CN114944927A - Portal authentication-based client-side-free mutual exclusion access platform - Google Patents

Abstract

The invention discloses a clientless mutual exclusive access platform based on Portal authentication, which includes a portal client, a network controller, a Portal server, an AAA server, a RADIUS server, and a device fingerprint memory; the network controller is used to obtain the identity information of the access user, Open user network access rights; the portal client is used to input the authentication information of the access user; the Portal server receives the authentication request of the access user from the portal client, provides free portal services and a web-based authentication interface, and the AAA server communicates with The network controller interacts to complete user authentication, accounting and authorization; the RADIUS server authenticates the identity authentication information of the access user terminal equipment; the device fingerprint memory stores the device fingerprint information used for the identity authentication of the handheld terminal equipment. Based on a variety of billing methods and access rights, the solution monitors networked handheld terminals and customizes more intelligent and personalized network services.

Description

Clientless Mutual Exclusive Access Platform Based on Portal Authentication

technical field

The invention relates to the technical field of network security authentication, in particular, to a clientless mutually exclusive access platform based on Portal authentication.

Background technique

In the government, enterprise, medical and other industries, for security reasons, there are often multiple security physical isolation scenarios such as intranet and extranet. Such as e-government extranet and Internet, procuratorial work network and Internet, taxation special network and Internet, enterprise R&D and development intranet and Internet, etc., to meet the high security requirements of multi-network users for office access.

In the traditional scenario of multiple security physical isolation, such as internal and external networks, if the internal network terminal needs to access the Internet with changes in demand, the configuration of network equipment (such as switches, etc.) needs to be adjusted, or even needs to be changed. The physical location of the terminal to change the internal network terminal to the external network terminal; if the user needs to access the internal network and the Internet at the same time, two terminals will be provided, one internal network terminal and one external network terminal.

With the development of mobile Internet, Internet of Things, etc., the access requirements of users and Internet of Things terminals to the network are no longer as pure as before. For example, the hospital charging system needs to access the medical charging information on the intranet server, and also needs to access the Internet. Implement mobile payments. The network boundary is becoming more and more blurred. The traditional scenario of multiple network security physical isolation not only requires more network equipment to build different physical networks, but also is very difficult to implement, which can no longer meet the network requirements of users in related scenarios. There is an urgent need for a technology that integrates multiple networks and facilitates network switching. Different network channels are opened according to different user identities and user access needs, so that network access is not disturbed.

Portal authentication is also commonly referred to as web authentication, and Portal authentication websites are generally referred to as portal websites. It provides a relatively simple user authentication method, which is easier for users to use than other authentication methods. It has two major features: 1. Client-free: it only needs the support of a web browser (such as IE) to provide users with authentication services, without the need to install a special client or dial-up program; For public network nodes such as hotels, client-free software is a basic requirement;

2. New service carrier: Using the portal function of Portal authentication, operators can put community broadcasting, advertisement, information query, online shopping and other services on Portal. Users will be forced to see the above information when surfing the Internet.

The basic method of Portal authentication is to set an authentication window in a prominent position on the Portal page. After the user boots up to obtain an IP address, the user logs in to the Portal authentication page for authentication. After the authentication is passed, the user can access the Internet.

The terminal access technology based on identity authentication actually uses the portal authentication technology, which has the following features: it does not need to install the authentication client, reduces the maintenance workload of the client, facilitates operation, and can develop business on the Portal page, mature technology, etc. Due to its advantages, it is widely used in electric power, operators, schools and other networks. Portal authentication is not encrypted in the network access stage, but when the user accesses the network, the user will be required to enter the user name and password. After the authentication is successful, the Internet can be accessed. The characteristics of portal authentication are obvious, that is, no special client is required. The browser is enough, so the mobile phone can also be used; but the disadvantages are also obvious. For different end users, the networking cost is high, the user connectivity is poor, and it is not easy to detect that the user is offline, so it is difficult to implement time-based billing. , IP addresses are allocated before user authentication, if the user is not an Internet user, it will cause a waste of addresses, and it is not convenient to support multiple ISPs.

