WO2021031465A1

WO2021031465A1 - Sd-wan-based device authentication method and system

Info

Publication number: WO2021031465A1
Application number: PCT/CN2019/124188
Authority: WO
Inventors: 王巍; 赵伟
Original assignee: 烽火通信科技股份有限公司
Priority date: 2019-08-20
Filing date: 2019-12-10
Publication date: 2021-02-25
Also published as: CN110611658A; CN110611658B

Abstract

Disclosed are an SD-WAN-based device authentication method and system, which relate to the technical field of communications. The method comprises the following steps: an SD-WAN controller performing SSH connection with a WAN device, and the WAN device performing SSH key exchange with the SD-WAN controller according to a device authentication identifier in an authentication configuration file of the WAN device; and the SD-WAN controller acquiring the device authentication identifier and obtaining user authentication information according to the device authentication identifier, and performing SSH user authentication on the WAN device according to the user authentication information. According to the present invention, on the basis of the device authentication identifier in an authentication configuration file, each WAN device is authenticated, without being affected by each WAN device actively online, IP address change and device information independence, thereby ensuring the smooth progress of device authentication.

Description

A device authentication method and system based on SD-WAN

Technical field

The present invention relates to the field of communication technology, in particular to an SD-WAN-based device authentication method and system.

Background technique

SDN (Software Defined Network) is a new network architecture that provides more agile and flexible network services by virtualizing the network and establishing centralized control.

Wide Area Network WAN (Wide Area Network) is a telecom network or computer network covering a long distance. Virtual WAN is based on the existing public WAN network to realize the user's private WAN, thereby saving funds and operating and maintaining costs.

SD-WAN (Software-Defined Wide Area Network) is a combination of Virtual WAN and traditional WAN, which is used for coverage processing. SD-WAN uses the SDN concept for user private WAN network management to realize Efficient management of WAN.

The SD-WAN controller is a centralized controller for the SD-WAN network. It is used to uniformly manage and configure WAN network devices through standardized interfaces, realize flexible traffic strategies, fault monitoring, and simplify WAN management and troubleshooting.

Unlike data center networks, WAN networks require network devices to support flexible routing configuration and management configuration. The current open flow protocol commonly used in data centers cannot meet WAN requirements, while NETCONF (Network Configuration Protocol, network configuration protocol) uses XML (Extensible Markup Language) , Extensible Markup Language) as the data encoding method of configuration data and protocol message content, it is transmitted based on SSH (Secure Shell) of TCP (Transmission Control Protocol), and transmitted by RPC (Remote Procedure Call, remote Process call protocol) mode to achieve equipment operation and control, so the NETCONF configuration protocol can meet the requirements of flexible configuration management of WAN equipment.

In the prior art, when the device uses NETCONF to go online, the active mode is generally adopted, that is, the controller actively connects to the device. In this mode, the device's authentication information is bound to the device's IP address, and the controller actively uses the device authentication information to connect to the device's IP address. Device authentication is completed. However, in the WAN network, there are a lot of users' devices, and the IP address of the device connection will dynamically change with the user's network. The controller cannot predict the IP address of the device, and the device needs to be authenticated actively.

Therefore, there is currently a need for an SD-WAN network device active authentication method to solve the device authentication problem when the device in the WAN network actively goes online, the device connection IP address changes dynamically, and the authentication information of different devices is independent.

Summary of the invention

In view of the defects in the prior art, the purpose of the present invention is to provide an SD-WAN-based device authentication method and system. Based on the device authentication identifier in the authentication configuration file, each WAN device is authenticated without being affected by each WAN device. Active online, IP address changes and the influence of device information independence ensure the smooth progress of device certification.

In order to achieve the above objectives, the technical solution adopted by the present invention is:

In the first aspect, the present invention discloses an SD-WAN-based device authentication method, the method includes the following steps:

The SD-WAN controller performs an SSH connection with the WAN device, and the WAN device performs SSH key exchange with the SD-WAN controller according to the device authentication identifier in the authentication configuration file of the WAN device;

The SD-WAN controller obtains the device authentication identifier, obtains user authentication information according to the device authentication identifier, and performs SSH user authentication on the WAN device according to the user authentication information.

