WO2012048551A1

WO2012048551A1 - Method and system for network access control

Info

Publication number: WO2012048551A1
Application number: PCT/CN2011/071770
Authority: WO
Inventors: 李剑雄; 杜志强; 铁满霞; 曹军; 周吉阳; 王俊峰; 张莎
Original assignee: 天维讯达无线电设备检测（北京）有限责任公司; 西安西电捷通无线网络通信股份有限公司
Priority date: 2010-10-13
Filing date: 2011-03-14
Publication date: 2012-04-19
Also published as: CN102231736A; CN102231736B

Abstract

Disclosed are a method and system for network access control. After a visitor makes an access request, an access controller in a target network processes the access request and initiates an authentication request for the identity of the visitor to an authentication server via the visitor; the access controller in the target network completes the authentication for the identity of the visitor according to the publishable authentication results of the authentication server forwarded by the visitor, and performs authorization management for the visitor with successful authentication according to authorization strategies. Thus the problem in the prior art that access control cannot be implemented caused when an access controller cannot directly use the authentication services provided by an authentication server is solved, and the requirements of practical application are satisfied.

Description

The present invention claims the priority of the Chinese patent application entitled "A Network Access Control Method and System", filed on October 13, 2010, by the Chinese Patent Office, Application No. 201010504262.3 The content is incorporated herein by reference. Technical field

The present invention belongs to the field of network security applications in information security technologies, and in particular, to a network access control method and system. Background technique

In the existing network access control method, after the visitor initiates an access request to the destination network, the access controller in the destination network completes the authentication and authorization of the visitor, thereby implementing access control to the visitor. In an access control scenario where a third party, such as an authentication server, is involved in identity authentication, the access controller may not be directly connected to the authentication server because of access to the controller itself or the destination network, thereby preventing the access controller from directly using the access controller. The authentication service provided by the authentication server. In this case, the prior art access control method in which the access controller directly connects and uses the authentication server to provide the authentication service will not be able to meet the practical application requirements for access control of the visitor. Summary of the invention

In order to solve the above technical problems in the prior art, the present invention provides a network access control method and system capable of satisfying application requirements for access control of a visitor.

The present invention provides a network access control method, including:

Step 1), a visitor sends an access request message to an access controller in a destination network, where the access request message includes a random number N _REQ ;

Step 2), after the access controller receives the access request message, constructing a first identity The access authentication request message of the authentication information is sent to the visitor, and the first identity authentication information is symmetrically used by the shared key K _AS , _AC between the access controller and an authentication server to the N _REQ The result of the cryptographic operation;

Step 3), after receiving the access authentication request message, the visitor constructs an identity authentication request message and sends the identifier to the authentication server. The identity authentication request message includes the first identity authentication information and the second Identity identification information; the second identity authentication information is a result of the symmetric cryptographic operation performed by the visitor on the N _REQ by using the shared key K _AS , _REQ between the user and the authentication server;

Step 4), after receiving the identity authentication request message, the authentication server uses the K _AS , _AC to authenticate the first identity authentication information to obtain a first authentication result, and utilizes the first authentication result. Encrypting the K _AS , _REQ to form a first publicly identifiable authentication result to the access controller; and authenticating the second identity authentication information by using the K _AS , _REQ to obtain a second authentication result, and The second authentication result is encrypted by the K _AS , _AC to form a second publicly identifiable authentication result for the visitor; and the authentication server constructs an identity authentication response message sent to the visitor, the identity The authentication response message includes the first publicly available authentication result and the second publicly available authentication result;

Step 5), after receiving the identity authentication response message, the visitor decrypts the first publicly available authentication result to obtain the first authentication result, and constructs an access authentication response message according to the first authentication result. Giving the access controller; the access authentication response message includes the second publicly available authentication result;

Step 6), after receiving the access authentication response message, the access controller decrypts the second publicly available authentication result, obtains the second authentication result, and constructs an access response message according to an authorization policy. Giving the visitor; the authorization policy refers to a policy for the access controller to authorize the access request.

The present invention provides an access device, including:

An access request interaction module, configured to send an access request message to an access controller of a destination network, where the access request message includes a random number N _REQ ; and receive the packet sent by the access controller An access authentication request message including first identity authentication information; the first identity authentication information is a symmetric cryptographic operation on the N _REQ by using a shared key K _AS , _AC between the access controller and an authentication server Result produced;

An authentication request interaction module, configured to send an identity authentication request message to an authentication server, where the identity authentication request message includes the first identity authentication information and second identity authentication information, where the second identity authentication information is a result obtained by the visitor using a shared key K _AS , _REQ between the user and the authentication server to perform a symmetric cryptographic operation on the N _REQ ; and receiving an identity authentication response message sent by the authentication server, the identity authentication The response message includes a first publicly available authentication result and a second publicly available authentication result, where the first publicly available authentication result is an identity authentication of the access controller according to the first identity authentication information. An authentication result is further formed by using the K _{AS; REQ} , and the second publicly available authentication result is a second authentication result after the identity authentication of the visitor according to the second identity authentication information. Encrypting is performed by using the K _AS and _Ae ;

An authentication result interaction module, configured to send, according to the first authentication result, an access authentication response message that includes the publicly available second authentication result to the access controller, and receive the sent by the accessor Access response message.

The invention also provides an authentication server, comprising:

An authentication request receiving module, configured to receive an identity authentication request message sent by a visitor, where the identity authentication request message includes first identity authentication information of the destination network one access controller and second identity authentication information of the visitor; The first identity authentication information is performed by the access controller by using a shared key κ _Α ^ between the self and the authentication server for a random number N _REQ included in the access request message sent by the visitor. As a result of the symmetric cryptographic operation, the second identity authentication information is a result of the symmetric cryptographic operation performed by the visitor on the N _REQ by using the shared key K _AS , _REQ between the user and the authentication server;

An authentication execution module, configured to generate, according to the first identity authentication information, a first authentication result after performing identity authentication on the access controller, and re-encrypting the first authentication result by using the K _AS and _REQ a first publicly identifiable result for the access controller; and according to the second The identity authentication information generates a second authentication result after the identity authentication of the visitor, and encrypts the second authentication result by using the K _AS , _AC to form a second publicly discriminable result for the visitor;

The authentication response sending module is configured to send an identity authentication response message to the visitor, where the identity authentication response message includes the first publicly available authentication result and the second publicly available authentication result.

The invention also provides an access controller, comprising:

An access request receiving module, configured to receive an access request message sent by a visitor, where the access request message carries a random number N _REQ ;

An access authentication request constructing module, configured to send an access authentication request message including first identity authentication information to the visitor, where the first identity authentication information is shared by using the access controller and the authentication server a result of a symmetric cryptographic operation performed by the key K _AS , _Ae on the N _REQ ; an access authentication response receiving module, configured to receive an access authentication response message sent by the visitor, and decrypt the second authentication result; The access authentication response message is constructed by the visitor according to the first authentication result included in the identity authentication response message sent by the destination network to the authentication server, and includes the second authentication result; the first authentication result is The authentication server determines, by using the K _AS , the _AC , the first identity authentication information included in the identity authentication request message sent by the visitor, and the second authentication result is determined by the authentication server. after using the shared key K _AS between the visitor, _REQ second authentication information transmitted by said visitor identification determination The second authentication information is the result of the visitor with the K _AS, _REQ N _REQ said symmetric cryptographic operation;

The access request response module is configured to send an access response message to the visitor according to the obtained second authentication result and the authorization policy.