SUMMARY OF THE INVENTION

The purpose of the present invention is to design a clientless mutual exclusive access platform based on Portal authentication, without the need to install various forms of clients on the handheld terminal, the user identity can be authenticated through the portal website, and the user identity ID and the handheld terminal can be accessed. The MAC address is automatically bound, and based on a variety of billing methods and access rights, it can monitor the networked handheld terminals and verify the user identity according to different user identities and network requirements, and customize more intelligent and private network services.

In order to realize the above-mentioned technical purpose, a kind of technical scheme provided by the present invention is, based on Portal authentication clientless mutual exclusive access platform, including portal client, network controller, Portal server, AAA server, RADIUS server, device fingerprint memory ;

As the access port of the user equipment, the network controller is used to obtain the identity information of the access user and open the user's network access rights;

The portal client, as a browser carrier running the HTTP protocol, is used to input the authentication information of the access user; the Portal server, receives the authentication request of the access user from the portal client, and provides free portal services and a web-based authentication interface, And interact with the handheld terminal device of the visiting user to obtain the device fingerprint information of the handheld terminal device;

The AAA server interacts with the network controller to complete user identity authentication, accounting and authorization;

The RADIUS server stores the account and password for accessing the user terminal equipment, and performs authentication on the identity verification information for accessing the user terminal equipment;

The device fingerprint memory stores device fingerprint information used for the identity authentication of the handheld terminal device.

Preferably, the first time the access user obtains the network access authority includes the following steps:

S1. After the handheld terminal device is connected to the network controller, a network request is sent to the portal server;

S2. The portal server feeds back the web page link of the portal client, and initiates a user identity request;

S3, the access user enters its account and password through the portal client displayed by the handheld terminal device and submits a connection request; the account includes a domain user name and a password;

S4. The network controller sends the obtained account and password to the RADIUS server for verification and matching; if the matching is successful, execute S5, and if the matching is unsuccessful, feedback abnormal prompt information to the portal client;

S5. The network controller feeds back the successful result of the access user authentication to the portal server;

S6. The portal server authorizes and protects the user's network connection request, commands the network controller to open the network and assigns an IP address according to the authority of the AAA server, and the network controller binds the relationship between the user identity and the VRF; feedback the successful result of identity confirmation to the portal client.

Preferably, in S6, the network controller opening the network according to the authority of the AAA server includes the following steps: the AAA server obtains the account of the accessing user, and opens the corresponding authority according to the restriction conditions of the corresponding account;

The constraints include network connection duration, network data flow size and speed, and network access domains.

Preferably, when the handheld terminal accesses the network for the first time, the automatic entry and archiving of the device fingerprint information is completed, including the following steps:

After the handheld terminal and the network controller are connected to the network, the AAA server performs real-time monitoring according to the restriction conditions corresponding to the IP address;

When the corresponding IP address touches any one of the restriction conditions, the AAA server interacts with the portal server, and the portal server sends a network service interruption instruction to the network controller;

The portal server queries whether the fingerprint information of the handheld device exists in the device fingerprint memory; if so, feeds back the corresponding permission prompt information to the portal client; if not, the access user sends a verification request through the account and password again;

The network controller obtains the MAC address of the handheld terminal, sends a storage bit expansion request to the device fingerprint memory, binds the MAC address and the IP address, and sends it to the expansion bit.

Preferably, the user requests a network connection for the second time, including the following steps:

If the permission prompt message is not released, you need to continue to wait, or operate according to the agreement to release the restrictions;

If the permission prompt information is released, the network controller will connect to the network according to the IP address of the handheld terminal;

The AAA server feeds back the restrictions corresponding to the IP address to the portal server, and the portal server retrieves the fingerprint information in the fingerprint memory of the device; verifies the authority by matching the IP address and the MAC address; if the MAC address and the IP address match successfully, the network is not connected. The traffic information is forwarded through the exclusive channel in the routing table in the VRF; if the MAC address does not match the IP address successfully, the network monitoring is performed according to the restrictions of the original IP address.

Preferably, if the MAC address does not match the IP address successfully, it means that there is an abnormal user, and the user identity information needs to be verified again. After the verification is successful, the new MAC address and IP address are bound. In the storage bit with the IP address, the new MAC address is used as the backup fingerprint information of the original MAC address.

