WO2020210925A1

WO2020210925A1 - Access authentication method for switch, switch, and system

Info

Publication number: WO2020210925A1
Application number: PCT/CN2019/000221
Authority: WO
Inventors: 林皓; 刘建兵
Original assignee: 北京北信源软件股份有限公司
Priority date: 2019-04-15
Filing date: 2019-11-18
Publication date: 2020-10-22
Also published as: CN110035082B; CN110035082A

Abstract

Embodiments of the present invention provide an access authentication method for a switch, a switch, and a system. The method comprises: receiving a data packet sent by a terminal, the data packet at least comprising a MAC address of the terminal; initiating an authentication process with the terminal according to the MAC address and a pre-determined cryptosystem; and opening a connection channel of the terminal to a network if, according to a received response message sent by the terminal during the authentication process, the terminal is determined as being authenticated successfully for a current round. The embodiments of the present invention utilize an authentication server embedded within a switch, enable the authentication server to initiate an authentication process with a terminal according to a received data packet sent by the terminal and a pre-determined cryptosystem, and after interaction with a client installed at the terminal, determine whether the terminal is authenticated successfully, then enable, if the authentication is successful, the switch to open a channel of the terminal to a network, and thereby improving integrity and immediacy of authentication and access control.

Description

Switch admission authentication method, switch and system

Technical field

The embodiment of the present invention relates to the field of electronic communication technology, in particular to a switch admission authentication method, switch and system.

Background technique

Access layer switches currently have no identity authentication (hereinafter referred to as authentication) function, nor complete network access control (hereinafter referred to as access) capabilities, and only provide simple access capabilities based on Media Access Control Address (MAC) address. There are defects in the authentication mechanism. When the MAC address is modified or counterfeited, the authenticity of the access device cannot be distinguished, resulting in the failure of access, and the security problem of illegal or malicious access is one of the important security vulnerabilities. .

In the prior art, the identity confirmation and authentication process for terminal access authentication and admission functions are all terminated on the authentication server (RadiusServer). As the core position of the authentication system, RadiusServer is the risk concentration point in the authentication system. From the architectural point of view, the current authentication method ending on RadiusServer is directly exposed to the Internet. Once it fails or is breached or is attacked by a Distributed Denial of Service (DDOS) attack, the authentication system will fail. In addition, there are some authentication access methods that are completely unrelated to the access switch, such as the gateway method based on data mirroring, the authentication access method based on the dynamic address allocation protocol, and the Portal authentication method based on the HTTP protocol. In the existing identity authentication and admission system, the authentication and admission process is initiated by the access terminal, and it is useless in scenarios where the access terminal does not actively initiate authentication.

Therefore, the existing technology is less secure than the authentication and admission control process of the switch.

Summary of the invention

The embodiment of the present invention provides a switch admission authentication method, switch and system, which are used to solve the problem of insufficient security for the switch authentication and admission control process in the prior art.

In the first aspect, an embodiment of the present invention provides a switch admission authentication method, including:

Receiving a data message sent by a terminal, the data message including at least the MAC address of the terminal;

Initiating an authentication process to the terminal according to the MAC address and the preset cryptosystem;

According to the reply message received by the terminal during the authentication process, if it is determined that the terminal is authenticated this time, the connection path between the terminal and the network is opened.

In the second aspect, an embodiment of the present invention provides a switch for admission authentication, including:

A data receiving module, configured to receive a data message sent by a terminal, the data message including at least the MAC address of the terminal;

An authentication server module, configured to initiate an authentication process to the terminal according to the MAC address and a preset cryptosystem;

The access control module is configured to open a connection path between the terminal and the network if it is determined that the terminal is authenticated this time according to the reply message received by the terminal during the authentication process.

In a third aspect, an embodiment of the present invention provides a system for admission authentication, which is characterized in that it includes:

A preset number of any of the above-mentioned switches, all switches are deployed in parallel at the edge of the network, the embedded authentication service closes the network-facing ports, and the consistency of authentication data is maintained through a preset authentication data synchronization protocol.