The present invention also provides a network access control system, including a visitor, an access controller of a destination network, and an authentication server, where:

The visitor is configured to send an access request message to the access controller, where the access request message carries a random number N _REQ ; Receiving an access authentication request message returned by the access controller, where the access authentication request message includes first identity authentication information;

Sending an identity authentication request message to the authentication server, including the first identity authentication information second identity authentication information; the second identity authentication information is a shared key K between the visitor and the authentication server _AS , _REQ , a result of performing a symmetric cryptographic operation on the N _REQ ; and receiving, by the authentication server, a first publicly available authentication result and a second publicly available authentication result identity authentication response message; and decrypting the The first publicly available authentication result obtains the first authentication result;

Sending an access authentication response message to the access controller, the access authentication response message being constructed according to the first authentication result, and including the second publicly available authentication result;

Receiving an access response message sent by the access controller according to the second authentication result to authorize access to the target network;

The access controller is configured to receive an access request message sent by the visitor, and send an access authentication request message that includes the first identity authentication information to the visitor; Accessing a shared key K _AS between the controller and the authentication server, _AC performing a symmetric cryptographic operation on the N _REQ ;

Receiving an access authentication response message sent by the visitor and decrypting, to obtain the second authentication result;

Forming an access response message to the visitor according to the obtained second authentication result and an authorization policy;

The authentication server is configured to receive the identity authentication request message sent by the visitor, and generate a first authentication result after performing identity authentication on the access controller according to the first identity authentication information, and Decoding the first authentication result by using the K _AS , _REQ to form a first publicly identifiable authentication result to the access controller, and generating an identity authentication for the visitor according to the second identity authentication information a second authentication result, and encrypting the second authentication result by using the K _A ^ to form a second publicly discriminable result for the visitor; and returning an identity authentication response message to the visitor, including The first publicly discriminable authentication result and the second publicly discriminable authentication node fruit.

The advantages of the invention are:

The network access control method and system provided by the present invention is a network access control method for completing identity authentication of a visitor in the case where an authentication server participates and the access controller of the destination network cannot directly utilize the authentication service provided by the authentication server. . The invention is based on a symmetric crypto mechanism. After the visitor makes an access request, the access controller in the destination network processes the access request, and the visitor initiates an authentication request for the identity of the visitor to the authentication server, and the access in the destination network. The controller completes the authentication of the identity of the visitor according to the publicly available authentication result of the authentication server forwarded by the visitor, and authorizes the successful authenticated visitor according to the authorization policy. The present invention solves the problem that the access control cannot be implemented when the access controller cannot directly use the authentication service provided by the authentication server, and satisfies the practical application requirements. DRAWINGS

1 is a flow chart of a network access control method provided by the present invention.

2 is a schematic diagram of the operation of the network access control system provided by the present invention.

Figure 3 is a detailed block diagram of step S 1 in Figure 2.

Figure 4 is a detailed block diagram of step S 2 in Figure 2.

Figure 5 is a detailed block diagram of step S3 in Figure 2.

Figure 6 is a detailed block diagram of step S 4 in Figure 2.

Figure 7 is a detailed block diagram of step S 5 in Figure 2.

Figure 8 is a detailed block diagram of step S6 in Figure 2. Detailed ways

Referring to FIG. 2, the present invention provides a network access control system 100. The access control system 100 includes a visitor REQ, an authentication server AS, and an access controller AC. Before the system 100 works, the shared key K _AS , _REQ is shared between the visitor REQ and the authentication server AS, and the keys K _AS , _AC are shared between the access controller AC and the authentication server AS. Referring to FIG. 1 to FIG. 8 , the network access control system 100 completes the authentication and authorization of the visitor REQ through six steps of SI to S6.

Step S1: Referring to FIG. 3, the visitor REQ sends an access request message M1 to the access controller AC in the destination network. The access request message M1 contains N _RE oQ _REQ . Where N _REQ represents the random number generated by the visitor REQ, and Q _REQ represents the access request of the visitor REQ, the same below.

Step S2: Referring to FIG. 4, after receiving the access request message M1, the access controller AC constructs an access authentication request message M2 and sends it to the visitor REQ. The access authentication request message M2 contains the identity authentication information 11 of the access controller AC. The identity authentication information 11 is used to prove the validity of the access controller AC identity to the authentication server AS, and is a result of performing a symmetric cryptographic operation on the N _REQ by using the shared key K _AS , _Ae .

Step S3: Referring to FIG. 5, after the visitor REQ receives the access authentication request message M2, the constructive identity authentication request message M3 is sent to the authentication server AS. The identity authentication request message M3 includes the identity authentication information 11 and the identity authentication information 12 of the visitor REQ. The identity authentication information 12 is used to prove the validity of the visitor REQ identity to the authentication server AS, and is a result of performing a symmetric cryptographic operation on the N _REQ by using the shared key K _AS , _REQ .

Step S4: Referring to FIG. 6, the authentication server AS provides an authentication service according to the identity authentication request message M3 and generates an authentication result. The authentication server AS authenticates the identity authentication information 11 in the identity authentication request message M3 by using the shared key K _AS , _Ae and obtains the first authentication result to the access controller AC, and uses the shared key K _AS , _REQ for the identity authentication request. The identity authentication information 11 in the message M3 is authenticated and the second authentication result is obtained for the visitor REQ, and the authentication server AS encrypts the first authentication result by using the shared key K _AS , _REQ to form an access controller AC. The publicly available authentication result C1, the second authentication result is encrypted by using the shared key K _AS , _Ae to form a publicly discriminable authentication result C 2 to the visitor REQ, and the authentication server AS constructs the identity authentication response message M4 to be sent to the access REQ. The identity authentication response message M4 includes publicly discriminable authentication results C 1 and C 2 .

Step S5: Referring to FIG. 7, after receiving the identity authentication response message M4, the visitor REQ decrypts the publicly available authentication result C1 to obtain the first authentication result, and constructs an access authentication response message M5 according to the first authentication result. Give access to the controller AC. The access authentication response message M5 includes a publicly available authentication result C2; Step S6: Referring to FIG. 8, after receiving the access authentication response message M5, the access controller AC decrypts the publicly available authentication result C2 in the authentication response message M5, obtains the second authentication result, and constructs an access response according to the authorization policy. The message M6 is sent to the visitor REQ, and the access response message M6 contains information as to whether the accessor REQ is authorized to access the destination network. So far, the process of authenticating and authorizing the visitor REQ of the present invention has been completed. The authorization policy refers to a policy in which the access controller AC authorizes the access request Q _REQ of the visitor REQ. The authorization policy may come from a certain server, such as the authentication server AS, or may be from the access controller AC local. The authorization policy has been previously built in the authentication server AS or the access controller AC, and the present invention only invokes the authorization policy.

