normal accesses network, client positive opening patch downloading page, page URL is the concrete patch title of patch server URL+:

http：//www.lianchuang.com/ServicePack.asp？id＝KB000001

● example 3: server is to user's limiting access authority

Terminal configuration: the user uses user name example@internet to login the BAS configuration: configuration acl rule 1: disable access Ftp: // 202.102.24.35Certificate server configuration: user example@internet is specified access control rule 1 authentification of user result: the user can be by authentication, and the user can normally visit and remove Ftp: // 202.102.24.35Any service

802.1X authentication can realize security features such as two-way authentication, dynamic key management.IEEE 802.1x is a kind of authentication method based on port, and it has all defined a controlled subport and a uncontrolled subport for each port (physical port/logic port).Uncontrolled subport is mainly used in the authentication message bag, and controlled subport was closed before authentication success, only just open fully after authentication success, thereby the user can communicate by letter normally.802.1x what solve is authentication scheme problem between user and the network, 802.1x has also defined a cover dynamic key consultative management mechanism in addition, supports the dynamic negotiation of wireless mouth multicast and singlecast key.802.1x concrete authentication protocol is by the decision of EAP method, its architecture is very flexible, EAP-TTLS, and EAP-SIM, EAP-AKA, EAP methods such as PEAP are supported mechanism such as bi-directional authentification, the anonymous transmission of user account information, the dynamic key consultative management.Authentication modes such as EAP-MD5 are supported unidirectional authentication.

The present invention utilizes the access authentication method of 802.1x, (1) client is initiated the 802.1x authentication request message, be transparent to access control equipment (BAS) through double layer network, (2) BAS initiates authentication request by RADIUS CLIENT to radius server, (3) pass through if authenticate, BAS returns 802.1x authentication success message to client, (4) client is initiated the dhcp address allocation request message, (5) double layer network passes through BAS with dhcp message, (6) BAS distributes the address to client, the allocation strategy of client ip address is specified in authenticating by response message by the radius server, as radius server designated user address allocation policy not, then determine according to territory, user place; DHCP Server is according to user's address allocation policy, response user's DHCP request, finish the IP address assignment work of client, (7) BAS is according to the vlan number of the client that obtains, and MAC Address and distribute to user's IP address is set up the binding relationship between the VLAN-MAC-IP three, generate software VM1 clauses and subclauses and hardware flow control clauses and subclauses, and sending out charge information to the RADIU server, the user reaches the standard grade, and sets up the vmi binding relationship.

Claims (1)

1, based on the safety identification control method of the terminal broadband access of 802.1X, each user is among alone the VLAN at ordinary times, isolate each other, when the access of 802.1x, certificate server is a radius server, this server can be stored relevant user's information, the binding of VLAN+MAC+lP that it is characterized in that adopting the user is as logic port, utilize client, Verification System and certificate server to set up the identifying procedure of user access network: 1), before authentication passes through, the 802.1X message identifying that passage can only be by EAPOL; 2), the authentication by the time, the state of passage switches to authorized, this moment can transmit user's information from the remote authentication server, such as VLAN, CAR parameter, priority, user's Access Control List (ACL); 3, after authentication is passed through, user's flow just will be accepted the supervision of above-mentioned parameter, and this moment, this passage can pass through any message, and dhcp process is arranged; 4, client is that needs insert LAN, supports the EAPOL agreement, operation 802.1X client software; Verification System is for supporting the network equipment of IEEE 802.1x agreement, Verification System is corresponding to the port (physical port of different user, or the binding of the VLAN+MAC+IP of subscriber equipment is as logic port, above-mentioned two logic ports: controlled ports and unconfined end mouth, the unconfined end mouth is in the diconnected state all the time, be mainly used to transmit the EAPOL protocol frame, can guarantee that client can send or accept authentication all the time; Controlled ports is only just opened under the state that authentication is passed through, and is used for delivery network resource and service; That controlled ports can be configured to is bi-direction controlled, only import controlled dual mode, to adapt to different applied environments.If by authentication, then controlled ports is not in un-authenticated state to the user, the then service that can't access authentication system provides of user; After the user was by authentication, certificate server can pass to Verification System to user's relevant information, makes up dynamic Access Control List (ACL) by Verification System, and user's follow-up flow just will be accepted the supervision of above-mentioned parameter; Communicate by the EAP agreement between certificate server and the radius server.Before access network, initiate authentication request with above-mentioned 802.1x.This moment, TGATE not only will authenticate user's identity, and also will check the safe class of terminal:

Do not pass through as authenticating user identification, then do not allow access network;

Pass through as authenticating user identification, but safe class is undesirable, the user can only visit a very limited coverage so, can only remove to install patch etc. to that coverage, goes to promote safe class.

Images