WO2011107013A1 - 设备间安全接入方法和通信设备 - Google Patents

设备间安全接入方法和通信设备 Download PDF

Info

Publication number
WO2011107013A1
WO2011107013A1 PCT/CN2011/071223 CN2011071223W WO2011107013A1 WO 2011107013 A1 WO2011107013 A1 WO 2011107013A1 CN 2011071223 W CN2011071223 W CN 2011071223W WO 2011107013 A1 WO2011107013 A1 WO 2011107013A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication information
service
access authentication
access
channel
Prior art date
Application number
PCT/CN2011/071223
Other languages
English (en)
French (fr)
Inventor
袁乐林
闫帅
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP11750166.8A priority Critical patent/EP2544397B1/en
Publication of WO2011107013A1 publication Critical patent/WO2011107013A1/zh
Priority to US13/598,236 priority patent/US8826404B2/en

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/18—Network architectures or network communication protocols for network security using different networks or channels, e.g. using out of band channels
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3215—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a plurality of channels

Definitions

  • the present invention relates to the field of communication technologies, and in particular, to a method and a communication device for secure access between devices. Background technique
  • a service plan is divided into relatively independent service nodes according to service functions, and deployed on different physical nodes of the same network, and each node interacts to complete service flow processing.
  • Distributed systems are widely used in blade-based solutions, such as the large number of distributed systems in telecom products based on the Advanced Telecommunications System (ATCA).
  • ATCA Advanced Telecommunications System
  • Access authentication between nodes in a distributed system, that is, between hosts, is a security issue that cannot be ignored.
  • the access authentication control between hosts usually adopts a password authentication mechanism.
  • the source host initiates an access request carrying the account and password information to the target host through the service network; the target host receives the access request, and matches the access account and password with the legal account and password stored locally by the target host, if the matching succeeds Provide the service to the source host, otherwise reject the access request.
  • the inventor finds that the inter-host access mechanism of the prior art transmits an access request including key information such as a password through the service network, and the service network is an open network, which makes key information such as passwords easy to be sniffed.
  • the probe tool detects and cracks, which reduces the reliability of key information such as passwords, thereby reducing the security of access between hosts. Summary of the invention
  • the embodiments of the present invention provide a secure access method between devices and a communication device, which are used to improve the security of access between devices in a tree-connected distributed system.
  • An embodiment of the present invention provides a method for securely accessing between devices, including: obtaining access authentication information by using an outband channel, where the access authentication information is used for access authentication between a service requesting device and a service providing device.
  • the service requesting device and the service providing device share the same management device, and respectively form the outband channel with the management device;
  • the service providing device And authenticating the access authentication information, and when the authentication result indicates that the access authentication information is successfully authenticated, the service providing device provides a service to the service requesting device by using an inband data channel, where the service providing device And the service requesting device forms the in-band data channel via a service network.
  • the embodiment of the invention further provides a communication device, including:
  • An obtaining module configured to obtain access authentication information by using an outband channel, where the access authentication information is used for access authentication between the service requesting device and the service providing device, where the service requesting device and the service providing device share the same Administering the device, and separately forming the pair of channels with the management device;
  • An authentication module configured to authenticate the access authentication information, and when the authentication result indicates that the access authentication information is successfully authenticated, the service providing device provides a service for the service requesting device by using an inband data channel, The service providing device and the service requesting device form the in-band data channel via a service network.
  • the communication channels of the service switching and the access authentication are isolated from each other, and the service data is transmitted by using an in-band data channel, and the access authentication information required for access authentication is transmitted by using an outband channel. Since the access authentication information required for the authentication does not need to go through the external service network, the probability that the access authentication information is intercepted or falsified during the transmission process is reduced, and the reliability of the access authentication information transmission is improved, thereby improving the reliability. Security of access between devices in a tree-connected distributed system.
  • FIG. 1 is a flowchart of a method for securely connecting devices according to a first embodiment of the present invention
  • FIG. 2 is a schematic diagram of a distributed system structure of a tree connection in an application scenario according to an embodiment of the present invention
  • FIG. 3 is a schematic structural diagram of a distributed system based on a blade server in an application scenario according to an embodiment of the present disclosure
  • FIG. 4 is a flowchart of a method for securely accessing devices between devices according to a second embodiment of the present invention
  • FIG. 5 is a flowchart of a method for securely accessing devices between devices according to a third embodiment of the present invention
  • FIG. 8 is a schematic structural diagram of a communication device according to a sixth embodiment of the present invention
  • FIG. 8 is a schematic structural diagram of a communication device according to a sixth embodiment of the present invention.
  • FIG. 1 is a flowchart of a method for securely connecting devices according to a first embodiment of the present invention. As shown in Figure 1, the secure access method between devices in this embodiment includes:
  • Step 11 Obtain access authentication information by using an outband channel, where the access authentication information is used for access authentication between the service requesting device and the service providing device, where the service requesting device and the service providing device share the same management device And forming the out-of-band channel with the management device respectively.
  • the service request device and the service providing device are connected to the same management device, and the management device is The unified management of the line, such that the service requesting device, the service providing device, and the management device form a distributed system of tree connections, the management device can serve as a root node, and the service requesting device and the service providing device respectively serve as child nodes.
  • the networking mode can be divided into Out-Band Networking and In-Band Networking.
  • the Ethernet network uses the communication channel provided by other devices instead of the communication channel provided by the management device itself to transmit network management information and perform network device management.
  • the inband network uses the service channel provided by the managed device to manage the network device. In this networking mode, the NMS information is transmitted through the service channel of the device.
  • the outband networking can provide a more reliable device management channel. If the managed device fails, it can still locate and monitor the network device in real time.
  • the channel used to transmit data during out-of-band networking is called Out-Band Channe l; the channel used to transmit data in the in-band network is called in-band data channel (In-Band Da ta Channe l) )
  • FIG. 2 is a schematic diagram of a distributed system structure of a tree connection in an application scenario according to an embodiment of the present invention.
  • the service requesting device and the service providing device respectively can be a separate system mainboard, and the service requesting device and the service providing device are physically connected to the same management device through a hardware interface to form an outband channel, as shown by the dotted line in the figure.
  • the service network access to the service network through the network interface, forming an in-band data channel, as shown by the solid line in the figure.
  • the traffic is transmitted through the in-band channel but not through the out-of-band channel.
  • the service requesting device, the service providing device, the out-of-band channel, and the management device are equivalent to forming an "access authentication system", and the service requesting device, the service providing device, and the in-band data channel are equivalent to form a "service switching system.”
  • Access authentication between devices is implemented in the access authentication system, and service data exchange between devices is implemented in the service switching system.
  • the specific application environment of the tree-connected distributed system shown in FIG. 2 is not limited, for example, it can be applied to a distributed system based on a blade server, or can also be applied to a distributed system of a slot-connected switch. , or a class-like blade server distributed system with a physical tree connection structure.
  • Step 12 Authenticate the access authentication information, and the authentication result indicates the access
  • the service providing device provides a service to the service requesting device by using an in-band data channel, and the service providing device and the service requesting device form the in-band data channel via a service network.
  • the communication channels of the service switching and the access authentication are isolated from each other, and the service data is transmitted by using the inband data channel, and the access authentication information required for access authentication is transmitted by using an outband channel. Since the access authentication information required for authentication does not need to go through an external service network, the probability that the access authentication information is intercepted or falsified during the transmission process is reduced, the reliability of the access authentication information transmission is improved, and the tree is improved. The security of access between devices in a distributed system. The entire implementation process of the embodiment of the present invention does not require manual intervention, so that security risks caused by manual intervention can be avoided.
  • FIG. 3 is a schematic structural diagram of a distributed system based on a blade server in an application scenario according to an embodiment of the present invention.
  • the blade server shown in Figure 3 is a low-cost server platform with high availability (High Ava i labi ty Hi gh Dens ty). Its main advantage is that it can save the space and cost of the server, and can Provide users with flexible, portable extensions and upgrades.
  • Each blade on a blade server is actually a business motherboard.
  • Each of the service boards has an onboard controller, and the onboard controllers of the different service boards are respectively connected to the chassis management board.
  • the onboard controllers of the different service boards and the chassis management board respectively adopt the intelligent platform management bus ( The Inte lli gent P la tform Management BUS (IPMB) connection, which forms the IPMB hardware management channel in the blade server.
  • IPMB Intelligent platform management bus
  • Hardware management such as power-on, power-off, reset, alarm, and monitoring of the blade server can be realized through the hardware management channel.
  • the hardware management channel is a built-in channel of the blade server. The channel does not need to transmit through the service network, does not transmit the service data stream, and is physically isolated from the service network.
  • the hosts set on each service board of the blade server are respectively connected to the service network through the network card, so that the communication channels are formed between the hosts of the blade server, and the communication channel can transmit the service data stream through the service network.
  • each blade service is provided with a service host and an onboard controller, and the same blade service.
  • the service host and the onboard controller communicate with each other through a private interface.
  • the service requesting device and the service providing device in the embodiment of the present invention are the blade servers inserted in different slots of the blade server.
  • the management device in the embodiment of the present invention is the chassis management board.
  • the in-band data channel of the embodiment of the present invention is a service data stream transmission channel formed by a host on a different service main board connected to the service network by using a network card.
  • the outband channel according to the embodiment of the present invention is a service board of each service.
  • the onboard controller is on the bus, such as through the intelligent platform management bus
  • IPMB Intelligent Platform Management BUS
  • the blade server A is provided with a blade server A and a blade server B.
  • the blade server A is provided with a service host A (hereinafter referred to as a host A) and an onboard controller A, a blade.
  • the service server B is provided with a service host B (hereinafter referred to as a host B) and an onboard controller B.
  • Host A and onboard controller A communicate based on the private interface, and host B and onboard controller B also communicate based on the private interface.
