TW550925B - Method capable of back tracing authentication status in a multi-layer network apparatus architecture - Google Patents

Abstract

The present invention provides a method capable of back tracing authentication status in a multi-layer network apparatus architecture. In the method, a protocol packet of multi-layer back-trace is designed in the multi-layer network apparatus architecture. Therefore, when each user side finds that its authentication is not passed, the user side can ask each network apparatus to sequentially back trace each node in the multi-layer network apparatus architecture by issuing the protocol packet. The response packets from each network apparatus are carried with all authentication pass and rejection information, so that each user side can quickly find the authentication status of each network apparatus, the node, time and reason that cause errors by analyzing the information carried by the response packets, and thus correct them.

Description

550925 V. Description of the invention (1) Background of the invention: tf Ming is a party that performs authentication in a multi-level network device architecture: especially declaring an authentication status of each network device in the multi-level network device rack, How to make mistakes and causes. Previous technology: Due to the booming development of the Internet world, a variety of places have been developed, and the wide range of popular sources, such as <,., And Kushiro Hanbok *, are also the speed and effectiveness of people's information circulation. Come with wireless LAN card: Convenient. In recent years, it has begun to use wireless LAN technology, and the number of multi-information wireless LANs has gradually increased. There is no wide-road circulation at all. Because of the opportunity of the local area network, it has also increased dramatically: Without surgery, the hacker only needs to carry a pen network with a well-known hacker technology notebook computer in a public place, while other 802.11 wireless helmets are equipped with a shielded wireless area for transmission. The notebook computer of the device is hacked in the vicinity of the eighth, the Internet, the infrared and the Bluetooth, and when it is used illegally, it may be stolen by the website, steal the important confidential information of the company, charge the Internet, and even invade the company. 'From many perspectives, the wireless zone: poisons or modifies web pages, which is one of the most vulnerable areas in the world. -,, and Kushiro are the foundation of network information infrastructure. For the development of network products, ___ 'gradually move to network security and 550925. 5. Description of invention (2) Trend of tolerance mechanism, and in the authentication mechanism , Generally adopts the EEE 8 0 2 · 1 X standard, which is a very commonly used standard, mainly using the extended network g tolerance protocol EAPoL (Extensible

Authentication Protocol Over LAN (hereinafter referred to as EAPoL), and communicates with the remote authentication service RADIUS (Remote

Authentication Dial-In User Service (hereinafter referred to as RAD I US) is matched to achieve a very efficient management mode on the authentication function. Adopting IEEE 802 · lx standard, which enables users to use different encryption keys each time they log in to the network. The standard itself also provides key management mechanisms and supports centralized identification such as Kerberos and RADIUS. , Identification and account management framework. Generally speaking, IEEE 802 · 1X is a new standard created to address the inadequate security of IEEE 80 2 · 11. It strengthens connection-based network access control (Port-Based Network Access). Control), and on [EEE⑽ ^ 丨 丨, the most significant lack of security issues, including the lack of user identity authentication mechanism and dynamic data encryption gold record distribution mechanism, so by IEEE 80 2.1 χ standard, RADIUS server Cooperation between the server and the user account database, the enterprise or Internet service provider can effectively manage the access behavior of mobile users on the wireless local area network, and Before authorizing access to the wireless LAN controlled by the IEEE 802.1x standard, X can make it pass EAPoL and provide the account and password or digital certificate (Digital Certificate) to the back end through EAPoL and wireless broadband router. The RADIUS server can only legally enter the wireless LAN after passing the RADIus server cry authentication. At this time, radi & 55〇925 V. Description of the invention (3) — " " '— ^-word It is also described in the user login and logout time information for purposes of monitoring the state of network usage count. 3 However, 'In the process of authenticating the user side, it is generally only possible to know whether the upper server (Server) side of the machine is successfully connected to the user side. Wan: The authentication result does not meet the requirements, such as a wrong password or use The user name is wrong. The connection is immediately blocked (β 丨 〇cked). Because in a multi-level network architecture, the authentication path often passes through several network devices (lntermedia) and the Internet. ? 〇; 1 authentication mechanism, at this time, if the user only knows the authentication error and does not know which side is the problem, it is equivalent to only knowing that the authentication has failed, but not knowing which side makes the user side non-existent and smooth. After completing the certification, there is no clue for tracking, which causes users to have great problems in checking for errors, or finding system problems. The goal is' For a local network using the I EEE 802 · 1 X standard, the EAPoL mechanism is used as the basis for authentication between the client (End Point) and the server (Server). If the authentication passes, Then the network device (Device) will allow the port communication (Unb 丨 cked) to allow the packet data to pass through for network communication. If the authentication fails, the port will be blocked (Bl0cked) for the use The end (End point) cannot use the network. In this traditional authentication mechanism, because of the IEEE 8002 standard and the Hierarchical Query Backtracking (BaCk TraCe) mechanism, it can only know ^ 也, " I ca n’t know exactly which node ’s authentication, there is a problem ^ t " Qingxing in the current situation of increasingly complex network products, especially under the framework of LC Shibei's indeed for network administrators and users a As for the Rong node, it causes a lot of trouble. If it is to be effectively resolved, the potential

