CN1486013A - Method for network access user authentication - Google Patents
Method for network access user authentication Download PDFInfo
- Publication number
- CN1486013A CN1486013A CNA02131781XA CN02131781A CN1486013A CN 1486013 A CN1486013 A CN 1486013A CN A02131781X A CNA02131781X A CN A02131781XA CN 02131781 A CN02131781 A CN 02131781A CN 1486013 A CN1486013 A CN 1486013A
- Authority
- CN
- China
- Prior art keywords
- user
- name
- authentication
- network
- authentication mode
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Landscapes
- Computer And Data Communications (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention discloses a certificating method for the user connected to the network. First, set a network connect name containing user name, domain name, and certificating mode name, thus, when user connects the network, the network server uses the network connect name provided by the user to identify the certificating mode, and then use the certificating mode identified to determine the network certificating server to certificate the user; it is simple and largely reduces the time of certification.
Description
Technical field
The present invention relates to method to network access user authentication.
Background technology
Usually and depositing multiple different authentification of user mode, the certificate server of network just need be discerned the authentication mode of user's employing for the user who adopts the different authentication mode is authenticated in computer network.With the Ethernet is example, and in Ethernet, the IEEE 802.1x agreement that adopts IEEE to recommend is mostly carried out authentication operation to the user at present.IEEE 802.1x agreement is the access-control protocol (Port based network access controlprotocol) based on port, it uses Extensible Authentication Protocol (EAP, Extensible AuthenticationProtocol) authentication mode, EAP authentication mode commonly used has MD5 (a kind of encryption method), TLS (Transport Layer Security), OTP (disposal password), SIM (subscriber identification module) etc., as long as the user provides user name, authentication informations such as user cipher, by certain EAP authentication mode that comprises in the 802.1x agreement, just can arrive the authentication of carrying out the user identity legitimacy on the BAS Broadband Access Server (BAS) of network.After BAS Broadband Access Server (BAS) was received user's authentication information, the agreement by similar remote user dialing authentication protocol (radius protocol) authenticated to the certificate server of correspondence.
Along with the application based on the 802.1x agreement of ethernet technology, the multiple EAP authentication mode that comprises in the above-mentioned 802.1x agreement has all obtained using widely.From a user, may select a kind of authentication the in the EAP authentication mode arbitrarily; From a group user, multiple exactly EAP authentication mode is also deposited.At present, in request note agreement (RFC agreement) standard, use mutual negotiation mechanism to hold consultation, thereby discern the authentication mode of certain EAP.For example, suppose that client only supports the md5 authentication mode of EPA, i.e. EAP-MD5, and certificate server is supported EAP-SIM and EAP-MD5 authentication mode simultaneously, and the EAP-SIM authentication mode is preferential.Like this, for certificate server, will under EAP-MD5 authentication mode and EAP-SIM authentication mode and the condition of depositing, discern concrete EAP authentication mode through consultation.
But adopt negotiation mechanism to come certain EAP authentication mode of Dynamic Recognition, before confirming, authentication mode may need a large amount of negotiation packets, may support multiple modes such as EAP-MD5, EAP-SIM, EAP-TLS, EAP-OTP such as client, and certificate server is supported EAP-TTLS, EAP-MD5 dual mode, so, client and certificate server may need repeatedly to initiate the negotiation of authentication mode, travel through all EAP authentication modes, the authentication mode as a result that obtains at last consulting authenticates the user with this mode.Above-mentioned authentication method to the user must consume a large amount of Internet resources and computational resource, and the authentification of user time of expending is also considerable, realizes comparatively complicated simultaneously.
Owing in the network environment of reality, a plurality of certificate servers are often arranged, because user's difference of each certificate server authentication is generally only supported limited several authentication modes.In authentication agreement process, when access server once authenticates negotiation at certain,, therefrom can only select a certificate server according to many certificate servers that the domain name part in the user name finds corresponding ISP (ISP) to provide.If selected wrong certificate server, all authentication modes of this server support all can not satisfy the demand of client certificate mode so, so just can only notify user authentication failure.And really support the server of this authentication mode not play a role.