  • the host A and the host B transmit the service data through the inband data channel and the service network.
  • the onboard controller A and the onboard controller B pass the IPMB outband channel and transmit the access authentication information through the chassis management board. .
  • blade server-based distributed system shown in FIG. 3 is used as an application scenario, and the technical solution for implementing secure access between devices in the embodiment of the present invention is described in detail.
  • FIG. 4 is a flowchart of a method for securely connecting devices according to a second embodiment of the present invention.
  • the access authentication information is a service requesting device, that is, a random access code generated by the host A, and the validity authentication of the random access code is completed by the service requesting device, that is, the host A.
  • this embodiment includes:
  • Step 31 Host A generates and stores a random access code before Host A requests access to Host B.
  • Step 32 The host A generates a service request, and sends the service request to the host B through the in-band data channel, where the service request carries the location information and the random access code, where the location information may be the host A in the blade server.
  • Logical location such as the chassis number and slot number of host A Wait.
  • Host A sends the service request path to Host B through the inband channel, for example: Host A ⁇ Service Network ⁇ Host B.
  • Step 33 The host B sends an authentication request to the chassis management board through the outband channel.
  • the authentication request carries the location information of the host A and the random access code, and is used to request the chassis management board to instruct the host A to legalize the random access code. Sexual certification.
  • host B can be pre-defined to allow access to the host information.
  • the host B When receiving the service request, the host B first determines whether the host A corresponding to the location information in the service request is a host that is allowed to be accessed by default, and if yes, sends an authentication request to the chassis management board through the outband channel; otherwise, Reject host A's service request and end this process (not shown).
  • the advantage of this processing is that Host B can guarantee the access of the host that is allowed to access in advance, and reject the undefined host access, thereby further improving the security of the access.
  • the path for the host B to send an authentication request to the chassis management board through the outband channel is as follows: Host B ⁇ Onboard controller B ⁇ Chassis management board.
  • Step 34 The chassis management board sends an authentication indication to the host A through the outband channel.
  • the authentication indicator carries a random access code, which is used to indicate that the host A authenticates the random access code.
  • chassis management board sends the authentication indication to host A through the outband channel.
  • Step 35 Host A receives the authentication indication and performs legality authentication on the random access code in the authentication indication.
  • the host A can compare the random access code carried in the authentication indication with the random access code of the host A.
  • Step 36 Host A sends the authentication result to host B through the outband channel.
  • the path that host A sends the authentication result to host B through the outband channel for example: host A ⁇ board controller A ⁇ frame management board ⁇ board controller B ⁇ host B.
  • Step 37 The host B receives the authentication result of the host A through the outband channel, and determines whether to provide the service to the host A according to the authentication result: If the authentication result indicates that the random access code authentication is successful, the host B provides the host A through the inband data channel. Service; If the authentication result indicates that the random access code authentication fails, Host B refuses to provide the service to Host A.
  • the path that Host B provides to Host A through the in-band data channel is, for example, Host B ⁇ Service Network ⁇ Host A.
  • the device responsible for generating the random access code in this embodiment, is the host A, which can generate a random access code with high complexity.
  • the complex random access code generation mechanism is also applicable to the embodiments corresponding to the following FIG. 5 to FIG. 7, and will not be described again.
  • the device responsible for the random access code legality authentication is the host A, and the validity period of the random access code may be preset. For example, if the lifetime of the random access code is set to 30 seconds, the random access code is valid within 30 seconds from the time when the random access code is generated, and if it exceeds 30 seconds, the random access code is invalid.
  • the device responsible for the random access code legality authentication is the host A. Before performing the random access code authentication, it is first determined whether the random access code is valid, such as calculating the random access code generation time and the re-acquisition time. If the duration is less than the preset validity period, the random access code is valid, and the validity of the random access code is authenticated.
  • the random access code is invalid, and the random access code may be directly determined. Access code legality authentication failed. The longer the random access code survives, the higher the risk of being cracked, tampered with or intercepted.
  • the device responsible for the random access code controls the validity period of the random access code, which can reduce the risk, improve the reliability of the random access code, and improve the security of access between devices.
  • the random access code validity period control mechanism is also applicable to the corresponding embodiments in FIG. 4 to FIG. 6 below, and details are not described herein again.
  • host A and host B may be based on a long connection mechanism, such as a session (Se ssi on ) or a socket (Socke t ) long connection mechanism. Maintain the validity of the connection between Host A and Host B without multiple access authentication. Because the access authentication system is used for access authentication, while improving the security of access authentication, the access authentication efficiency may be reduced to some extent, and the introduction of a long connection mechanism is beneficial to ensure the validity of the connection, thereby improving communication efficiency. That is, an effective balance between security and communication efficiency.
  • a long connection mechanism such as a session (Se ssi on ) or a socket (Socke t ) long connection mechanism.
  • connection between the host A and the host B is invalid due to the disconnection of the long connection, such as the session timeout or the disconnection of the socket, if the host A needs to initiate a service request to the host B, the foregoing may be based on the embodiment.
  • the process can be used for access authentication between hosts, and will not be described here.
  • the long connection mechanism is also applicable to the corresponding embodiments in FIG. 5 to FIG. 7 below, and details are not described herein again.
  • the service requesting device that is, the host A generates a random access code, and sends the random access code to the service providing host through the outband channel. That is, when the host B is transmitted again to the host A through the outband channel, the host A authenticates the random access code. If the authentication is successful, host B provides service to host A through the in-band data channel. Therefore, in this embodiment, the communication channels of the service switching and the access authentication are isolated from each other, and the service data is transmitted by using an inband data channel, and the access authentication information is transmitted by using an outband channel, which does not need to pass through the service network, thereby reducing access. The probability that the authentication information is intercepted or tampered with during transmission increases the reliability of access authentication information transmission, thereby improving the security of access between devices in a tree-connected distributed system.
  • FIG. 5 is a flowchart of a method for securely connecting devices according to a third embodiment of the present invention.
  • the access authentication information is a service providing device, that is, a random access code generated by the host B, and the validity authentication of the random access code is completed by the service providing device, that is, the host B.
  • this embodiment includes:
  • Step 41 Before the host A requests to access the host B, the host A sends an access code acquisition request to the chassis management board through the outband channel.
  • the access code acquisition request carries the service providing device, that is, the location information of the host B.
  • the path that the host A sends the access code acquisition request to the chassis management board through the outband channel is as follows: Host A ⁇ board controller A ⁇ rack management board.
  • Step 42 The chassis management board sends an access code generation request to the host B pointed to by the location information through the outband channel, where the access code generation request carries the location information of the host A.
  • chassis management board sends an access code generation request to host B through the outband channel.
  • Step 43 Host B generates and saves a random access code.
  • host B can be pre-defined to allow access to the host information.
  • the host B receives the access code generation request, it first determines whether the host A corresponding to the location information in the access code generation request is a host that is allowed to access, and if so, generates and stores a random access code; otherwise, rejects the host.
  • a service request end this process (not shown).
  • the advantage of this processing is that Host B can guarantee the access of the host that is allowed to access in advance, and reject the undefined host access, thereby further improving the security of the access.
  • Step 44 Host B sends the generated random access code to the chassis management board through the outband channel.
  • Host B sends the random access code path to the chassis management board through the outband channel.
  • host B ⁇ onboard controller B ⁇ chassis management board.
  • Step 45 The chassis management board sends a random access code generated by host B to host A through the outband channel.
  • the path of the chassis management board to send random access codes to host A through the outband channel is as follows: Chassis Management Board ⁇ Onboard Controller A ⁇ Host A.
  • Step 46 Host A receives the random access code and generates a service request, and sends a service request to the host B through the outband channel, where the service request carries the service request device, that is, the location information of the host A and the random access received by the host A. code.
  • host A sends a service request to host B through the out-of-band channel, for example: host A ⁇ board controller A ⁇ frame management board ⁇ board controller B ⁇ host B.
  • Step 47 Host B performs legality authentication on the random access code in the service request, and is in the right When the random access code authentication succeeds, the host A is served through the in-band data channel.
  • the path that Host B provides to Host A through the in-band data channel is, for example, Host B ⁇ Service Network ⁇ Host A.
  • the service providing device that is, the host B requests the access service request device, that is, the host A generates a random access code
  • the random access code is sent to the host A through the outband channel, and is sent by the host A to the host B through the outband channel, and the host B authenticates the random access code. If the authentication is successful, Host B serves Host A through the in-band data channel. Therefore, in this embodiment, the communication channels of the service switching and the access authentication are isolated from each other, and the service data is transmitted by using an inband data channel, and the access authentication information is transmitted by using an outband channel, which does not need to pass through the service network, thereby reducing access. The probability that the authentication information is intercepted or tampered with during transmission increases the reliability of access authentication information transmission, thereby improving the security of access between devices in a tree-connected distributed system.
  • FIG. 6 is a flowchart of a method for securely connecting devices according to a fourth embodiment of the present invention.
  • the access authentication information is a service providing device, that is, a random access code generated by the host A, and the legality authentication of the random access code is completed by the service providing device, that is, the host B.
  • this embodiment includes:
  • Step 51 Host A generates and stores a random access code before Host A requests access to Host B.
  • Step 52 The host A generates a preparation service request, and sends the preparation service request to the host B through the outband channel, where the preparation service request carries a random access code.
  • Host A sends the path to prepare the service request to host B through the outband channel.
  • Host A Onboard controller A ⁇ Chassis management board ⁇ Onboard controller B ⁇ Host B.
  • Step 53 Host B receives the preparation service request and temporarily saves the random access code carried in the preparation service request.
  • the host information that is allowed to be accessed may be pre-defined on the host B.
  • host B receives When the service request is prepared, it is first determined whether the host A corresponding to the location information in the access code generation request is a host that is allowed to access, and if yes, the random access code is saved, and step 54 is performed; otherwise, the service request of the host A is rejected. , End this process (not shown).
  • the advantage of this processing is that the host B can guarantee the access of the host that is allowed to access in advance, and reject the undefined host access, thereby further improving the security of the access.