Based on the above technical solution, the WAN device performs SSH key exchange with the SD-WAN controller according to the device authentication identifier in the authentication configuration file of the WAN device, which specifically includes the following steps:

The WAN device interacts with the SD-WAN controller to unify key agreement and key exchange algorithm;

The WAN device sets the device authentication identifier in the authentication configuration file as a key exchange characteristic value;

The SD-WAN controller performs key exchange with the WAN device, and obtains the key exchange characteristic value.

On the basis of the above technical solution, the SD-WAN controller obtains the device authentication identifier, obtains user authentication information according to the device authentication identifier, and performs SSH user authentication on the WAN device according to the user authentication information. It includes the following steps:

The SD-WAN controller obtains the user authentication information of the WAN device in a preset local data table according to the device authentication identifier;

The SD-WAN controller sends an SSH user authentication request to the WAN device in accordance with the SSH protocol standard, where the SSH user authentication request includes the user authentication information;

In response to the user authentication information, the WAN device passes the SSH user authentication.

On the basis of the above technical solution, the method further includes the following steps:

The WAN device is initialized according to the authentication configuration file;

The SD-WAN controller establishes a TCP connection with the WAN device, and the SD-WAN controller initiates SSH user authentication to the WAN device;

After the SSH user authentication of the WAN device is passed, the SD-WAN controller sends a NETCONF connection request to the WAN device, and the WAN device responds and generates a NETCONF connection feedback.

The SD-WAN controller registers the WAN equipment, and will generate a device online form and a device certification form;

The SD-WAN controller generates the authentication configuration file, and publishes the authentication configuration file to the WAN device;

Wherein, the device online table is used to record WAN devices that have completed device registration on the SD-WAN controller, and the device authentication table is used to record device SSH authentication information of the SDN-WAN controller.

In the second aspect, the present invention also discloses an SD-WAN-based device authentication system, the system includes:

The SSH key exchange unit is used to control the SD-WAN controller and the WAN according to the device authentication identifier in the authentication configuration file of the WAN device after the SD-WAN controller and the WAN device are connected via SSH. The device performs SSH key exchange;

The SSH user authentication unit is used to obtain user authentication information according to the device authentication identifier after the SD-WAN controller obtains the device authentication identifier, and perform SSH user authentication on the WAN device according to the user authentication information Certification.

On the basis of the above technical solution, the SSH key exchange unit is also used to unify a key agreement and a key exchange algorithm between the WAN device and the SD-WAN controller;

The SSH key exchange unit is further configured to set the device authentication identifier in the authentication configuration file as a key exchange characteristic value;

The SSH key exchange unit is further configured to control the SD-WAN controller to obtain the key exchange characteristic value after completing the SSH key exchange with the WAN device.

Based on the above technical solution, the SSH user authentication unit is further configured to control the SD-WAN controller to obtain user authentication information of the WAN device in a preset local data table according to the device authentication identifier;

The SSH user authentication unit is further configured to control the SD-WAN controller to send an SSH user authentication request to the WAN device in accordance with the SSH protocol standard, where the SSH user authentication request includes the user authentication information;

The SSH user authentication unit is further configured to wait for the WAN device to issue SSH user authentication passing information in response to the user authentication information.

On the basis of the above technical solution, the system further includes:

The TCP connection unit is configured to control the WAN device to perform a TCP connection with the SD-WAN controller after the WAN device completes initialization according to the authentication configuration file;

NETCONF connection unit, which is used to control the NETCONF connection with the SD-WAN controller after the SSH user authentication of the WAN device is passed;

The authentication judging unit is used to determine that the WAN device passes the device authentication when the TCP connection is completed, the SHH authentication is passed, and the NETCONF connection is completed, and otherwise, the WAN device authentication fails.

On the basis of the above technical solution, the system further includes:

A pre-preparation unit, which is used to control the SD-WAN controller to register the WAN device, and generate a device online table and a device authentication table;

The pre-preparation unit is further configured to control the SD-WAN controller to generate an authentication configuration file and publish the authentication configuration file to the WAN device;

Compared with the prior art, the advantages of the present invention are:

The invention authenticates each WAN device based on the device authentication identifier in the authentication configuration file, and is not affected by the active online of each WAN device, IP address change, and device information independence, and ensures the smooth progress of the device authentication work.

