WO2019238006A1

WO2019238006A1 - Access authentication method for port, terminal, and storage medium

Info

Publication number: WO2019238006A1
Application number: PCT/CN2019/090547
Authority: WO
Inventors: 杨曦
Original assignee: 中兴通讯股份有限公司
Priority date: 2018-06-12
Filing date: 2019-06-10
Publication date: 2019-12-19
Also published as: CN110602022A

Abstract

Disclosed in the embodiments of the present invention are an access authentication method for a port, a terminal and a storage medium. The method comprises: creating an aggregation group of ports according to link configuration information concerning at least two ports; one said aggregation group corresponding to one aggregation port; creating a corresponding management port table entry for said aggregation group of ports; acquiring an access authentication state of the aggregation port; and configuring, according to the management port table entry, the access authentication state of the aggregation port to member ports corresponding to the aggregation port.

Description

Port access authentication method, terminal and storage medium

This application claims priority from Chinese patent application CN201810603272.9 entitled "A port access authentication method, terminal, and storage medium" filed on June 12, 2018, the entire contents of which are incorporated herein by reference.

Technical field

Embodiments of the present invention relate to port authentication technologies in the field of communication technology, and relate to, but are not limited to, a port access authentication method, terminal, and storage medium.

Background technique

802.1x, as a simple user access authentication protocol, is widely used in switches. 802.1x controls whether users can access the network by setting port authentication or unauthenticated status. The Link Aggregation Control Protocol (LACP) aggregates multiple ports together to form an aggregation group, so as to realize the sharing of the inbound / outbound load among the member ports in the aggregation group, providing more reliable and higher bandwidth. Access. Both LACP and 802.1x protocols are port-level protocols. On the same device, the two cannot be easily superimposed.

For example, in related optical network access technologies, optical line terminals (OLT) can be connected to small devices or optical network units (ONUs). Among them, ONUs generally do not support the 802.1x protocol. , Small devices connected under the OLT support the 820.1x protocol. Under normal networking conditions, operators will choose to enable 802.1x uniformly on the OLT to ensure the consistency of the protocol. In this case, when small devices connected to the OLT choose to enable the LACP protocol, the 802.1x protocol and the LACP protocol are used. All belong to the port level protocol, so the protocol supported by the aggregation port formed by the LACP protocol cannot be a simple superposition of the protocols supported by the member ports of the aggregation port, that is, the problem that the 802.1x protocol and the LACP protocol cannot be shared on the OLT, As a result, the access authentication state machine cannot perform overall access authentication on the aggregated port.

Summary of the Invention

In order to solve the existing technical problems, embodiments of the present invention provide a port access authentication method, terminal, and storage medium.

The technical solution of the embodiment of the present invention is implemented as follows:

An embodiment of the present invention provides a method for port access authentication. The method includes:

Create an aggregation group of ports according to the link configuration information of at least two ports; wherein one of the aggregation groups corresponds to one aggregation port;

Creating a corresponding management port entry for the port aggregation group;

Acquiring the access authentication status of the aggregation port;

According to the management port entry, the access authentication status of the aggregation port is configured to a member port corresponding to the aggregation port.

An embodiment of the present invention provides a device for access authentication of a port. The device at least includes a processor and a storage medium configured to store executable instructions, where:

The processor is configured to execute a stored executable instruction configured to perform the method for access authentication of a port described above.

An embodiment of the present invention provides a computer-readable storage medium, where the computer-readable storage medium stores computer-executable instructions configured to perform the foregoing method for protecting contact data; or The execution instruction is configured to perform the method of access authentication of the port described above.

Embodiments of the present invention provide a port access authentication method, terminal, and storage medium, wherein an aggregation group of ports is created according to link configuration information of at least two ports; wherein one of the aggregation groups corresponds to one aggregation port; Create a corresponding management port entry for the aggregation group of the port; obtain the access authentication status of the aggregation port; configure the access authentication status of the aggregation port to the aggregation port according to the management port entry Corresponding member port; In this way, by completing the online and authentication configuration conversion between the protocol and the user port, the port-level protocol is shared with the device, which improves user access security and provides users with higher access bandwidth.

BRIEF DESCRIPTION OF THE DRAWINGS

In the drawings, which are not necessarily drawn to scale, similar reference numerals may describe similar components in different views. Similar reference numerals with different letter suffixes may represent different examples of similar components. The drawings generally illustrate various embodiments discussed herein by way of example and not limitation.

FIG. 1 is a schematic flowchart of implementing access authentication of a port according to an embodiment of the present invention;

FIG. 2 is a schematic flowchart of an access authentication implementation of another port according to an embodiment of the present invention; FIG.