  • Step 54 Host B sends processing completion information to host A through the outband channel.
  • the processing completion information is used to notify host A that the random access code has been saved on host B.
  • Host B sends the processing completion information to the host A through the outband channel.
  • Host B Onboard controller B ⁇ Chassis management board ⁇ Onboard controller A ⁇ Host A.
  • Step 55 Host A sends a service request to Host B through the inband data channel, and the service request carries a random access code.
  • the path that host A sends a service request to host B through the inband data channel for example: Host A ⁇ Service Network ⁇ Host B.
  • Step 56 Host B performs legality authentication on the random access code in the service request, and provides service to host A through the in-band data channel when the authentication succeeds.
  • the path that Host B provides to Host A through the in-band data channel is, for example, Host B ⁇ Service Network ⁇ Host A.
  • the service requesting device that is, the host A generates a random access code
  • the host in the preparation service phase, when the service request is initiated, the host is generated.
  • B authenticates the random access code. If the authentication is successful, host B provides service to host A through the in-band data channel. Therefore, in this embodiment, the communication channels of the service switching and the access authentication are isolated from each other, and the service data is transmitted by using an inband data channel, and the access authentication information is transmitted by using an outband channel, which does not need to pass through the service network, thereby reducing access.
  • FIG. 3 is a flowchart of a method for securely connecting devices according to a fifth embodiment of the present invention.
  • the access authentication information is a service providing device, that is, a random access code generated by the host, and the validity authentication of the random access code is completed by the management device, that is, the chassis management board.
  • this embodiment includes:
  • Step 61 Host A generates and stores a random access code before Host A requests access to Host B.
  • Step 62 The host A generates a service request, and sends the service request to the host B through the inband data channel, where the service request carries the location information and the random access code, where the location information may be the host A in the blade server.
  • the logical location such as the chassis number and slot number of host A.
  • Host A sends the service request path to Host B through the inband data channel, for example: Host A ⁇ Service Network ⁇ Host B.
  • Step 63 The host B sends an authentication request to the chassis management board through the outband channel.
  • the authentication request carries the location information of the host A and the random access code, and the authentication request is used to request the legality authentication of the random access code.
  • host B can be pre-defined to allow access to the host information.
  • the host B When receiving the service request, the host B first determines whether the host A corresponding to the location information in the service request is a host that is allowed to be accessed by default, and if yes, sends an authentication request to the chassis management board through the outband channel; otherwise, Reject host A's service request and end this process (not shown).
  • the advantage of this processing is that Host B can guarantee the access of the host that is allowed to access in advance, and reject the undefined host access, thereby further improving the security of the access.
  • the path for the host B to send an authentication request to the chassis management board through the outband channel is as follows: Host B ⁇ Onboard controller B ⁇ Chassis management board.
  • Step 64 The chassis management board receives the authentication request and saves the random access code carried in the authentication request.
  • Step 65 Send an access code response request to host A through the outband channel, for requesting to the main Machine A obtains the random access code of host A.
  • the path that the chassis management board sends an access code response request to host A through the outband channel is as follows: Chassis management board ⁇ board controller A ⁇ host A.
  • Step 66 Host A sends a random access code to the chassis management board through the outband channel.
  • the path that host A sends an authentication request to the chassis management board through the outband channel For example: Host A ⁇ Onboard controller A ⁇ Chassis management board.
  • Step 67 The chassis management board performs legality authentication on the random access code sent by host A according to the saved random access code.
  • the chassis management board compares the random access code obtained in this step with the random access code saved in step 64. If the two are consistent, the random access code authentication succeeds; otherwise, the random access code authentication fails.
  • Step 68 The chassis management board sends the authentication result to host B through the outband channel.
  • Step 69 Host B passes the authentication result of the outband channel receiver management board, and determines whether to provide service to host A according to the authentication result: If the authentication result indicates that the random access code authentication is successful, host B passes the inband data channel to host A. Providing a service; If the authentication result indicates that the random access code authentication fails, Host B refuses to provide the service to Host A.
  • the service requesting device that is, the host A generates a random access code, and is acquired by the chassis management board through the outband channel.
  • the random access codes from host A and host B are authenticated for legality, and the authentication result is notified to host B through the outband channel. If the authentication is successful, host B provides service to host A through the in-band data channel. Therefore, in this embodiment, the communication channels of the service switching and the access authentication are isolated from each other, and the service data is transmitted by using an inband data channel, and the access authentication information is transmitted by using an outband channel, which does not need to pass through the service network, thereby reducing access. Certification information is passing The probability of interception or tampering during the transmission process improves the reliability of access authentication information transmission, thereby improving the security of access between devices in a tree-connected distributed system.
  • FIG. 8 is a schematic structural diagram of a communication device according to a sixth embodiment of the present invention. As shown in FIG. 8, the communication device of this embodiment includes: an obtaining module 71 and an authentication module 72.
  • the obtaining module 71 is configured to obtain access authentication information by using an outband channel, where the access authentication information is used for access authentication between the service requesting device and the service providing device, where the service requesting device and the service providing device share the same
  • the device is managed, and the communication channel is formed separately from the management device.
  • the authentication module 72 is configured to authenticate the access authentication information, and when the authentication result indicates that the access authentication information is successfully authenticated, the service providing device provides a service for the service requesting device by using an inband data channel.
  • the service providing device and the service requesting device form the in-band data channel via a service network.
  • the communication device in this embodiment may be a service request device, or a service providing device, or a management device.
  • the communication device in this embodiment may further include: a generating module 73 and a sending module 74.
  • the generating module 73 is configured to generate and save the access authentication information.
  • the sending module 74 is configured to send a service request to the service providing device by using the inband data channel, where the service request includes the access authentication information.
  • the obtaining module 71 is specifically configured to receive the access authentication information sent by the service providing device by using the outband channel.
  • the authentication module 72 is specifically configured to perform legality authentication on the received access authentication information according to the access authentication information saved by the generating module, and send an authentication result to the service providing device through an outband channel.
  • the communication device in this embodiment may further include: a generating module 73 and a sending module 74.
  • the generating module 73 is configured to receive, by using the outband channel, an access information acquisition request sent by the service requesting device, where The access authentication information is generated and saved according to the access information acquisition request.
  • the sending module 74 is configured to send the access authentication information to the service requesting device by using the outband channel.
  • the obtaining module 71 is specifically configured to receive, by using the inband data channel, a service request sent by the service requesting device, where the service request includes the access authentication information.
  • the authentication module 72 is specifically configured to perform legality authentication on the received access authentication information according to the saved access authentication information.
  • the working mechanism of the communication device in this case refer to the description of the service request device in the corresponding embodiment of FIG. 5, and details are not described herein again.
  • the obtaining module 71 is specifically configured to receive the access authentication information by using an outband channel, where the access authentication information is requested by the service. Generating, by the outband channel, a feedback message that the access authentication information has been saved to the service requesting device, and receiving a service request sent by the service requesting device by using the inband data channel, the service The request includes the access authentication information.
  • the authentication module 72 is specifically configured to perform legality authentication on the received access authentication information according to the saved access authentication information.
  • the obtaining module 7 is specifically configured to receive and save the access authentication information sent by the service providing device by using the outband channel. Obtaining the access authentication information from the service requesting device by using the outband channel; the access authentication information sent by the service providing device, generated by the service requesting device, and passing the inband data A channel is sent to the service providing device.
  • the authentication module 72 is specifically configured to perform legality authentication on the saved access authentication information according to the access authentication information acquired by the service requesting device, and send the authentication result to the service providing device by using the outband channel.
  • the access authentication information may be a random access code.
  • the communication device in this embodiment is responsible for authenticating the access authentication information
  • the method may further include: an expiration date determining module 75.
  • the validity period determining module 75 is configured to determine whether the random access code is in a preset validity period.
  • the authentication module 72 is specifically configured to authenticate the random access code when determining that the random access code is in a preset validity period.
  • the communication device of this embodiment may further include a long connection module 76.
  • the long connection module 76 is configured to: after the access authentication information is successfully authenticated, the service requesting device and the service providing device maintain the service requesting device and the long connection manner by using the inband data channel The service provides an access connection between the devices.
  • the communication channels of the service switching and the access authentication are isolated from each other, and the service data is transmitted by using the inband data channel, and the access authentication information required for access authentication is transmitted by using an outband channel. Since the access authentication information required for the authentication does not need to go through the external service network, the probability that the access authentication information is intercepted or falsified during the transmission process is reduced, and the reliability of the access authentication information transmission is improved, thereby improving the reliability. Security of access between devices in a tree-connected distributed system.
  • the embodiment of the present invention further provides a communication system including the communication device shown in FIG. 8.
  • the networking mode can be referred to the description of FIG. 2 or FIG. 3, wherein the communication device can be specifically a service request device, a service providing device, or a management. device.
  • the communication device can be specifically a service request device, a service providing device, or a management. device.
  • modules in the apparatus in the embodiments may be distributed in the apparatus of the embodiment as described in the embodiments, or may be correspondingly changed in one or more apparatuses different from the embodiment.
  • the modules of the above embodiments may be combined into one module, or may be further split into a plurality of sub-modules.
  • the readable storage medium when executed, executes the steps including the foregoing method embodiments; and the foregoing storage medium includes: a medium that can store program codes, such as ROM, RAM, magnetic disk or optical disk.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Computer And Data Communications (AREA)
  • Telephonic Communication Services (AREA)