In a fourth aspect, an embodiment of the present invention also provides an electronic device, including:

Processor, memory, communication interface and communication bus; among them,

The processor, the memory, and the communication interface communicate with each other through the communication bus;

The communication interface is used for information transmission between communication devices of the electronic device;

The memory stores computer program instructions that can be executed by the processor, and the processor can execute the following methods by invoking the program instructions:

In a fifth aspect, embodiments of the present invention also provide a non-transitory computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the following method is implemented:

The switch admission authentication method, switch and system provided by the embodiments of the present invention use the authentication server embedded in the switch, and according to the received data message sent by the terminal, the authentication server initiates to the terminal according to the preset cryptosystem After the authentication process and interaction with the client installed on the terminal, it is judged whether the terminal has passed the authentication. If it passes, the switch opens the path between the terminal and the network, thereby improving the integrity of authentication and admission control And timeliness.

Description of the drawings

In order to explain the embodiments of the present invention or the technical solutions in the prior art more clearly, the following will briefly introduce the drawings used in the description of the embodiments or the prior art. Obviously, the drawings in the following description These are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative work.

FIG. 1 is a flowchart of a method for authenticating switch admission according to an embodiment of the present invention;

Figure 2 is a flowchart of another switch admission authentication method according to an embodiment of the present invention;

3 is a schematic diagram of the structure of a switch for admission authentication according to an embodiment of the present invention;

4 is a schematic diagram of the system structure for admission authentication according to an embodiment of the present invention;

Figure 5 illustrates a schematic diagram of the physical structure of an electronic device.

detailed description

In order to make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be described clearly and completely in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments It is a part of the embodiments of the present invention, not all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative work shall fall within the protection scope of the present invention.

Fig. 1 is a flowchart of a switch admission authentication method according to an embodiment of the present invention. As shown in Fig. 1, the method includes:

Step S01: Receive a data message sent by a terminal, where the data message includes at least the MAC address of the terminal.

The access layer switch is a network border device. When a terminal wants to access the network, a data message sent to the network will first be sent to the switch connected to the terminal, and the data message includes at least the MAC address of the terminal.

Step S02: Initiate an authentication process to the terminal according to the MAC address and the preset cryptosystem.

The switch in the prior art does not have authentication and admission capabilities, and is only used as a forwarding point for a data message. Only when the terminal initiates an authentication request, the authentication server is authenticated according to the IP address of the authentication server contained in the authentication request. The request is sent to the authentication server to perform the authentication process. In addition, since the existing authentication protocol is service-based, when the terminal is performing a service that does not require authentication, it will not initiate an authentication request to the authentication server. At this time, the data message initiated by the terminal does not contain the IP address of the authentication server, and the switch will not send the data message to the authentication server.

The switch used in the embodiment of the present invention includes the authentication and admission functions of the authentication server, which is equivalent to embedding the authentication server into the switch.

When the switch receives a data message sent by the terminal, the embedded authentication server will initiate an authentication process to the terminal according to the MAC address contained in the data message and the preset cryptosystem. The terminal uses the installed client to exchange information with the authentication server in the switch to implement the authentication process.

The cryptosystem can be set according to actual needs. For example, a public key cryptosystem is used, and multiple cryptographic algorithms and private algorithms are used, including PKI, IPK, SM2, RSA, and private algorithms. The authentication server of the switch uses a private random number screening algorithm, the client uses a combined identification algorithm, and the authentication process uses the SM2/RSA algorithm. The specific authentication process is as follows:

The authentication server encrypts a piece of fixed-length random data with the public key corresponding to the MAC address, and sends it to the terminal corresponding to the MAC using the Layer 2 protocol; when the client of the terminal listens to the random data sent by the authentication server, it uses the local private key Decrypt the data; the client uses the local private key to sign and decrypt the data, and sends a reply message to the switch; and then the authentication server of the switch performs authentication judgment on the reply message.

Step S03: According to the reply message received by the terminal during the authentication process, if it is determined that the terminal is authenticated this time, the connection path between the terminal and the network is opened.

The authentication server of the switch analyzes and verifies the reply message sent by the terminal during the authentication process. If the authentication server succeeds in the verification, it is determined that the terminal has passed the authentication this time; otherwise, it is determined that the terminal has failed the authentication this time.

If the terminal is authenticated this time, the switch opens the connection path between the terminal and the network, controls the data path from the access port to the switching matrix, and sends the data message sent by the terminal to the network.