550925 V. Description of Invention (4) It must take a lot of time to solve. A multi-layer network equipment architecture is taken as an example. Refer to Figure 1 to illustrate the use of regional authentication (10 ca 1 au hen henticati ο η) as follows: When the user terminal SI 4, SI 5 and S16 are all Passed the EAPoL authentication on the web server D1 3, and the client S13 and the web server D13 passed the EAPoL authentication on the web server D12, but the client S12 did not pass the web server The EAPoL authentication on D12, and the network server D1 2 has not passed the EAPoL authentication on the network server Dl1. At this time, the lines L14, L15, L16, L17, and L18 between the ports are presented. Communicable state 'The lines L12 and L13 are in a broken state. Therefore, although the user terminal S1 4 can connect to the user terminals S15, S16, and S13 respectively, it cannot connect to the user terminals S1 2 and SI. 1, and the client S1 4 after obtaining the information that the authentication passed, 'can't know which machine is set incorrectly (such as S i 2)' or which domain cannot be accessed (such as ... s 11). ^ Take another multi-level network device architecture as an example. Refer to Figure 2 to illustrate the use of centralized authentication as follows: In this other multi-level network device architecture, a RADIUS server is mainly added. R21 is used as a centralized authentication server. The user side S21 is successfully authenticated by the RADIUS server R21 through the server side D21. The user side S22 and the network server side D22 fail the authentication. At this time, due to each connection 璋Lines L20 and L21 are in a communicable state, lines L22 and 123 are in a discontinued state, and the user side S23, S24, S25, S26 and D23 on the network feeder must be authenticated before they must be authenticated. Connect to RADIUS feeder R21 first, so in the case of line L23 interruption, use

550925 V. Description of the invention (5) '---------- The client side S23, S24, / 25, S26 and the web server side D2: 3 cannot be authenticated and cannot be known * Lichuan user side S24 I only get the information that the certification has not passed, but ... what brother, Jiu Jiu ', which makes it impossible to pass the certification. Under the circumstance of control, following these circumstances, without affecting the network security authentication mechanism, the user or management efficiency of the BackTrace machine authentication has a problem. Li can easily and clearly understand which node end, important topic. That is, one of the invention outlines that network equipment and system operators need to solve urgently: In view of the foregoing value & ^ ^, it is impossible to know clearly in the 3 = f mechanism, only the authentication result can be known, and a kind of θ can be mocked, and the point Authentication problems, the inventor has researched and talked about, and pursued multiple methods, the period # his name Xixi layer one-person network equipment architecture back-tracking the authentication status (Back TTra x When a multi-layer is not authenticated, you can use ^ ^ protocol packets. 俾 Each client finds that they need to track back in order: af sends out the protocol packets, and requires each network to set each network device to return a route. Each node in the equipment architecture, and the information that has failed. Should be packaged to bring back all network equipment certifications. Information brought back by a packet that passes one of the objectives of the present invention. Γ = The response can be analyzed at each user end. second network device architecture ,,, main, - a 8〇2 · lx authentication mechanisms to provide multiple layers of backup architecture that occurred two f = wrong quickly backtracking of the multi-level network design process that was wrong and debugging:; kg Consumption # :: Correction 'to effectively reduce Between the thiophene, significantly enhance network authentication, tube