Description

设备间安全接入方法和通信设备
本申请要求于 2010 年 3 月 2 日提交中国专利局、 申请号为 201010117583. 8 , 发明名称为 "设备间安全接入方法和通信设备" 的中国 专利申请的优先权， 其全部内容通过引用结合在本申请中。 技术领域
本发明涉及通信技术领域， 特别是一种设备间安全接入方法和通信设 备。 背景技术
分布式系统中将业务方案按业务功能分割成相对独立的业务节点， 部 署同一网络不同物理节点上， 各个节点间交互完成业务流的处理。 分布式 系统在基于刀片式服务器领域的解决方案中广泛应用， 如基于先进的电信 计算架构 ( Advanced Te l ecom Comput ing Archi tec ture ， ATCA ) 的电信 产品存在大量分布式系统等。 分布式系统中各节点之间， 即主机间的接入 认证是一个不容忽视的安全问题。
分布式系统中主机间接入认证控制通常采用密码认证机制。 源主机经 过业务网络向目标主机发起携带有账号和密码信息的接入请求； 目标主机 接收接入请求， 将接入账号和密码与目标主机本地储存的合法账号和密码 进行匹配， 如果匹配成功则向源主机提供服务， 否则拒绝本次接入请求。
发明人在实现本发明实施例过程中发现， 现有技术主机间接入机制通 过业务网络传输包括密码等关键信息的接入请求， 而业务网络为开放式网 络， 这使得密码等关键信息易被嗅探工具探测破解， 降低了密码等关键信 息的可靠性， 从而降低了主机间接入的安全性。 发明内容
本发明实施例提供一种设备间安全接入方法和通信设备， 用于提高树 状连接的分布式系统中设备间接入的安全性。 本发明实施例提供了一种设备间安全接入方法， 包括： 通过带外通道获取接入认证信息， 所述接入认证信息用于服务请求设 备和服务提供设备之间的接入认证， 所述服务请求设备和所述服务提供设 备共享同一管理设备、 且分别与所述管理设备形成所述带外通道；
对所述接入认证信息进行认证， 且在认证结果表示所述接入认证信息 认证成功时， 由所述服务提供设备通过带内数据通道为所述服务请求设备 提供服务， 所述服务提供设备和所述服务请求设备经由业务网络形成所述 带内数据通道。
本发明实施例还提供了一种通信设备， 包括：
获取模块， 用于通过带外通道获取接入认证信息， 所述接入认证信息 用于服务请求设备和服务提供设备之间的接入认证， 所述服务请求设备和 所述服务提供设备共享同一管理设备、 且分别与所述管理设备形成所述带 夕卜通道；
认证模块， 用于对所述接入认证信息进行认证， 且在认证结果表示所 述接入认证信息认证成功时， 由所述服务提供设备通过带内数据通道为所 述服务请求设备提供服务， 所述服务提供设备和所述服务请求设备经由业 务网络形成所述带内数据通道。
本发明实施例将业务交换与接入认证的通信通道相互隔离， 业务数据 采用带内数据通道传输， 接入认证所需的接入认证信息采用带外通道传输。 由于入认证所需的接入认证信息不需要经过外部的业务网络， 因此降低了 接入认证信息在传输过程中被截获或篡改的几率， 提高了接入认证信息传 输的可靠性， 进而提高了树状连接的分布式系统中设备间接入的安全性。 附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案， 下面将对 实施例或现有技术描述中所需要使用的附图作简单地介绍， 显而易见地， 下面描述中的附图仅仅是本发明的一些实施例， 对于本领域普通技术人员 来讲， 在不付出创造性劳动性的前提下， 还可以根据这些附图获得其他的 附图。
图 1为本发明第一实施例提供的设备间安全接入方法流程图； 图 2为本发明实施例提供的应用场景中树状连接的分布式系统结构示 意图；
图 3为本发明实施例提供的应用场景中基于刀片式服务器的分布式系 统结构示意图；
图 4为本发明第二实施例提供的设备间安全接入方法流程图； 图 5为本发明第三实施例提供的设备间安全接入方法流程图； 图 6为本发明第四实施例提供的设备间安全接入方法流程图； 图 Ί为本发明第五实施例提供的设备间安全接入方法流程图； 图 8为本发明第六实施例提供的通信设备结构示意图。 具体实施方式
下面将结合本发明实施例中的附图， 对本发明实施例中的技术方案进 行清楚、 完整地描述， 显然， 所描述的实施例仅仅是本发明一部分实施例， 而不是全部的实施例。 基于本发明中的实施例， 本领域普通技术人员在没 有付出创造性劳动前提下所获得的所有其他实施例， 都属于本发明保护的 范围。
图 1 为本发明第一实施例提供的设备间安全接入方法流程图。 如图 1 所示， 本实施例设备间安全接入方法包括：
步骤 11 : 通过带外通道获取接入认证信息， 所述接入认证信息用于服 务请求设备和服务提供设备之间的接入认证， 所述服务请求设备和所述服 务提供设备共享同一管理设备、 且分别与所述管理设备形成所述带外通道。
服务请求设备和服务提供设备与同一管理设备连接， 由该管理设备进 行统一管理， 这样服务请求设备、 服务提供设备和管理设备就形成了树状 连接的分布式系统， 管理设备可作为根节点， 服务请求设备和服务提供设 备分别作为子节点。
根据组网模式的不同， 可将组网模式分为带外组网 （ Out-Band Networking )和带内组网 （ In-Band Ne tworking )。 带夕卜组网使用其他设备 提供的通信通道， 而不是被管理设备本身提供的通信通道来传输网管信息， 并进行网络设备管理。 带内组网使用被管理设备提供的业务通道来进行网 络设备管理， 在这种组网模式下， 网管信息通过设备的业务通道来进行传 输。 同带内组网相比， 带外组网能提供更可靠的设备管理通道， 如果被管 理设备发生故障， 它仍然能实时定位并监控网络设备。 带外组网过程中用 来传输数据的通道称为带外通道（ Out-Band Channe l ); 带内组网中用来传 输数据的通道称为带内数据通道（ In-Band Da ta Channe l )
图 2为本发明实施例提供的应用场景中树状连接的分布式系统结构示 意图。 如图 2 所示， 服务请求设备和服务提供设备分别可为一独立的系统 主板， 服务请求设备和服务提供设备一方面通过硬件接口物理连接同一管 理设备， 形成带外通道， 如图中虚线所示； 另一方面通过网络接口接入业 务网络， 形成带内数据通道， 如图中实线所示。 业务数据流通过带内通道 传输， 但不经过带外通道。 这样， 服务请求设备、 服务提供设备、 带外通 道和管理设备相当于形成了 "接入认证系统"， 服务请求设备、 服务提供设 备和带内数据通道相当于形成了 "业务交换系统"。 设备间的接入认证在接 入认证系统内实现， 而设备间的业务数据交换则在业务交换系统内实现。
图 2所示的树状连接的分布式系统具体应用环境不受限制， 例如： 可 应用于基于刀片式服务器的分布式系统中， 或者， 还可应用于槽式连接的 交换机的分布式系统中， 或具有物理树状连接结构的类刀片式服务器分布 式系统中。
步骤 12 : 对所述接入认证信息进行认证， 且在认证结果表示所述接入 认证信息认证成功时， 由所述服务提供设备通过带内数据通道为所述服务 请求设备提供服务， 所述服务提供设备和所述服务请求设备经由业务网络 形成所述带内数据通道。
本实施例将业务交换与接入认证的通信通道相互隔离， 业务数据采用 带内数据通道传输， 接入认证所需的接入认证信息采用带外通道传输。 由 于认证所需的接入认证信息不需要经过外部的业务网络， 因此降低了接入 认证信息在传输过程中被截获或篡改的几率， 提高了接入认证信息传输的 可靠性， 进而提高了树状连接的分布式系统中设备间接入的安全性。 本发 明实施例整个实现过程不需要人工干预， 因此可避免因人工干预造成的安 全隐患。
图 3为本发明实施例提供的应用场景中基于刀片式服务器的分布式系 统结构示意图。 如图 3 所示的刀片式服务器， 是一种高可用密度（High Ava i labi l i ty Hi gh Dens i ty ) 的低成本服务器平台， 其优势主要在于能够 节约服务器的使用空间和费用， 并能够为用户提供灵活、 便携的扩展和升 级手段。 刀片式服务器上的每一块刀片实际上就是一块业务主板。 每块业 务主板上设有板载控制器， 不同业务主板的板载控制器分别与机框管理板 连接， 如将不同业务主板的板载控制器分别与机框管理板采用智能平台管 理总线 ( Inte l l i gent P la tform Management BUS , IPMB )连接， 这样在刀 片式服务器内就形成了 IPMB硬件管理通道。 经由该硬件管理通道可以实现 刀片式服务器的上下电、 复位、 告警、 监控等硬件管理。 该硬件管理通道 为刀片式服务器的内建通道， 该通道不需要经过业务网络传输， 不传输业 务数据流， 与业务网络在物理上是相互隔离的。 刀片式服务器上各业务主 板上设置的主机分别通过网卡接入业务网络， 这样刀片式服务器各主机之 间形成通信通道， 该通信通道可经过业务网络传输业务数据流。
在实际应用过程中， 可选的， 刀片式服务器机框中设置多个刀片式服 务器， 每一刀片式服务其上设置有业务主机和板载控制器， 同一刀片式服 务器上业务主机和板载控制器之间通过私有接口通信。 本发明实施例所述 的服务请求设备和服务提供设备， 即为刀片式服务器机框中不同槽位上插 入的刀片式服务器， 本发明实施例所述的管理设备即为机框管理板。 本发 明实施例所述的带内数据通道， 即为不同业务主板上的主机通过网卡连接 业务网络所形成的业务数据流传输通道； 本发明实施例所述的带外通道， 即为各业务主板上的板载控制器通过总线， 如通过智能平台管理总线
( Inte l l i gent Pla tform Management BUS , IPMB )连接机框管理板所形成 的硬件管理通道。
如图 3所示， 假设刀片式服务器机框内设置有刀片式服务器 A和刀片 式服务器 B， 刀片式服务器 A上设置有业务主机 A (以下简称为主机 A )和 板载控制器 A， 刀片式服务器 B上设置有业务主机 B (以下简称为主机 B ) 和板载控制器 B。 主机 A和板载控制器 A之间基于私有接口通信， 主机 B和 板载控制器 B之间也是基于私有接口通信。 主机 A和主机 B之间通过带内 数据通道并经由业务网络络传输业务数据； 板载控制器 A和板载控制器 B 之间通过 IPMB带外通道并经由机框管理板传输接入认证信息。
下面以图 3所示的基于刀片式服务器的分布式系统为应用场景， 详细 说明本发明实施例实现设备间安全接入的技术方案。
图 4为本发明第二实施例提供的设备间安全接入方法流程图。 本实施 例中， 接入认证信息为服务请求设备， 即主机 A生成的随机访问码， 对随 机访问码的合法性认证由服务请求设备， 即主机 A完成。 如图 3和图 4所 示， 本实施例包括：