Description of the drawings

FIG. 1 is a flowchart of the steps of an SD-WAN-based device authentication method in an embodiment of the present invention;

2 is a step flow chart of the preamble process of the SD-WAN-based device authentication method in an embodiment of the present invention;

FIG. 3 is a step flow diagram of step S1 of the SD-WAN-based device authentication process in the embodiment of the present invention;

4 is a flowchart of step S2 of the SD-WAN-based device authentication method in the embodiment of the present invention;

FIG. 5 is a flow chart of the steps of the pre-preparation process of the SD-WAN-based device authentication method in the embodiment of the present invention;

6 is a step flow chart of step C1 of the SD-WAN-based device authentication method in the embodiment of the present invention;

Figure 7 is a structural block diagram of an SD-WAN-based device authentication system in an embodiment of the present invention;

In the figure: 1. SSH key exchange unit; 2. SSH user authentication unit; 3. TCP connection unit; 4. NETCONF connection unit; 5. authentication judgment unit; 6. pre-preparation unit.

detailed description

Term explanation:

SDN: Software Defined Network, software customized network;

WAN: Wide Area Network, a telecommunications network or computer network covering a long distance;

SD-WAN: Software-Defined Wide Area Network is the combination of Virtual WAN and traditional WAN, which is used for coverage processing. SD-WAN uses the SDN concept for user private WAN network management to achieve efficient management of private WAN;

Virtual WAN: Virtual Wide Area Network, virtual wide area network;

TCP: Transmission Control Protocol, transmission control protocol, is a connection-oriented, reliable, byte stream-based transport layer communication protocol;

SSH: Secure Shell, secure shell protocol;

NETCONF: NETCONF protocol, an XML-based network configuration protocol;

IP address: IP Address, Internet Protocol Address, Internet Protocol address, also known as Internet Protocol address, is a digital label assigned to Internet Protocol devices used by users to access the Internet;

Diffie-Hellman key exchange algorithm: The Diffie-Hellman-Group-Exchange-SHA algorithm enables both parties in communication to exchange keys securely in an insecure channel for encrypting subsequent communication messages.

The embodiments of the present invention will be described in further detail below with reference to the accompanying drawings.

To achieve the above technical effects, the general idea of this application is as follows:

An SD-WAN-based device authentication method, the method includes the following steps:

S1, the SD-WAN controller connects with the WAN device through SSH, and the WAN device exchanges SSH keys with the SD-WAN controller according to the device authentication identifier in the authentication configuration file of the WAN device;

S2, the SD-WAN controller obtains the device authentication ID, obtains user authentication information according to the device authentication ID, and performs SSH user authentication on the WAN device according to the user authentication information.

The embodiment of the present invention realizes the active online of the WAN device, and ensures the isolation of authentication information of different WAN devices through the use of the device authentication identifier, thereby enhancing the security of device online authentication.

1 to 6, the method embodiment of the present invention provides an SD-WAN-based device authentication method, the method includes the following steps:

In the embodiment of the present invention, if necessary, there is also a pre-procedure, which specifically includes the following steps:

Q1. WAN equipment is initialized according to the authentication configuration file;

Q2. The SD-WAN controller establishes a TCP connection with the WAN device, and the SD-WAN controller initiates SSH user authentication to the WAN device;

Q3. After the SSH user of the WAN device is authenticated, the SD-WAN controller sends a NETCONF connection request to the WAN device, and the WAN device responds and generates a NETCONF connection feedback.