3 is a schematic diagram of a composition result of a device for access authentication of a port according to an embodiment of the invention;

4 is a schematic structural diagram of a three-level management port entry created according to an embodiment of the present invention;

5A is a schematic flowchart of an implementation of adding a new member port according to an embodiment of the invention;

5B is a schematic flowchart of an implementation of deleting a member port according to an embodiment of the invention;

6 is a schematic flowchart of an implementation of modifying an aggregate port state according to an embodiment of the present invention;

FIG. 7 is a schematic flowchart of an implementation of an online and offline state of an aggregate port according to an embodiment of the present invention; FIG.

FIG. 8 is a schematic flowchart of implementing an access authentication method for another port according to an embodiment of the present invention; FIG.

FIG. 9 is a schematic structural diagram of a terminal according to an embodiment of the present invention.

detailed description

Generally, Link Aggregation technology refers to bundling multiple physical ports together to achieve load sharing of inbound and outbound traffic among member ports. The switch determines packets according to the port load sharing policy configured by the user. Which member port is sent to the peer switch. When the switch detects that the link of one of the member ports fails, it stops sending packets on this member port, and reloads the remaining links based on the load sharing strategy. Calculate the message sending port. After the faulty port recovers, recalculate the message sending port again. Link aggregation is a very important technology in terms of increasing link bandwidth and achieving link transmission flexibility and redundancy. Because the state machine of the access authentication protocol in the prior art cannot perform overall access authentication on the aggregated ports obtained through the link set, there is a problem of network access security when the aggregated ports are used for message transmission.

The LACP state machine in the terminal can perform link aggregation through the LACP protocol according to the link configuration information of the port to form a corresponding aggregation group. For example, switch A needs to establish an aggregation connection of two lines with switch B. It only needs to enable LACP for two ports on switch A. Switch A only needs to connect with switch B. Two switches between switch A and switch B Link aggregation; then physically link the two links to complete the aggregation of the two links. At this time, an aggregation group with two member ports is formed on Switch A. Here, the switch A may be an OLT switch B may be one of a small device connected to the OLT or an ONU connected to the OLT.

Based on this, an embodiment of the present invention provides a port access authentication method. FIG. 1 is a schematic diagram of a process for implementing port access authentication according to an embodiment of the present invention. As shown in FIG. 1, the method includes the following steps:

Step S101: Create a port aggregation group according to the link configuration information of at least two ports.

Here, any one of the at least two ports may separately support LACP or 802.1x protocols. The creating an aggregation group of ports according to the link configuration information of at least two ports may be a user according to the link configuration information of the configured ports, the link aggregation controller system in the terminal starts a link aggregation protocol, and the links in the terminal The aggregation controller system automatically performs link aggregation to form a corresponding aggregation group according to the link configuration information of the port configured by the user.

Step S102: Create a corresponding management port entry for the port aggregation group.

Here, the management port entry is a three-level management port entry, wherein the first-level management port entry is a physical port configured in the aggregation group and is responsible for the state management of the port; the second-level management port table Entry is the activated physical port in the aggregation group and is responsible for message sending; the third-level management port entry is the aggregation port that controls access authentication for the access authentication protocol state machine and is responsible for accessing the authentication protocol state machine. run. The management port entry is used to store the port identifiers of all physical ports included in the aggregation group, the port identifiers of the activated physical ports included in the aggregation group, and the port identifiers of the aggregation ports corresponding to the aggregation group. Mapping relations.

The creation of a corresponding management port entry for the aggregation group of the port may be that the link aggregation controller in the terminal automatically performs link aggregation to form a corresponding aggregation group according to the link configuration information of the port configured by the user. The link aggregation controller sends a message to the terminal processor to create a management port. The message contains the port identifiers of all the physical ports included in the aggregation group, and the activated physical port ports included in the aggregation group. The identifier and the port identifier of the aggregation port corresponding to the aggregation group; the processor of the terminal creates a corresponding management port entry according to the message.

Step S103: Acquire the access authentication status of the aggregation port.

Here, the access authentication status of the aggregation port includes an authentication status and a non-authentication status.

The obtaining the access authentication status of the aggregated port may be a process in which the terminal processes and receives a message sent by a user through a physical port to perform access authentication, and the message carries a port identifier of a physical port that sends the message. The processor of the terminal searches for the port identifier of the aggregation port corresponding to the physical port in the management port entry according to the port identifier of the physical port, and the processor of the terminal controls access authentication to the aggregation port , The processor of the terminal receives the access authentication status of the aggregation port.

The obtaining the access authentication status of the aggregated port may also be that the user port of the terminal sends a request to the processor of the terminal for access authentication, and the request carries the port identifier of the user port that sent the request, and the processor of the terminal The request determines a port identifier of an aggregation port corresponding to the user port, the processor of the terminal controls access authentication to the aggregation port, and the processor of the terminal receives the access authentication status of the aggregation port.

Step S104: Configure the access authentication status of the aggregation port to a member port corresponding to the aggregation port according to the management port entry.

Here, the member ports corresponding to the aggregation port include all physical ports in the aggregation group, and the member ports include all physical ports included in the aggregation group corresponding to the aggregation port.

The configuring the access authentication status of the aggregation port to a member port corresponding to the aggregation port according to the management port entry may be after the processor of the terminal receives the access authentication status of the aggregation port. By querying the management port entry for a port of a physical port in an aggregation group corresponding to the aggregation port, and the processor of the terminal configures the access authentication status of the aggregation port to an aggregation group corresponding to the aggregation port. Contained on all physical ports.

In the embodiment of the present invention, an aggregation group of ports is created according to the link configuration information of at least two ports; wherein one aggregation group corresponds to one aggregation port, and a corresponding management port entry is created for the aggregation group of the ports; Obtain the access authentication status of the aggregation port; configure the access authentication status of the aggregation port to the member port corresponding to the aggregation port according to the management port entry; thus, by completing the protocol with the user port On-line and authentication configuration conversion, the port-level protocol is shared with the device, which improves user access security and provides users with higher access bandwidth.

An embodiment of the present invention provides a method for access authentication of a port. FIG. 2 is a schematic diagram of an implementation process of access authentication of another port according to an embodiment of the present invention. As shown in FIG. 2, the method includes the following steps:

Step S201: Create an aggregation group of ports according to the link configuration information of at least two ports.

Here, the link configuration information of the port includes information such as link aggregation information, rate, and duplex attributes of the port; the one aggregation group corresponds to one aggregation port, and the aggregation port includes online and offline status, support All protocols supported by all member ports in the aggregation group.

The creation of the port aggregation group based on the link configuration information of at least two ports may be that the user starts the link aggregation protocol on the link aggregation controller system in the terminal and the link in the terminal according to the link configuration information of the configured port. The aggregation controller system automatically performs link aggregation to form a corresponding aggregation group according to the link configuration information of the port configured by the user.

Step S202: Obtain a packet for access authentication of member ports in the aggregation group.

Step S203: Create a management port entry corresponding to the aggregation group of the port according to the message.

Here, the management port entry is used to store port identifiers of all physical ports included in the aggregation group, port identifiers of activated physical ports included in the aggregation group, and port identifiers of the aggregation ports corresponding to the aggregation group. The management port table entry may be a three-level management port table entry, wherein the first-level management port table entry is a physical port configured in the aggregation group and is responsible for the state management of the port; The management port entry is an activated physical port in the aggregation group and is responsible for message transmission; the third-level management port entry is an aggregation port for access authentication protocol state machine to control access authentication and is responsible for access authentication protocol Operation of the state machine.

The creation of the management port entry corresponding to the aggregation group of the port according to the message may be that the link aggregation controller in the terminal automatically performs link aggregation to form a corresponding one according to the link configuration information of the port configured by the user. Aggregation group, the link aggregation controller in the terminal sends a message to the processor of the terminal, and the message carries the port identifier of the member port in the aggregation group and the aggregation corresponding to the aggregation group The port identifier of the port, the processor of the terminal creates a first-level management port entry according to the port identifier of the member port in the message, and the processor of the terminal according to the port of the aggregated port in the message It is identified that a first-level management port entry is created; when the link aggregation protocol is enabled and activated and the port is activated, the processor of the terminal creates a corresponding second-level management port entry according to the activated member port.

The creation of the management port entry corresponding to the aggregation group of the port according to the message may also be that the link aggregation controller in the terminal automatically performs link aggregation to form a correspondence according to the link configuration information of the port configured by the user An aggregation group of the terminal, the link aggregation controller in the terminal sends a request for creating a management port entry to a processor of the terminal, and the request carries a port identifier of a member port in the aggregation group and the The port identifier of the aggregation port corresponding to the aggregation group, the processor of the terminal creates a first-level management port entry according to the port identification of the member port in the request, and at the same time, creates a corresponding one of the member ports in the aggregation group. The third-level management port entry of the aggregation port; when the link aggregation protocol is enabled to activate and activate the port, the processor of the terminal creates a corresponding second-level management port entry according to the activated member port.

Step S204: The access authentication protocol state machine is controlled to perform access authentication on the aggregation port to obtain the access authentication status of the aggregation port.

Here, the control access authentication protocol state machine performs access authentication on the aggregated port to obtain the access authentication state of the aggregated port: the processor of the terminal receives a message sent by a user for access authentication, and The packet carries the port identifier of the first-level port corresponding to the first-level management entry, and the processor of the terminal searches for the corresponding second-level port in the management port entry according to the port identifier of the first-level port. And sending the message for performing access authentication to the access authentication state machine through the second-level port to perform access authentication on a third-level port corresponding to the first-level port.

The obtaining the access authentication status of the aggregated port may be that when the access authentication state machine receives the message, the access authentication protocol state machine initializes and starts to the third The first-level port performs access authentication, and at the same time, the result of the access authentication is fed back to the processor of the terminal through the second-level port, and the processor of the terminal receives the access authentication status of the aggregated port.

Step S205: The processor of the terminal configures the access authentication status of the aggregation port to a member port corresponding to the aggregation port according to the management port entry.

Here, when the access authentication state machine modifies the access authentication state of the aggregation port, the processor of the terminal receives the modified access authentication state of the aggregation group. The processor of the terminal configures the modified access authentication status of the aggregation group to a member port of the aggregation group.

In the embodiment of the present invention, an access authentication state machine is used to perform access authentication on a set aggregation port that meets the requirements of the access authentication protocol, and the access authentication protocol state machine is controlled to perform access authentication on the aggregation port. The method of configuring the access authentication status corresponding to an aggregation port to all member ports corresponding to the aggregation port realizes access authentication of the aggregation port through the access authentication state machine, and implements port-level protocol sharing with devices. While improving user access security, it also provides higher bandwidth for user access.

In other embodiments, the step S203, that is, "controlling the access authentication protocol state machine to perform access authentication on the aggregation port to obtain the access authentication status of the aggregation port" includes the following steps:

Step S231: Determine the online and offline status of the corresponding aggregation port according to the online and offline status of the member ports in the aggregation group.

Here, the online state of the member port may be a state where one port is online or offline, or a plurality of ports may be online or offline. The processor of the terminal determines the number of member ports in the aggregation group whose online and offline states are online.

If the number of the member ports in the aggregation group whose online status is online is greater than 0, determine that the online status of the corresponding aggregation port is online; if all the member ports in the aggregation group are offline, The online status determines whether the corresponding aggregation port goes offline or online.

Step S232: Control the access authentication protocol state machine to perform access authentication on the aggregation port according to the online and offline status of the aggregation port to obtain the access authentication status of the aggregation port.

Here, the step S232, that is, "controlling the access authentication protocol state machine to perform access authentication on the aggregation port according to the online and offline status of the aggregation port to obtain the access authentication status of the aggregation port" includes :

When it is determined that the online and offline status of the aggregation port is online, controlling the access authentication protocol state machine to perform access authentication on the aggregation port to obtain the access authentication status of the aggregation port;

When it is determined that the online and offline status of the aggregation port is an offline state, the access authentication protocol state machine is controlled to terminate access authentication on the aggregation port, and at the same time, the access authentication protocol state machine is controlled to initialize.

In other embodiments, in step S204, that is, "the processor of the terminal configures the access authentication status of the aggregation port to the member port corresponding to the aggregation port according to the management port entry" After that, the method also includes the following two cases:

The first case: when a link aggregation state machine adds a member port to the aggregation group, the following steps can be implemented:

Step S241: The processor of the terminal obtains a first-type port identifier, and updates a management port entry according to the first-type port identifier.

Here, the first type of port identifier includes the port identifier of the newly added member port; for example, the aggregation port corresponding to the original aggregation group is composed of three member ports: port 1, port 2 and port 3. When a new member port 4 joins the aggregation group, the port identifier of the member port 4 is the first type of port identifier. In step S241, the processor of the terminal obtains the first-type port identifier, and updates the management port entry according to the first-type port identifier. It can be understood that the aggregation support device according to the first-type port identifier of the newly added user port ( That is, the identifier of port 4) finds the corresponding 802.1x aggregation port (that is, the aggregation port corresponding to the aggregation group to which port 4 joins); if the corresponding 802.1x aggregation port cannot be found, the aggregation support device assigns a new Aggregation port.

Step S242: Acquire the access authentication status of the first aggregation port according to the first-type port identifier.

Here, the first-type port identifier may correspond to one newly-added port or multiple newly-added ports; the first aggregation port corresponds to a member port having the first-type port identifier. Aggregation port; for example, the aggregation port corresponding to the original aggregation group is composed of three member ports: port 1, port 2, and port 3. When another new member port 4 is added to the aggregation group, the aggregation group includes Four member ports: port 1, port 2, port 3, and port 4. The aggregation port corresponding to the aggregation group is the first aggregation port.

Step S243: Configure the access authentication status of the first aggregation port to a member port of the first aggregation group according to the updated management port entry, where the first aggregation group is the one corresponding to the first aggregation port. Aggregation group.

