WO2011035514A1

WO2011035514A1 - Tunneling-technique-based tri-element authentication extensible method and system thereof

Info

Publication number: WO2011035514A1
Application number: PCT/CN2009/075647
Authority: WO
Inventors: 肖跃雷; 曹军; 黄振海; 葛莉
Original assignee: 西安西电捷通无线网络通信有限公司
Priority date: 2009-09-22
Filing date: 2009-12-16
Publication date: 2011-03-31
Also published as: CN101662410B; CN101662410A

Abstract

A tunneling-technique-based tri-element authentication extensible method and system thereof are provided by the invention. The method comprises steps as follows: 1) an outer authentication process is executed by an applicant, an authentication access controller and an authentication server, and a safe tunnel between the applicant and the authentication access controller is established; 2) an inner authentication process is executed by the applicant, the authentication access controller and an inner authentication server, wherein the inner tri-element authentication extensible protocol (TAEP) packet between the applicant and the authentication access controller is protected via the safe tunnel established in step 1); 3) the authentication process is ended by the authentication access controller with a success packet or a failure packet of TAEP. The invention provides a tunneling-technique-based tri-element authentication extensible method and system thereof that can increase the applicability of the tunnel TAEP, and enhance the security of the inner authentication process.

Description

Three-dimensional authentication scalable method based on tunnel technology and system thereof

The invention belongs to the technical field of network security, and in particular relates to a ternary authentication scalable method based on tunnel technology and a system thereof. Background technique

The Extensible Authentication Protocol (EAP) is an authentication framework that is used for point-to-point authentication and supports multiple authentication mechanisms. EAP does not specify the authentication method during the link control phase, but defers the process to the authentication phase. This way the discriminator can ask for more information and decide what authentication method to use later. This mechanism allows a "back-end" authentication server to be used to actually perform the authentication mechanism, while the discriminator simply passes the authentication exchange information.

Since EAP is only an authentication framework suitable for point-to-point authentication protocols, EAP is not suitable for implementing three-party authentication protocols, such as: Ternary Peer-to-Peer Authentication Protocol—Identify both parties to implement two-way authentication based on trusted third parties. In order to meet the needs of the three-party authentication protocol, a suitable authentication for the three-party authentication protocol is 11 architecture. Tri-element Authentication Extensible

Protocol, TAEP) is proposed, where the format of the TAEP packet is the same as that of the EAP packet, but the hierarchical model of TAEP is different from EAP. FIG. 1 is a schematic diagram of a format structure of a TAEP packet in the prior art. The format of a TAEP packet is as shown in FIG. 1 , where:

Code field: The Code field is 1 octet in length, indicating the type of TAEP packet:

1, request (Request) grouping

2, response (Response) grouping

3. Success group

4, failure (Failure) grouping

Identifier field: The Identifier field is 1 octet long and is used to match the Request. Grouped with Response.

Length field: The Length field has a length of 2 octets, which indicates the number of octets of the entire TAEP group, that is, the sum of the lengths of all fields including Code, Identifier, Length, and Data.

Data field: The length of the Data field is variable. The group contains 0 or more octets. The format is determined by the value of the Code field. If the value of the Code field is Request or Response, the Data field contains a Type field and a Type-Data field, and the Type field may be an Identity and a TP Authentication. If the value of the Code field is Success or Failure, the Data field does not exist.

2 is a schematic structural diagram of a TAEP multiplexing model in the prior art. The TAEP multiplexing model is shown in FIG. 2, and the steps of TAEP message exchange are as follows:

Step a: The authentication access controller sends a Request packet to the requester to start authentication, and the Request has a Tpye field indicating the type of the request, and the Type field is Identity, indicating the identity;

Step b: The requester sends a Response packet to the authentication access controller to respond to the valid Request. The Response packet includes a Type field corresponding to the Type field in the Request packet, and the Type-Data includes the identity of the peer.

Step c: The authentication access controller sends a Request packet to the authentication server, and the Request has a Type field indicating the type of the request, and the Type is TP Authentication, which is used to request the authentication method type from the authentication server;

Step d: The authentication server sends a Response packet to the authentication access controller, and the Response packet includes a Type field corresponding to the Type field in the Request packet.