When number of users increases to a certain degree, carry out cluster with regard to many certificate servers of needs, under the multiple EAP authentication mode and the situation of depositing, can not the user be assigned to corresponding certain authentication sub-cluster according to business and authenticate, but whole cluster all to authenticate each business.When if desired the user who uses certain authentication mode being carried out business statistics, must add up whole cluster certificate server, and can not add up according to the certificate server sub-cluster that really offers the authentification of user service.
Because EAP provides an authentication framework, can constantly release new authentication mode on the EAP basis.After newly-increased a kind of EAP authentication mode enters operation, must uninterruptedly upgrade to the certificate server that is moving on the net, this difficulty is very big; Upgrade again if interrupt original authentication service, can influence at line service again, cause unnecessary loss and client's complaint.
From the above, the existing authentication mode that through consultation user is adopted is discerned, and low to method complexity, the efficient that the user authenticates with the authentication mode that identifies, and expends a large amount of Internet resources.
Summary of the invention
The object of the present invention is to provide a kind of authentication method of network access user of the authentification of user of Dynamic Recognition simply and effectively mode, use this method can improve the service efficiency of Internet resources.
For achieving the above object, the method to network access user authentication provided by the invention comprises the steps:
Step 1: the user network that comprises user name, domain name and authentication mode name is set inserts name;
Step 2: when the user carried out network insertion, the network insertion name that network access server utilizes the user to provide identified the authentication mode that this user adopts;
Step 3: the authentication mode that utilizes step 2 to identify is defined as the network authentication server of this user's service, by this network authentication server the user is authenticated.
Described step 2 further comprises:
Step 21: the user sends the message of network insertion request to network access server;
Step 22: network access server sends the message that the request user provides the network insertion name to the user;
Step 23: the user inserts the response message of name to network access server feedback packet includes network;
Step 24: network access server extracts user name, authentication mode name and domain name from the network insertion name of response message, determines the authentication mode that the user adopts according to this authentication mode name.
Described step 3 further comprises:
Step 31: network access server obtains the relevant authentication server list of corresponding ISP (ISP) according to domain name;
Step 32: certificate server or the certificate server sub-cluster of supporting this authentication mode used in decision according to the authentication mode name;
Step 33:, finish authentification of user with the flow process of the authentication mode correspondence of determining.
Because inserting name by the user network that comprises user name, domain name and authentication mode name that sets in advance, the present invention carries out network insertion, this network insertion name that can make network access server directly utilize the user to provide identifies the authentication mode that this user adopts, and then is defined as the network authentication server that this user serves with the authentication mode that identifies the user is authenticated; Therefore, the authentication mode of the present invention's multiple user's employing of Dynamic Recognition does not simply and effectively have unnecessary negotiations process, realizes simply, and the consumption of Internet resources and computational resource and authentification of user time are significantly reduced; Simultaneously, the present invention's convenience is according to the certificate server of user's service selection correspondence, can be according to delineation of activities certificate server or certificate server sub-cluster, like this, when increasing a kind of authentication mode newly, only need to increase new certificate server, on equipment, simply cooperate, just can carry out new authentication service, to original authentication service without any influence, thereby guarantee the continuity of operation.
Description of drawings
Fig. 1 is the embodiment flow chart of the method for the invention.
Embodiment
The present invention is described in further detail in conjunction with the accompanying drawings to be identified as example with the multiple authentication mode to EAP below.
Fig. 1 is the embodiment flow chart of the method for the invention.The described embodiment flow process of Fig. 1 adopts the 802.1x agreement.Implement the present invention according to Fig. 1, the user network that comprises user name, domain name and authentication mode name at first to be set insert name, this network insertion name can also be according to additional other the information of user demand, charging way for example, but only comprise user name, domain name and authentication mode in this example.The concrete form that user network in this example inserts name is: user name authentication mode name. domain name, can certainly be other form, as: user name. authentication mode name domain name, or, the user name domain name. the authentication mode name.So just can insert name and discern multiple EAP authentication mode simply and effectively by user network, for example user zhangsan has a user name zhangsan on the net in China Telecom 163, use the EAP-MD5 authentication mode, it is " [email protected] " (it can be " [email protected] " that operator directly is distributed to the user that upward routine user network inserts name, also can be that client generates " [email protected] " automatically according to the authentification of user mode on " [email protected] " basis) that the user network that this moment, subscription client provided inserts name.