In the embodiment of the present invention, the WAN device first initializes according to a preset authentication configuration file. During specific operations, the WAN device can obtain the online configuration information in the authentication configuration file by email or other methods, and then complete the device initialization operation;

Among them, the WAN device initializes the device according to the authentication configuration file. The key information in the authentication configuration file includes the SD-WAN controller IP address, local exit configuration, SSH login user name, and SSH user authentication information (password or controller public key) ；

After the initialization of the WAN device is completed, the SD-WAN controller and the WAN device will perform a TCP connection. When a specific TCP connection is made, the WAN device can use the SD-WAN controller IP address and port to actively initiate a TCP connection to the SDWAN controller, and the SD -The WAN controller monitors TCP port 6622, and then obtains the TCP connection request initiated by the WAN device;

Furthermore, after the TCP connection is completed, the SD-WAN controller performs SSH user authentication with the WAN device according to the device authentication identifier in the authentication configuration file of the WAN device;

Furthermore, in the SSH user authentication process, that is, during the SSH connection process, key exchange is required. In the key exchange phase, the device authentication identifier in the configuration properties is used as the seed value of the Diffie-Hellman key exchange algorithm, SD- The WAN controller completes the SSH key exchange process according to the SSH protocol standard, establishes an SSH session between the SD-WAN controller and the WAN device, and obtains the key exchange algorithm seed value from the received SSH key exchange message, and SD-WAN controls The device obtains the seed value of the Diffie-Hellman key exchange algorithm as the unique identifier of the authentication of the WAN device, that is, the device authentication identifier, and obtains the SSH user authentication information of the WAN device from the local data table, and the SD-WAN controller follows the SSH protocol standard , Send an SSH user authentication message to the WAN device, and the WAN device responds to the SSH user authentication message to complete the SSH user authentication;

The NETCONF Client module of the SD-WAN controller, that is, the NETCONF client module, uses the SSH channel to send NETCONF handshake messages to establish a NETCONF connection. The SD-WAN controller acts as a NETCONF client and uses the NETCONF protocol to configure WAN devices. The NETCONF SERVICE module, that is, the NETCONF server module, uses the SSH channel to accept NETCONF messages, respond to the NETCONF network configuration request of the SD-WAN controller, and generate NETCONF connection feedback, and the device authentication will pass, otherwise the device authentication will fail;

Assume that when the SD-WAN controller and the WAN device are connected abnormally, the WAN device re-initiates a TCP request and completes the NETCONF over SSH process again.

In the embodiment of the present invention, the active online of the WAN device is realized, and the authentication information of different WAN devices is isolated through the use of the device authentication identifier, thereby enhancing the security of the device online authentication.

Among them, the Diffie-Hellman key exchange algorithm, namely the Diffie-Hellman-Group-Exchange-SHA algorithm, the DH algorithm is the key exchange algorithm required by the SSH2.0 protocol, and the security of the Diffie-Hellman key exchange algorithm depends on such a Fact: Although it is relatively easy to calculate an exponent modulo a prime number, it is difficult to calculate the discrete logarithm. For large prime numbers, it is almost impossible to calculate the discrete logarithm. The large prime numbers mentioned here are the equipment certification mark .

It should be noted that the networking topology of a typical SD-WAN network includes an SD-WAN controller, multiple WAN devices, that is, WAN network devices;

Among them, the SD-WAN controller is the management core of the entire network. It communicates with each WAN device in the network through a common WAN network (mainly Internet, MPLS dedicated line), manages the device certification of each WAN device, and assigns each WAN device at the same time Authentication message. At the same time, each WAN device is also connected to the same public WAN network. The public WAN network ensures that the IP of each WAN device is reachable, that is, the IP of the host or network port is reachable;

The WAN devices mentioned in the embodiments of the present invention mainly refer to WAN network edge routers with routing functions. These devices can be specific hardware facilities or virtualized software. The devices used in SD-WAN networks are also called For SD-WAN equipment;

In the embodiment of the present invention, the SD-WAN controller manages network equipment through the NETCONF protocol, and at the same time uses the SSH protocol as the connection layer of the NETCONF protocol, referred to as NETCONF over SSH,

The SD-WAN controller serves as the NETCONF client, and the WAN device serves as the NETCONF server.