Here, when the access authentication state of the first aggregation port is configured on a member port of the first aggregation group, the 802.1x state machine corresponding to the aggregation port is in a suspended state; the processor of the terminal is based on the updated Manage port entries, configure the access authentication status of the first aggregation port to the member ports of the first aggregation group, the first aggregation group is the aggregation group corresponding to the first aggregation port, and control the The access authentication protocol state machine abandons access authentication for member ports in the first aggregation port.

Case 2: When the link aggregation state machine deletes a member port from the aggregation group, the following steps can be implemented:

Step S244: Obtain a second-type port identifier, where the second-type port identifier includes the port identifier of the deleted member port.

Here, the second type of port identifier may correspond to one deleted port or multiple deleted ports; for example, the aggregation port corresponding to the original aggregation group is composed of three member ports: port 1, port 2 And port 3, if port 3 is deleted from the aggregated port, the identifier of port 3 is the second type of port identifier.

Step S245: Control the access authentication protocol state machine to resume access authentication on the second type of port.

Here, the second type of port is a port corresponding to the second type of port identifier; for example, the aggregation port corresponding to the original aggregation group is composed of three member ports: port 1, port 2, and port 3. If port 3 is deleted from the aggregation port, then port 3 is the second type port. The processor of the terminal controls the access authentication protocol state machine to resume access authentication on the second type of port, and at the same time, determines the number of member ports of the second aggregation port, where the second aggregation port is the second The previous aggregation port corresponding to the class port deletes the aggregation port corresponding to the second type port; according to the number of member ports in the second aggregation group, releases the aggregation corresponding to the previous aggregation group corresponding to the second type port port.

In other embodiments, when the link aggregation state machine deletes a member port from the aggregation group, the method further includes the following steps:

Step S246: Determine the number of member ports of the second aggregation port.

Here, the second aggregation port is an aggregation port corresponding to the second type port before deleting the second type port. For example, the aggregation port corresponding to the original aggregation group is composed of three member ports: port 1, port 2, and port 3. If port 3 is deleted from the aggregation port, the second type of port is that port 3 is not Delete the previous aggregation port (that is, the aggregation port corresponding to the original aggregation group).

Step S247: Determine the number of member ports of the third aggregation port according to the second type of port identifier and the number of member ports of the second aggregation port.

Here, the third aggregation port is an aggregation port corresponding to the second aggregation port after the second type of port is deleted. For example, the aggregation port corresponding to the original aggregation group is composed of three member ports: port 1, port 2 and port 3. If port 3 is deleted from the aggregation port, after deleting port 3, the members in the aggregation group are Ports 1 and 2 and the aggregated ports corresponding to ports 1 and 2 are the third aggregated ports.

Step S248: Release the second aggregation port according to the number of member ports of the third aggregation port.

Here, the release of the second aggregation port can be understood as the second aggregation port (for example, port 3) has been deleted from the second aggregation port, so the second aggregation port becomes the third aggregation port. That is, the second aggregation port no longer exists, so there is no need to control the second aggregation port, that is, release the second aggregation port.

An embodiment of the present invention provides a port access authentication method (the operations of the embodiments of the present invention are based on the 802.1x protocol). FIG. 3 is a schematic diagram of a composition result of the port access authentication device according to the embodiment of the present invention, as shown in FIG. As shown, the device includes four modules: an aggregation support device module 301, an 802.1x state machine module 302, a LACP state machine module 303, a message transceiver module 304, and a port state configuration module 305, of which:

The aggregation support device module 301 is configured to support the 802.1x protocol and provide overall port management for the 802.1x protocol. The aggregation support device module 301 exists between the 802.1x state machine module 302, the LACP state machine 303, and the message transceiver module 304.

In the aggregation support device module 301, the port managed by the 802.1x state machine is no longer the actual user port, but the overall port state. The biggest difference between the port managed by the 802.1x state machine and the aggregate port is that the port managed by the 802.1x state machine has online and offline status and protocol-controlled authentication, and the non-authentication status must meet the requirements of the 802.1x protocol management port.

When the port authentication state controlled by the 802.1x protocol is sent to the aggregation support device, the aggregation support device is converted into each actual port state and configured to the actual port. Whether the link state change of each actual port is reflected on the overall port state is determined and notified by the aggregation support device.

The 802.1x state machine module 302 is used to manage the authentication status of the 802.1x management port. When not authenticated, the 802.1x management port can still perform LACP protocol interaction, so that the 802.1x protocol and the LACP protocol are shared in the same device.

The LACP state machine module 303 is configured to notify the aggregation support device module 301 to create a level 2 port table.

The message sending and receiving module 304 is configured to send and receive 802.1x messages and trigger a status update when the 802.1x state machine module 302 runs normally.