Step e: The authentication access controller selects an authentication method to start the authentication process according to the type of the authentication method returned by the authentication server. The Request packet is sent to the requester, and the requester responds to the Response packet to the authentication access controller, and the sequence of Request and Response continues to interact as needed. The authentication access controller sends a Request packet to the authentication server, and the authentication server responds to the authentication access controller with a Response packet. The sequence of this Request and Response will continue to be the required length. Authentication access The controller is responsible for retransmitting the Request packet;

Step f, the conversation continues until the authentication access controller cannot authenticate the requester, the authentication access controller will send the Failure packet to the requester; or the authentication access controller determines that the successful authentication has been completed, authenticates the access controller or stops sending the Request packet. End the message interaction, or send a Success packet to the requester.

Step 0 and step d above are optional. In some cases, when the authentication method is determined or otherwise determined by the authentication method and identity, step c, step d may be selectively performed.

In order to enhance the security of the authentication mechanism or adapt to specific application scenarios, EAP supports tunnel-based EAP authentication methods, such as: Trusted Computing Group (TCG) Trusted Network Connection (Trusted Network Connect) The TNC architecture leverages tunnel EAP to implement the TNC architecture platform authentication protocol. The authentication process for establishing a secure tunnel can be referred to as an external authentication process, and the authentication process within a secure tunnel can be referred to as an internal authentication process. Similarly, TAEP also needs a TAEP authentication method that supports tunneling technology to enhance the security of the ternary authentication mechanism or adapt to specific application scenarios. For example, a trusted network connection architecture based on ternary peer authentication needs to support tunneling technology. The TAEP authentication method is used to implement platform authentication. Therefore, it is necessary to establish a ternary authentication scalable method based on tunnel technology. Summary of the invention

In order to solve the above technical problems in the prior art, the present invention provides a tunnel-based ternary authentication scalable method and system thereof that can increase the applicability of the tunnel TAEP and enhance the security of the intra-authentication process.

The present invention provides a ternary authentication scalable method based on tunneling technology, the method comprising the following steps:

Step 1. The requester, the authentication access controller, and the authentication server perform an external authentication process, and establish a secure tunnel between the requester and the authentication access controller.

Step 2, the requester, the authentication access controller, and the internal authentication server perform an internal authentication process, where The inner TAEP packet between the requester and the authentication access controller is protected by the secure tunnel established in step 1;

Step 3. The authentication access controller ends the authentication process by using TAEP's Success packet or Failure packet.

The specific implementation of step 1 above is:

Step 1.1: The authentication access controller uses the Request packet and the Response packet of the TAEP to obtain the external authentication identity of the requester.

Step 1.2: The authentication access controller uses the Request packet and the Response packet of the TAEP to obtain the authentication method type from the authentication server.

Step 1.3: The authentication access controller selects an authentication method to perform an external authentication process with the requester and the authentication service server, and establishes a secure tunnel between the requester and the authentication access controller.

The specific implementation of step 1.1 above is:

Step 1.1.1: The authentication access controller sends a request packet of the TAEP to the requester, where the value of the Type field is Identity;

Step 1.1.2: The requester sends a TAEP Response packet to the authentication access controller, where

The Type field corresponds to the Type field in the Request packet of TAEP in step 1.1.1, and the Type-Data contains the external authentication identity of the requester.

The specific implementation of step 1.2 above is:

Step 1.2.1: The authentication access controller sends a TAEP Request packet to the authentication server, where the value of the Type field is TP Authentication, and the Type-Data includes the external authentication identity of the requester and the authentication access controller.

Step 1.2.2: The authentication server sends a TAEP Response packet to the authentication access controller, where the Type field corresponds to the Type field in the TAEP Request packet in step 1.2.1, and the Type-Data includes the authentication method type.

The specific implementation manner of the foregoing step 1.3 is: identifying a request packet and a Response packet between the access controller and the requester, and between the authentication access controller and the authentication server, and interacting with the authentication server. Until the security tunnel between the requester and the authentication access controller is established, where the Type field is the authentication method selected by the authentication access controller in step 1.3, the Type-Data includes the authentication protocol message corresponding to the value of the Type field.

The specific implementation of step 2 above is:

Step 2.1: The authentication access controller uses the Request packet and the Response packet of the TAEP to obtain the internal identity of the requester.