According to the method shown in steps SI to S6, the authentication and authorization of the visitor REQ can be realized to meet the practical application requirements for access control of the visitor REQ.

According to the method shown in the foregoing steps S1 to S6, the present invention provides an access device, including: an access request interaction module, configured to send an access request message to an access controller of a destination network, where the access request message includes a random number N _REQ; the access controller transmits and receives a first authentication information comprises an access authentication request message; the first authentication information using the shared secret between the access controller and an authentication server a result of a symmetric cryptographic operation performed by the key K _AS , _AC on the N _REQ ;

An authentication request interaction module, configured to send an identity authentication request message to an authentication server, where the identity authentication request message includes the first identity authentication information and second identity authentication information, where the second identity authentication information is a result obtained by the visitor using a shared key K _AS , _REQ between the user and the authentication server to perform a symmetric cryptographic operation on the N _REQ ; and receiving an identity authentication response message sent by the authentication server, the identity authentication The response message includes a first publicly available authentication result and a second publicly available authentication result, where the first publicly available authentication result is an identity authentication of the access controller according to the first identity authentication information. An authentication result is further utilized by the K _{AS; the REQ} is formed by encryption, and the second publicly available authentication result is a second authentication result after the identity authentication of the visitor according to the second identity authentication information. Encrypting is performed by using the K _AS and _Ae ;

An authentication result interaction module, configured to construct, according to the first authentication result, the publicly available The access authentication response message of the second authentication result is sent to the access controller, and receives an access response message sent by the accessor.

The invention also provides a corresponding authentication server, comprising:

An authentication request receiving module, configured to receive an identity authentication request message sent by a visitor, where the identity authentication request message includes first identity authentication information of the destination network one access controller and second identity authentication information of the visitor; The first identity authentication information is performed by the access controller by using a shared key K _A ^ between itself and the authentication server for a random number N _REQ included in an access request message sent by the visitor. As a result of the symmetric cryptographic operation, the second identity authentication information is a result of the symmetric cryptographic operation performed by the visitor on the N _REQ by using the shared key K _AS , _REQ between the user and the authentication server;

An authentication execution module, configured to generate, according to the first identity authentication information, a first authentication result after performing identity authentication on the access controller, and re-encrypting the first authentication result by using the K _AS and _REQ a first publicly available authentication result to the access controller; and generating a second authentication result after the identity identification of the visitor according to the second identity authentication information, and using the second authentication result K _AS , _AC performs encryption to form a second publicly discriminable result for the visitor;

Correspondingly, the present invention further provides an access controller, including:

An access authentication request constructing module, configured to send an access authentication request message including first identity authentication information to the visitor, where the first identity authentication information is shared by using the access controller and the authentication server a result of a symmetric cryptographic operation performed by the key K _AS , _Ae on the N _REQ ; an access authentication response receiving module, configured to receive an access authentication response message sent by the visitor, and decrypt the second authentication result; The access authentication response message is used by the visitor according to the purpose Constructing, by the network-authentication server, the first authentication result included in the identity authentication response message, and including the second authentication result; the first authentication result is used by the authentication server by using the K _AS , _AC pair Determining, by the first identity authentication information included in the identity authentication request message sent by the visitor, that the second authentication result is that the authentication server utilizes a shared key K with the visitor. _AS , _REQ determines, after the second identity authentication information sent by the visitor, the second identity authentication information, after the visitor uses the K _AS , _REQ to perform symmetric cryptographic operations on the N _REQ Result produced;

According to the above method provided by the present invention, a network access control system having a corresponding function includes a visitor, an access controller of a destination network, and an authentication server, wherein:

The visitor is configured to send an access request message to the access controller, where the access request message carries a random number N _REQ ;

Receiving an access authentication request message returned by the access controller, where the access authentication request message includes first identity authentication information;

The access controller is configured to receive an access request message sent by the visitor, and send an access authentication request message that includes the first identity authentication information to the visitor; Other information using the shared key K _AS between the access controller and the authentication server, _AC symmetric cryptographic computation result of the generated N _REQ; and

The authentication server is configured to receive the identity authentication request message sent by the visitor, and generate a first authentication result after performing identity authentication on the access controller according to the first identity authentication information, and Decoding the first authentication result by using the K _AS , _REQ to form a first publicly identifiable authentication result to the access controller, and generating an identity authentication for the visitor according to the second identity authentication information a second authentication result, and using the second authentication result

K _A ^ is encrypted to form a second publicly identifiable result for the visitor; and an identity authentication response message is returned to the visitor, including the first publicly identifiable authentication result and the second publicly identifiable authentication result.

A specific embodiment of the above steps SI ~ S6 is:

Step S1:

The visitor REQ constructs the N _REQ ||Q _{REQ and} sends it to the access controller AC. In this embodiment, the N _REQ ||Q _{REQ is} the access request message M1. In other embodiments, the request message M1 may also be other messages. The other message includes at least N _REQ ||Q _REQ . Where "||" means that the two messages before and after are connected in series, the same below.

Step S2:

After receiving the access request message M1, that is, N _REQ ||Q _REQ , the access controller AC constructs an access authentication request message M2, that is, N _REQ ||N _AC ||E (K _{AS; AC} , N _REQ ), and sends it to the visitor REQ. In other embodiments, the access authentication request message M2 is a message including at least N _REQ ||N _AC ||E (K _{AS; AC} , N _REQ ).

Wherein, N _AC represents a random number generated by the access controller AC; 6 (1^^, ^ represents the result of encrypting N _REQ by using the shared key K _AS , _Ae , that is, the identity authentication information II of the access controller AC; E is A symmetric encryption algorithm; the same below.

Step S3: After receiving the access authentication request message M2, that is, N _REQ ||N _AC ||E (K _{AS; AC} , N _REQ ), the visitor REQ first determines whether the N _REQ is a random number generated by the visitor REQ, and if not, the lost Discarding the authentication request message M2; if yes, the visitor REQ calculates the E (K _{AS; REQ} , N _REQ ), that is, the identity authentication information of the visitor REQ, using the shared key K _AS , _REQ , and constructs the identity authentication request message M3 That is, ID _Ae ||N _REQ ||E (K _AS , _REQ , N _REQ ) ||E (K _{AS; AC} , N _REQ ) is sent to the authentication server AS. The ID _AC is the identity of the access controller AC, the same below.

In other embodiments, the identity authentication request message M3 is a message containing at least ID _AC ||N _REQ ||E (K _{AS; REQ} , N _REQ ) ||E (K _{AS; AC} , N _REQ ).

Step S4:

4. 1), after the authentication server AS receives the identity authentication request message M3, ie ID _AC ||N _REQ ||E (K _{AS; REQ} , N _REQ ) ||E (K _{AS; AC} , N _REQ ), first judge Whether the accessor REQ has shared the key K _AS , _REQ with the authentication server AS, and if the key K _AS , _REQ is not shared, the implementation of 4. 2 ); if the shared key K _AS , _REQ , the implementation of 4. 3 ) .