It can be seen from the above that since the authentication server is embedded in the switch, the authentication server does not need to be accessed through the IP address, which makes it impossible to launch a network attack on the authentication server through the IP address. At the same time, the embedded authentication server can reduce data transmission and improve the efficiency of the authentication process.

In the embodiment of the present invention, the authentication server embedded in the switch, according to the received data message sent by the terminal, the authentication server initiates the authentication process to the terminal according to the preset cryptosystem, and interacts with the client installed in the terminal Afterwards, it is determined whether the terminal passes the authentication, and if it passes, the switch opens the path between the terminal and the network, thereby improving the completeness and timeliness of authentication and admission control.

Fig. 2 is a flowchart of another switch admission authentication method according to an embodiment of the present invention. As shown in Fig. 2, after the step S03, the method further includes:

Step S04: Periodically send a new authentication process to the terminal that has passed the authentication.

In order to reduce unnecessary authentication process, after passing the authentication process, if the authentication server of the switch determines that the terminal is authenticated, it will no longer perform the authentication process for the data packets subsequently sent by the terminal, but directly Forward. At the same time, the authentication server of the switch periodically initiates a new authentication process to the terminal.

In a specific implementation manner, the self-learning function of the switch is closed, and the authentication server updates the MAC table of the switch according to the authentication result. Record the MAC addresses corresponding to all terminals that have passed authentication in the MAC table of the switch, so that when the switch subsequently receives a data message sent by the MAC address, it directly records the MAC address according to the MAC table. The data message is forwarded to the network and is no longer sent to the embedded authentication server to initiate the authentication process. At the same time, the authentication server maintains an authentication list synchronized with the MAC table, and according to the authentication list, periodically initiates a new authentication process to the terminal corresponding to the MAC address in the table. In the period, a timer can be set for each MAC address. When the timer reaches the period, a new authentication process is initiated to the terminal corresponding to the MAC address, or a list timer is set for the authentication list. When the list timer reaches the period, a new authentication process is initiated to all the terminals corresponding to the MAC addresses in the MAC list.

Step S05: If it is determined that the authentication of the terminal has failed this time according to the reply message received by the terminal in the new authentication process, the connection path between the terminal and the network is closed.

The client of the terminal also exchanges information with the authentication server of the switch according to the new authentication process. If the authentication server still determines that the terminal has passed the authentication this time, it will continue to wait for the period of time before initiating the next authentication process to the terminal.

If the authentication server determines that the terminal has failed the authentication this time, the switch will close the connection path between the terminal and the network. At the same time, the MAC address corresponding to the terminal is deleted from the MAC table and authentication list. At this time, if the terminal sends a data message to the switch again, the authentication server will re-initiate the authentication process.

In the embodiment of the present invention, the authentication server periodically initiates the authentication process to the terminal that has passed authentication, thereby better improving the completeness of authentication and admission control and the efficiency of authentication.

Based on the foregoing embodiment, further, the method further includes:

If it is determined that the authentication of the terminal fails this time, the stop timer corresponding to the terminal is started according to the preset duration, so that the data message sent by the terminal is no longer received before the stop timer ends.

In order to prevent the terminal from still initiating a large number of data packets when it fails to pass the authentication, thereby reducing the authentication efficiency of the authentication server embedded in the switch. When the authentication server of the switch determines that the terminal has failed this time, the switch will close the connection port with the terminal, not receive any data packets sent by the terminal, and open the connection with the terminal. The stop timer corresponding to the MAC address. The duration of the stop timer can be set according to actual needs, until the stop timer reaches the preset duration, the switch will re-open the connection port with the terminal to monitor the data sent by the terminal Message.

The embodiment of the present invention stops receiving the data message sent by the terminal within a preset time period after determining that the terminal authentication fails, thereby reducing the risk of the authentication server being attacked and improving the authentication of the authentication server. effectiveness.

Based on the foregoing embodiment, further, the method further includes:

The MAC address of the data message is queried in a pre-stored MAC address list, and if it does not exist, the switch determines that the authentication of the terminal fails this time.

The switch also includes a MAC address list, and the MAC address list includes all allowed access MAC addresses. When the switch receives a data message sent by the terminal, the authentication server will query the MAC address list, and if the MAC address of the data message is not in the MAC address list, it will directly determine that the terminal is currently authenticated If it fails, discard the data message.

Record the MAC addresses of all data packets that have failed authentication in the log to enable subsequent traceability and management. For example, the MAC address list can be actively or passively deleted according to the log.