步骤 31 : 在主机 A请求访问主机 B之前， 主机 A生成并保存随机访问 码。
步骤 32 : 主机 A生成服务请求， 并通过带内数据通道向主机 B发送该 服务请求， 该服务请求中携带有位置信息和随机访问码， 其中， 该位置信 息可为主机 A在刀片式服务器内的逻辑位置， 如主机 A的机框号和槽位号 等。
主机 A通过带内通道向主机 B发送该服务请求的路径例如：主机 A→业 务网络→主机 B。
步骤 33: 主机 B通过带外通道向机框管理板发送认证请求， 该认证请 求携带有主机 A的位置信息和随机访问码，用于请求机框管理板指示主机 A 对该随机访问码进行合法性认证。
可选的， 主机 B上可预先定义允许接入的主机信息。 当主机 B接收到 服务请求时， 首先判断该服务请求中位置信息对应的主机 A是否为预设允 许接入的主机， 如果是， 则通过带外通道向机框管理板发送认证请求； 否 则， 拒绝主机 A的服务请求， 结束本流程（图中未示出）。 如此处理的好处 在于， 主机 B可保证预先定义允许接入的主机接入， 拒绝未定义的主机接 入， 从而进一步提高了接入的安全性。
主机 B通过带外通道向机框管理板发送认证请求的路径例如： 主机 B →板载控制器 B→机框管理板。
步骤 34 : 机框管理板通过带外通道向主机 A发送认证指示， 该认证指 示携带有随机访问码， 用于指示主机 A对随机访问码进行合法性认证。
机框管理板通过带外通道向主机 A发送认证指示的路径例如： 机框管 理板→板载控制器 A→主机 A。
步骤 35 : 主机 A接收认证指示， 对认证指示中的随机访问码进行合法 性认证。
主机 A在对认证指示中的随机访问码进行合法性认证过程中， 可将认 证指示中携带的随机访问码与主机 A在先生成的随机访问码进行比较。
如果认证指示中的随机访问码与主机 A在先生成的随机访问码匹配， 说明随机访问码通过合法性认证， 则通过带外通道向主机 B发送认证成功 的通知信息。 如果认证指示中携带的随机访问码与主机 A在先生成的随机 访问码不匹配， 则通过带外通道向主机 B发送认证失败的通知信息。 步骤 36: 主机 A将认证结果通过带外通道发送给主机 B。
主机 A通过带外通道向主机 B发送认证结果的路径例如：主机 A→板载 控制器 A→机框管理板→板载控制器 B→主机 B。
步骤 37 : 主机 B通过带外通道接收主机 A的认证结果， 并根据认证结 果确定是否向主机 A提供服务： 如果认证结果表示随机访问码认证成功， 则主机 B通过带内数据通道向主机 A提供服务； 如果认证结果表示随机访 问码认证失败， 则主机 B拒绝向主机 A提供服务。
主机 B通过带内数据通道向主机 A提供服务的路径例如：主机 B→业务 网洛→主机 A。
为了进一步提高接入认证的安全性， 可选的， 在随机访问码的生成过 程中， 负责生成随机访问码的设备， 本实施例即为主机 A， 可生成复杂度较 高的随机访问码， 以提高随机访问码的暴力破解难度。 该复杂随机访问码 生成机制也适用于以下图 5-图 7对应的实施例， 均不再赘述。
可选的， 负责随机访问码合法性认证的设备， 本实施例即为主机 A， 可 为随机访问码预设有效期。 例如： 将随机访问码的存活时长设置为 30秒， 则自该随机访问码生成时刻起 30秒内该随机访问码有效， 如果超过 30秒 则该随机访问码无效。 负责随机访问码合法性认证的设备， 本实施例即为 主机 A， 在进行随机访问码认证之前， 首先判断该随机访问码是否有效， 如 计算随机访问码的生成时间和再次获取时间之间的时长， 如果该时长不超 过预设有效期， 则说明随机访问码有效， 进而对该随机访问码的合法性进 行认证； 如果该时长超过预设有效期， 则说明随机访问码无效， 则可直接 认定随机访问码合法性认证失败。 由于随机访问码存活时间越长， 其被破 解、 篡改或截获的风险较高。 在接入认证过程中， 由负责随机访问码的设 备对随机访问码的有效期进行控制， 可降低风险， 提高随机访问码的可靠 性， 进而提高设备间接入的安全性。 该随机访问码有效期控制机制也适用 于以下图 4-图 6对应的实施例， 均不再赘述。 可选的，如果主机 A基于上述流程成功接入主机 B ,则之后主机 A和主 机 B之间可基于长连接机制， 如会话 ( Se s s i on )或套接字 （Socke t )长连 接机制， 保持主机 A和主机 B之间连接的有效性， 无需进行多次接入认证。 由于采用 "接入认证系统" 进行接入认证， 在提高接入认证安全性的同时， 一定程度上可能降低接入认证效率， 而引入长连接机制有利于保证连接的 有效性， 从而提高通信效率， 即在安全性和通信效率之间进行了有效的平 衡。 如果由于长连接断开， 如会话超时或者套接字连接断开等原因导致主 机 A和主机 B之间的连接失效后， 如果主机 A需要向主机 B发起业务请求， 则可基于本实施例上述流程进行主机间接入认证即可， 在此不再赘述。 该 长连接机制也适用于以下图 5-图 7对应的实施例， 均不再赘述。
本实施例在刀片式服务器机框中的任两个刀片式服务器进行接入认证 时， 服务请求设备即主机 A生成随机访问码， 并将该随机访问码通过带外 通道发送给服务提供主机， 即主机 B， 并由主机 B通过带外通道再次传输到 主机 A时， 由主机 A对该随机访问码进认证。 如果认证成功， 则主机 B通 过带内数据通道为主机 A提供服务。 由此可见， 本实施例将业务交换与接 入认证的通信通道相互隔离， 业务数据采用带内数据通道传输， 接入认证 信息采用带外通道传输， 不需要经过业务网络， 因此降低了接入认证信息 在传输过程中被截获或篡改的几率， 提高了接入认证信息传输的可靠性， 进而提高了树状连接的分布式系统中设备间接入的安全性。
图 5为本发明第三实施例提供的设备间安全接入方法流程图。 本实施 例中， 接入认证信息为服务提供设备， 即主机 B生成的随机访问码， 对随 机访问码的合法性认证由服务提供设备， 即主机 B完成。 如图 3和图 5所 示， 本实施例包括：
步骤 41： 在主机 A清求访问主机 B之前， 主机 A通过带外通道向机框 管理板发送访问码获取请求， 访问码获取请求中携带有服务提供设备， 即 主机 B的位置信息。 主机 A通过带外通道向机框管理板发送访问码获取请求的路径例如： 主机 A→板载控制器 A→机框管理板。
步骤 42 : 机框管理板通过带外通道， 向位置信息指向的主机 B发送访 问码生成请求， 访问码生成请求中携带有主机 A的位置信息。
机框管理板通过带外通道向主机 B发送访问码生成请求的路径例如： 机框管理板→板载控制器 B→主机 B。
步骤 43： 主机 B生成并保存随机访问码。
可选的， 主机 B上可预先定义允许接入的主机信息。 当主机 B接收到 访问码生成请求时， 首先判断该访问码生成请求中位置信息对应的主机 A 是否为预设允许接入的主机， 如果是， 则生成并保存随机访问码； 否则， 拒绝主机 A的服务请求， 结束本流程（图中未示出）。如此处理的好处在于， 主机 B可保证预先定义允许接入的主机接入， 拒绝未定义的主机接入， 从 而进一步提高了接入的安全性。
步骤 44： 主机 B通过带外通道向机框管理板发送生成的随机访问码。 主机 B通过带外通道向机框管理板发送随机访问码的路径例如：主机 B →板载控制器 B→机框管理板。
步骤 45 : 机框管理板通过带外通道向主机 A发送主机 B生成的随机访 问码。
机框管理板通过带外通道向主机 A发送随机访问码的路径例如： 机框 管理板→板载控制器 A→主机 A。
步骤 46: 主机 A接收随机访问码并生成服务请求， 并通过带外通道向 主机 B发送服务请求， 该服务请求中携带有服务请求设备， 即主机 A的位 置信息以及主机 A接收到的随机访问码。
主机 A过带外通道向主机 B发送服务请求的路径例如：主机 A→板载控 制器 A→机框管理板→板载控制器 B→主机 B。
步骤 47： 主机 B对服务请求中的随机访问码进行合法性认证， 并在对 随机访问码认证成功时， 通过带内数据通道向主机 A提供服务。
主机 B通过带内数据通道向主机 A提供服务的路径例如：主机 B→业务 网洛→主机 A。
本实施例在刀片式服务器机框中设置的任两个刀片式服务器进行接入 认证时， 服务提供设备， 即主机 B为请求接入的服务请求设备， 即主机 A 生成随机访问码， 并将该随机访问码通过带外通道发送给主机 A， 并由主机 A通过带外通道发送给主机 B， 由主机 B对该随机访问码进认证。 如果认证 成功， 则主机 B通过带内数据通道为主机 A提供服务。 由此可见， 本实施 例将业务交换与接入认证的通信通道相互隔离， 业务数据采用带内数据通 道传输， 接入认证信息采用带外通道传输， 不需要经过业务网络， 因此降 低了接入认证信息在传输过程中被截获或篡改的几率， 提高了接入认证信 息传输的可靠性， 进而提高了树状连接的分布式系统中设备间接入的安全 性。
图 6为本发明第四实施例提供的设备间安全接入方法流程图。 本实施 例中， 接入认证信息为服务提供设备， 即主机 A生成的随机访问码， 对随 机访问码的合法性认证由服务提供设备， 即主机 B完成。 如图 3和图 6所 示， 本实施例包括：
步骤 51： 在主机 A请求访问主机 B之前， 主机 A生成并保存随机访问 码。
步骤 52 : 主机 A生成准备服务请求， 并通过带外通道向主机 B发送该 准备服务请求， 该准备服务请求中携带有随机访问码。
主机 A通过带外通道向主机 B发送准备服务请求的路径例如： 主机 A →板载控制器 A→机框管理板→板载控制器 B→主机 B。
步骤 53: 主机 B接收准备服务请求， 并临时保存该准备服务请求中携 带的随机访问码。
可选的， 主机 B上可预先定义允许接入的主机信息。 当主机 B接收到 准备服务请求时， 首先判断该访问码生成请求中位置信息对应的主机 A是 否为预设允许接入的主机， 如果是， 则保存随机访问码， 执行步骤 54 ; 否 则， 拒绝主机 A的服务请求， 结束本流程（图中未示出）。 如此处理的好处 在于， 主机 B可保证预先定义允许接入的主机接入， 拒绝未定义的主机接 入， 从而进一步提高了接入的安全性。
步骤 54: 主机 B通过带外通道向主机 A发送处理完成信息， 该处理完 成信息用于通知主机 A随机访问码在主机 B上已保存。
主机 B通过带外通道向主机 A发送处理完成信息的路径例如： 主机 B →板载控制器 B→机框管理板→板载控制器 A→主机 A。
步骤 55 : 主机 A通过带内数据通道正式向主机 B发送服务请求， 该服 务请求中携带有随机访问码。
主机 A通过带内数据通道向主机 B发送服务请求的路径例如： 主机 A →业务网络→主机 B。