Step 2.2: The authentication access controller uses the Request packet and the Response packet of the TAEP to obtain the authentication method type from the internal authentication server.

Step 2.3: The authentication access controller selects an authentication method and performs an internal authentication process with the requester and the internal authentication server.

The specific implementation of step 2.1 above is:

Step 2.1.1 The authentication access controller sends a TAEP Request packet to the requester, where the value of the Type field is the authentication method selected by the authentication access controller in step 1.3, and the value of the Type-Data field is the inner TAEP packet, and the inner TAEP packet. The value of the Code field is Request, and the value of the Type field is Identity. Step 2.1.2. The requester sends a Response packet of the TAEP to the authentication access controller, where the Type field corresponds to the Type field in the Request packet of the TAEP in step 2.1.1. The value of the Type-Data field is the inner TAEP packet, the value of the Code field of the inner TAEP packet is Response, the Type field corresponds to the Type field in the Request packet of the TAEP packet in step 2.1.1, and the Type-Data field contains the requester's Identify identity internally.

The specific implementation of step 2.2 above is:

Step 2.2.1: The authentication access controller sends a TAEP Request packet to the internal authentication server, where the value of the Type field is TP Authentication, and the Type-Data includes the internal authentication identity of the requester and the authentication access controller.

Step 2.2.2, the internal authentication server sends a Response packet of the TAEP to the authentication access controller, where the Type field corresponds to the Type field in the Request packet of the TAEP in step 2.2.1, and the Type-Data includes the authentication method type. The specific implementation manner of the foregoing step 2.3 is: authenticating a request packet and a Response packet between the access controller and the requester, and between the authentication access controller and the internal authentication server, until the internal authentication process is completed. For a series of TAEP Request packets and Response packets for authenticating the interaction between the access controller and the requester, wherein the value of the Type field is the authentication method selected by the authentication access controller in step 1.3, and the value of the Type-Data field is the inner TAEP packet. . The value of the Type field of the inner TAEP packet is the authentication method selected by the authentication access controller in step 2.3, and the Type-Data field contains the authentication protocol message corresponding to the value of the Type field; for the interaction between the authentication access controller and the internal authentication server A series of TAEP Request packets and Response packets, where the value of the Type field is the authentication method selected by the authentication access controller in step 2.3, and the Type-Data field contains the authentication protocol message corresponding to the value of the Type field.

The specific implementation of step 3 above is:

Step 3.1: If the access controller successfully authenticates the requester during the internal authentication process in step 2.3, sending a success packet of the TAEP to the requester;

Step 3.2: If the authentication access controller fails to authenticate the requester during the internal authentication process in step 2.3, the TAEP Failure packet is sent to the requester.

The present invention provides a tunneling-based ternary authentication scalable system, the tunneling-based ternary authentication scalable system including a requester, an authentication access controller, an authentication server, and an internal authentication server; The authentication server and the internal authentication server are respectively connected to the authentication access controller through the TAEP; the requester, the authentication access controller, and the authentication server perform an external authentication process, establishing a secure tunnel between the requester and the authentication access controller; The authentication access controller and the internal authentication server perform an internal authentication process.

The advantages of the invention are:

1. The applicability of TAEP in the tunnel can be increased. The data transmitted by the invention in the security tunnel is an inner TAEP packet, which can support multiple internal authentication mechanisms, and increases the applicability of the tunnel TAEP;

2. It can enhance the security of the internal authentication process. The invention protects the inner TAEP packet between the requester and the authentication access controller by a secure tunnel established by the external authentication process, and can provide an internal authentication identity protection. Protection, thereby enhancing the security of the internal authentication process;

3. The present invention enables a requester and an authentication access controller to implement multiple TAEP authentication methods in a TAEP authentication session, which can be applied to an access control method based on ternary peer authentication. DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, a brief description of the drawings used in the embodiments or the prior art description will be briefly described below. Obviously, the drawings in the following description It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any inventive labor.