In addition, the common way for the NETCONF client to connect to the server is that the client initiates an SSH connection through the pre-configured server IP address and SSH user authentication information. After the SSH session is established, the NETCONF connection is established;

As can be seen from the above description, NETCONF connection establishment requires the client (SD-WAN controller) to obtain the IP address of the server (WAN device) and SSH user authentication in advance. However, in the SD-WAN scenario, there are a large number of WAN devices. The WAN device IP address is dynamically allocated. The authentication information of the WAN device cannot be bound to the WAN device IP address. The SD-WAN controller needs to be dynamically online after the WAN device IP address changes. The traditional technical solution does not meet the characteristics of the SD-WAN network. , And the embodiments of the present invention can deal with this technical problem.

It should be noted that the authentication configuration file includes SD-WAN controller IP address, local exit configuration, SSH login user name, and SSH user authentication information;

SSH user authentication information is different from SSH user authentication messages. The former SSH user authentication information is data related to SSH user authentication in the authentication configuration file, while the latter SSH user authentication message is a message sent during SSH user authentication.

In another implementation manner in the embodiment of the present invention, the WAN device performs SSH key exchange with the SD-WAN controller according to the device authentication identifier in the authentication configuration file of the WAN device, that is, step S1 specifically includes the following steps:

A1, WAN equipment interacts with SD-WAN controller, unified key agreement and key exchange algorithm;

A2. The WAN device sets the device authentication identifier in the authentication configuration file as the key exchange characteristic value;

A3. The SD-WAN controller performs key exchange with the WAN device and obtains the key exchange characteristic value.

Specifically, in another implementation manner in the embodiment of the present invention, the SD-WAN controller obtains the device authentication ID, obtains user authentication information according to the device authentication ID, and performs SSH user authentication on the WAN device according to the user authentication information, that is, the step S2 specifically includes the following steps:

B1. The SD-WAN controller obtains the user authentication information of the WAN device in the preset local data table according to the device authentication identifier;

B2. The SD-WAN controller sends an SSH user authentication request to the WAN device in accordance with the SSH protocol standard. The SSH user authentication request includes user authentication information;

B3. The WAN device responds to the user authentication information, and the SSH user is authenticated.

In another implementation manner in the embodiment of the present invention, before the WAN device is initialized according to the preset authentication configuration file, it also includes a pre-preparation process, and the pre-preparation process specifically includes the following steps:

C1, SD-WAN controller registers WAN equipment, and will generate equipment online form and equipment certification form;

C2, SD-WAN controller generates authentication configuration files, and publishes authentication configuration files to WAN devices;

Among them, the device online table is used to record the WAN devices that have completed device registration on the SD-WAN controller, and the device authentication table is used to record the device SSH authentication information of the SDN-WAN controller.

The device SSH authentication information records the SSH device authentication results of each WAN device when the SDN-WAN controller performs SSH authentication;

When the SD-WAN controller registers the WAN device, the SD-WAN controller mainly generates the device online table and the device certification table according to the device registration message. The key data in the online table is to generate a large prime number as the device's certification mark;

Common configuration forms of authentication configuration files include: email authentication URL, local configuration file or local installation package.

It should be noted that in step C1, the SD-WAN controller registers the WAN device, and generates the device online list and the device certification table, which specifically include the following steps:

C10. The SD-WAN controller configures the authentication identifier for the device according to the device registration message. This identifier will be used as a key parameter in the subsequent algorithm. According to the requirements of the DH key exchange algorithm, the device authentication identifier is a large prime number;

C11. The SD-WAN controller assigns independent SSH user login names and user authentication messages to the WAN device according to the characteristic messages of the device user. SSH user authentication supports key authentication and key authentication;

C12. The SD-WAN controller configures the online information for the WAN device according to the device registration message. The configured online information mainly includes the device outlet network information and the controller network information;

C13. According to the results of step C11 and step C12, update the device authentication table and the device online table in the local database of the SD-WAN controller;

C14. Generate the authentication configuration file of the WAN device according to the device authentication table, the device online table and the authentication import method supported by the WAN device;

C15. The SD-WAN controller issues the authentication configuration file described in step C14 in an offline or online manner.