Based on above-mentioned setting, after having set up physical connection between user and the access server, subscription client is when network insertion, send an authentication beginning message (EAPoL-Start message) in step 1 to access server, if the user is a dynamically allocate address, then send DHCP (DHCP) message, to start the beginning of carrying out network insertion according to the 802.1x agreement.At this moment, access server sends EAP request or identification message (EAP-Request/Identity message) in step 2 to client, require subscription client that user's network insertion name is sent up, then subscription client is responded an EAP response or identification message (EAP-Response/Identity) in step 3 to network access server, comprises this user's who satisfies preset user network insertion name format network insertion name in this message.Need to prove that this user name refers to end user's name, if the card of pre-payment distribution, this user name is exactly the card number of above-mentioned card; And domain name is meant the relevant title of operator that this webserver is provided, and can directly be operator name, also can be the relevant title of network that operator provides.Such as " [email protected] ", be that the user of user zhangsan by name inserts name at China Telecom's 163 online user networks; " [email protected] " is that the user network on the prepaid card of China Netcom issue inserts name.When network access server is received the EAP-Response/Identity message that subscription client is responded in step 4, therefrom extract user name, authentication mode name, domain name, determine the authentication mode that the user adopts according to this authentication mode name, network access server obtains the relevant authentication server list of corresponding ISP in step 5 according to domain name then, certificate server or the certificate server sub-cluster of supporting this authentication mode used in decision according to the authentication mode name, uses the flow process of the authentication mode correspondence of determining to finish authentification of user in step 6 at last.
Also need illustrate at last, when certificate server or certificate server sub-cluster are supported multiple authentication mode, can allow certificate server or certificate server sub-cluster and user to consult authentication mode, also can only use the authentication mode of authentication mode name correspondence and not allow to use other authentication mode by the access server restriction in step 5.
Claims (6)
1, a kind of method to network access user authentication comprises the steps:
Step 1: the user network that comprises user name, domain name and authentication mode name is set inserts name;
Step 2: when the user carried out network insertion, the network insertion name that network access server utilizes the user to provide identified the authentication mode that this user adopts;
Step 3: the authentication mode that utilizes step 2 to identify is defined as the network authentication server of this user's service, by this network authentication server the user is authenticated.
2, the method to network access user authentication according to claim 1 is characterized in that, described step 2 further comprises:
Step 21: the user sends the message of network insertion request to network access server;
Step 22: network access server sends the message that the request user provides the network insertion name to the user;
Step 23: the user inserts the response message of name to network access server feedback packet includes network;
Step 24: network access server extracts user name, authentication mode name and domain name from the network insertion name of response message, determines the authentication mode that the user adopts according to this authentication mode name.
3, the method to network access user authentication according to claim 2 is characterized in that, described step 3 further comprises:
Step 31: network access server obtains the relevant authentication server list of corresponding ISP (ISP) according to domain name;
Step 32: certificate server or the certificate server sub-cluster of supporting this authentication mode used in decision according to the authentication mode name;
Step 33:, finish authentification of user with the flow process of the authentication mode correspondence of determining.
4, the method to network access user authentication according to claim 3, it is characterized in that: when certificate server or certificate server sub-cluster were supported multiple authentication mode, described step 32 comprised that also certificate server or certificate server sub-cluster and user consult the substep of authentication mode.
5, the method to network access user authentication according to claim 3, it is characterized in that: when certificate server or certificate server sub-cluster were supported multiple authentication mode, described step 32 comprised that also network access server determines the substep of authentication mode.