Preferably, the storage bit expansion follows the following principles:

If a user logs in user information on different handheld terminals, the corresponding IP address is bound to the MAC address of the new handheld terminal, and several MAC addresses form a MAC address pool, and a threshold H is set for the user's MAC address pool according to the user's authority. H MAC addresses are reserved according to the frequency of use of MAC addresses per unit time, and the remaining MAC addresses are unbound from the IP addresses; when the unbound MAC addresses or new MAC addresses access the network controller again, the user identity needs to be checked It is verified separately, and a log of MAC address usage is generated, so that the MAC address pool can be updated according to the usage frequency.

Beneficial effects of the present invention: The present invention designs a clientless mutually exclusive access platform based on Portal authentication, without installing various clients on the handheld terminal, the user identity can be authenticated through the portal website, and the access user identity ID and The MAC address of the handheld terminal is automatically bound, and based on a variety of billing methods and access rights, it monitors the networked handheld terminal and customizes more intelligent and private network services.

Description of drawings

FIG. 1 is a schematic structural diagram of a clientless mutually exclusive access platform based on Portal authentication of the present invention.

FIG. 2 is a flow chart of the first time an access user obtains a network access right according to the present invention.

Description of marks in the figure: 1-handheld terminal, 2-portal client, 3-network controller, 4-Portal server, 5-AAA server, 6-RADIUS server, 7-device fingerprint memory.

Detailed ways

In order to make the objectives, technical solutions and advantages of the present invention clearer, the present invention will be described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only the best of the present invention. The embodiments are only used to explain the present invention, and do not limit the protection scope of the present invention. All other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present invention.

Example:

As shown in Figure 1, the clientless mutually exclusive access platform based on Portal authentication includes portal client 2, network controller 3, Portal server 4, AAA server 5, RADIUS server 6, device fingerprint memory 7;

As the access port of the user equipment, the network controller is used to obtain the identity information of the access user and open the user's network access rights;

The portal client, as a browser carrier running the HTTP protocol, is used to input the authentication information of the access user; the Portal server, receives the authentication request of the access user from the portal client, and provides free portal services and a web-based authentication interface, And interact with the handheld terminal 1 device of the visiting user to obtain the device fingerprint information of the handheld terminal device;

The AAA server interacts with the network controller to complete user authentication, accounting and authorization;

The RADIUS server stores the account and password for accessing the user terminal equipment, and performs authentication on the identity verification information for accessing the user terminal equipment;

The device fingerprint memory stores device fingerprint information used for the identity authentication of the handheld terminal device.

As shown in Figure 2, the first time an access user obtains network access rights includes the following steps:

S1. After the handheld terminal device is connected to the network controller, a network request is sent to the portal server;

S2. The portal server feeds back the web page link of the portal client, and initiates a user identity request;

S3, the access user enters its account and password through the portal client displayed by the handheld terminal device and submits a connection request; the account includes a domain user name and a password;

S4, the network controller sends the obtained account and password to the RADIUS server for verification and matching; if the matching is successful, execute S5, if the matching is unsuccessful, feedback abnormal prompt information to the portal client for user identity re-authentication;

S5. The network controller feeds back the successful result of the access user authentication to the portal server;

S6. The portal server authorizes and protects the user's network connection request, commands the network controller to open the network and assigns an IP address according to the authority of the AAA server, and the network controller binds the relationship between the user identity and the VRF; feedback the successful result of identity confirmation to the portal client.

In S6, the network controller opening the network according to the authority of the AAA server includes the following steps: the AAA server obtains the account of the accessing user, and enables the corresponding authority according to the restriction conditions of the corresponding account;

The constraints include network connection duration, network data flow size and speed, and network access domains.

The network controller can be configured with the following:

On the network controller, the association between the authentication domain and the VRF can be realized by configuring the domain name, VRF (virtual route forwarding), network isolation, etc. Name + domain name: For example, zhangsan@inner, if the user is authenticated successfully, bind the user to VRF1, and all traffic of the user will be forwarded in the routing table of VRF1; if the user exits the current authentication, use the user identity zhangsan@ If outer authentication is performed, the user will be bound to VRF 2, and all traffic of the user will be forwarded in the routing table of VRF 2.

When the handheld terminal accesses the network for the first time, the automatic entry and archive of the device fingerprint information is completed, including the following steps: after the handheld terminal and the network controller are connected to the network, the AAA server performs real-time monitoring according to the restrictions corresponding to the IP address;

When the corresponding IP address touches any of the restriction conditions, the AAA server interacts with the portal server, and the portal server sends a network service interruption instruction to the network controller; when the AAA server detects that the handheld terminal and the network controller are within the time T When there is no data flow, the portal server sends a network service interruption command to the network controller;

The portal server queries whether the fingerprint information of the handheld device exists in the device fingerprint memory; if so, feeds back the corresponding permission prompt information to the portal client; if not, the access user sends a verification request through the account and password again;

The network controller obtains the MAC address of the handheld terminal, sends a storage bit expansion request to the device fingerprint memory, binds the MAC address and the IP address, and sends it to the expansion bit.

The storage bit expansion follows the following principles:

If a user logs in user information on different handheld terminals, the corresponding IP address is bound to the MAC address of the new handheld terminal, and several MAC addresses form a MAC address pool, and a threshold H is set for the user's MAC address pool according to the user's authority. H MAC addresses are reserved according to the frequency of use of MAC addresses per unit time, and the remaining MAC addresses are unbound from the IP addresses; when the unbound MAC addresses or new MAC addresses access the network controller again, the user identity needs to be checked It is verified separately, and a log of MAC address usage is generated, so that the MAC address pool can be updated according to the usage frequency.

A specific example is: if a user's daily cumulative use of the MAC address pool has MAC addresses (a1, a2, a3, a4, a5), if the user authority is a general user, the number of MAC address authority is 3, Then sort the MAC address usage frequency according to the usage frequency of the MAC address in a unit time. For example, the MAC address usage frequency in one month: a1>a2>a3>a4>a5; then the MAC address stored in the extended bit is ( a1, a2, a3), unbind a4 and a5; when the MAC address a4 or a5 is connected to the network controller again, the user identity needs to be verified, and a usage log is generated, so that the MAC address pool can be updated according to the frequency of use.

The user requests a network connection for the second time, including the following steps:

If the permission prompt message is not released, you need to continue to wait, or operate according to the agreement to release the restrictions;

If the permission prompt information is released, the network controller will connect to the network according to the IP address of the handheld terminal;

The AAA server feeds back the restrictions corresponding to the IP address to the portal server, and the portal server retrieves the fingerprint information in the fingerprint memory of the device; verifies the authority by matching the IP address and the MAC address; if the MAC address and the IP address match successfully, the network is not connected. The traffic information is forwarded through the exclusive channel in the routing table in the VRF; if the MAC address does not match the IP address successfully, the network monitoring is performed according to the restrictions of the original IP address.

If the match between the MAC address and the IP address is unsuccessful, it means that there is an abnormal user, and the user information needs to be verified again. After the verification is successful, the new MAC address is bound to the IP address. After the binding is completed, it is sent to the original IP address. In the storage bit, the new MAC address is used as the backup fingerprint information of the original MAC address.

The specific embodiment described above is the preferred embodiment of the clientless mutually exclusive access platform based on Portal authentication of the present invention, and is not intended to limit the specific implementation scope of the present invention. The scope of the present invention includes but is not limited to the specific implementation manner. , all equivalent changes made according to the shape and structure of the present invention are within the protection scope of the present invention.

Claims (7)

1. The client-side-free mutual exclusion access platform based on Portal authentication is characterized in that: the system comprises a Portal client, a network controller, a Portal server, an AAA server, an RADIUS server and an equipment fingerprint memory;

the network controller is used as an access port of the user equipment and is used for acquiring identity information of an access user and opening network access authority of the user;

the portal client serves as a browser carrier running an HTTP (hyper text transport protocol) and is used for inputting the identity authentication information of an access user;

the Portal server receives an authentication request of an access user from a Portal client, provides free Portal service and a Web-based authentication interface, and interacts with handheld terminal equipment of the access user to acquire equipment fingerprint information of the handheld terminal equipment;

the AAA server interacts with the network controller to complete user identity authentication, charging and authorization;

the RADIUS server stores an account number and a password of the access user terminal equipment and performs identity authentication on identity authentication information of the access user terminal equipment;

the device fingerprint memory stores device fingerprint information used for identity authentication of the handheld terminal device.

2. The Portal authentication-based clientless mutually exclusive access platform according to claim 1, wherein: the method for the access user to acquire the network access right for the first time comprises the following steps:

s1, the hand-held terminal device is connected with the network controller and then sends a network request to the portal server;

s2, the portal server feeds back the webpage link of the portal client and initiates a user identity request;

s3, the access user inputs the account and the password and submits the connection request through the portal client displayed by the handheld terminal device; the account comprises a domain user name and a password;

s4, the network controller sends the obtained account and the obtained password to the RADIUS server for verification and matching; if the matching is successful, S5 is executed, and if the matching is unsuccessful, abnormal prompt information is fed back to the portal client;

s5, the network controller feeds back the successful result of the access user identity authentication to the portal server;

s6, authorizing the network connection request of the protection user by the portal server, commanding the network controller to open the network and allocate an IP address according to the authority of the AAA server, and binding the relationship between the user identity and the VRF by the network controller; and feeding back the identity confirmation success result to the portal client.

3. The Portal authentication-based clientless mutually exclusive access platform according to claim 2, wherein: in S6, the network controller opening the network according to the authority of the AAA server includes the steps of:

the AAA server acquires an account number of an access user and opens corresponding authority according to the limiting condition of the corresponding account number;

the limiting conditions include network connection duration, network data flow size and speed, and network access domain.

4. The Portal authentication-based clientless exclusive access platform according to claim 1 or 2, characterized in that: the handheld terminal accesses the network for the first time, namely, the automatic input and archiving of the fingerprint information of the equipment are completed, and the method comprises the following steps: after the handheld terminal is connected with the network controller through the network, the AAA server carries out real-time monitoring according to the limiting conditions corresponding to the IP address;

when the corresponding IP address touches any one of the limiting conditions, the AAA server interacts with the portal server, and the portal server sends a network service interruption instruction to the network controller;

the portal server inquires whether fingerprint information of the handheld device exists in the device fingerprint memory; if yes, feeding back corresponding authority prompt information to the portal client; if not, the access user sends an authentication request again through the account and the password;

the network controller acquires the MAC address of the handheld terminal, sends a storage bit expansion request to the equipment fingerprint memory, binds the MAC address and the IP address and then sends the MAC address and the IP address to an expansion position.

5. The Portal authentication-based clientless mutually exclusive access platform according to claim 4, wherein:

the user requests network connection for the second time, which comprises the following steps:

if the permission prompt message is not released, continuing waiting or releasing the contract according to the limit condition for operation;

if the authority prompt information is removed, the network controller carries out network connection according to the IP address of the handheld terminal;

the AAA server feeds back the limiting conditions corresponding to the IP address to a portal server, and the portal server calls the fingerprint information in the device fingerprint memory; performing authority verification by matching the IP address with the MAC address; if the MAC address is successfully matched with the IP address, the network communication is unlimited, and the flow information is forwarded through a dedicated channel through a routing table in a VRF; and if the MAC address is not successfully matched with the IP address, monitoring the network according to the limiting conditions of the original IP address.

6. The Portal authentication-based clientless mutually exclusive access platform according to claim 5, wherein:

if the MAC address is not matched with the IP address successfully, the abnormal user is indicated, the user identity information needs to be verified again, after the user identity information is verified successfully, a new MAC address is bound with the IP address, the new MAC address is sent to a storage bit of the original IP address after the binding is completed, and the new MAC address serves as the standby fingerprint information of the original MAC address.

7. The Portal authentication-based client-less mutually exclusive access platform according to claim 4, 5 or 6, wherein: the memory bit expansion follows the following principle:

if a user logs in user information at different handheld terminals, binding corresponding IP addresses with MAC addresses of new handheld terminals, forming an MAC address pool by a plurality of MAC addresses, setting a threshold value H for the MAC address pool of the user according to the authority of the user, reserving H MAC addresses according to the use frequency of the MAC addresses in unit time, and unbinding the rest MAC addresses from the IP addresses; when the unbound MAC address or a new MAC address is accessed into the network controller again, the user identity needs to be verified separately, and a MAC address use log is generated, so that the MAC address pool can be updated conveniently according to the use frequency.

Images