In addition, a form of the equipment certification form and the equipment online form are respectively given, as follows:

Equipment online table:

Device user authentication form:

Based on the same inventive concept, the system embodiment of the present invention provides an embodiment of an SD-WAN-based device authentication system, which is specifically as follows:

As shown in Figure 7, an SD-WAN-based device authentication system includes:

The SSH key exchange unit 1, which is used to control the SD-WAN controller and the WAN device to perform SSH keys according to the device authentication identifier in the authentication configuration file of the WAN device after the SD-WAN controller and the WAN device have an SSH connection exchange;

SSH user authentication unit 2, which is used to obtain user authentication information according to the device authentication ID after the SD-WAN controller obtains the device authentication ID, and perform SSH user authentication on the WAN device according to the user authentication information;

It should be noted that the system also includes:

The TCP connection unit 3, which is used to control the WAN device to perform a TCP connection with the SD-WAN controller after the WAN device is initialized according to the authentication configuration file;

NETCONF connection unit 4, which is used to control the NETCONF connection with the SD-WAN controller after the SSH user authentication of the WAN device is passed;

The authentication judgment unit 5 is used to determine that the WAN device has passed the device authentication when the TCP connection is completed, the SHH authentication is passed, and the NETCONF connection is completed, and otherwise, the WAN device authentication has failed.

It should be noted that the authentication configuration file includes the SD-WAN controller IP address, local exit configuration, SSH login user name, and SSH user authentication information.

In another implementation manner in the embodiment of the present invention, the SSH key exchange unit 1 is also used to unify the key agreement and the key exchange algorithm between the WAN device and the SD-WAN controller;

The SSH key exchange unit 1 is also used to set the device authentication identifier in the authentication configuration file as the key exchange characteristic value;

The SSH key exchange unit 1 is also used to control the SD-WAN controller to obtain the key exchange characteristic value after the SD-WAN controller and the WAN device complete the SSH key exchange.

In another implementation manner in the embodiment of the present invention, the SSH user authentication unit 2 is further configured to control the SD-WAN controller to obtain user authentication information of the WAN device in a preset local data table according to the device authentication identifier;

The SSH user authentication unit 2 is also used to control the SD-WAN controller to send an SSH user authentication request to the WAN device in accordance with the SSH protocol standard, and the SSH user authentication request includes user authentication information;

The SSH user authentication unit 2 is also used for the waiting WAN device to release SSH user authentication information in response to the user authentication information.

In another implementation manner in the embodiment of the present invention, the system further includes a pre-preparation unit 6, which is used to control the SD-WAN controller to register the WAN device and generate a device online list and a device authentication list;

The pre-preparation unit 6 is also used to control the SD-WAN controller to generate an authentication configuration file, and to release the authentication configuration file to the WAN device;

；

Those skilled in the art should understand that the embodiments of the present invention can be provided as methods, systems, servers, or computer program products. Therefore, the present invention may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may be in the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, optical storage, etc.) containing computer-usable program codes.

The present invention is described with reference to flowcharts and/or block diagrams of methods, devices (systems), servers, and computer program products according to embodiments of the present invention. It should be understood that each process and/or block in the flowchart and/or block diagram, and the combination of processes and/or blocks in the flowchart and/or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to the processors of general-purpose computers, special-purpose computers, embedded processors, or other programmable data processing equipment to generate a machine, so that instructions executed by the processor of the computer or other programmable data processing equipment are used It is a device that realizes the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device. The device implements the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment. The instructions provide steps for implementing functions specified in a flow or multiple flows in the flowchart and/or a block or multiple blocks in the block diagram.

Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. In this way, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalent technologies, the present invention is also intended to include these modifications and variations.