In the embodiment of the present invention, the MAC address of the data message is compared with a preset MAC address list, and the authentication server will determine that the data message not included in the MAC address list has failed authentication, thereby reducing the number of attacks on the authentication server. Risk, and improve the authentication efficiency of the authentication server.

Fig. 3 is a schematic structural diagram of a switch for admission authentication according to an embodiment of the present invention. As shown in Fig. 3, the switch at least includes: a data receiving module 10, an authentication server module 11, and an access control module 12;

The data receiving module 10 is configured to receive a data message sent by a terminal, and the data message includes at least the MAC address of the terminal; the authentication server module 11 is configured to receive a data message according to the MAC address and a preset cryptosystem , Initiate an authentication process to the terminal; the access control module 12 is configured to, according to the reply message sent by the terminal received during the authentication process, if it is determined that the terminal is authenticated this time, open the The connection path between the terminal and the network. specifically:

When the terminal wants to access the network, the data message sent to the network will be sent to the data receiving module 10 first, and the data message includes at least the MAC address of the terminal.

When the data receiving module 10 receives the data message sent by the terminal, it will send the authentication server module 11, and the authentication server module 11 according to the MAC address contained in the data message and the preset cryptosystem, Initiate an authentication process to the terminal. The terminal uses the installed client to exchange information with the authentication server in the switch to implement the authentication process.

The cryptosystem can be set according to actual needs. For example, a public key cryptosystem is used, and multiple cryptographic algorithms and private algorithms are used, including PKI, IPK, SM2, RSA, and private algorithms. The authentication server module 11 uses a private random number screening algorithm, the client uses a combined identification algorithm, and the authentication process uses the SM2/RSA algorithm.

The authentication server module 11 analyzes and verifies the reply message sent by the terminal during the authentication process. If the authentication server module 11 succeeds in the verification, it is determined that the terminal has passed the authentication this time; otherwise, it is determined that the terminal has failed the authentication this time.

If the terminal is authenticated this time, the authentication server module 11 instructs the access control module to open the connection path between the terminal and the network, control the data path from the access port to the switching matrix, and then transfer the data sent by the terminal The message is sent to the network.

The switch provided in the embodiment of the present invention is used to execute the foregoing method, and for its function, refer to the foregoing method embodiment for details, and the specific method flow is not repeated here.

The embodiment of the present invention uses the data message sent by the terminal received by the data receiving module 10, the authentication server module 11 initiates an authentication process to the terminal according to the preset cryptosystem, and interacts with the client installed in the terminal, and then determines Whether the terminal passes the authentication, if passed, the access control module 12 opens the path between the terminal and the network, thereby improving the completeness and timeliness of authentication and admission control.

Based on the above embodiment, further, the authentication server module is further used for:

Periodically send a new authentication process to terminals that have passed authentication;

If it is determined that the terminal has failed the authentication this time according to the reply message received by the terminal during the new authentication process, the connection path between the terminal and the network is closed.

In order to reduce the unnecessary authentication process, after passing the authentication process, if the authentication server module determines that the terminal is authenticated, it will no longer perform the authentication process for the data message subsequently sent by the terminal, but directly forward it . At the same time, the authentication server module periodically initiates a new authentication process to the terminal.

In a specific embodiment, the authentication server module sets an authentication list and sends the MAC addresses corresponding to all the terminals that have passed authentication to the data receiving module, so as to record them in the MAC table preset by the data receiving module, so that the data When the receiving module subsequently receives the data message sent by the MAC address, it directly forwards the data message to the network according to the MAC table, and no longer sends it to the authentication server module to initiate the authentication process. At the same time, the authentication server module sets and maintains an authentication list synchronized with the MAC table, and according to the authentication list, periodically initiates a new authentication process to the terminal corresponding to the MAC address in the table.

The client of the terminal also exchanges information with the authentication server module of the switch according to the new authentication process. If the authentication server module still determines that the terminal has passed the authentication this time, it will continue to wait for the period of time before initiating the next authentication process to the terminal.

If the authentication server module determines that the terminal has failed the authentication this time, it instructs the access control module to close the connection path between the terminal and the network. At the same time, the MAC address corresponding to the terminal is deleted from the authentication list, and the data receiving module is instructed to synchronize the MAC table. At this time, if the data receiving module receives the data message sent by the terminal again, it will send it to the authentication server module to re-initiate the authentication process.