550925

V. Description of the invention (6) Convenience in management and maintenance. Another purpose of Gu Yueyue is in the content of the agreement package. It only needs to mention the error message about the authentication problem, and it doesn't need to be ^ βπ ^ Therefore, the hacker cannot use the traceback message to perform any sabotage on the network equipment. In order to more clearly express the technical means and operating vortex of the present invention, a preferred embodiment will be given in conjunction with the accompanying drawings, which are described as follows: k Detailed description: In the present invention ^-最In the preferred embodiment, it is mainly directed to a multi-level network device architecture. See FIG. 3, 'Using centralized authentication equipment for management. In this embodiment, a multi-level network, RADHS, is used as a centralized authentication device. First, there is a RADIUS server server R31 with a multi-layer network connection structure. At least the present invention is to quickly learn which node has a back trace in the multi-layer network when the back trace is not authenticated. The equipment can trace back the multi-layered information in order to block and fail the information returned by each network setting, such as: network ID) or address (Mac Address). Information to find out the error-prone device architecture that caused the error. 'Enable the client. By designing a multi-layer protocol packet, each client sends and sends the protocol packet, requesting each network device. In architecture Each node and package will bring back all network equipment authentication path equipment name, identification code (Device, time, and failed authentication errors. You can analyze the point brought back by the response packet and correct it.

550925 V. Description of the invention (7) More than one network device is connected. In the embodiment shown in FIG. 3, the RADIUS server R31 is connected to one of the first network devices D31 through the line L30. The first network device D31 is connected to one of the ports of the second network device D32 through line x L33, and the second network device D32 is connected to the third network device through line L35. One of D33 is connected to the connecting line, and so on, to form the multi-layer network structure referred to in the present invention. In this embodiment, 'the first network device D31 is connected to the-port on the first user terminal S31 and the second user terminal a through the lines, L31, and L32, respectively, and the second The network device D32 is connected to one of the ports on the third user terminal S33 through line ⑶, and the third network D33 is connected to the fourth user & device S34 through the lines L36, L37, and L38, respectively. The fifth user terminal S35 and the sixth user terminal S36 are connected to each other. Connection 璋 = In the embodiment, by designing a multi-level back trace agreement packet, when each client finds that it can pass the agreement packet, it can request each of them; In the architecture, visually tracking and returning each section J should allow each user to quickly know which section is true, and "to deserve the retrospective break, you must first define :, now every network ° Both are equipped with the ability to trace back. The types of agreements can be divided into two types: request packets and pull-back shore packets. * Response packets. The request packets are composed of the lower layers of the two architectures. Network devices transmit H-Secondary packets from upper-layer network devices to lower-layer networks.

Page 10 550925 V. Description of the invention (8) Relevant information is brought back. In the multi-layer network equipment architecture, the embodiment shown in FIG. 3 is taken as an example. 'Assuming that in the multi-layer network equipment architecture, the first layer: S3 1, D32, and S32 are all certified, and That is, L31, L33, and L32 are all communicable states; the second layer: S33 is authenticated and D33 is failed to authenticate, that is, L 3 4 疋 communicable state, [3 5 is the interrupt state, then the third layer, $ 3 4, S 3 5, S 3 6 杳 cannot be successfully authenticated. When each network device requests a packet for the traceback, the following steps are followed to process the transmission. Solution 1: When the fourth client S34 sends a traceback packet for traceback: ^ in the third The network device D33 authenticates and authenticates the fourth user, and the third network device D33 will receive the traceback packet and generate a traceback response packet, and send it back to the request packet m. Λ To cut the packet and send it to the upper layer. The third network device side has not passed the authentication.,: Ί; 网:; training pair also generates a response packet for backtracking. 'Next — Route device D 3 2 Network device D33 , And issue a trace back to the bottom-layer of the third-layer of the network-device D31. At this time, the top-level client authenticates the second network device D32. Therefore, the basic information of this certification must be obtained for two reasons, because the device D32 and the third network device!) 33, it is transmitted to the left of the second network S34. To the fourth user end In this embodiment, the traceback request packet and response packet

$ 11 pages 550925 V. Description of the invention (9) The format can be one of the formats shown in the table below (format 1): SA DA Code State Depth Length Description Char [6] Char [6] Integer Integer Integer Integer Char [] Also Can be another format (format 2): SA DA Code State Depth Type Char [6] Char [6] Integer Integer Integer Integer The description of each block is as follows: Unit SA: It is used to represent the source address of the packet sent (s〇 urce Address); Block DA: used to represent the destination address (destinati〇η Address) of the packet to be transmitted; Block Code: used to represent the code value of the requested packet or response packet, 0 represents the requested packet, 1 represents the response packet ; Depth: used to represent the depth of the source from which the request packet was sent. For example, when the request packet is sent by the third network device D33, its Depth = 1, and when the request packet is sent by the second network device D 3 When it is sent out, its Depth = 2. When it is required that the packet is sent by the first network device D31, its Depth field State: a code value used to represent the success or failure of the authentication, 〇 represents the authentication failure, and 1 represents the authentication success. Field Length: Description for the representative length;

Page 12 550925 V. Description of the invention (ίο) Field Description ·· Describes the basic description of the authentication problem; Field Type: It is used to represent the basic classification of the authentication problem, each of which can be defined in advance, also It can be expanded in the future. For example: Type 0 means that the authentication is successful, Type 1 means that the RADIUS server fails to pass the authentication, Type 2 means that the RADIUS server does not respond. Type 3 means that the network device fails to pass the authentication, and Type 4 refers to the network. There was no response from the device; as for 'Char [] & Integer and the attributes used to represent the data in each field', respectively, are strings and integers.