The aggregation support device module 301 is configured to create an aggregation group of ports according to the link configuration information of at least two ports, and to create a three-level management port entry for each aggregation group. FIG. 4 is a schematic structural diagram of a three-level management port entry created according to an embodiment of the present invention. As shown in FIG. 4, the three-level management port entry includes:

The first-level management port entry is used to indicate the LACP configuration port. The first-level management port entry is the physical port configured in the aggregation group and is responsible for the state management of the port. For example, the first-level management port entry controls the port. Enabled and disabled state and user non-protocol message interaction.

The second-level management port entry is used to indicate an LACP activation port; the second-level management port entry is an activated physical port in the aggregation group and is responsible for sending packets;

The third-level management port entry is used to indicate the overall port used by 802.1x. The third-level management port entry is the aggregation port that controls the access authentication for the access authentication protocol state machine and is responsible for accessing the authentication protocol state machine (that is, , 802.1x state machine).

The port status configuration module 305 is configured to receive a notification message from the aggregation support device module 301, and configure a status for each port according to the notification message.

In the process of implementing the port access authentication method, LACP's management of user ports includes the first case (see FIG. 5A) and the second case (see FIG. 5B), where:

Case 1: When LACP newly manages a user port (that is, when a link aggregation state machine adds a member port to the aggregation group), as shown in FIG. 5A, the method can be implemented by the following steps: :

Step S501: When LACP newly manages a certain user port, the aggregation support device searches for the 802.1x aggregation port corresponding to the user port.

Here, the aggregation support device is controlled by the processor of the terminal, and the aggregation support device searches for a corresponding 802.1x aggregation port according to the first-type port identifier of the newly added user port.

In step S502, if there is no 802.1x aggregation port corresponding to the user port, the aggregation support device allocates a new aggregation port to the user port.

Here, allocating a new aggregation port to the user port is to update the management port entry according to the first type of port identifier, and obtain the authentication status of the first aggregation port.

Step S503: The aggregation support device notifies the 802.1x state machine to perform access authentication on the new aggregation port.

The second case: When LACP deletes and manages a user port, as shown in FIG. 5B, the method can be implemented by the following steps:

In step S511, when LACP deletes and manages a certain user port, the aggregation support device obtains the first type of port identifier.

Step S512: The aggregation support device deletes the first-type port identifier and its corresponding second-type port identifier, and notifies the 802.1x state machine of the first-type port identifier.

In step S513, the 802.1x state machine resumes performing access authentication on the first-level port of the user port.

Here, the 802.1x state machine resumes performing access authentication on the first-level port of the user port, which can be understood as: first, when a certain user port (for example, port 1) is enabled in the 802.1x protocol and LACP protocol is not enabled The 802.1x state machine performs access authentication on port 1. Second, after LACP is enabled on port 1, the 802.1x state machine no longer performs access authentication on port 1, but performs access authentication on the aggregate port corresponding to port 1. . The 802.1x state machine corresponding to port 1 will not run; finally, when port 1 is deleted from the aggregated port, the 802.1x state machine will perform access authentication on port 1 again.

In other embodiments, after allocating a new aggregation port to the user port, the method further includes:

First, the aggregation support device receives the 802.1x message and finds the aggregation port corresponding to the second-level port that sends the 802.1x message (that is, the aggregation port generated when the LACP protocol activates the port); second, the aggregation support device will find The aggregation port corresponding to the second-level port is notified to the 802.1x state machine. Finally, the 802.1x state machine updates the state of the aggregated port corresponding to the found second-level port.

In other embodiments, after step S513, the 802.1x state machine resumes level 1 port management of the user port, the method further includes:

The aggregation support device determines whether there is a first-level user port under the current aggregation port. If there is no first-level user port, it notifies the 802.1x state machine to release the current aggregation port. For example, when an aggregation group joins, several ports can join at the same time. When port 2 is added to the aggregation group where port 1 is located, the first-level user ports in the aggregation group include two: port 1 and port 2. At this time, if port 1 is deleted from the aggregation group, the 802.1x state machine performs access authentication on port 1 and the third-level port corresponding to the aggregation group. At this time, the aggregation port still takes effect. If port 2 is also deleted from the aggregation group, the first-level user ports in the aggregation group will not have any actual ports. At this time, the aggregation port can be deleted to release the aggregation port that has been created.

FIG. 6 is a schematic flowchart of an implementation of modifying an aggregate port state according to an embodiment of the present invention. As shown in FIG. 6, the modifying the aggregate port state includes the following steps:

Step S601: When the 802.1x state machine needs to modify the state of the aggregation port, the aggregation support device searches for the corresponding first-level user port.