In the embodiment of the present invention, the authentication server module periodically initiates the authentication process to the terminal that has passed the authentication, thereby better improving the completeness of authentication and admission control and the efficiency of authentication.

Based on the above embodiment, further, the argument server module is also used for:

If it is determined that the authentication of the terminal fails this time, the stop timer corresponding to the terminal is started according to the preset duration, so that the data receiving module no longer receives the data sent by the terminal before the stop timer ends. Data message.

In order to prevent the terminal from still initiating a large number of data messages when it fails to pass the authentication, the authentication efficiency of the authentication server module is reduced. When the authentication server module determines that the terminal has failed the authentication this time, the data receiving module will close the connection port with the terminal, not receive any data messages sent by the terminal, and open the connection with the terminal. Stop timer corresponding to the MAC address. The duration of the stop timer can be set according to actual needs. Until the stop timer reaches the preset duration, the data receiving module will re-open the connection port with the terminal to monitor the terminal's transmission. Data message.

In the embodiment of the present invention, after the authentication server module determines that the terminal authentication fails, the data receiving module stops receiving data messages sent by the terminal within a preset time period, thereby reducing the authentication server module being attacked. It also improves the authentication efficiency of the authentication server.

Fig. 4 is a schematic structural diagram of a system for admission authentication according to an embodiment of the present invention. As shown in Fig. 4, it is characterized in that it includes:

A preset number of any switch as described in the foregoing embodiment, all switches are deployed in parallel at the edge of the network, the embedded authentication service closes network-facing ports, and the consistency of authentication data is maintained through a preset synchronization protocol.

The system for admission authentication in the embodiment of the present invention adopts a distributed edge computing architecture, and multiple switches with embedded authentication servers are deployed in parallel at the network edge. The authentication server in each switch opens the southbound interface facing the terminal, and closes the northbound interface facing the network, so that each authentication server is only responsible for the authentication process of the terminal connected to the switch.

In addition, the authentication server of each switch deployed in parallel in the same network uses a preset authentication data synchronization protocol (Authenitication Data Synchronization Protocol, ADSP) to synchronize authentication data. The authentication data includes the authentication data described in the above embodiment. Authentication list, MAC address list, etc. In a specific method, one of the authentication servers may be designated as the master server, and the other is the slave server Slave, and the master server manages the authentication data and performs synchronization operations.

The system provided by the embodiment of the present invention is used to execute the foregoing method, and its function is specifically referred to the foregoing method embodiment, and the specific method flow is not repeated here.

In the embodiment of the present invention, a preset number of switches are deployed in parallel in the network to be responsible for the authentication process of the terminal connected to the switch, and according to the preset authentication data synchronization protocol, the authentication data between each authentication server is realized. Synchronization, so that the network boundary is the authentication control location, so that the authentication is more accurate. The authentication process is completed between directly connected devices, and the authentication stroke is the shortest, avoiding the influence of network factors; distributed deployment disperses the authentication load, omitting the traditional authentication server , The authentication speed is fast and efficient; the northbound interface is closed to prevent attacks from the network, which improves its own security; the authentication process is simple, the authentication data is short, and the operation and management is simple; suitable for industrial control networks of various scales and corporate internal networks, Versatility and expansibility realize the mobility of the connected terminal in the whole network, that is, authentication access is not restricted by location.

FIG. 5 illustrates a schematic diagram of the physical structure of an electronic device. As shown in FIG. 5, the server may include: a processor (processor) 810, a communication interface (Communications Interface) 820, a memory (memory) 830, and a communication bus 840, wherein, The processor 810, the communication interface 820, and the memory 830 communicate with each other through the communication bus 840. The processor 810 may call the logical instructions in the memory 830 to execute the following method: receiving a data message sent by the terminal, the data message including at least the MAC address of the terminal; according to the MAC address and a preset password According to the reply message sent by the terminal received during the authentication process, if it is determined that the terminal is authenticated this time, the connection path between the terminal and the network is opened.