步骤 56: 主机 B对服务请求中的随机访问码进行合法性认证， 并在认 证成功时， 通过带内数据通道向主机 A提供服务。
主机 B通过带内数据通道向主机 A提供服务的路径例如：主机 B→业务 网洛→主机 A。
本实施例在刀片式服务器机框中设置的任两个刀片式服务器进行接入 认证时， 服务请求设备， 即主机 A生成随机访问码， 并在准备服务阶段， 是发起服务请求时， 由主机 B对该随机访问码进认证。 如果认证成功， 则 主机 B通过带内数据通道为主机 A提供服务。 由此可见， 本实施例将业务 交换与接入认证的通信通道相互隔离， 业务数据采用带内数据通道传输， 接入认证信息采用带外通道传输， 不需要经过业务网络， 因此降低了接入 认证信息在传输过程中被截获或篡改的几率， 提高了接入认证信息传输的 可靠性， 进而提高了树状连接的分布式系统中设备间接入的安全性。 图 Ί为本发明第五实施例提供的设备间安全接入方法流程图。 本实施 例中， 接入认证信息为服务提供设备， 即主机 Α生成的随机访问码， 对随 机访问码的合法性认证由管理设备， 即机框管理板完成。 如图 3和图 7所 示， 本实施例包括：
步骤 61： 在主机 A请求访问主机 B之前， 主机 A生成并保存随机访问 码。
步骤 62 : 主机 A生成服务请求， 并通过带内数据通道向主机 B发送该 服务请求， 该服务请求中携带有位置信息和随机访问码， 其中， 该位置信 息可为主机 A在刀片式服务器内的逻辑位置， 如主机 A的机框号和槽位号 等。
主机 A通过带内数据通道向主机 B发送该服务请求的路径例如：主机 A →业务网络→主机 B。
步骤 63: 主机 B通过带外通道向机框管理板发送认证请求， 该认证请 求携带有主机 A 的位置信息和随机访问码， 该认证请求用于请求对该随机 访问码进行合法性认证。
可选的， 主机 B上可预先定义允许接入的主机信息。 当主机 B接收到 服务请求时， 首先判断该服务请求中位置信息对应的主机 A是否为预设允 许接入的主机， 如果是， 则通过带外通道向机框管理板发送认证请求； 否 则， 拒绝主机 A的服务请求， 结束本流程（图中未示出）。 如此处理的好处 在于， 主机 B可保证预先定义允许接入的主机接入， 拒绝未定义的主机接 入， 从而进一步提高了接入的安全性。
主机 B通过带外通道向机框管理板发送认证请求的路径例如： 主机 B →板载控制器 B→机框管理板。
步骤 64: 机框管理板接收认证请求并保存认证请求中携带的随机访问 码。
步骤 65 : 通过带外通道向主机 A发送访问码响应请求， 用于请求向主 机 A获取主机 A在先生成的随机访问码。
机框管理板通过带外通道向主机 A发送访问码响应请求的路径例如： 机框管理板→板载控制器 A→主机 A。
步骤 66: 主机 A通过带外通道向机框管理板发送随机访问码。
主机 A通过带外通道向机框管理板发送认证请求的路径例如： 主机 A →板载控制器 A→机框管理板。
步骤 67 : 机框管理板根据保存的随机访问码， 对主机 A发送的随机访 问码进行合法性认证。 机框管理板将本步骤获取的随机访问码， 与步骤 64保存的随机访问码进行 比较， 如果二者一致， 则说明随机访问码认证成功； 否则说明随机访问码 认证失败。
步骤 68： 机框管理板将认证结果通过带外通道发送给主机 B。
机框管理板将通过带外通道向主机 B发送认证结果的路径例如： 机框 管理板→板载控制器 B→主机 B。
步骤 69: 主机 B通过带外通道接收机框管理板的认证结果， 根据认证 结果确定是否向主机 A提供服务： 如果认证结果表示随机访问码认证成功， 则主机 B通过带内数据通道向主机 A提供服务； 如果认证结果表示随机访 问码认证失败， 则主机 B拒绝向主机 A提供服务。
本实施例在刀片式服务器机框中设置的任两个刀片式服务器进行接入 认证时， 服务请求设备， 即主机 A生成随机访问码， 并由机框管理板对通 过带外通道获取的、 分别来自主机 A和主机 B的随机访问码进行合法性认 证， 将认证结果通过带外通道通知主机 B。 如果认证成功， 则主机 B通过带 内数据通道为主机 A提供服务。 由此可见， 本实施例将业务交换与接入认 证的通信通道相互隔离， 业务数据采用带内数据通道传输， 接入认证信息 采用带外通道传输， 不需要经过业务网络， 因此降低了接入认证信息在传 输过程中被截获或篡改的几率， 提高了接入认证信息传输的可靠性， 进而 提高了树状连接的分布式系统中设备间接入的安全性。
图 8为本发明第六实施例提供的通信设备结构示意图。 如图 8所示， 本实施例通信设备包括： 获取模块 71和认证模块 72。
获取模块 71用于通过带外通道获取接入认证信息， 所述接入认证信息 用于服务请求设备和服务提供设备之间的接入认证， 所述服务请求设备和 所述服务提供设备共享同一管理设备、 且分别与所述管理设备形成所述带 夕卜通道。
认证模块 72用于对所述接入认证信息进行认证， 且在认证结果表示所 述接入认证信息认证成功时， 由所述服务提供设备通过带内数据通道为所 述服务请求设备提供服务， 所述服务提供设备和所述服务请求设备经由业 务网络形成所述带内数据通道。
本实施例通信设备的具体实现方式不受限制， 如本实施例通信设备可 具体为一服务请求设备， 或为一服务提供设备， 或为管理设备。
本实施例通信设备具体可实现为一服务请求设备时， 可选的， 本实施 例通信设备还可包括： 生成模块 73和发送模块 74。 生成模块 73用于生成 并保存所述接入认证信息。 发送模块 74用于通过所述带内数据通道向所述 服务提供设备发送服务请求， 所述服务请求包括所述接入认证信息。 相应 的， 获取模块 71具体用于通过所述带外通道， 接收所述服务提供设备发送 的所述接入认证信息。 认证模块 72具体用于根据所述生成模块保存的接入 认证信息， 对接收的接入认证信息进行合法性认证， 通过带外通道向所述 服务提供设备发送认证结果。 该情形下通信设备的工作机理， 可参见图 4 对应实施例中关于服务请求设备的记载， 在此不再赘述。
或者， 本实施例通信设备具体可实现为一服务提供设备时， 本实施例 通信设备还可包括： 生成模块 73和发送模块 74。 该情形下， 生成模块 73 用于通过所述带外通道接收所述服务请求设备发送的接入信息获取请求， 根据所述接入信息获取请求生成并保存接入认证信息。 发送模块 74用于通 过所述带外通道向所述服务请求设备发送所述接入认证信息。 相应的， 获 取模块 71具体用于通过所述带内数据通道接收所述服务请求设备发送的业 务请求， 所述业务请求包括所述接入认证信息。 认证模块 72具体用于根据 保存的接入认证信息， 对接收的接入认证信息进行合法性认证。 该情形下 通信设备的工作机理， 可参见图 5对应实施例中关于服务请求设备的记载， 在此不再赘述。
或者， 本实施例通信设备具体可实现为一服务请求设备时， 可选的， 获取模块 71具体用于通过带外通道接收所述接入认证信息， 所述接入认证 信息由所述服务请求模块生成； 通过所述带外通道， 向所述服务请求设备 发送接入认证信息已保存的反馈消息， 并通过所述带内数据通道， 接收所 述服务请求设备发送的服务请求， 所述服务请求包括所述接入认证信息。 认证模块 72具体用于根据保存的接入认证信息， 对接收的接入认证信息进 行合法性认证。 该情形下通信设备的工作机理， 可参见图 6对应实施例中 关于服务请求设备的记载， 在此不再赘述。
或者， 本实施例通信设备具体可实现为一管理设备时， 可选的， 获取 模块 7 1具体用于通过所述带外通道， 接收并保存所述服务提供设备发送的 所述接入认证信息， 并通过所述带外通道向所述服务请求设备获取所述接 入认证信息； 所述服务提供设备发送的所述接入认证信息， 由所述服务请 求设备生成并通过所述带内数据通道发送给所述服务提供设备。 认证模块 72具体用于根据向所述服务请求设备获取的接入认证信息， 对保存的接入 认证信息进行合法性认证， 通过所述带外通道向所述服务提供设备发送认 证结果。 该情形下通信设备的工作机理， 可参见图 7对应实施例中关于服 务请求设备的记载， 在此不再赘述。
上述通信设备的技术方案中， 接入认证信息可为随机访问码。 当本实 施例通信设备负责对接入认证信息进行合法性认证时， 本实施例通信设备 还可包括： 有效期确定模块 75。有效期确定模块 75用于确定所述随机访问 码是否处于预设有效期。 相应的， 认证模块 72具体用于在确定所述随机访 问码处于预设有效期时， 对所述随机访问码进行认证。
上述通信设备的技术方案中， 为了提高通信效率， 可选的， 本实施例 通信设备还可包括长连接模块 76。长连接模块 76用于在所述接入认证信息 认证成功之后， 所述服务请求设备和所述服务提供设备通过所述带内数据 通道， 并以长连接方式维持所述服务请求设备和所述服务提供设备之间的 接入连接。
本实施例将业务交换与接入认证的通信通道相互隔离， 业务数据采用 带内数据通道传输， 接入认证所需的接入认证信息采用带外通道传输。 由 于入认证所需的接入认证信息不需要经过外部的业务网络， 因此降低了接 入认证信息在传输过程中被截获或篡改的几率， 提高了接入认证信息传输 的可靠性， 进而提高了树状连接的分布式系统中设备间接入的安全性。
本发明实施例还提供了一种包括如图 8所示通信设备的通信系统， 其 组网方式可参见图 2或图 3的记载， 其中通信设备可具体为服务请求设备、 服务提供设备或管理设备。 通信系统中各节点的工作机理可参见图 1、 图 4-图 7对应实施例的记载， 在此不再赘述。
本领域普通技术人员可以理解： 附图只是一个实施例的示意图， 附图 中的模块或流程并不一定是实施本发明所必须的。
本领域普通技术人员可以理解： 实施例中的装置中的模块可以按照实 施例描述分布于实施例的装置中， 也可以进行相应变化位于不同于本实施 例的一个或多个装置中。 上述实施例的模块可以合并为一个模块， 也可以 进一步拆分成多个子模块。
上述本发明实施例序号仅仅为了描述， 不代表实施例的优劣。
本领域普通技术人员可以理解： 实现上述方法实施例的全部或部分步 骤可以通过程序指令相关的硬件来完成， 前述的程序可以存储于一计算机 可读取存储介质中， 该程序在执行时， 执行包括上述方法实施例的步骤； 而前述的存储介质包括： R0M、 RAM, 磁碟或者光盘等各种可以存储程序代 码的介质。
最后应说明的是： 以上实施例仅用以说明本发明的技术方案， 而非对 其限制； 尽管参照前述实施例对本发明进行了详细的说明， 本领域的普通 技术人员应当理解： 其依然可以对前述实施例所记载的技术方案进行修改， 或者对其中部分技术特征进行等同替换； 而这些修改或者替换， 并不使相 应技术方案的本质脱离本发明实施例技术方案的精神和范围。