Step S602: The aggregation support device configures a corresponding state for the first-level user port according to the 802.1x state machine management port state.

Here, the aggregation support device configures the corresponding state for the first-level user port according to the 802.1x state machine management port status. It can be understood that the aggregation support device configures the modified access authentication status of the aggregation group to On the member ports of the aggregation group.

FIG. 7 is a schematic flowchart of implementing an online state of an aggregate port according to an embodiment of the present invention. As shown in FIG. 7, the online state of the aggregate port includes the following steps:

In step S701, the aggregation support device records the online and offline status of the current aggregation port according to the online and offline status of the first-level user port.

Here, the first-level user port may be any member port in the aggregation group; when the state of the first-level user port is the first online state or the last offline state of the first-level user port To record the online and offline status of the current aggregation port.

In step S702, the aggregation support device notifies the 802.1x state machine of the current online and offline status of the aggregated port.

Step S703: The 802.1x state machine performs access authentication on the aggregation port to obtain the access authentication status of the aggregation port.

FIG. 8 is a schematic flowchart of an access authentication method for another port according to an embodiment of the present invention. As shown in FIG. 8, the method includes the following steps:

Step S801: Create an aggregation group of ports according to the link configuration information of at least two ports.

Here, in the aggregation group for creating a port, LACP instructs the aggregation support device to create a first-level port entry, and simultaneously generates a third-level port entry. At this time, the 802.1x state machine is notified to manage the aggregation port corresponding to the aggregation group and suspend the port state machine of the first-level port entry.

In step S802, the LACP protocol is enabled, and the LACP state machine notifies the aggregation support device to create a second-level port entry of the aggregation port.

Step S803: The aggregation support device searches for a third-level port entry corresponding to the aggregation port according to the first-level port entry.

Here, when the user initiates 802.1x authentication, the aggregation support device searches for a third-level port entry corresponding to the first-level port entry according to the first-level port entry sent during the 802.1x authentication process.

In step S804, the aggregation support device notifies the status update when the 802.1x state machine runs normally.

Here, the 802.1x message sent during the 802.1x authentication initiated by the user triggers a status update when the 802.1x state machine is running normally.

Step S805: The aggregation support device searches for a third-level port entry corresponding to the 802.1x packet according to the 802.1x packet, and then searches for a second-level port entry corresponding to the third-level port entry.

Step S806: The aggregation support device configures the states of all the first-level port entries according to the third-level port entries.

Here, the aggregation support device configures the state of all the first-level port entries according to the third-level port entry. It can be understood that the user completes 802.1x authentication, and the aggregation support device configures the state of the aggregation port for the current aggregation group.

An embodiment of the present invention provides a terminal for port access authentication. FIG. 9 is a schematic structural diagram of a terminal according to an embodiment of the present invention. As shown in FIG. 9, the terminal 900 includes at least a controller 901 and a storage device configured to store the terminal. Executable instruction storage medium 902, where:

The controller 901 is configured to execute stored executable instructions, where the executable instructions are used to implement the following steps:

Creating a corresponding management port entry for the port aggregation group;

Acquiring the access authentication status of the aggregation port;

It should be noted that, in the embodiment of the present invention, if the above-mentioned port access authentication method is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium. . Based on such an understanding, the technical solution of the embodiments of the present invention that is essentially or contributes to the existing technology can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for A computer device (which may be a personal computer, a server, or a network device) is caused to execute all or part of the methods described in the embodiments of the present invention. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (Read Only Memory, ROM), a magnetic disk, or an optical disk, which can store program codes. In this way, the embodiments of the present invention are not limited to any specific combination of hardware and software.

Correspondingly, an embodiment of the present invention provides a computer storage medium, where the computer storage medium stores computer-executable instructions, and the computer-executable instructions are configured to execute a method for access authentication of a port provided by other embodiments of the present invention.

Those skilled in the art should understand that the embodiments of the present invention may be provided as a method, a system, or a computer program product. Therefore, the present invention may take the form of a hardware embodiment, a software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, magnetic disk memory, optical memory, etc.) containing computer-usable program code.

The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, and combinations of processes and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing device to produce a machine, so that instructions generated by the processor of the computer or other programmable data processing device may be used to A device for implementing the functions specified in one or more flowcharts and / or one or more blocks of the block diagrams.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to work in a particular manner such that the instructions stored in the computer-readable memory produce a manufactured article including the instruction device, the instructions The device implements the functions specified in one or more flowcharts and / or one or more blocks of the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of steps can be performed on the computer or other programmable device to produce a computer-implemented process, which can be executed on the computer or other programmable device. The instructions provide steps for implementing the functions specified in one or more flowcharts and / or one or more blocks of the block diagrams.