Further, an embodiment of the present invention discloses a computer program product, the computer program product includes a computer program stored on a non-transitory computer-readable storage medium, the computer program includes program instructions, when the program instructions are When executed, the computer can execute the methods provided in the foregoing method embodiments, for example, including: receiving a data message sent by a terminal, the data message including at least the MAC address of the terminal; according to the MAC address and preset Initiate an authentication process to the terminal; according to the reply message received by the terminal during the authentication process, if it is determined that the terminal is authenticated this time, the connection path between the terminal and the network is opened .

Further, an embodiment of the present invention provides a non-transitory computer-readable storage medium, the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions cause the computer to execute the methods provided in the foregoing method embodiments The method, for example, includes: receiving a data message sent by a terminal, the data message including at least the MAC address of the terminal; initiating an authentication process to the terminal according to the MAC address and a preset cryptosystem; For the reply message received by the terminal during the authentication process, if it is determined that the terminal is authenticated this time, the connection path between the terminal and the network is opened.

Those of ordinary skill in the art can understand that: in addition, the aforementioned logic instructions in the memory 830 can be implemented in the form of software functional units and can be stored in a computer readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention essentially or the part that contributes to the existing technology or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes.

The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in One place, or it can be distributed to multiple network units. Some or all of the modules may be selected according to actual needs to achieve the objectives of the solutions of the embodiments. Those of ordinary skill in the art can understand and implement it without creative work.

Through the description of the above implementation manners, those skilled in the art can clearly understand that each implementation manner can be implemented by software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions can be embodied in the form of software products, which can be stored in computer-readable storage media, such as ROM/RAM, magnetic A disc, an optical disc, etc., include a number of instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute the methods described in each embodiment or some parts of the embodiment.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: The technical solutions recorded in the foregoing embodiments are modified, or some of the technical features are equivalently replaced; these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

A switch admission authentication method, characterized in that it comprises: receiving a data message sent by a terminal, the data message including at least the MAC address of the terminal; according to the MAC address and a preset cryptosystem, The terminal initiates an authentication process; according to the reply message received by the terminal during the authentication process, if it is determined that the terminal is authenticated this time, the connection path between the terminal and the network is opened.
The method according to claim 1, characterized in that the method further comprises: periodically sending a new authentication process to the terminal that has passed the authentication; if according to the new authentication process received by the terminal, In the reply message, it is determined that the authentication of the terminal fails this time, and the connection path between the terminal and the network is closed.
The method according to claim 2, characterized in that, the method further comprises: if it is determined that the authentication of the terminal fails this time, starting a stop timer corresponding to the terminal according to a preset duration, so that when the terminal is stopped No more data messages sent by the terminal will be received before the timer expires.
The method according to claim 3, wherein the method further comprises: querying the MAC address of the data message in a pre-stored MAC address list, and if it does not exist, the switch determines that the terminal itself This authentication failed.
A switch for admission authentication, which is characterized by comprising: a data receiving module for receiving a data message sent by a terminal, the data message including at least the MAC address of the terminal; an authentication server module, Initiating an authentication process to the terminal according to the MAC address and the preset cryptosystem; the access control module is configured to, according to the reply message received by the terminal during the authentication process, if it is determined that the If the terminal passes the authentication this time, the connection path between the terminal and the network is opened.
The switch for admission authentication according to claim 5, characterized in that the authentication server module is further used to: periodically send a new authentication process to the terminal that has passed the authentication; When the reply message sent by the terminal is received, it is determined that the terminal has failed the authentication this time, and the connection path between the terminal and the network is closed.
The switch for admission authentication according to claim 6, wherein the demonstration server module is further configured to: if it is determined that the terminal has failed the authentication this time, turn on the stop corresponding to the terminal according to a preset time period. Timer, so that the data receiving module no longer receives data messages sent by the terminal before the stop timer ends.
A system for admission authentication, which is characterized by comprising: a preset number of any switch as claimed in claims 5-7, all switches are deployed in parallel at the edge of the network, and the embedded authentication service closes the network-facing ports , And maintain the consistency of the authentication data through the preset authentication data synchronization protocol.
An electronic device, comprising a memory, a processor, and a computer program stored on the memory and running on the processor, wherein the processor executes the program as described in any one of claims 1 to 4 Describe the steps of the switch admission authentication method.
A non-transitory computer-readable storage medium with a computer program stored thereon, wherein the computer program implements the steps of the switch admission authentication method according to any one of claims 1 to 4 when the computer program is executed by a processor.