According to the above, "In this embodiment, when the fourth client S34 sends a packet requesting the client to connect, if it receives a poor message that is not authenticated," the fourth use The client S34 can send a traceback request packet. If the traceback authentication result is requested, each network device returns ^ Yes! The traceback response packet is analyzed by the fourth user terminal S34: the second two will carry the information contained in the following table (format 2, please refer to Figure 4 for detailed seal content) ·· SA DA State Depth Type D33 S34 Authentication failure 1 RADIUS server did not respond D33 S34 2 Password error D33 S34 ~ IBS ~ 3-Option 2: ^ 3rd, the user side S34 issues a request for backtracking Packet 'authenticates the fourth client S34 with the second network device D33 and

Page 13 550925 V. Description of the invention (11) --- failed, the third network device J) 3 3 will receive the traceback request packet and generate a traceback response packet, and send it back to the first The four clients S34 send a traceback request packet and send it to the first network device D 3 2 of the upper layer. Similarly, since the second network device D 3 2 sends the second network device D33 certification failed, so the second network device]) 32 also generates a response packet for traceback, sends it directly to the fourth client S 3 4 'at the source and sends a request packet for traceback. , Sent to the first network device D 3 1 in the upper layer. At this time, since the first network device D 3 1 has authenticated the second network device d 3 2 and has passed the authentication, 'this one The basic information that passed the authentication is directly returned to the fourth user terminal S34. In this embodiment, the format of the request packet and response packet of the traceback can be one of the formats (format 3) shown in the following table: SA DA Code SSA SDA State Depth Length Description Char [6] Char [6] Integer Char [6] Char [6] Integer Integer Integer Char [] can also be in another format (format 4): SA DA Code SSA SDA State Depth Type Char [6] Char [6] Integer Char [6] Char [6] The fields of Integer Integer Integer are described as follows: Block SA: used to represent the source address of the packet (S 〇urce Address); Field DA: used to represent the destination address of the packet to be transmitted (Destinati ο η

Page 14 550925 V. Description of the invention (12)

Address); Block Code: It is used to represent the code value of the requested packet or response packet, 0 is the requested packet, and 1 is the response packet; Block SSA: If the format of the requested packet, this block is used to represent the source of back to the lake ~ Address (Start Source Address); if it should be in the format of the packet, this column is used to represent the beginning of the authentication segment, such as the address (.Segment Source Address); Block SDA ·· If the format of the packet is required, this column is used It represents the current destination address (Scale Destination Address) traced back. If the format of the response packet is used, this column is used to represent the destination address of the authentication section.

Destination Address); Field Depth: It is used to represent the depth of the source from which the request packet is sent. For example, when the request packet is sent by the third network device D33, its Depth = 1, and when the request packet is sent by the second network When device D32 sends out, its Depth = 2, when it is required that the packet is sent by the first network device D31, its Depth = 3; Field S tate: a code value used to represent the success or failure of authentication, 〇 represents the authentication failure, 1 indicates successful authentication; Field Length: used to represent the length of the description; Descript i〇n ·· Used to describe the basic description of the authentication problem; Extreme 1-bit Type: Used to represent the basic classification of the authentication problem, each should Basic classifications can be defined in advance or extended in the future, such as:

Page 15 (13) " '"-Type 550925 0 ^ means successful authentication, type 1 means RADius server failed certification, type 2 means no response from RADIUs server, type 3 means network equipment If the authentication fails, the type 4 series network device has no response. ^ In, Char [] & Integer and are used to represent the attributes in the block, which are string and integer respectively. According to the above, in this embodiment, when the fourth user terminal s 3 4 sends a packet requesting connection with its user terminal, if it receives unauthenticated information, the fourth use The client S3 4 can send a traceback request packet 'requests the result of the traceback authentication, and then each network device returns a response packet of the traceback after analysis and processing by the fourth client S34' will Bring the information contained in the following table (format 4, detailed packet content please refer to Figure 5): 'SA DA SSA SDA State Depth Type D33 S34 S34 D33 Authentication failure 1 No response from RADIUS server D32 S34 D33 D32 authentication failed 2 password error D31 S34 D32 D31 authentication passed 3-so 'for a multi-level network equipment architecture that provides 80 2 · ΐχ authentication mechanism' can indeed pass the packets and 'Response packet' helps users or administrators to more clearly and quickly trace back errors occurring in various network devices and correct them to effectively reduce the cost of debugging and troubleshooting during the authentication process. Wrong time, greatly improving the convenience of network authentication, management and maintenance.