Claims

权利要求
1、 一种设备间安全接入方法， 其特征在于， 包括：
通过带外通道获取接入认证信息， 所述接入认证信息用于服务请求设 备和服务提供设备之间的接入认证， 所述服务请求设备和所述服务提供设 备共享同一管理设备、 且分别与所述管理设备形成所述带外通道；
对所述接入认证信息进行认证， 且在认证结果表示所述接入认证信息认 证成功时， 由所述服务提供设备通过带内数据通道为所述服务请求设备提供 服务， 所述服务提供设备和所述服务请求设备经由业务网络形成所述带内数 据通道。
2、 根据权利要求 1所述的方法， 其特征在于，
通过带外通道获取接入认证信息之前， 还包括： 所述服务请求设备生 成并保存接入认证信息， 并通过所述带内数据通道向所述服务提供设备发 送服务请求， 所述服务请求包括所述接入认证信息；
通过带外通道获取接入认证信息， 包括： 所述服务请求设备通过所述 带外通道， 接收所述服务提供设备发送的所述接入认证信息；
对所述接入认证信息进行认证， 包括： 所述服务请求设备根据保存的 接入认证信息， 对接收的接入认证信息进行合法性认证， 通过带外通道向 所述服务提供设备发送认证结果。
3、 根据权利要求 1所述的方法， 其特征在于，
通过带外通道获取接入认证信息之前， 还包括： 所述服务提供设备通 过所述带外通道接收所述服务请求设备发送的接入信息获取请求；
通过带外通道获取接入认证信息， 包括： 所述服务提供设备根据所述 接入信息获取请求生成并保存接入认证信息， 并通过所述带外通道向所述 服务请求设备发送所述接入认证信息；
对所述接入认证信息进行认证之前， 还包括： 所述服务提供设备通过 所述带内数据通道接收所述服务请求设备发送的业务请求， 所述业务请求 包括所述接入认证信息；
对所述接入认证信息进行认证， 包括： 所述服务提供设备根据保存的 接入认证信息， 对接收的接入认证信息进行合法性认证。
4、 根据权利要求 1所述的方法， 其特征在于，
通过带外通道获取接入认证信息， 包括： 所述服务提供设备通过带外 通道接收所述接入认证信息， 所述接入认证信息由所述服务请求模块生成； 所述服务提供设备通过所述带外通道， 向所述服务请求设备发送接入认证 信息已保存的反馈消息， 并通过所述带内数据通道， 接收所述服务请求设 备发送的服务请求， 所述服务请求包括所述接入认证信息；
对所述接入认证信息进行认证， 包括： 所述服务提供设备根据保存的 接入认证信息， 对接收的接入认证信息进行合法性认证。
5、 根据权利要求 1所述的方法， 其特征在于，
通过带外通道获取接入认证信息之前， 还包括： 所述服务请求设备生 成并保存接入认证信息， 并通过所述带内数据通道向所述服务提供设备发 送服务请求， 所述服务请求包括所述接入认证信息；
通过带外通道获取接入认证信息， 包括： 所述管理设备通过所述带外 通道， 接收并保存所述服务提供设备发送的所述接入认证信息， 并通过所 述带外通道向所述服务请求设备获取所述接入认证信息；
对所述接入认证信息进行认证， 包括： 所述管理设备根据向所述服务 请求设备获取的接入认证信息， 对保存的接入认证信息进行合法性认证，
6、 根据权利要求 1所述的方法， 其特征在于， 所述接入认证信息为随 机访问码；
对所述接入认证信息进行认证之前， 还包括： 确定所述随机访问码是 否处于预设有效期；
对所述接入认证信息进行认证， 包括： 在确定所述随机访问码处于预 设有效期时， 对所述随机访问码进行认证。
7、 根据权利要求 1-6任一所述的方法， 其特征在于， 在所述接入认证 信息认证成功之后， 还包括：
所述服务请求设备和所述服务提供设备通过所述带内数据通道， 并以 长连接方式维持所述服务请求设备和所述服务提供设备之间的接入连接。
8、 一种通信设备， 其特征在于， 包括：
获取模块， 用于通过带外通道获取接入认证信息， 所述接入认证信息 用于服务请求设备和服务提供设备之间的接入认证， 所述服务请求设备和 所述服务提供设备共享同一管理设备、 且分别与所述管理设备形成所述带 夕卜通道；
认证模块， 用于对所述接入认证信息进行认证， 且在认证结果表示所 述接入认证信息认证成功时， 由所述服务提供设备通过带内数据通道为所 述服务请求设备提供服务， 所述服务提供设备和所述服务请求设备经由业 务网络形成所述带内数据通道。
9、 根据权利要求 8所述的通信设备， 其特征在于， 还包括： 生成模块， 用于生成并保存所述接入认证信息；
发送模块， 用于通过所述带内数据通道向所述服务提供设备发送服务 请求， 所述服务请求包括所述接入认证信息；
所述获取模块， 具体用于通过所述带外通道， 接收所述服务提供设备 发送的所述接入认证信息；
所述认证模块， 具体用于根据所述生成模块保存的接入认证信息， 对接收的 接入认证信息进行合法性认证， 通过带外通道向所述服务提供设备发送认证结 果。
1 0、 根据权利要求 8所述的通信设备， 其特征在于， 还包括： 生成模块， 用于通过所述带外通道接收所述服务请求设备发送的接入 信息获取请求， 根据所述接入信息获取请求生成并保存接入认证信息； 发送模块， 用于通过所述带外通道向所述服务请求设备发送所述接入认证信 息；
所述获取模块， 具体用于通过所述带内数据通道接收所述服务请求设 备发送的业务请求， 所述业务请求包括所述接入认证信息；
所述认证模块， 具体用于根据保存的接入认证信息， 对接收的接入认 证信息进行合法性认证。
11、 根据权利要求 8所述的通信设备， 其特征在于，
所述获取模块， 具体用于通过带外通道接收所述接入认证信息， 所述 接入认证信息由所述服务请求模块生成； 通过所述带外通道， 向所述服务 请求设备发送接入认证信息已保存的反馈消息， 并通过所述带内数据通道， 接收所述服务请求设备发送的服务请求， 所述服务请求包括所述接入认证 信息；
所述认证模块， 具体用于根据保存的接入认证信息， 对接收的接入认 证信息进行合法性认证。
12、 根据权利要求 8所述的通信设备， 其特征在于，
所述获取模块， 具体用于通过所述带外通道， 接收并保存所述服务提 供设备发送的所述接入认证信息， 并通过所述带外通道向所述服务请求设 备获取所述接入认证信息； 所述服务提供设备发送的所述接入认证信息， 由所述服务请求设备生成并通过所述带内数据通道发送给所述服务提供设 备；
所述认证模块， 具体用于根据向所述服务请求设备获取的接入认证信 息， 对保存的接入认证信息进行合法性认证， 通过所述带外通道向所述服 务提供设备发送认证结果。
1 3、 根据权利要求 8 所述的通信设备， 其特征在于， 所述接入认证信 息为随机访问码， 所述通信设备还包括：
有效期确定模块， 用于确定所述随机访问码是否处于预设有效期； 所述认证模块，
对所述随机访问码进行认证。
14、 根据权利要求 8所述的通信设备， 其特征在于，
长连接模块， 用于在所述接入认证信息认证成功之后， 所述服务请求 设备和所述服务提供设备通过所述带内数据通道， 并以长连接方式维持所 述服务请求设备和所述服务提供设备之间的接入连接。
PCT/CN2011/071223 2010-03-02 2011-02-24 设备间安全接入方法和通信设备 WO2011107013A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP11750166.8A EP2544397B1 (en) 2010-03-02 2011-02-24 Method and communication device for accessing to devices in security
US13/598,236 US8826404B2 (en) 2010-03-02 2012-08-29 Method and communication device for accessing to devices in security