1 is a schematic diagram showing the format of a TAEP packet in the prior art;

2 is a schematic structural diagram of a TAEP multiplexing model in the prior art;

FIG. 3 is a schematic structural diagram of a tunneling-based ternary authentication scalable method referred to in the present invention. detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is a partial embodiment of the invention, and not all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

FIG. 3 is a schematic structural diagram of a tunneling-based ternary authentication scalable method according to the present invention. Referring to FIG. 3, the present invention provides a ternary authentication scalable method based on tunnel technology, and the specific steps are as follows:

Step 1. The requester, the authentication access controller, and the authentication server perform an external authentication process, and establish a secure tunnel between the requester and the authentication access controller, such as: they perform a user authentication process and establish a requester and an authentication access controller. Session key Step 1.1: The authentication access controller uses the TAEP Request packet and the Response packet to obtain the requester's external authentication identity, such as: user identity;

Step 1.1.2: The requester sends a TAEP Response packet to the authentication access controller, where the Type field corresponds to the Type field in the TAEP Request packet in Step 1.1.1, and the Type-Data includes the requester's external authentication identity;

Step 1.1 above is an optional step. If the authentication access controller is aware of the requester's external authentication identity, then step 1.1 is not required.

Step 1.2: The authentication access controller uses the Request packet and the Response packet of the TAEP to obtain the authentication method type from the authentication server, such as: a certificate-based WAI protocol in the Chinese WLAN standard or a WAI protocol based on a pre-shared key;

After the headquarters 1.2.1, the authentication access controller sends a TAEP Request packet to the authentication server, wherein the value of the Type field is TP Authentication, and the Type-Data includes the external authentication identity of the requester and the authentication access controller;

Step 1.2 above is an optional step. If the authentication access controller has been configured with a specific authentication method, then step 1.2 is not required.

Step 1.3: The authentication access controller selects an authentication method to perform an external authentication process with the requester and the authentication service server, and establishes a secure tunnel between the requester and the authentication access controller, such as: performing certificate-based WAI in the Chinese WLAN standard. Protocol or WAI protocol based on pre-shared key; etc.; Step 1.3.1, between the authentication access controller and the requester, between the authentication access controller and the authentication server, a series of TAEP Request packets and Response packets are exchanged until the request is established. And the secure tunnel between the authentication access controller, where the Type field is the authentication access controller selected in step 1.3. In the authentication method, Type-Data includes an authentication protocol message corresponding to the value of the Type field; Step 2, the requester, the authentication access controller, and the internal authentication server perform an internal authentication process, such as: they execute a platform authentication protocol, where the requester And the internal TAEP packet between the authentication access controller is protected by the secure tunnel established in step 1;

Step 2.1.1: The authentication access controller sends a TAEP Request packet to the requester, where the value of the Type field is the authentication method selected by the authentication access controller in step 1.3, and the value of the Type-Data field is the inner TAEP packet. The value of the Code field of the inner TAEP packet is Request, and the value of the Type field is Identity. Step 2.1.2: The requester sends a TAEP Response packet to the authentication access controller, where

The Type field corresponds to the Type field in the Request packet of TAEP in step 2.1.1, and the value of the Type-Data field is the inner TAEP packet. The value of the Code field of the inner TAEP packet is Response, and the Type field corresponds to the Type field in the Request packet of the TAEP packet in step 2.1.1, and the Type-Data field contains the internal authentication identity of the requester;

Step 2.1 above is an optional step.

Step 2.2.2: The internal authentication server sends a TAEP Response packet to the authentication access controller, where the Type field corresponds to the Type field in the TAEP Request packet in Step 2.2.1, and the Type-Data includes the authentication method type.

The Type-Data in the above step 2.2.2 may further include an authentication policy of the authentication method, for example, the internal authentication server includes a platform authentication policy in the Type-Data of the step, and is used to deliver a platform authentication policy to the authentication access controller. . Step 2.2 above is an optional step. If the authentication access controller has configured a specific authentication method and authentication policy for the internal authentication process, step 2.2 is not required.

Step 2.3: The authentication access controller selects an authentication method to perform an internal authentication process with the requester and the internal authentication server, such as: they execute a platform authentication protocol;

Step 2.3.1: The authentication access controller and the requester, the authentication access controller and the internal authentication server exchange a series of TAEP Request packets and Response packets until the internal authentication process is completed. For a series of TAEP Request packets and Response packets for authenticating the interaction between the access controller and the requester, where the value of the Type field is the authentication method selected by the authentication access controller in step 1.3, and the value of the Type-Data field is the inner TAEP packet. . The value of the Type field of the inner TAEP packet is the authentication method selected by the authentication access controller in step 2.3, and the Type-Data field contains the authentication protocol message corresponding to the value of the Type field; for the interaction between the authentication access controller and the internal authentication server A series of TAEP Request packets and Response packets, where the value of the Type field is the authentication method selected by the authentication access controller in step 2.3, and the Type-Data field contains the authentication protocol message corresponding to the value of the Type field.