4. 2), the authentication server AS determines, according to the ID _Ae, whether the access controller AC has shared the key K _AS , _AC with the authentication server _AS , and if the key K _AS , _AC is not shared, executes 4. 2. 1 ); If the key K _AS , _AC is shared, go to step 4. 2. 2 ).

4. 2. 1), the authentication server AS terminates the authentication.

4. 2. 2), the authentication server AS decrypts E (K _{AS; AC} , N _REQ ), that is, the identity authentication information 11 by using the shared key K _AS , _Ae , and determines whether the N _REQ obtained after decryption is in the step with the visitor REQ S 3 is transmitted to the authentication server AS identity authentication request message is equal to N _REQ message M3 is, if the decrypted N visitors REQ _REQ and authentication transmitted to the authentication server AS in step S3 in the request information message M3 If N _{REQ is} not equal, then 4. 2. 2. 1 ) is executed; if the N _REQ obtained after decryption is equal to the information N _REQ in the identity authentication request message M3 sent by the visitor REQ to the authentication server AS in step S3, then Execute 4. 2. 2. 2).

4. 2. 2. 1), the authentication server AS terminates the authentication.

4. 2. 2. 2) The authentication server AS constructs an identity authentication response message M4 ie ID _AC ||N _REQ ||Res (AC) ||Res (REQ) ||MIC _{2 is} sent to the visitor REQ. Among them, Res (AC) is the publicly discriminable result CI, Res (REQ) is the publicly discriminable result C 2 , Res (AC) = E (K _{AS; REQ} , R (AC) ) , Res (REQ = E (K _{AS; AC} , R (REQ) ) , R (AC) is the first discrimination result, R (REQ) is the The second authentication result, the MIC ₂ is a message integrity authentication code, the same below; at this time, R(AC) = True, indicating that the identity of the access controller AC is legal, and R(REQ) = Failure, indicating that the identity of the visitor REQ is illegal. At this time, MIC ₂ =H (K _AS;REQ , ID _AC ||N _REQ ||Res (AC) ||Res (REQ) ), used to verify the message ID _AC ||N _REQ ||Res (AC) ||Res (REQ) integrity.

4.3), the authentication server AS decrypts E (K _{AS; REQ} , N _REQ ) by using the shared key K _AS , _REQ , and determines whether the N _REQ obtained after decryption and the identity of the visitor REQ are sent to the authentication server AS in step S3. The information N _REQ in the authentication request message M3 is equal. If the N _REQ obtained after decryption is not equal to the information N _REQ in the identity authentication request message M3 sent by the visitor REQ to the authentication server AS in step S3, then 4.3.1 is performed. If the authentication server AS decrypts E (K _AS , _REQ , the obtained N _REQ and the visitor REQ in the identity authentication request message M 3 sent to the authentication server AS in step S 3 by using the shared key K _AS , _REQ If the information N _{REQ is} equal, then 4.3.2).

4.3.1), the authentication server AS determines, according to the ID _AC, whether the access controller AC has shared the key K _AS , _AC with the authentication server _AS , and if the key K _AS , _AC is not shared, executes 4.3.1.1); Keys K _AS , _AC , then execute 4.3.1.2).

4.3.1.1), the authentication server AS terminates the authentication.

4.3.1.2), the authentication server AS decrypts E (K _AS , _AC , N _REQ ;) by using the shared key K _A ^, and determines whether the N _REQ obtained after decryption is sent to the authentication server in step S 3 with the visitor REQ. The information N _REQ in the identity authentication request message M3 of the AS is equal. If the N _REQ obtained after decryption is not equal to the information N _REQ in the identity authentication request message M3 sent by the visitor REQ to the authentication server AS in step S3, the execution is performed. 4.3.1.2.1); If the N _REQ obtained after decryption is equal to the information N _REQ in the identity authentication request message M3 sent by the visitor REQ to the authentication server AS in step S3, 4.3.1.2.2) is performed.

4.3.1.2.1), the authentication server terminates the authentication.

4.3.1.2.2), the authentication server AS constructs the identity authentication response message M4

ID _AC ||N _REQ ||Res(AC)||Res(REQ)||MIC _{2 is} sent to the visitor REQ. At this time, R(AC)=True, indicating that the authentication server AS successfully authenticates the access controller AC, and R(REQ)=Failure, indicating that the authentication server AS fails to authenticate the visitor REQ; at this time, MIC ₂ =H (K _{AS ;REQ} , ID _AC ||N _REQ ||Res (AC) ||Res (REQ)) , used to verify the integrity of the message ID _AC ||N _REQ ||Res(AC)||Res(REQ). Where H is a one-way hash Algorithm, the same below.

4.3.2), the authentication server AS determines, according to the ID _AC, whether the access controller AC has shared the key K _AS , _AC with the authentication server _AS , and if the key K _AS , _AC is not shared, executes 4.3.2.1); Key K _AS , _AC , then execute 4.3.2.2);

4.3.2.1) The authentication server AS constructs the identity response message M4

ID _AC ||N _REQ ||Res (AC)||Res (REQ)||MIC _{2 is} sent to the visitor REQ. At this time, R (AC) = Fai lure, indicating that the authentication server AS fails authentication to the access controller AC; R (REQ) = True, indicating that the authentication server AS successfully authenticates the visitor REQ. At this time MIC ₂ =H (K _AS , _REQ , ID _AC ||N _REQ ||Res (AC) ||Res (REQ) ), used to verify the message ID _AC ||N _REQ ||Res (AC) || The integrity of Res (REQ).

4.3.2.2), the authentication server AS determines to use the shared key K _AS , _{Ae to} decrypt 6 (1^^, ^ obtained)

Whether visitors REQ _REQ N in step S 3 are sent to the authentication server AS identity authentication request message is equal to N in the _REQ message M3, and if not, step 4.3.2.1); if yes, execute 4.3.2.3).

4.3.2.3), the authentication server AS generates a session key KACREQ between the visitor REQ and the access controller AC, and then calculates E (K _AS; using the shared key K _A ^ OK _as , _req and the session key K _ac , _req _{; AC} , ID _REQ ||K _A C, _REQ ) and E(K _AS , _REQ , K _Ae , _REQ ), and then calculate the message integrity authentication code at this time

MIC ₂ =H (K _Q , ID _AC ||N _REQ ||Res (AC) ||Res (REQ) ||E (K _AS;AC , ID _REQ ||K AC, REQ) ||E (KAS, , AC, Q)). Where ID _REQ is the identity of the visitor REQ, the same below. The message integrity authentication code MIC ₂ at this time is used to verify the message ID _AC ||N _REQ ||Res (AC) ||Res (REQ) ||E (K _{AS; AC} , ID _REQ ||K AC, REQ) ||E (KAS, , AC, Q) is redundant. At this time, R(AC)=True, indicating that the authentication server AS successfully authenticates the access controller AC; R (REQ) = True, indicating that the authentication server AS successfully authenticates the visitor REQ. The authentication server AS further constructs an identity authentication response message M4 at this time, that is, ID _AC ||N _REQ ||Res (AC) ||Res (REQ) ||E (K _{AS; AC} , ID _REQ ||K _AC , _REQ ) ||E (K _AS , _REQ , K _AC , _REQ ) ||MIC _{2 is} sent to the visitor REQ.