The above description is only the preferred embodiments of the present invention, and is not intended to limit the protection scope of the present invention.

Claims

A port access authentication method, wherein the method includes:

Create an aggregation group of ports according to the link configuration information of at least two ports; wherein one of the aggregation groups corresponds to one aggregation port;

Creating a corresponding management port entry for the port aggregation group;

Acquiring the access authentication status of the aggregation port;

According to the management port entry, the access authentication status of the aggregation port is configured to a member port corresponding to the aggregation port.
The method according to claim 1, wherein the obtaining the access authentication status of the aggregation port comprises:

Control the access authentication protocol state machine to perform access authentication on the aggregation port to obtain the access authentication state of the aggregation port.
The method according to claim 1, wherein the creating a corresponding management port entry for the aggregation group of the ports comprises:

Obtaining a packet for access authentication of a member port in the aggregation group;

Create a management port entry corresponding to the aggregation group of the port according to the message.
The method according to claim 2, wherein the performing access authentication on the aggregation port by using an access authentication protocol state machine to obtain the access authentication status of the aggregation port comprises:

Determining the online and offline status of the corresponding aggregation port according to the online and offline status of the member ports in the aggregation group;

Controlling the access authentication protocol state machine to perform access authentication on the aggregation port according to the online and offline status of the aggregation port to obtain the access authentication state of the aggregation port.
The method according to claim 4, wherein determining the online and offline status of the corresponding aggregation port according to the online and offline status of the member ports in the aggregation group comprises:

If the online and offline states of all member ports in the aggregation group are offline, determine that the online and offline states of the corresponding aggregate port are offline;

or,

Obtain the number of member ports in the aggregation group that are online or offline; if the number of member ports in the aggregation group that are online or offline is greater than 0, determine that the corresponding aggregation port is online or offline .
The method according to claim 4, wherein the controlling the access authentication protocol state machine to perform access authentication on the aggregation port according to the online and offline status of the aggregation port to obtain access authentication of the aggregation port Status, including:

When it is determined that the online and offline status of the aggregation port is online, controlling the access authentication protocol state machine to perform access authentication on the aggregation port to obtain the access authentication status of the aggregation port;

When it is determined that the online and offline status of the aggregation port is an offline state, the access authentication protocol state machine is controlled to terminate access authentication on the aggregation port, and at the same time, the access authentication protocol state machine is controlled to initialize.
The method of claim 1, further comprising:

Acquiring a first-type port identifier, and updating a management port entry according to the first-type port identifier; wherein the first-type port identifier includes a port identifier of a newly added member port;

Obtaining the access authentication status of the first aggregation port according to the first-type port identifier, where the first aggregation port is an aggregation port corresponding to a member port having the first-type port identifier;

According to the updated management port entry, the access authentication status of the first aggregation port is configured to a member port of the first aggregation group, and the first aggregation group is an aggregation group corresponding to the first aggregation port.
The method according to claim 7, wherein the method further comprises:

And controlling the access authentication protocol state machine to abandon the access authentication of the member port in the first aggregation port according to the port identifier of the newly added member port and the updated management port entry.
The method of claim 1, further comprising:

Obtaining a second-type port identifier, where the second-type port identifier includes a port identifier of a deleted member port;

Controlling the access authentication protocol state machine to resume access authentication on a second type of port, where the second type of port is a port corresponding to the second type of port identifier.
The method according to claim 9, wherein the method further comprises:

Determining the number of member ports of the second aggregation port, where the second aggregation port is an aggregation port corresponding to the second type port before deleting the second type port;

Determining the number of member ports of the third aggregation port according to the second type of port identifier and the number of member ports of the second aggregation port, and the third aggregation port is to delete the first aggregation port from the second aggregation port. Corresponding aggregation port after type 2 port;

Release the second aggregation port according to the number of member ports of the third aggregation port.
The method according to any one of claims 1, 3, 8 and 9, wherein the management port entry is a three-level management port entry, and wherein the first-level management port entry is the aggregation group The configured physical port is responsible for the state management of the port; the second-level management port entry is the activated physical port in the aggregation group and is responsible for message transmission; the third-level management port entry is the access authentication protocol The state machine controls the aggregation port for access authentication and is responsible for the operation of the access authentication protocol state machine.
A terminal for port access authentication, wherein the terminal includes at least: a processor and a storage medium configured to store executable instructions, wherein:

The processor is configured to execute stored executable instructions configured to perform a method for access authentication of a port provided by any one of claims 1 to 11 above.
A computer-readable storage medium, wherein computer-executable instructions are stored in the computer-readable storage medium, and the computer-executable instructions are configured to perform access authentication of a port provided by any one of the preceding claims 1 to 11. method.