Step 3. The authentication access controller ends the authentication process by using the TAEP Success packet or the Failure packet;

The present invention provides a ternary authentication scalable method based on tunnel technology, and provides a ternary authentication scalable system based on tunnel technology, the system includes a requester, an authentication access controller, an authentication server, and an internal The authentication server; the requester, the authentication server, and the internal authentication server are respectively connected to the authentication access controller through the TAEP; the requester, the authentication access controller, and the authentication server perform an external authentication process, and establish a secure tunnel between the requester and the authentication access controller. The requester, the authentication access controller, and the internal authentication server perform an internal authentication process. The requester, the authentication access controller, and the authentication server perform an external authentication process, establishing a relationship between the requester and the authentication access controller Secure tunnels, such as: They perform a user authentication process and establish a session key between the requester and the authentication access controller, wherein the authentication server may not participate in the external authentication process. The requester, the authentication access controller, and the internal authentication server perform an internal authentication process, such as: they execute a platform authentication protocol, wherein the value of the Type field of the TAEP packet transmitted between the access controller and the internal authentication server is identified as an internal authentication process method, The value of the Type-Data field is an intra-authentication process message, and the Type field of the TAEP packet transmitted between the requester and the authentication access controller is an external authentication process method, the Type-Data field is an inner TAEP packet, and the Type field of the inner TAEP packet is The value is the internal authentication process method, and the value of the Type-Data field is the internal authentication process message.

It should be noted that the above embodiments are only for explaining the technical solutions of the present invention, and are not intended to be limiting; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those skilled in the art that: The technical solutions described in the foregoing embodiments are modified, or some of the technical features are equivalently replaced. The modifications and substitutions do not depart from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

Rights request

A ternary authentication scalable method based on tunneling technology, characterized in that: the method comprises the following steps:

Step 2: The requester, the authentication access controller, and the internal authentication server perform an internal authentication process, wherein the inner ternary authentication scalable protocol package between the requester and the authentication access controller is protected by using the secure tunnel established in step 1. ;

Step 3. The authentication access controller uses the ternary authentication scalable protocol to successfully packet or fail the packet to end the authentication process.

The tunneling technology-based ternary authentication scalable method according to claim 1, wherein: the specific implementation manner of the step 1 is:

Step 1.1: The authentication access controller uses the request packet and the response packet of the ternary authentication scalable protocol to obtain the external authentication identity of the requester;

Step 1.2: The authentication access controller uses the request packet and the response packet of the ternary authentication scalable protocol to obtain the authentication method type from the authentication server;

The tunneling technology-based ternary authentication scalable method according to claim 2, wherein: the specific implementation manner of the step 1.1 is:

Step 1: 1. The authentication access controller sends a request packet of the ternary authentication scalable protocol to the requester, where the value of the type field is an identity;

Step 1: 2. The requester sends a response packet of the ternary authentication scalable protocol to the authentication access controller, where the type field corresponds to the type field in the request packet of the ternary authentication scalable protocol in step 1.1.1, where the type The data field contains the external authentication identity of the requester.

4. The tunneling-based ternary authentication scalable method according to claim 3, characterized in that The specific implementation manner of the step 1.2 is as follows:

Step 1.2.1: The authentication access controller sends a request packet of the ternary authentication scalable protocol to the authentication server, where the value of the type field is a third-party authentication, where the type data field includes the requester and the authentication access controller. Identification of identity;

Step 1.2.2, the authentication server sends a response packet of the ternary authentication scalable protocol to the authentication access controller, where the type field corresponds to the type field in the request packet of the ternary authentication scalable protocol in step 1.2.1, where the type The data field contains the authentication method type.

The tunneling technology-based ternary authentication scalable method according to claim 4, wherein: the specific implementation manner of the step 1.3 is: authenticating between the access controller and the requester, authenticating the access controller, and authenticating The server interacts with a series of ternary authentication scalable request packets and acknowledgment packets until a secure tunnel between the requester and the authentication access controller is established, wherein the type field is the authentication method selected by the authentication access controller in step 1.3. , wherein the type data field contains an authentication protocol message corresponding to the value of the type field.