In summary, when R(AC)=Failure or R(REQ)=Failure, the message integrity authentication code MIC ₂ =H(K _AS , _REQ , ID _AC ||N _REQ ||Res (AC)| |Res (REQ)), correspondingly, the identity authentication response message M4 is ID _AC ||N _REQ ||Res (AC)||Res (REQ)||MIC ₂ , in addition, in other embodiments, the identity authentication response Message M4 is a message containing at least ID _AC ||N _REQ ||Res (AC) ||Res (REQ) ||MIC ₂ ; when R (AC) = True and When R (REQ) = True, the message integrity authentication code MIC ₂ =

H (K _{AS; REQ} , ID _AC ||N _REQ ||Res (AC) ||Res (REQ) ||E (K _AS;AC , ID _REQ ||K ||E (K , , ) ) ·> Correspondingly, the identity authentication response message M4 is ID _AC ||N _REQ ||Res (AC) ||Res (REQ) ||E (K _{AS; AC} , ID _REQ ||K _AC ) ||E (K _{AS; REQ} , K _AC , _REQ ) ||MIC ₂ , In addition, in other embodiments, the identity authentication response message M4 is at least including ID _AC ||N _REQ ||Res (AC) ||Res (REQ) ||E (K _{AS; AC} , ID _REQ ||K _AC ) ||E (K _{AS; REQ} , K _AC , _REQ ) || MIC ₂ message.

Step S5:

5.1), the interviewer REQ receives the identity identification response message Μ4

ID _AC ||N _REQ ||Res (AC) ||Res (REQ) ||MIC ₂ or ID _AC ||N _REQ ||Res (AC) ||Res (REQ) ||E (K _AS;AC , ID _REQ ||K _AC , _REQ ) ||E (K _AS , _REQ , K _AC , _REQ ) || After MIC ₂ , first determine whether the random number N _REQ is a random number generated by the visitor REQ, and if not, execute 5.2 ); If yes, execute 5.3).

Step 5.2), the visitor REQ discards the identity authentication response message M4.

Step 5.3), the visitor REQ judges the integrity of the corresponding message according to the MIC ₂ , if not, executes 5.3.1); if complete, executes 5.3.2).

5.3.1), the visitor REQ discards the identity authentication response message M4.

5.3.2), the visitor REQ uses K _AS , _REQ to decrypt the publicly identifiable result C1, ie Res (AC), to determine the legitimacy of the access controller AC, and if the Res (AC) is decrypted, the R is obtained. (AC) =Failure, it means that the access controller AC is illegal, then 5.3.2.1); If Res (AC) is decrypted, R(AC)=True, it means the access controller AC is legal, then execute 5.3 .2.2).

5.3.2.1), the visitor REQ terminates the access.

5.3.2.2), the visitor REQ decrypts the E (K _AS , _REQ , K _AC , _REQ ) in the identity authentication response message M4 to obtain the session key K _Ae , _REQ , and generates the random number N′ _REQ , and calculates the message integrity. The authentication code MIC ₃ =H (K _AC , N _AC ||N' _REQ ||Res (REQ) ||E (K _{AS; AC} , ID _REQ ||K _AC , _REQ ) ), constructs an access authentication response message M5 That is, N _AC ||N, _REQ ||Res (REQ) ||E (K _{AS; AC} , ID _REQ ||K _AC ) || MIC _{3 is} sent to the access controller AC. The message integrity authentication code MIC _{3 is} used to verify the integrity of the message N _AC ||N' _REQ ||Res (REQ) ||E (K _{AS; AC} , ID _REQ ||K _AC , _REQ ). In other embodiments, the access authentication response message M5 is at least one of

N _AC ||N' _REQ ||Res (REQ) ||E (K _AS;AC , ID _REQ ||K _AC , _REQ ) ||MIC ₃ message.

Step S6:

6.1), the access controller AC receives the identity authentication response message M5 ie N _AC ||N' _REQ ||Res (REQ) ||E (K _{AS; AC} , ID _REQ ||K _AC , _REQ ) ||MIC ₃ After that, first determine whether the random number N _AC accesses the random number generated by the controller AC, if not, execute 6.2); if yes, execute 6.3);

6.2), Access Controller AC denied access to the visitor REQ.

6.3), the access controller AC uses K _AS , _AC to decrypt Res (REQ), if the R (REQ)=Failure obtained by decrypting Res (REQ), indicating that the visitor REQ is illegal, then 6.3.1); Res (REQ) gets R(REQ)=True, indicating that the visitor REQ is legal, then 6.3.2).

6.3.1), Access Controller AC deny access to the visitor REQ.

6.3.2), the access controller AC decrypts E (K _AS , _AC , ID _REQ ||K _AC ), obtains the session key K _AC , _REQ , and judges the message N _AC ||N' _REQ ||Res according to the MIC ₃ (REQ) ||E (K _AS;AC , ID _REQ ||K _AC , _REQ ) Integrity, if not complete, perform 6.3.2.1); if complete, perform 6.3.2.2).

6.3.2.1), Access Controller AC deny access to the visitor REQ.

6.3.2.2), access controller AC confirmation ID _REQ decrypts _{_{E (K AS, AC, ID}} REQ || K AC) obtained whether the identity ID _REQ REQ visitors - the cause, if not match, the 6.3. 2.2.1); If they are consistent, proceed to 6.3.2.2.2).

6.3.2.2.1), Access Controller AC deny access to the visitor REQ.

6.3.2.2.2), the access controller AC determines, according to the authorization policy, whether the access request Q _REQ sent by the visitor REQ in step S1 is legal, and if not, performs 6.3.2.2.2.1); if legal, Implementation of 6.3.2.2.2.2

6.3.2.2.2.1), Access Controller AC denies access to the visitor REQ.

6.3.2.2.2.2), the access controller AC response data structure according to Q _REQ R & lt _AC, calculates the message authentication code integrity _{MIC 4 = H (KACREQ, N} 'REQ || E (KACREQ, R ac)), and further configured to access The response message M6, N' _REQ ||E (KACKEQ, RAC) ||MIC _{4, is} sent to the visitor REQ. The R _{AC is} used by the access controller AC to notify the visitor REQ whether to have access to the destination network. The message integrity authentication code MIC _{4 is} used to verify the integrity of the message N' _REQ ||E(K _AC , _REQ , R _AC ), and the authorization policy of the access controller AC to the visitor REQ may come from the access controller. The AC local may also be provided by another server such as the authentication server AS. When the authorization policy is provided by the authentication server AS, the identity authentication response message M4 in step S4 is required to be ID _AC ||N _REQ ||Res (AC). )||Res (REQ) ||E (K _AS;AC , ID _REQ ||K _AC , _REQ ) ||E (K _AS;REQ , K _AC , _REQ ) || E in the MIC ₂ (K _AS , _AC , ID _REQ ||K _AC , _REQ ) is modified to E (K _AS , _AC , ID _REQ ||K _A c, _REQ ||AP _AS ), and the access authentication response message M5 in step S5 is required to be NAC. ||N'REQ||E (K _A S,AC, ID _RE Q||KAC,REQ) || E (K _AC , ID _REQ ||K _AC , _REQ ) in MIC ₃ is modified to E (K _{AS ;AC} , ID _REQ ||K _A c, _REQ ||AP _AS ) ₀ where AP _AS represents an authorization policy for the visitor REQ.