Claims

An SD-WAN-based device authentication method, characterized in that the method includes the following steps:

The SD-WAN controller performs an SSH connection with the WAN device, and the WAN device performs SSH key exchange with the SD-WAN controller according to the device authentication identifier in the authentication configuration file of the WAN device;

The SD-WAN controller obtains the device authentication identifier, obtains user authentication information according to the device authentication identifier, and performs SSH user authentication on the WAN device according to the user authentication information.
The method of claim 1, wherein the WAN device performs SSH key exchange with the SD-WAN controller according to the device authentication identifier in the authentication configuration file of the WAN device, which specifically includes the following steps :

The WAN device interacts with the SD-WAN controller to unify key agreement and key exchange algorithm;

The WAN device sets the device authentication identifier in the authentication configuration file as a key exchange characteristic value;

The SD-WAN controller performs key exchange with the WAN device, and obtains the key exchange characteristic value.
The method according to claim 2, wherein the SD-WAN controller obtains the device authentication ID, obtains user authentication information according to the device authentication ID, and performs a check on the WAN device according to the user authentication information. SSH user authentication includes the following steps:

The SD-WAN controller obtains the user authentication information of the WAN device in a preset local data table according to the device authentication identifier;

The SD-WAN controller sends an SSH user authentication request to the WAN device in accordance with the SSH protocol standard, where the SSH user authentication request includes the user authentication information;

In response to the user authentication information, the WAN device passes the SSH user authentication.
The method of claim 1, wherein the method further comprises the following steps:

The WAN device is initialized according to the authentication configuration file;

The SD-WAN controller establishes a TCP connection with the WAN device, and the SD-WAN controller initiates SSH user authentication to the WAN device;

After the SSH user authentication of the WAN device is passed, the SD-WAN controller sends a NETCONF connection request to the WAN device, and the WAN device responds and generates a NETCONF connection feedback.
The method of claim 1, wherein the method further comprises the following steps:

The SD-WAN controller registers the WAN equipment, and will generate a device online form and a device certification form;

The SD-WAN controller generates the authentication configuration file, and publishes the authentication configuration file to the WAN device;

Wherein, the device online table is used to record WAN devices that have completed device registration on the SD-WAN controller, and the device authentication table is used to record device SSH authentication information of the SDN-WAN controller.
An SD-WAN-based device authentication system, characterized in that, the system includes:

The SSH key exchange unit is used to control the SD-WAN controller and the WAN according to the device authentication identifier in the authentication configuration file of the WAN device after the SD-WAN controller and the WAN device are connected via SSH. The device performs SSH key exchange;

The SSH user authentication unit is used to obtain user authentication information according to the device authentication identifier after the SD-WAN controller obtains the device authentication identifier, and perform SSH user authentication on the WAN device according to the user authentication information Certification.
The system of claim 6, wherein:

The SSH key exchange unit is also used to unify a key agreement and a key exchange algorithm between the WAN device and the SD-WAN controller;

The SSH key exchange unit is further configured to set the device authentication identifier in the authentication configuration file as a key exchange characteristic value;

The SSH key exchange unit is further configured to control the SD-WAN controller to obtain the key exchange characteristic value after completing the SSH key exchange with the WAN device.
The system of claim 6, wherein:

The SSH user authentication unit is further configured to control the SD-WAN controller to obtain user authentication information of the WAN device in a preset local data table according to the device authentication identifier;

The SSH user authentication unit is further configured to control the SD-WAN controller to send an SSH user authentication request to the WAN device in accordance with the SSH protocol standard, where the SSH user authentication request includes the user authentication information;

The SSH user authentication unit is further configured to wait for the WAN device to respond to the user authentication information and release the SSH user authentication passing information.
The system of claim 6, wherein the system further comprises:

The TCP connection unit is configured to control the WAN device to perform a TCP connection with the SD-WAN controller after the WAN device completes initialization according to the authentication configuration file;

The NETCONF connection unit is used to control the NETCONF connection with the SD-WAN controller after the SSH user authentication of the WAN device is passed;

The authentication judging unit is used to determine that the WAN device passes the device authentication when the TCP connection is completed, the SHH authentication is passed, and the NETCONF connection is completed, and otherwise, the WAN device authentication fails.
The system of claim 6, wherein the system further comprises:

A pre-preparation unit, which is used to control the SD-WAN controller to register the WAN device, and generate a device online table and a device authentication table;

The pre-preparation unit is further configured to control the SD-WAN controller to generate an authentication configuration file and publish the authentication configuration file to the WAN device;

Wherein, the device online table is used to record WAN devices that have completed device registration on the SD-WAN controller, and the device authentication table is used to record device SSH authentication information of the SDN-WAN controller.