The tunneling technology-based ternary authentication scalable method according to claim 1 or 2 or 3 or 4 or 5, wherein: the specific implementation manner of the step 2 is:

Step 2.1: The authentication access controller uses the request packet and the response packet of the ternary authentication scalable protocol to obtain the internal identity of the requester;

Step 2.2: The authentication access controller uses the request packet and the response packet of the ternary authentication scalable protocol to obtain the authentication method type from the internal authentication server;

The tunneling technology-based ternary authentication scalable method according to claim 6, wherein: the specific implementation manner of the step 2.1 is:

Step 2.1.1, the authentication access controller sends a request packet of the ternary authentication scalable protocol to the requester, where the value of the type field is the authentication method selected by the authentication access controller in step 1.3, wherein the value of the type data field is Internal ternary authentication scalable protocol packet, inner ternary authentication scalable protocol packet The value of the code field is the request, where the value of the type field is the identity;

Step 2.1.2. The requester sends a response packet of the ternary authentication scalable protocol to the authentication access controller, where the type field corresponds to the type field, the type data field in the request packet of the ternary authentication scalable protocol in step 2.1.1. The value of the inner ternary authentication scalable protocol packet, the value of the code field of the inner ternary authentication scalable protocol packet is a response, and the type field of the inner ternary authentication scalable protocol packet corresponds to the ternary authentication in step 2丄1. The type field in the request packet of the extended protocol packet, and the type data field of the inner ternary authentication scalable protocol packet contains the requester's internal authentication identity.

The tunnel technology-based ternary authentication scalable method according to claim 7, wherein: the specific implementation manner of the step 2.2 is:

Step 2.2.1: The authentication access controller sends a request packet of the ternary authentication scalable protocol to the inward authentication server, where the value of the type field is a third party authentication, where the type data field includes the requester and the authentication access controller. Identification of identity;

Step 2.2.2, the internal authentication server sends a response packet of the ternary authentication scalable protocol to the authentication access controller, where the type field corresponds to the type field in the request packet of the ternary authentication scalable protocol in step 2.2.1, wherein the type The data field contains the authentication method type.

The tunneling technology-based ternary authentication scalable method according to claim 8, wherein: the specific implementation manner of the step 2.3 is: authenticating between the access controller and the requester, authenticating the access controller and the internal The authentication server interacts with a series of ternary authentication scalable request packets and acknowledgment packets until the internal authentication process is completed; a request packet and a series of ternary authentication scalable protocols for authenticating the interaction between the access controller and the requester a response packet, wherein the value of the type field is an authentication method selected by the authentication access controller in step 1.3, wherein the value of the type data field is an inner ternary authentication scalable protocol packet; the type field of the inner ternary authentication scalable protocol packet The value is the authentication method selected by the authentication access controller in step 2.3, and the type data field of the inner ternary authentication scalable protocol packet includes an authentication protocol message corresponding to the value of the type field; for the authentication access controller and the internal authentication server Interacting a series of ternary authentication scalable request packets and acknowledgment packets, The value of the type field is the authentication method selected by the authentication access controller in step 2.3, and the number of types According to the authentication protocol message corresponding to the value of the type field in the field.

The tunneling technology-based ternary authentication scalable method according to claim 9, wherein: the specific implementation manner of the step 3 is:

Step 3.1: If the access controller successfully authenticates the requester during the internal authentication process in step 2.3, sending a successful packet of the ternary authentication scalable protocol to the requester;

Step 3.2: If the authentication access controller fails to authenticate the requester during the internal authentication process in step 2.3, the failure packet of the ternary authentication scalable protocol is sent to the requester.

11. A ternary authentication scalable system based on tunneling technology, characterized in that: the tunneling-based ternary authentication scalable system comprises a requester, an authentication access controller, an authentication server, and an internal authentication server; And the authentication server and the internal authentication server are respectively connected to the authentication access controller by a ternary authentication scalable protocol; the requester, the authentication access controller and the authentication server perform an external authentication process, establishing a requester and the authentication access A secure tunnel between the controllers; the requester, the authentication access controller, and the internal authentication server perform an internal authentication process.