At this point, the access controller AC authenticates and authorizes the visitor REQ, and the access control to the access controller AC is realized.

6.4), after the visitor REQ receives the access response message M6, that is, N' _REQ ||E (K _AC , _REQ , R _AC ) ||MIC ₄ , first determines whether the random number N' _REQ is a random number generated by the visitor REQ, If not, execute 6.4.1); if yes, execute 6.4.2

6.4.1), the visitor REQ discards the access response message M6.

6.4.2), the visitor REQ breaks the message N' _REQ ||E (K _AC , _REQ , R _AC ) integrity according to MlC^'j, if not, executes 6.4.2.1); if complete, executes 6.4 .2.2

6.4.2.1), the visitor REQ discards the access response message M6.

6.4.2.2), the visitor REQ decrypts E (K _AC R _AC ) to obtain the response data R _AC , and judges whether the access controller AC authorizes access to the destination network according to the response data RAC, and then accesses the destination network accordingly.

In other embodiments, the access response message M6 is a message containing at least N' _REQ ||E (KACREQ, RAC), 1 ( ₄ ).

Another specific embodiment of the above steps S2 to S4 is:

Step S2:

After receiving the access request message M1, that is, N _REQ ||Q _REQ , the access controller AC constructs an access authentication request message M2, that is, N _REQ ||N _AC ||H(K _AS , _AC ||N _REQ ), and sends it to the visitor. REQ, in other embodiments, the access authentication request message M2 is a message containing at least N _REQ ||N _AC ||H(K _AS , _AC ||N _REQ 。 message. Where H(K _AS , _AC ||N _REQ ) represents the result of hashing K _AS , _AC ||N _REQ , that is, the identity authentication information II of the access controller AC.

Step S3:

After receiving the access authentication request message M2, that is, N _REQ ||N _AC ||H(K _AS , _AC ||N _REQ ), the visitor REQ first determines whether the N _REQ is a random number generated by the visitor REQ, and if not, The authentication request message M2 is discarded; if yes, the visitor REQ calculates the message integrity authentication code MIC ₅ =H (K _{AS; REQ} , ID _AC ||N _REQ ||H (K) using the shared key K _AS , _REQ _AS;AC ||N _REQ ) ) , and in turn constructs an authentication request message Μ3, ie ID _AC ||N _REQ ||H (K _{AS; AC} ||N _REQ ) || MIC _{5 is} sent to the authentication server AS. The message integrity authentication code MIC _{5 is} used to verify the integrity of the ID _AC ||N _REQ ||H(K _AC ||N _REQ ), and the MIC _{5 is} the identity authentication information 12 of the visitor REQ.

In other embodiments, the authentication request message M3 is at least one of

ID _AC ||N _REQ ||H(K _AS , _AC ||N _REQ )||MIC^々 message.

Step S4:

4.1'), after the authentication server AS receives the identity authentication request message M3, ie ID _AC ||N _REQ ||H(K _AS , _AC ||N _REQ )||MIC ₅ , it first determines whether the visitor REQ has been authenticated with the server AS shared key K _AS , _REQ , if no shared key K _AS , _REQ , then 4.2 '); if shared key K _AS , _REQ , then execute 4.) ₀

4.2'), the authentication server AS judges according to the ID _Ae whether the access controller AC has shared the key K _AS , _AC with the authentication server _AS , and if the key K _AS , _AC is not shared, performs 4.2.); if the shared key K _AS , _AC , then 4.2. V ).

4.2.1'), the authentication server AS terminates the authentication.

4.2. V), the authentication server AS constructs an identity authentication response message M4 ie ID _AC ||N _REQ ||Res (AC) ||Res (REQ) ||MIC _{2 is} sent to the visitor REQ. Among them, Res (AC) is the publicly discriminable result CI, Res (REQ) is the publicly discriminable result C 2, Res (AC) = E (K _{AS; REQ} , R (AC) ), Res (REQ) = E (K _{AS; AC} , R (REQ) ) , R (AC) is the first verification result, R (REQ) is the second verification result, and MIC ₂ is the message integrity authentication code. At this time, R(REQ)=Failure, indicating that the authentication server AS fails the authentication to the visitor REQ, and R(AC)=True indicates that the authentication server AS controls the access. The AC identification was successful. At this time MIC ₂ =H(K _AS , _REQ , ID _AC ||N _REQ ||Res (AC) ||Res (REQ) ) , used to verify the message

ID _AC ||N _REQ ||Res (AC) ||Res (REQ) integrity.

4.3'), the authentication server AS judges according to the MIC ₅ in the identity authentication request message M3

ID _AC ||N _REQ ||H (K _AS , _AC ||N _REQ ) integrity, if not complete, execute 4.3.1'); if complete, indicating that the visitor REQ is legal, then 4.3.1' ) ₀

4.3.1'), the authentication server AS discards the identity authentication request message M3.

4.3.2, ), the authentication server AS uses the ID _{Ae to} determine whether the access controller AC has been authenticated with the server.

AS shared key K _AS , _AC , if the key K _AS , _AC is not shared, then 4.3.2.1'); if the shared key K _AS , _AC , then 4.3.2.1' ) ₀

4.3.2. V), the other server AS constructs the identity verification and responds to the message M4

4.3.2. V), the authentication server AS verifies the integrity of H (K _{AS; AC} ||N _REQ ) according to N _REQ , if the verification fails, it executes 4.3.2.2. V ); if the verification is successful, it executes 4.3. 2.2.1' ) ₀

4.3.2.2. V), the authentication server AS constructs an identity authentication response message M4, ie ID _AC ||N _REQ ||Res (AC)||Res (REQ)||MIC _{2 is} sent to the visitor REQ. At this time, R (AC) = Fai lure, indicating that the authentication server AS fails authentication to the access controller AC; R (REQ) = True, indicating that the authentication server AS successfully authenticates the visitor REQ. At this time MIC ₂ =H(K _AS , _REQ , ID _AC ||N _REQ ||Res (AC)||Res (REQ)), used to verify the message ID _AC ||N _REQ ||Res (AC) || The integrity of Res (REQ).