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201010117583.8 2010-03-02
CN201010117583.8A CN102195930B (zh) 2010-03-02 2010-03-02 设备间安全接入方法和通信设备

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US13/598,236 Continuation US8826404B2 (en) 2010-03-02 2012-08-29 Method and communication device for accessing to devices in security

Publications (1)

Publication Number Publication Date
WO2011107013A1 true WO2011107013A1 (zh) 2011-09-09

Family

ID=44541656

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2011/071223 WO2011107013A1 (zh) 2010-03-02 2011-02-24 设备间安全接入方法和通信设备

Country Status (4)

Country Link
US (1) US8826404B2 (zh)
EP (1) EP2544397B1 (zh)
CN (1) CN102195930B (zh)
WO (1) WO2011107013A1 (zh)

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP4002761B1 (en) 2011-09-30 2023-11-15 INTEL Corporation Out-of-band remote authentication
US9081912B2 (en) 2011-11-24 2015-07-14 Huawei Technologies Co., Ltd. Method and apparatus for node hot-swapping
CN102520982A (zh) * 2011-11-24 2012-06-27 华为技术有限公司 节点热插拔的方法及装置
CN102624553A (zh) * 2012-03-02 2012-08-01 北京星网锐捷网络技术有限公司 信息传输方法、装置及系统、相关设备
WO2014163638A1 (en) * 2013-04-03 2014-10-09 Hewlett-Packard Development Company, L.P. Disabling counterfeit cartridges
WO2015100675A1 (zh) * 2013-12-31 2015-07-09 华为终端有限公司 一种网络配置方法、相关装置及系统
US9942631B2 (en) * 2015-09-25 2018-04-10 Intel Corporation Out-of-band platform tuning and configuration
CN106250078A (zh) * 2016-07-26 2016-12-21 青岛海信电器股份有限公司 一种显示终端控制方法及设备
CN108881130B (zh) * 2017-05-16 2021-07-30 中国移动通信集团重庆有限公司 会话控制信息的安全控制方法和装置
US11265711B2 (en) * 2019-09-13 2022-03-01 Microsoft Technology Licensing, Llc Proximity-based management of a computing device

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101167305A (zh) * 2005-04-04 2008-04-23 诺基亚公司 无线局域网的访问管理
CN101340287A (zh) * 2007-07-02 2009-01-07 华为技术有限公司 一种网络接入认证方法及系统和装置
US20090259838A1 (en) * 2008-04-15 2009-10-15 Authenex, Inc. Hardware-Bonded Credential Manager Method and System
CN101599896A (zh) * 2008-06-06 2009-12-09 华为技术有限公司 信令传送的方法、系统和设备

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7430670B1 (en) 1999-07-29 2008-09-30 Intertrust Technologies Corp. Software self-defense systems and methods
US7295556B2 (en) 2002-03-01 2007-11-13 Enterasys Networks, Inc. Location discovery in a data network
US6973587B1 (en) 2002-05-03 2005-12-06 American Megatrends, Inc. Systems and methods for out-of-band booting of a computer
US7436965B2 (en) * 2003-02-19 2008-10-14 Microsoft Corporation Optical out-of-band key distribution
US8146142B2 (en) * 2004-09-03 2012-03-27 Intel Corporation Device introduction and access control framework
US7386275B2 (en) * 2005-03-11 2008-06-10 Dell Products Llp Systems and methods for managing out-of-band device connection
CN1929371B (zh) 2005-09-05 2010-09-08 华为技术有限公司 用户和外围设备协商共享密钥的方法
JP4693171B2 (ja) * 2006-03-17 2011-06-01 株式会社日立ソリューションズ 認証システム
US8582734B2 (en) * 2007-03-20 2013-11-12 Shooter Digital Co., Ltd. Account administration system and method with security function

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101167305A (zh) * 2005-04-04 2008-04-23 诺基亚公司 无线局域网的访问管理
CN101340287A (zh) * 2007-07-02 2009-01-07 华为技术有限公司 一种网络接入认证方法及系统和装置
US20090259838A1 (en) * 2008-04-15 2009-10-15 Authenex, Inc. Hardware-Bonded Credential Manager Method and System
CN101599896A (zh) * 2008-06-06 2009-12-09 华为技术有限公司 信令传送的方法、系统和设备

Also Published As

Publication number Publication date
CN102195930A (zh) 2011-09-21
EP2544397A1 (en) 2013-01-09
CN102195930B (zh) 2014-12-10
US8826404B2 (en) 2014-09-02
EP2544397B1 (en) 2016-04-13
EP2544397A4 (en) 2013-04-24
US20120331538A1 (en) 2012-12-27

Similar Documents

Publication Publication Date Title
WO2011107013A1 (zh) 设备间安全接入方法和通信设备
TWI780047B (zh) 身份認證方法、裝置和系統
JP5068495B2 (ja) 分散型認証機能
EP3017582B1 (en) Method to enroll a certificate to a device using scep and respective management application
US9148412B2 (en) Secure configuration of authentication servers
WO2018010146A1 (zh) 一种虚拟网络计算认证中应答的方法、装置、系统和代理服务器
KR20050002628A (ko) 보안 프로토콜의 자동 협상 시스템 및 방법
TW201811087A (zh) 連接建立方法、裝置和設備
WO2015085848A1 (zh) 一种安全认证方法和双向转发检测bfd设备
EP2941855A1 (en) Authenticating a wireless dockee to a wireless docking service
US20070165582A1 (en) System and method for authenticating a wireless computing device
CN105282258B (zh) 控制远程桌面的方法及系统
WO2014048769A1 (en) Single sign-on method, proxy server and system
WO2012122730A1 (zh) 基于Tr069协议获取设备状态的方法、ACS及系统
WO2017005163A1 (zh) 基于无线通信的安全认证装置
CN111212117A (zh) 一种远程交互的方法和装置
US20160057232A1 (en) Portal device management method, portal device and portal system
US20220131695A1 (en) Distributed secure communication system
US8607058B2 (en) Port access control in a shared link environment
CN115065703A (zh) 物联网系统及其认证与通信方法、相关设备
CN110191139A (zh) 一种鉴权方法和系统、终端接入网络的方法
JP6126062B2 (ja) ネットワーク装置及びネットワーク装置のｍａｃアドレス認証方法
CN114050911B (zh) 一种容器远程登录方法及系统
JP7458348B2 (ja) 通信システム、アクセスポイント装置、通信方法及びプログラム
CN113647075B (zh) 设备激活方法、终端设备及计算机存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 11750166

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2011750166

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE