WO2014067284A1

WO2014067284A1 - Cross-domain controller authentication method, apparatus, and host

Info

Publication number: WO2014067284A1
Application number: PCT/CN2013/075910
Authority: WO
Inventors: 吴剑
Original assignee: 华为技术有限公司
Priority date: 2012-10-31
Filing date: 2013-05-20
Publication date: 2014-05-08
Also published as: CN103795530B; CN103795530A

Abstract

Embodiments of the present application disclose a cross-domain controller authentication method and apparatus, and a host, which are applied in multiple domain controllers and a multi-node system. The method comprises: a first node obtaining authentication information, the authentication information comprising domain information of a target domain controller; the first node determining whether the authentication information is in accordance with domain information of a domain controller the node joins; and if not, a second domain controller in accordance with the domain information performing the authentication, the authentication result being fed back to the first node by using the second node, and the second node being a node adding the second domain controller. Because the second domain controller in accordance with the domain information performs the authentication and the authentication result is fed back, by using the second node, to the first node, the embodiments of the present invention can implement the cross-domain controller authentication, thereby meeting requirements of a domain controlled user for accessing a shared resource on another domain controller node.

Description

Method, device and host for cross-domain controller authentication The present application claims to be submitted to the Chinese Patent Office on October 31, 2012, the application number is 201210427606.4, and the invention name is "a method, device and host for cross-domain controller authentication". The priority of the Chinese patent application is hereby incorporated by reference in its entirety.

The present invention relates to the field of network authentication technologies, and in particular, to an authentication method, apparatus, and host for a cross-domain controller.

Background technique

The management and operation of modern enterprises and institutions are inseparable from computers and local area networks. When enterprises use the network to conduct regular office management and operations, they will generate daily business documents, drawing documents and other business data and personal documents. In order to achieve unified management and security application of data within the entire enterprise, there must be a storage device that is safe, cost-effective, easy to use, and simple to manage to store and back up data within the enterprise. The NAS (Network Attached Storage) network storage server is the ideal storage device described above. The NAS Network Storage Server is a specially designed file storage and backup server that manages data in the network reasonably, efficiently, and securely, and can be used as a backup device to automatically back up databases and other application data to the NAS from time to time. .

Currently, the network file device sharing protocol widely used by NAS is CIFS (Common Internet File System). There are two types of CIFS authentication for users: one is local user authentication, and the other is domain controller. User Authentication. Local user authentication means that when the user logs in, the user's authority is completely authenticated by the CIFS server itself. It does not need to go through the third party's certification authority, which is a relatively simple authentication method. In order to make the user's authentication more secure, the domain controller user authentication method is used. The domain controller user authentication mode means that when a client user logs in, the user's authority is authenticated by a third-party certification authority, which is a relatively complicated authentication method.

As shown in Figure 1: The existing domain controller user authentication method is as follows:

Each node on the clustered NAS joins different domain controllers. Different domain controllers perform user authentication on the nodes that are added to the domain, so that each node uses an independent domain controller to implement independent access control. The technical problems brought by this program are:

The configuration is complicated, and each node on the cluster needs to be added to a different domain controller. The network on the group is more complicated.

A user on a domain controller can only perform user authentication by the domain controller to which the currently logged-in node joins, but cannot authenticate with the domain controller, and thus cannot satisfy the domain controller's access to shared resources on other domain controller nodes. demand. Summary of the invention

In view of the above, in order to solve the problem that a user on a domain controller cannot be authenticated across a domain controller, the first aspect of the present application provides an authentication method for a cross-domain controller, which is applied to multiple domain controllers and multiple nodes. System, the method includes:

The first node obtains the authentication information, where the authentication information includes the domain information of the target domain controller; the first node determines whether the authentication information meets the domain information of the domain controller to which the node is joined, and if not, the following:

And the second domain controller that is consistent with the authentication information performs authentication, and the authentication result is fed back to the first node by using the second node;

The second node is a node that joins the second domain controller.

In conjunction with the first aspect, in a first possible implementation of the first aspect,

The second domain controller that is in compliance with the authentication information performs authentication, and the authentication result is fed back to the first node by using the second node, including:

The first node forwards the authentication information to the second node, and the second domain controller performs authentication, and the second domain controller feeds the authentication result to the second node, where the second node The authentication result is fed back to the first node.

With reference to the first possible implementation manner of the first aspect, in a second possible implementation manner, the authenticating information is forwarded to a second node, and the second domain controller that is joined by the second node performs Certification, including:

The domain information of the domain controller corresponding to the domain information of the target domain controller is searched in a preset control table, where the preset control table includes: node information, domain control of the node to which the node information belongs Domain information of the device; Finding, according to the domain information of the domain controller, the matched node information in the preset control table, where the matched node information is the second node information;

And forwarding the authentication information to the second node, and the second domain controller joined by the second node performs authentication.

Broadcasting the authentication information to all nodes in the cluster;

All nodes in the cluster determine whether the domain information of the domain controller to which they join meets the authentication information. If yes, the node is the second node, and the second node obtains feedback of the domain controller to which it joins. The result of the authentication, and the feedback result is sent to the first node.

A second aspect of the present invention provides an authentication device for a cross-domain controller, the device comprising a first node, a second node, and a second pre-controller:

The first node obtains the authentication information, where the authentication information includes the domain information of the target domain controller; the first node determines whether the authentication information meets the domain information of the domain controller to which the node is joined, and if not, Then:

The second node is a node that joins the second domain controller.

In conjunction with the second aspect, in a first possible implementation of the second aspect,

The first node includes a forwarding unit and a feedback unit;

The forwarding unit forwards the authentication information to the second node, and the second domain controller performs authentication, and the second domain controller feeds back the authentication result to the feedback unit, where the feedback unit The authentication result is fed back to the first node.

With reference to the first possible implementation manner of the second aspect, in a second possible implementation manner, the forwarding unit includes a first searching module, a second searching module, and a sending module:

The first searching module is configured to search, in a preset control table, domain information of a domain controller corresponding to the domain information of the target domain controller, and transmit the domain information of the domain controller to the searched domain controller Giving the second search module, wherein the preset control table includes: node information, a section The domain information of the domain controller to which the node to which the point information belongs is added;

The second search module is configured to receive the domain information of the domain controller from the first search module, and obtain domain information of the domain controller according to the search, and find the domain information in the preset control table. Matching node information, the matched node information is second node information, and transmitting the second node information to the sending module;

The sending module is configured to receive the second node information from the second search module, and forward the authentication information to the second node according to the second node information, where the second node joins The second domain controller performs authentication.

The first node includes a broadcast unit;

The broadcast unit is configured to broadcast the authentication information to all nodes in the cluster; all nodes in the cluster determine whether the domain information of the domain controller to which they join meets the authentication information, and if so, The node is the second node, and the second node obtains the authentication result fed back by the domain controller that it joins, and sends the feedback result to the first node.

A third aspect of the present invention provides a host, the host including a processor, a communication interface, a memory, and a bus;

Wherein the processor, the communication interface, and the memory complete communication with each other through the bus;

The communication interface is configured to acquire authentication information, and transmit the authentication information to the processor; the processor is configured to execute a program;

The memory is configured to store a program;

The program is used to:

Obtaining authentication information, where the authentication information includes domain information of a target domain controller;

Determining whether the authentication information conforms to the domain information of the domain controller to which the node is joined, and if not, the following:

The second node is a node that joins the second domain controller.

The authentication is performed by the second node, and the authentication result is fed back to the first node by using the second node. Therefore, the embodiment of the present application can implement the authentication of the cross-domain controller, thereby satisfying The need for domain-controlled users to access shared resources on other domain controller nodes. BRIEF DESCRIPTION OF THE DRAWINGS In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below, and obviously, in the following description The drawings are only some of the embodiments of the present application, and those skilled in the art can obtain other drawings based on these drawings without any creative work.

1 is a schematic flowchart of a cross-domain controller authentication method according to an embodiment of the present disclosure; FIG. 2 is a timing diagram of a cross-domain controller authentication method according to an embodiment of the present application; FIG. 4 is a schematic diagram of a method for authenticating a cross-domain controller according to an embodiment of the present invention; FIG. 5 is a schematic diagram of a cross-domain controller authentication method according to an embodiment of the present application; FIG. 6 is a schematic structural diagram of a first node shown in an embodiment of the present application; FIG.

7 is a schematic structural diagram of a host shown in an embodiment of the present application;

FIG. 8 is a schematic structural diagram of a program 732 shown in an embodiment of the present application. detailed description

The technical solutions in the embodiments of the present application are clearly and completely described in the following with reference to the drawings in the embodiments of the present application. It is obvious that the described embodiments are only a part of the embodiments of the present application, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present application without departing from the inventive scope are the scope of the present application. Referring to FIG. 1, a schematic flowchart of an embodiment of an authentication method of a cross-domain controller according to the present application is shown, where the method includes:

Step 110: The first node obtains the authentication information.

The authentication information contains the domain information of the target domain controller.

Step 120: The first node determines whether the authentication information meets the domain information of the domain controller to which the node is added. If the information does not match, step 130 is performed. The embodiment of the present application discloses an authentication method for a cross-domain controller, which is applied to multiple domain controllers and devices of multiple nodes. The domain controller authenticates the nodes that are added to the domain, and it is necessary to explain that the foregoing The first node does not specifically refer to a certain node, but is added to any one of a plurality of nodes of a domain controller. The above-mentioned domain controller is assumed to be the first domain controller, and is not specifically referred to. The user logs in through the first node, enters the authentication information, and the domain information of the target domain controller. If the authentication information input by the user matches the information of the first domain controller, the first domain controller performs authentication, otherwise the step is performed. 130. The authentication information includes domain information, a username, and a password of the target domain controller, and the domain information includes at least: a domain IP address and a domain name.

Step 130: The second domain controller that matches the authentication information performs authentication, and the authentication result is fed back to the first node by using the second node.

The second node is a node that joins the second domain controller.

The authentication is performed by the second node, and the authentication result is fed back to the first node by using the second node. Therefore, the embodiment of the present application can implement the authentication of the cross-domain controller, thereby satisfying the domain control user accessing the other. The need to share resources on a domain controller node. Referring to FIG. 2, an embodiment of the present application discloses an authentication method for a cross-domain controller, which is applied to a cluster network-connected storage NAS. The clustered NAS includes multiple domain controllers and multiple nodes, and the domain controller pair is added to the domain. The node is authenticated. The embodiment of the present application is described by taking a node in the clustered NAS as an example:

Step 210: The first node acquires authentication information.

The authentication information contains the domain information of the target domain controller. The user inputs the authentication information through the first node in the clustered NAS, and requests to log in to access the resource information on the node, where the authentication information includes the domain information, the user name, and the password of the target domain controller, and the domain information of the target domain controller is at least Includes: Domain IP address and domain name.

Step 220: The first node determines whether the authentication information meets the domain information of the domain controller to which the node joins. If not, proceed to step 230:

Step 230: The first node forwards the authentication information to the second node, where the second domain controller performs authentication, and the second domain controller feeds the authentication result to the second node, and the second node feeds back the authentication result to the first node. . The first node forwards the authentication information to the second node, and the second domain controller that is added by the second node performs authentication, and may include:

Finding the domain information of the domain controller corresponding to the domain information of the target domain controller in the preset control table; finding the matching node information in the preset control table according to the domain information of the domain controller obtained by the search, the matching node The information is the second node information; the authentication information is forwarded to the second node, and the second domain controller joined by the second node performs authentication, wherein the preset control table includes: node information, and the node to which the node information belongs belongs to the domain The domain information of the controller may be preset in the cluster NAS, and the node information of the node joining the domain controller and the domain information of the domain controller to which the node information belongs are synchronized to the control table, in the cluster NAS All nodes can find the node information of the domain controller that is joined to the domain controller according to the domain information of the domain controller in the control table, and find the node that joins the domain controller according to the node information.

On the other hand, in step 220, if the first node determines that the authentication information conforms to the domain information of the domain controller to which the node is joined, then the domain controller joined by the node performs authentication, and the domain controller joined by the node It contains a database consisting of the IP address of this domain, the domain name, the user name and password of the computer belonging to this domain. When the computer is connected to the network, the domain controller first needs to identify whether the computer belongs to this domain. The user enters the domain name in the authentication information, whether the username exists, and whether the password is correct. If the above information is incorrect, the domain controller will refuse the user to log in from this computer. If the user cannot log in, the user cannot access the resources protected by the server, which protects the network to a certain extent. Resources.

The following describes the process of domain controller authentication. Please refer to Figure 3.

Step 310: The node sends a negotiation negotiate request to a Common Internet File System (CIFS) server.

Before establishing a CIFS connection, the node sends a negotiation request to the CIFS server. The CIFS server finally negotiates some important parameters of the communication between the two parties according to its implementation.

Step 320: The CIFS server generates a random password of a random number and sends the random password to the node. Step 330: The node generates an authentication message according to a random password generated by the CIFS server, and the received user name and password, and the authentication message includes the first response of the NTLM (New Technology LAN Manager), and the authentication report is sent. The text is sent to the CIFS server.

Step 340: The CIFS server sends the username, the random password, and the first response to the domain controller. Request a domain controller for authentication.

Step 350: The domain controller calculates the second response according to the random password, the user name, and the real password of the user on the domain controller, and compares with the first response sent by the CIFS server, and the same. If the authentication is successful, the authentication fails, and the authentication result is returned to the CIFS server.

The same steps as step 330 refer to the calculation using a user name, a random password, and a real password of the user on the domain.

Step 360: The CIFS server finally returns the authentication result to the node.

In this embodiment, the shared access is performed on the clustered NAS through the CIFS protocol, so that users on different domain controllers can read and write shared files on different nodes through each node on the cluster. For example, the permissions of different departments of a company are controlled by different domain controllers, but different departments have access rights to the same share. You can use the embodiments of this application to perform rights authentication, and do not need to solve the technology of joining multiple nodes in the same node. The problem is that the CIFS server used by each NAS vendor is samba. Samba cannot implement the same node to join different domain controllers. In addition, various versions of Windows cannot implement operations for joining multiple domain controllers. Referring to FIG. 4, further, the second domain controller that is consistent with the authentication information performs the authentication, and the authentication result is fed back to the first node by using the second node, which may include:

Broadcast authentication information to all nodes in the cluster;

All the nodes in the cluster determine whether the domain information of the domain controller they join meets the authentication information. If yes, the node is the second node, and the second node obtains the authentication result fed back by the domain controller that it joins, and the feedback result is obtained. Send to the first node.

It can be seen from the foregoing embodiment that even if the domain controller that the first node joins, the domain controller that is joined by other nodes can perform authentication to achieve the purpose of accessing the resources on the first node, and also reduce the domain. The risk that the controller will not be able to log in.

It should be noted that a backup domain controller may also be established for the domain controller of each node, thereby further reducing the risk that the domain controller may not be able to log in. Referring to FIG. 5, corresponding to the foregoing method embodiment, the embodiment of the present application further discloses a cross-domain. An authentication device of the controller, the device comprising a first node 510, a second node 520 and a second pre-controller 530:

The first node 510 obtains the authentication information, and the authentication information includes the domain information of the target domain controller. The first node 510 determines whether the authentication information conforms to the domain information of the domain controller to which the node joins. If not, the following:

The second domain controller 530, which is in compliance with the authentication information, performs authentication, and the authentication result is fed back to the first node 510 through the second node 520;

The second node 520 is a node that joins the second domain controller 530. Further, referring to FIG. 6, the first node 510 includes a forwarding unit 511 and a feedback unit 512; the forwarding unit 511 forwards the authentication information to the second node 520, and the second domain controller 530 performs authentication, and the second domain controller 530 The authentication result is fed back to the feedback unit 512, and the feedback unit 512 feeds back the authentication result to the first node 510.

Further, the forwarding unit 511 includes a first searching module, a second searching module, and a sending module. The first searching module is configured to search, in a preset control table, a domain of the domain controller corresponding to the domain information of the target domain controller. Information, and transmitting the domain information of the domain controller to the second search module, where the preset control table includes: node information, domain information of the domain controller to which the node to which the node information belongs;

a second search module, configured to receive domain information of the domain controller from the first search module, and obtain the matching node information in the preset control table according to the domain information of the domain controller obtained by the search, and the matched node information is Second node information, and transmitting the second node information to the sending module;

The sending module is configured to receive the second node information from the second search module, and forward the authentication information to the second node according to the second node information, and perform authentication by the second domain controller that is added by the second node.

In other embodiments of the invention.

The first node may include a broadcast unit;

The broadcast unit is configured to broadcast the authentication information to all nodes in the cluster;

All the nodes in the cluster determine whether the domain information of the domain controller they join meets the authentication information. If yes, the node is the second node, and the second node obtains the authentication result fed back by the domain controller that it joins, and the feedback result is obtained. Send to the first node. The authentication is performed by the second node, and the authentication result is fed back to the first node by using the second node. Therefore, the embodiment of the present application can implement the authentication of the cross-domain controller, thereby satisfying the domain control user accessing the other. The need to share resources on a domain controller node. Referring to FIG. 7, an embodiment of the present invention provides a schematic diagram of a host 700. The host 700 may be a host server that includes computing power, or a personal computer PC, or a portable computer or terminal that can be carried. The specific embodiment of the present invention does not limit the specific implementation of the host. The host 700 includes:

A processor 710, a communications interface 720, a memory 730, and a bus 740.

The processor 710, the communication interface 720, and the memory 730 complete communication with each other via the bus 740. The communication interface 720 is configured to obtain authentication information, and transmit the authentication information to the processor 710. The processor 710 is configured to execute the program 732.

In particular, program 732 can include program code, the program code including computer operating instructions. Processor 710 may be a central processing unit CPU or a specific integrated circuit ASIC

(Application Specific Integrated Circuit), or one or more integrated circuits configured to implement embodiments of the present invention.

The memory 730 is configured to store the program 732. Memory 730 may include high speed RAM memory and may also include non-volatile memory, such as at least one disk storage.

Program 732 can be specifically used to:

Obtain authentication information, where the authentication information includes domain information of the target domain controller;

Determine whether the authentication information meets the domain information of the domain controller to which the node joins. If they do not match, then:

The second domain controller corresponding to the authentication information performs authentication, and the authentication result is fed back to the first node by using the second node;

The second node is a node that joins the second domain controller.

As shown in FIG. 8, the program 732 may include:

The first node 510, the second node 520, and the second pre-controller 530: The first node 510 obtains the authentication information, and the authentication information includes the domain information of the target domain controller. The first node 510 determines whether the authentication information meets the domain information of the domain controller to which the node joins. If not, the following:

The second node 520 is a node that joins the second domain controller 530.

For the specific implementation of each node and the pre-controller in the program 732, refer to the corresponding units in the foregoing embodiment, and details are not described herein. A person skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working process of the device, the device and the unit described above can refer to the corresponding process in the foregoing method embodiment, and details are not described herein again.

In the several embodiments provided herein, it should be understood that the disclosed apparatus, apparatus, and methods may be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, for example, multiple units or components may be combined or Can be integrated into another device, or some features can be ignored, or not executed. Alternatively, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some communication interface, device or unit, and may be in electrical, mechanical or other form. The components displayed by the unit may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solution of the embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

The functions may be stored in a computer readable storage medium if implemented in the form of a software functional unit and sold or used as a standalone product. Based on such understanding, the technical solution of the present invention may contribute to the prior art or part of the technical solution. Illustrated in the form of a software product stored in a storage medium, comprising instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform the embodiments of the present invention. All or part of the steps of the method. The foregoing storage medium includes: a U disk, a removable hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and the like, which can store program codes. .

The above is only a specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope of the present invention. It should be covered by the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the claims.

Claims

Rights request

1. A cross-domain controller authentication method, applied to systems with multiple domain controllers and multiple nodes, characterized in that the method includes:

The first node obtains authentication information, which includes the domain information of the target domain controller; the first node determines whether the authentication information matches the domain information of the domain controller to which this node has joined. If it does not match, then:

The second domain controller that matches the authentication information performs authentication, and the authentication result is fed back to the first node through the second node;

Wherein, the second node is a node that joins the second domain controller.

2. The method according to claim 1, characterized in that: the second domain controller that matches the authentication information performs authentication, and the authentication result is fed back to the first node through the second node, including: The first node forwards the authentication information to the second node, and the second domain controller performs authentication. The second domain controller feeds back the authentication result to the second node. The second node transmits the authentication information to the second node. The authentication result is fed back to the first node.

3. The method according to claim 2, characterized in that: forwarding the authentication information to the second node, and performing authentication by a second domain controller joined by the second node, includes:

Search the domain information of the domain controller corresponding to the domain information of the target domain controller in the preset control table, where the preset control table includes: node information, domain control joined by the node to which the node information belongs Domain information of the server;

Find matching node information in the preset control table based on the domain information of the domain controller obtained by the search, and the matching node information is the second node information;

The authentication information is forwarded to the second node, and the second domain controller joined by the second node performs authentication.

4. The method according to claim 1, characterized in that: the second domain controller that matches the authentication information performs authentication, and the authentication result is fed back to the first node through the second node, including: The authentication information is broadcast to all nodes in the cluster;

All nodes in the cluster determine whether the domain information of the domain controller they join meets the authentication information. If so, the node is the second node, and the second node obtains feedback from the domain controller it joins. The authentication result is obtained, and the feedback result is sent to the first node.

5. A cross-domain controller authentication device, characterized in that the device includes a first node, a second node and a second pre-controller:

The first node obtains authentication information, and the authentication information includes the domain information of the target domain controller; the first node determines whether the authentication information matches the domain information of the domain controller to which the node has joined. If it does not match, but:

Wherein, the second node is a node that joins the second domain controller.

6. The device according to claim 5, characterized in that,

The first node includes a forwarding unit and a feedback unit;

The forwarding unit forwards the authentication information to the second node, and the second domain controller performs authentication. The second domain controller feeds back the authentication result to the feedback unit, and the feedback unit sends the The authentication result is fed back to the first node.

7. The device according to claim 6, characterized in that,

The forwarding unit includes a first search module, a second search module and a sending module:

The first search module is used to search the domain information of the domain controller corresponding to the domain information of the target domain controller in the preset control table, and transmit the domain information of the domain controller obtained by the search. To the second search module, wherein the preset control table includes: node information, domain information of the domain controller to which the node information belongs;

The second search module is configured to receive the domain information of the domain controller obtained from the search from the first search module, and find the domain information of the domain controller found in the preset control table according to the search. Matching node information, the matching node information is second node information, and transmitting the second node information to the sending module;

The sending module is configured to receive the second node information from the second search module, and forward the authentication information to the second node according to the second node information, and the second node joins second domain controller for authentication.

8. The device according to claim 5, characterized in that,

The first node includes a broadcast unit;

The broadcast unit is used to broadcast the authentication information to all nodes in the cluster; All nodes in the cluster determine whether the domain information of the domain controller they join meets the authentication information. If so, the node is the second node, and the second node obtains feedback from the domain controller it joins. The authentication result is obtained, and the feedback result is sent to the first node.

9. A host, characterized in that the host includes a processor, a communication interface, a memory and a bus;

Among them, the processor, communication interface, and memory complete communication with each other through the bus;

The communication interface is used to obtain authentication information and transmit the authentication information to the processor; the processor is used to execute programs;

The memory is used to store programs;

Where the program is used for:

Determine whether the authentication information matches the domain information of the domain controller to which this node has joined. If not, then:

Wherein, the second node is a node that joins the second domain controller.

+