4.3.2.2. V), the authentication server AS generates a session key K _Ae , _REQ between the visitor REQ and the access controller AC, and then utilizes the shared keys K _AS , _Ae and K _AS , _REQ and the session key K _Ae , _REQ calculates E (K _{AS; AC} , ID _REQ ||K _A c, _REQ ) and E (K _{AS; REQ} , KACKEQ), and then calculates the message integrity authentication code MIC ₂ =H (K _Q , ID _AC ) at this time. ||N _REQ ||Res (AC) ||Res (REQ) ||E (K _AS;AC , ID _REQ ||K AC, REQ) ||E (KAS, , AC, Q) ) , used to verify Message ID _AC ||N _REQ ||Res (AC) ||Res (REQ) ||E (K _AS;AC , ID _REQ ||K AC, REQ) ||E (KAS, , AC, Q) Sex. At this time, R(AC)=True, indicating that the authentication server AS successfully authenticates the access controller AC; R (REQ) = True, indicating that the authentication server AS successfully authenticates the visitor REQ. The authentication server AS further constructs an identity authentication response message M4 at this time

ID _AC ||N _REQ ||Res (AC) ||Res (REQ) ||E (K _{AS; AC} , ID _REQ ||K _AC , _REQ ) ||E (K _AS , _REQ , K _AC , _REQ ) ||MIC _{2 is} sent to the visitor REQ.

It can be noted that when R (AC) = Fa i lure or R (REQ) = Fa i lure, the message integrity authentication code MIC ₂ = H (K _AS , _REQ , ID _AC ||N _REQ || Res (AC) ||Res (REQ) ) , correspondingly, the identity authentication response message Μ4 is ID _AC ||N _REQ ||Res (AC) ||Res (REQ) ||MIC ₂ , in addition, in other embodiments The identity authentication response message M4 is a message including at least ID _AC ||N _REQ ||Res (AC) ||Res (REQ) ||MIC ₂ ; when R (AC) = True and R (REQ) = True , message integrity authentication code MIC ₂ = H (K _{AS; REQ} , ID _AC ||N _REQ ||Res (AC) ||Res (REQ) ||E (K _{AS; AC} , ID _REQ ||K || E (K , , ) ) ·> Correspondingly, the identity authentication response message M4 is ID _AC ||N _REQ ||Res (AC) ||Res (REQ) ||E (K _{AS; AC} , ID _REQ ||K _AC ) ||E (K _{AS; REQ} , K _AC , _REQ ) ||MIC ₂ , In addition, in other embodiments, the identity authentication response message M4 is at least including ID _AC ||N _REQ ||Res (AC) ||Res (REQ) ||E (K _{AS; AC} , ID _REQ ||K _AC ) ||E (K _{AS; REQ} , K _AC , _REQ ) || MIC ₂ message.

The invention is based on a symmetric cryptographic mechanism in cryptography, and provides two specific implementation methods for realizing authentication between the access controller AC and the visitor REQ when the authentication server AS provides the authentication service, and one method is based on symmetric encryption operation. In the previous embodiment, a method based on the hash operation, that is, the latter embodiment, can implement the authentication between the visitor REQ and the authentication server AS when the access controller AC cannot directly use the authentication service provided by the authentication server AS. The access control process for authorizing the visitor REQ is completed by the access controller AC.

Those skilled in the art will appreciate that embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or a combination of software and hardware. Moreover, the invention can be embodied in the form of one or more computer program products embodied on a computer-usable storage medium (including but not limited to disk storage, CD-ROM, optical storage, etc.) in which computer usable program code is embodied.

The present invention has been described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (system), and computer program products according to embodiments of the invention. It should be understood that the flow chart can be implemented by computer program instructions And/or a combination of the processes and/or blocks in the block diagrams, and the flowcharts and/or blocks in the flowcharts and/or block diagrams. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine for the execution of instructions for execution by a processor of a computer or other programmable data processing device. Means for implementing the functions specified in one or more of the flow or in a block or blocks of the flow chart.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device. The apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. The instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Although the preferred embodiment of the invention has been described, it will be apparent to those skilled in the < Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and the modifications and modifications The spirit and scope of the invention. Thus, it is intended that the present invention cover the modifications and variations of the inventions

Claims

Rights request

A network access control method, comprising:

Step 2) After the access controller receives the access request message, construct an access authentication request message including the first identity authentication information, where the first identity authentication information is used by using the access a result of a symmetric cryptographic operation performed by the shared key K _AS , _AC between the controller and an authentication server on the N _REQ ;

Step 6), after the access controller receives the access authentication response message, decrypt the second The publicly available authentication result is obtained, and the second authentication result is obtained, and an access response message is configured to be sent to the visitor according to an authorization policy; the authorization policy refers to the access controller authorizing the access request Strategy.

The method according to claim 1, wherein the performing the symmetric cryptographic operation comprises: using an operation based on a symmetric encryption algorithm or a hash algorithm.

The method according to claim 2, wherein the identity authentication request message further includes the identification information ID _{AC of} the access controller; in the step 4), the authentication server receives the After the identity authentication request message, if it is determined that the K _{AS; REQ is} not shared with the visitor, and according to the ID _AC, it is determined that the K _AS , _AC is not shared with the access controller. Then the authentication is terminated.

The method according to claim 2, wherein the identity authentication request message further includes the identification information ID _AC and the N _{REQ of} the access controller; in the step 4), the authentication After receiving the identity authentication request message, the server determines that the K _AS , _REQ is not shared with the visitor, and determines that the shared controller is shared with the access controller according to the ID _AC. K _AS , _AC , then

When the symmetric encryption algorithm is used, the first identity authentication information is decrypted by using the K _A ^ , and it is determined whether the decryption result is equal to the N _REQ , and if not, the authentication is terminated; if they are equal, the The first publicly identifiable authentication result is that the access controller is legally authenticated and the second publicly identifiable authentication result is that the visitor identity is illegal.

The method according to claim 2, wherein the identity authentication request message further includes the identification information ID _AC and the N _{REQ of} the access controller; in the step 4), when After the authentication server receives the identity authentication request message, if it is determined that the K _AS , _REQ is shared between itself and the visitor,

When the symmetric encryption algorithm is used, the second identity authentication information is decrypted by using the K _AS , _REQ , if the decryption result is determined to be unequal to the N _REQ , and the access controller is not determined according to the ID _Ae The K _AS , _AC is shared between them, and the authentication is terminated.

6. The method according to claim 2, wherein the identity authentication request message is further The identification information ID _AC and the N _{REQ of} the access controller are included; in the step 4), after the authentication server receives the identity authentication request message, if it is determined that it is between the user and the visitor The K _AS , _REQ , have been shared

When the symmetric encryption algorithm is used, the second identity authentication information is decrypted by using the K _AS and the _REQ , and if the decryption result is not equal to the N _REQ , and the access controller is determined according to the ID _AC The K _AS , _AC is shared between

Decrypting the first identity authentication information by using the K _A ^, and determining whether the decryption result is equal to the N _REQ , if not equal, terminating the authentication; if equal, determining that the first publicly discriminable authentication result is The access controller is legally authenticated and the second publicly available authentication result is that the visitor identity is illegal.

The method according to claim 2, wherein the identity authentication request message further includes identifier information ID _AC and the N _{REQ of} the access controller; when a symmetric encryption algorithm is used, In step 4), after the authentication server receives the identity authentication request message, it is determined that the K _AS , _REQ is shared with the visitor, and the _KAS and _{REQ are used to} decrypt the first Two identity authentication information, and determining that the decryption result is equal to the N _REQ , then

If it is determined according to the ID _AC that the K _AS , _AC is not shared with the access controller, determining that the first publicly available authentication result is that the access controller identity is illegal and the second publicly available The result of the authentication is that the identity of the visitor is legal.

The method according to claim 2, wherein the identity authentication request message further includes an identifier information ID _AC and the N _{REQ of} the access controller; when a symmetric encryption algorithm is used, In step 4), after the authentication server receives the identity authentication request message, it is determined that the K _AS , _REQ is shared with the visitor, and the _KAS and _{REQ are used to} decrypt the first Two identity authentication information, and determining that the decryption result is equal to the N _REQ , then

If it is determined according to the ID _AC that the K _AS , _AC is shared with the access controller, decrypting the first identity authentication information by using the K _A ^, and determining a decryption result and the N _REQ If they are equal, if not equal, determining that the first publicly available authentication result is that the access controller identity is illegal and the second publicly available authentication result is that the visitor identity is legal; if they are equal, Determining that the first publicly available authentication result is that the access controller identity is legal and the second publicly available authentication result is that the visitor identity is legal.

The method according to claim 2, wherein the identity authentication request message further includes the identification information ID _{AC of} the access controller; in the step 4), the authentication server receives the After the identity authentication request message, if it is determined that it does not share the content with the visitor

KAS, REQ, and

When the hash algorithm is used, if it is further determined according to the ID _AC that the K _AS , _AC is shared with the access controller, determining that the first publicly discriminable authentication result is the access control The identity of the device is legal and the second publicly identifiable authentication result is that the identity of the visitor is illegal.

The method according to claim 2, wherein, in the step 4), after the authentication server receives the identity authentication request message, if it is determined that it has been shared with the visitor The K _AS , _REQ , then

When the hash algorithm is used, the second identity authentication information is used to determine the integrity of the identity authentication request message, and if the determination result is incomplete, the identity authentication request message is discarded.

The method according to claim 2, wherein the identity authentication request message further includes an identifier information ID _{AC of} the access controller; in the step 4), when the authentication server receives the After determining the identity authentication request message, if it is determined that the K _AS , _REQ is shared between the user and the visitor, and the second identity authentication information is used to determine that the identity authentication request message is complete,

When the hash algorithm is used, further determining, according to the ID _AC, whether the K _AS , _AC is shared with the access controller, and if not, determining that the first publicly available authentication result is the access The controller identity is illegal and the second publicly identifiable authentication result is legal for the visitor identity.

The method of claim 2, wherein the identity authentication request message further includes the identification information ID _AC and the N _{REQ of} the access controller; in the step 4), when After the authentication server receives the identity authentication request message, if it is determined that the K _AS , _REQ is shared between the user and the visitor, and the second identity authentication information is used to determine that the identity authentication request message is complete, And determining, according to the ID _AC , that the K _AS , _AC is shared with the access controller, then

When the hash algorithm is used, verifying the integrity of the first identity authentication information by using the N _REQ , and if the verification result is incomplete, determining that the first publicly available authentication result is the access controller identity The illegal and the second publicly available authentication result is that the visitor identity is legal; if the verification result is complete, determining that the first publicly available authentication result is that the access controller is legal and the second The publicly identified result is that the visitor's identity is legal.

The method according to any one of claims 3 to 12, wherein when the visitor obtains the first publicly available authentication result that the identity of the access controller is illegal, the visitor terminates the access. ;

Transmitting the second publicly available authentication result to the access controller by using the access authentication response message when the visitor obtains the first publicly available authentication result that the identity of the access controller is legal ; as well as

The access controller denies the visitor access when the visitor identity is illegal according to the second publicly available authentication result; or the access controller is according to the second publicly available authentication result When the identity of the visitor is legal, the visitor is allowed access.

14. An access device, comprising:

An access request interaction module, configured to send an access request message to an access controller of a destination network, where the access request message includes a random number N _REQ ; and receive the first identity authentication information sent by the access controller Accessing an authentication request message; the first identity authentication information is a result of performing a symmetric cryptographic operation on the N _REQ by using a shared key K _AS , _AC between the access controller and an authentication server;

An authentication request interaction module, configured to send an identity authentication request message to an authentication server, where the identity authentication request message includes the first identity authentication information and second identity authentication information, where the second identity authentication information is a result obtained by the visitor using a shared key K _AS , _REQ between the user and the authentication server to perform a symmetric cryptographic operation on the N _REQ ; and receiving an identity authentication response message sent by the authentication server, the identity authentication The response message includes a first publicly available authentication result and a second publicly available authentication result, wherein the first publicly available authentication result is according to the first Reusing the first authentication result after the identity authentication information is authenticated by the access controller

K _{AS; REQ} performs encryption formation, and the second publicly discriminable authentication result is that the second authentication result after identity authentication of the visitor according to the second identity authentication information is reused by using the K _AS , _Ae Encryption formation;

15. An authentication server, comprising:

16. An access controller, comprising:

An access request receiving module, configured to receive an access request message sent by a visitor, where the access request message carries a random number N _REQ ; An access authentication request constructing module, configured to send an access authentication request message including first identity authentication information to the visitor, where the first identity authentication information is shared by using the access controller and the authentication server a result of a symmetric cryptographic operation performed by the key K _AS , _Ae on the N _REQ ; an access authentication response receiving module, configured to receive an access authentication response message sent by the visitor, and decrypt the second authentication result; The access authentication response message is constructed by the visitor according to the first authentication result included in the identity authentication response message sent by the destination network to the authentication server, and includes the second authentication result; the first authentication result is The authentication server determines, by using the K _AS , the _AC , the first identity authentication information included in the identity authentication request message sent by the visitor, and the second authentication result is determined by the authentication server. after using the shared key K _AS between the visitor, _REQ second authentication information transmitted by said visitor identification determination The second authentication information is the result of the visitor with the K _AS, _REQ N _REQ said symmetric cryptographic operation;

A network access control system, comprising: a visitor, an access controller of a destination network, and an authentication server, wherein:

Sending an access authentication response message to the access controller, where the access authentication response message is based on a first authentication result constructing, and including the second publicly available authentication result;

The authentication server is configured to receive the identity authentication request message sent by the visitor, and generate a first authentication result after performing identity authentication on the access controller according to the first identity authentication information, and Decoding the first authentication result by using the K _AS , _REQ to form a first publicly identifiable authentication result to the access controller, and generating an identity authentication for the visitor according to the second identity authentication information a second authentication result, and encrypting the second authentication result by using the K _A ^ to form a second publicly discriminable result for the visitor; and returning an identity authentication response message to the visitor, including The first publicly available authentication result and the second publicly available authentication result are described.