WO2014177106A1

WO2014177106A1 - Network access control method and system

Info

Publication number: WO2014177106A1
Application number: PCT/CN2014/079248
Authority: WO
Inventors: 卢安文; 李锐; 高为静
Original assignee: 中兴通讯股份有限公司
Priority date: 2013-09-26
Filing date: 2014-06-05
Publication date: 2014-11-06
Also published as: CN104518874A

Abstract

The present invention embodiment provides a network access control method, comprising: a security authentication device receives terminal device unique identification information and the security authentication device engages in digital certificate authentication in regard to the terminal device; following the digital certificate authentication, the terminal device unique identification information is authenticated and terminal device access permissions are determined. The present invention additionally provides a network access control system, comprising: a terminal device, configured for sending its own unique identification information to a security authentication device; a security authentication device, configured for engaging in digital certificate authentication in regard to the terminal device; a network management device, configured for authenticating the terminal device unique identification information and for determining terminal device access permissions.

Description

Network access control method and system

The present invention relates to network access control technologies, and in particular, to a network access control method and system. Background technique

In the case of further integration of wired and wireless networks, wireless base stations, in the era of LTE (Long Term Evolution), will deploy large number of small base stations (Small Cell) on a large scale in order to improve coverage. ), the Backhaul network that Small Cell reaches the core network is mostly deployed in the enterprise and user's home. Instead of going through the carrier's proprietary bearer network, the public transport network is selected to connect to the carrier's core network. The access security requirements of the accessed Small Cell are very high, and unauthorized base stations are not allowed to access their own core network.

For device security certification, the 3rd Generation Partnership Project (3GPP) recommends the use of IPSec (IP Security) technology to secure communication between the base station and the core network, while the base station and security gateway (SeGW, Security Gateway) Identity authentication technology is generally based on digital certificate authentication. Although the IPSec protocol can solve the need for authentication and encryption of the two parties, it cannot solve the scenario where the digital certificate is stolen and then masqueraded as a legitimate user. In this way, if someone steals the digital certificate, the security gateway can be bypassed to access the core network. Authorized access or attack. Summary of the invention

In view of this, the main purpose of the embodiments of the present invention is to provide a network access control method and system, which can improve the security and legality of a terminal accessing a network, and is compatible with more key associations. Negotiation.

To achieve the above objective, the technical solution of the embodiment of the present invention is implemented as follows:

The embodiment of the present invention provides a network access control method, where the method includes: the security authentication device receives the unique identification information of the terminal device; the security authentication device performs the digital certificate authentication on the terminal device; after the digital certificate authentication is passed, the terminal is The unique identification information of the device is authenticated, and the access authority of the terminal is determined.

Preferably, the method further includes: the network management device storing the unique identification information of each legal terminal device in batches, and establishing a unique identification information database.

Preferably, the security authentication device receives the unique identification information of the terminal device, and includes: obtaining the unique identification information of the terminal device from the IKE message from the terminal device.

Preferably, the authenticating the unique identification information of the terminal device, determining the access rights of the terminal, includes:

The security authentication device parses the received IKE packet, obtains the unique identifier information of the terminal device in the IKE packet, and sends the obtained unique identifier information to the network management device; the network management device pre-stores the unique identifier information received by the network management device. The unique identification information of each legal terminal device is matched. After the matching is successful, it is confirmed that the terminal device is allowed to access the network.

Preferably, the unique identification information is a device unique identifier (Device ID) and/or a source IP address.

The embodiment of the present invention further provides a network access control system, where the system includes: a terminal device, a security authentication device, and a network management device;

The terminal device is configured to send its unique identification information to the security authentication device; the security authentication device is configured to perform digital certificate authentication on the terminal device;

The network management device is configured to authenticate the unique identification information of the terminal device and determine the access rights of the terminal device.

Preferably, the security authentication device is further configured to receive and parse the unique identifier of the terminal device. After the digital certificate is verified, the unique identification information that is parsed is sent to the network management device.

Preferably, the network management device is further configured to store the unique identification information of each legal terminal device in batches, and establish a database of unique identification information.

Preferably, the network management device is further configured to retrieve a unique identifier information database according to the received unique identifier information, and match the received unique identifier information with the unique identifier information stored in the unique identifier information database, if the matching succeeds And determining to allow the terminal device to access the network; otherwise, determining to reject the terminal device from accessing the network.

Embodiments of the present invention also provide a computer storage medium in which computer executable instructions are stored, the computer executable instructions being used to perform the above method.

The network access control method and system provided by the embodiment of the present invention, the terminal device sends its own unique identification information to the security authentication device, and the security authentication device performs digital certificate authentication on the terminal device; after the digital certificate authentication is passed, the terminal device The unique identification information is authenticated, and the access authority of the terminal is determined. In this way, the terminal accessing the network has a valid identity, thereby improving the security and legality of the terminal accessing the network. Moreover, the IKE technology involved in the embodiment of the present invention can be compatible with the Internet Key Exchange Protocol version 2 (IKEv2). , Internet key exchange version 2 ), and compatible with Internet Key Exchange Protocol version 1 ( IKEvl , Internet key exchange version 1 ). DRAWINGS

1 is a schematic flowchart of a basic implementation of a network access control method according to an embodiment of the present invention; FIG. 2 is a schematic flowchart of a network access control method according to an embodiment of the present invention; FIG. 4 is a schematic structural diagram of a network access control system according to an embodiment of the present invention. detailed description

In the embodiment of the present invention, the terminal device sends the unique identification information of the terminal to the security authentication device; the security authentication device performs the digital certificate authentication on the terminal device; after the digital certificate authentication is passed, the unique identification information of the terminal device is authenticated, and the terminal is determined. Access rights to the device.

Specifically, the terminal device can place its unique identification information in the internet key exchange.

(IKE, Internet key exchange) is sent to the security authentication device; the IKE packet may be the IKEv2 version of the packet;

Determining the unique identification information of the terminal device, and determining the access authority of the terminal device includes: the security authentication device parses the received IKE packet, obtains the unique identifier information of the terminal device in the IKE packet, and obtains the unique identifier information. The identification information is sent to the network management device, and the network management device matches the unique identification information with the unique identification information of each legal terminal device that is pre-stored by the network management device. After the matching is successful, the terminal device is allowed to access the network.

The terminal device may be a small cell (Small Cell); the unique identifier information may be a device unique identifier (Device ID) and/or a source IP address of the terminal device; the security authentication device may be secure. A gateway or a high-end router; the network management device can be a server or a computer having a network management function.

The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

1 is a flowchart of a basic implementation of a network access control method according to an embodiment of the present invention. As shown in FIG. 1, the network access control method includes:

Step 101: The terminal device sends its own unique identification information to the security authentication device. Here, the unique identifier information may include one or more types, and may be a Device ID and/or a source IP address.

Here, the terminal device sends its own unique identification information to the security authentication device, specifically: the terminal device places its unique identification information in the IKE packet and sends the information to the security authentication device. The IKE packet is actually The application can be an IKEv2 version of the packet. Either the IKEvl version of the message;

Before the terminal device sends the unique identifier information to the security authentication device, the method further includes: the network management device stores the unique identifier information of each legal terminal device in batches, and establishes a unique identifier information database, so as to subsequently access the terminal device requesting access. Perform a secure authentication of uniquely identified information.

Here, the security authentication device may be a security gateway or a high-end router; the network management device may be a server or a computer having a network management function; the terminal device may be a Small CelL

Step 102: The security authentication device performs digital certificate authentication on the terminal device. After the digital certificate authentication is passed, the unique identification information of the terminal device is authenticated, and the access rights of the terminal device are determined.

Here, the security authentication device performs the digital certificate authentication on the terminal device as follows: The security authentication device performs IKE negotiation with the terminal device, and first performs digital certificate authentication on the terminal device.

The device authenticates the unique identification information of the terminal device, and determines the access authority of the terminal device, which is: the security authentication device parses the received IKE packet, and obtains the unique identifier information of the terminal device in the IKE packet, and obtains the obtained The unique identification information is sent to the network management device, and the network management device matches the unique identification information with the unique identification information of each legal terminal device that is pre-stored by the network management device. After the matching is successful, the terminal device is allowed to access the network.

2 is a flowchart of an implementation of a network access control method according to an embodiment of the present invention. In this embodiment, the unique identifier information is a Device ID, the terminal device is a Small Cell, and the security authentication device is a security gateway; As shown in FIG. 2, the network access control method in this embodiment includes:

Step 201: The network management device stores the Device ID of each legal Small Cell in batches, and establishes a unique identification information database.

Here, the network management device may be a server or a computer having a network management function; this step is a pre-processing, and may be entered at any time before the terminal device accesses the network. Row.

Step 202: When the small cell needs to access the network, the device ID is filled in the IKE packet and sent to the security gateway.

The IKE packet is in the IKE packet.

Step 203: The security gateway performs IKE negotiation with the Small Cell, first performs digital certificate authentication on the Small Cell, and determines whether the authentication is passed. If the authentication passes, step 204 is performed; otherwise, step 208 is executed to end the current processing flow.

Step 204: The security gateway parses the Device ID from the IKE message, and parses the

The Device ID is sent to the network management device.

Steps 205 to 207: The network management device searches the unique identifier information database, and matches the received device ID with the unique identifier information stored in the unique identifier information database to determine whether the matching is successful. If the matching is successful, the access authority of the Small Cell is determined. To allow the Small Cell to access the core network; otherwise, determine the access right of the Small Cell to reject the Small Cell access to the core network, and perform step 208 to end the current processing flow.

FIG. 3 is a schematic flowchart of a network access control method according to another embodiment of the present invention. In this embodiment, the unique identifier information is a device ID and a source IP address, and the terminal device is a Small Cell, and the security authentication device is Security gateway; As shown in FIG. 3, the method for the network access control includes:

Step 301: The network management device stores the Device ID and the source IP address of each legal Small Cell in batches, and establishes a unique identification information database.

The network management device may be a server or a computer having a network management function. This step is a pre-processing, and may be performed at any time before the terminal device accesses the network. Step 302: When the small cell needs to access the network, the device ID and the source IP address are filled in the IKE packet and sent to the security gateway.

Here, the device ID is filled in the IKE file: the Device ID is filled in the ID payload field in the IKE message according to the format recommended by the 3GPP; the source IP address is filled in the IKE message: according to the format recommended by the 3GPP The source IP address is in the source IP address field of the IKE packet. The IKE packet can be the IKEv2 version.

Step 303: The security gateway performs IKE negotiation with the Small Cell, first performs digital certificate authentication on the Small Cell, and determines whether the authentication is passed. If the authentication is passed, step 304 is performed; otherwise, step 308 is performed to end the current processing flow.

Step 304: The security gateway parses the device ID and the source IP address from the IKE packet, and sends the resolved device ID and source IP address to the network management device.

Steps 305-307: The network management device searches the unique identifier information database, and matches the received device ID and the source IP address with the unique identifier information stored in the unique identifier information database to determine whether the matching is successful. If the matching is successful, determine the Small Cell. The access permission is to allow the Small Cell to access the core network; otherwise, the access right of the Small Cell is determined to be denied access to the core network by the Small Cell, and step 308 is executed to end the current processing flow.

It should be noted that the embodiments of the present invention can be applied to, but not limited to, a plurality of communication scenarios of the Small Cell, and the same applies to an Asymmetric Digital Subscriber Line (ADSL) application scenario of the broadband access.

4 is a schematic structural diagram of a network access control system according to an embodiment of the present invention. As shown in FIG. 4, the network access control system includes: a terminal device 40, a security authentication device 41, and a network management device 42;

The terminal device 40 is configured to send its own unique identification information to the security authentication device 41. Here, the sending is: filling the unique identification information of the user into the IKE packet; the security authentication device 41 is configured as the terminal device. 40 certification of digital certificates; The network management device 42 is configured to authenticate the unique identification information of the terminal device 40, and determine the access authority of the terminal device 40.

Further, the security authentication device 41 is further configured to receive and parse the unique identification information of the terminal device 40, and send the parsed unique identification information to the network management device 42 after confirming that the digital certificate authentication is passed;

The security authentication device 41 is further configured to perform IKE negotiation with the terminal device 40.

The network management device 42 is further configured to store the unique identification information of each legal terminal device in batches, and establish a database of unique identification information.

The network management device 42 is further configured to retrieve the unique identifier information database according to the received unique identifier information, and match the received unique identifier information with the unique identifier information stored in the unique identifier information database, and if the matching is successful, determine Allowing the terminal device to access the network; No, it is determined that the terminal device is denied access to the network;

The unique identifier information may be a device ID and/or a source IP address; the security authentication device may be a security gateway or a high-end router; the network management device may be a server or a computer having a network management function; The device can be a Small Cell.

The embodiment of the present invention further provides a computer storage medium, wherein computer executable instructions are stored, and the computer executable instructions are used to execute the method described in the foregoing embodiments.

Each of the above units may be implemented by a central processing unit (CPU), a digital signal processor (DSP) or a Field-Programmable Gate Array (FPGA) in the electronic device.

Those skilled in the art will appreciate that embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention can take the form of a hardware embodiment, a software embodiment, or a combination of software and hardware aspects. Moreover, the invention can take the form of a computer program product embodied on one or more computer usable storage media (including but not limited to disk storage and optical storage, etc.) in which computer usable program code is embodied. The present invention has been described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (system), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine for the execution of instructions for execution by a processor of a computer or other programmable data processing device. Means for implementing the functions specified in one or more of the flow or in a block or blocks of the flow chart.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device. The apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. The instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

The above is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention.

Claims

claims

1. A network access control method, wherein the method includes:

The security authentication device receives the unique identification information of the terminal device;

The security authentication equipment authenticates the digital certificate of the terminal device;

After the digital certificate authentication is passed, the unique identification information of the terminal device is authenticated to determine the access permission of the terminal.

2. The method according to claim 1, wherein the method further includes: the network management device stores the unique identification information of each legal terminal device in batches, and establishes a database of unique identification information.

3. The method according to claim 1, wherein the security authentication device receives the unique identification information of the terminal device, including:

Obtain the unique identification information of the terminal device from the IKE message from the terminal device.

4. The method according to claim 3, wherein said authenticating the unique identification information of the terminal device and determining the access permission of the terminal includes:

The security authentication device parses the received IKE message, obtains the unique identification information of the terminal device in the IKE message, and sends the obtained unique identification information to the network management device; the network management device pre-stores the received unique identification information with itself The unique identification information of each legal terminal device is matched. After the matching is successful, it is confirmed that the terminal device is allowed to access the network.

5. The method according to any one of claims 1 to 4, wherein the unique identification information is a device unique identifier (Device ID) and/or a source IP address.

6. A network access control system, wherein the system includes: terminal equipment, security authentication equipment and network management equipment; wherein,

The terminal device is configured to send its own unique identification information to the security authentication device; the security authentication device is configured to authenticate the digital certificate of the terminal device;

The network management device is configured to authenticate the unique identification information of the terminal device and determine the access permission of the terminal device.

7. The system according to claim 6, wherein the security authentication device is further configured to receive and parse the unique identification information of the terminal device, and send the parsed unique identification information to the network management device after confirming that the digital certificate authentication is passed. .

8. The system according to claim 6, wherein the network management device is further configured to store the unique identification information of each legal terminal device in batches and establish a unique identification information database.

9. The system according to claim 8, wherein the network management device is further configured to retrieve the unique identification information database according to the received unique identification information, and compare the received unique identification information with the unique identification information stored in the unique identification information database. The identification information is matched, and if the matching is successful, it is determined that the terminal device is allowed to access the network; otherwise, it is determined that the terminal device is denied access to the network.

10. The system according to any one of claims 6 to 9, wherein the unique identification information is Device ID and/or source IP address.

11. A computer storage medium in which computer-executable instructions are stored, and the computer-executable instructions are used to execute the method described in any one of claims 1 to 5.