Page 16 550925 V. Description of the invention (14) In the present invention, since in the content of the traceback request packet and response packet, only the error message about the authentication problem is required, and no additional equipment is required. Content, so if a hacker wants to use this backtracking (B ack T race) mechanism to invade the network, because the hacker can only understand the problematic device and related error messages from the contents of these packets, therefore ' Hackers could not use the retrospective tracking mechanism to 'learn more about the tribute' 'and could not perform any acts of sabotage on the network equipment. The above is only one of the preferred embodiments of the present invention. However, the present invention is not limited to this in practice. Anyone familiar with the art can easily think in the field of the present invention. Any changes or modifications shall be covered by the scope of patent application claimed below.

The 550925 diagram on page 17 is briefly explained. The diagram is as follows: Figure 1 shows the connection diagram using area authentication in the traditional multi-layer network equipment architecture. Figure 2 shows the traditional multi-layer network equipment architecture. Schematic diagram of connection using centralized authentication; Fig. 3 illustrates a preferred embodiment of the present invention. In a multi-layer network equipment architecture, a schematic diagram of connection using centralized authentication; Fig. 4 illustrates this embodiment. Content of a traceback response packet returned by each network device;

Figure 5 shows the content of another traceback response packet returned by each network device in this embodiment. Description of drawing numbers of main components:

RADIUS server ... " • R31 first network device ... " • D31 second network device ... " • D32 third network device ... " • D33 first client ... " • S31 Second client ...… S32 Third client ... " • S33 Fourth client ... " • S34 Fifth client ... " • S35 Sixth User end ...… S36 line ••• L30, L31, L32 Λ L33, L34 Λ L35, L36, L37 and L38

Page 18

Claims (1)

550925 ---______ 6. Scope of patent application 1. A method for retroactive tracing. This method is applied to the authentication status hierarchy network equipment architecture in the first-person / people-exhibition equipment architecture, including the second-generation equipment. In the network equipment architecture, the multi-server is used as a centralized authentication-servo server. The RAD I US server is connected to at least one of the outside of the network: f is a multi-level connection method, and is connected to at least one of them. Usage and phase f: each of the network equipment and the backup architecture uses a multi-layer. Less σ. ,, two connections. 'The multi-layer network device end is found unrecognized; agreement packets, so that each use All network devices are required to return to the network in order to recover the protocol packet. "I-,, π month to chase the various network devices in the hierarchical network device architecture" and return to all networks. § · Supply knife > Double, s, and certificate each use honesty, class, and μ8 4 Γ, so they fail to pass the information, and quickly find out the state of the network equipment and the reason for the error. The method described in claim 1 of the patent scope, wherein the agreement contains a Packet, the request packet is sent by each client, through the multi-layer network device architecture, away from the RADIUS server-side lower-layer network device, and transmitted to the RADIUS server-side upper-layer network device. 3 The method as described in item 1 of the scope of patent application, wherein the agreement packet includes a response packet, and the response packet is formed by the multi-layer network device architecture adjacent to the upper-layer network device on the RADIUS server side. The information that the network device is authenticated and failed is sent back to the network device below the RAD 丨 us server end and each of the user ends. 4. The method as described in item 1 of the scope of patent application, where The format of the agreement packet includes: Page 19, 550925 6. Scope of patent application-a block representing the source address of the sending packet;-a field representing the destination address of the packet to be transmitted;-a representative of the system It is a code value field of a request packet or a response packet; and a bit field representing the type of authentication problem, each of which can be defined in advance. The method described in item 1, wherein the format of the agreement packet includes: a field representing the source address of the sending packet; a block representing the destination address of the packet to be transmitted; It is a code value field for requesting or responding to a packet; a length field for text description; and a text description field for authentication issues. 6. As indicated in item 4 or 5 of the scope of patent application. The method described above, wherein the format of the agreement packet further includes: a deep block representing the distance from the source address from which the request packet was sent. 7. The method described in item 4 or 5 of the scope of the patent application, wherein the agreement packet The format also includes: A block to represent the time of arrival of the packet. Page 20