6, according to claim 1,2,3,4 or 5 described methods to network access user authentication, it is characterized in that: the form that described user network inserts name is: user name authentication mode name. domain name.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN 02131781 CN1265579C (en) | 2002-09-23 | 2002-09-23 | Method for network access user authentication |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN 02131781 CN1265579C (en) | 2002-09-23 | 2002-09-23 | Method for network access user authentication |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN1486013A true CN1486013A (en) | 2004-03-31 |
| CN1265579C CN1265579C (en) | 2006-07-19 |
Family
ID=34145032
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN 02131781 Expired - Fee Related CN1265579C (en) | 2002-09-23 | 2002-09-23 | Method for network access user authentication |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN1265579C (en) |
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2007112624A1 (en) * | 2006-04-04 | 2007-10-11 | Huawei Technologies Co., Ltd. | A method for authenticating, a method for negotiating the authentication type, and a network access serving apparatus |
| CN101677440A (en) * | 2008-09-18 | 2010-03-24 | 华为技术有限公司 | Method, system and safe gateway of access point authentication |
| CN101051897B (en) * | 2006-04-07 | 2010-07-28 | 华为技术有限公司 | Biological information certifying method |
| CN101399726B (en) * | 2007-09-29 | 2011-09-07 | 中国电信股份有限公司 | Method for WLAN terminal authentication |
| CN101699893B (en) * | 2009-11-10 | 2012-09-05 | 广州杰赛科技股份有限公司 | Method for changing states of authentication service entities of certificate server cluster |
| CN103078877A (en) * | 2013-01-31 | 2013-05-01 | 中国科学院计算机网络信息中心 | User authentication and domain name access control method and system based on DNS (domain name system) |
| CN104378211A (en) * | 2014-11-26 | 2015-02-25 | 深圳市银雁金融配套服务有限公司 | Identity authentication method and device |
-
2002
- 2002-09-23 CN CN 02131781 patent/CN1265579C/en not_active Expired - Fee Related
Cited By (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2007112624A1 (en) * | 2006-04-04 | 2007-10-11 | Huawei Technologies Co., Ltd. | A method for authenticating, a method for negotiating the authentication type, and a network access serving apparatus |
| CN101051897B (en) * | 2006-04-07 | 2010-07-28 | 华为技术有限公司 | Biological information certifying method |
| CN101399726B (en) * | 2007-09-29 | 2011-09-07 | 中国电信股份有限公司 | Method for WLAN terminal authentication |
| CN101677440A (en) * | 2008-09-18 | 2010-03-24 | 华为技术有限公司 | Method, system and safe gateway of access point authentication |
| CN101699893B (en) * | 2009-11-10 | 2012-09-05 | 广州杰赛科技股份有限公司 | Method for changing states of authentication service entities of certificate server cluster |
| CN103078877A (en) * | 2013-01-31 | 2013-05-01 | 中国科学院计算机网络信息中心 | User authentication and domain name access control method and system based on DNS (domain name system) |
| CN103078877B (en) * | 2013-01-31 | 2015-09-16 | 中国科学院计算机网络信息中心 | Based on the user authentication of DNS and domain name access control method and system |
| CN104378211A (en) * | 2014-11-26 | 2015-02-25 | 深圳市银雁金融配套服务有限公司 | Identity authentication method and device |
Also Published As
| Publication number | Publication date |
|---|---|
| CN1265579C (en) | 2006-07-19 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US8125980B2 (en) | User terminal connection control method and apparatus | |
| US8484695B2 (en) | System and method for providing access control | |
| US8094663B2 (en) | System and method for authentication of SP ethernet aggregation networks | |
| US20040268118A1 (en) | System and method for automatic negotiation of a security protocol | |
| US20080092213A1 (en) | Method, system and server for realizing secure assignment of dhcp address | |
| CN101110847B (en) | Method, device and system for obtaining medium access control address | |
| CN101465856A (en) | Method and system for controlling user access | |
| JP3697437B2 (en) | Network system and network system construction method | |
| CN101087236B (en) | VPN access method and device | |
| CN1567868A (en) | Authentication method based on Ethernet authentication system | |
| US8769623B2 (en) | Grouping multiple network addresses of a subscriber into a single communication session | |
| CN1416241A (en) | Authentication method for supporting network switching in based on different devices at same time | |
| CN101227477A (en) | Method for implementing subscriber terminal access authentication | |
| CN1265579C (en) | Method for network access user authentication | |
| CN1266910C (en) | A method choosing 802.1X authentication mode | |
| US20090271852A1 (en) | System and Method for Distributing Enduring Credentials in an Untrusted Network Environment | |
| CN100591068C (en) | Method of transmitting 802.1X audit message via bridging device | |
| US8954547B2 (en) | Method and system for updating the telecommunication network service access conditions of a telecommunication device | |
| CN1235382C (en) | A client authentication method based on 802.1X protocol | |
| CN1225870C (en) | Method and apparatus for VLAN based network access control | |
| EP1530343A1 (en) | Method and system for creating authentication stacks in communication networks | |
| JP2007226620A (en) | Home gateway device and accounting management system for network system | |
| CN1484412A (en) | Method for realizing 802.1 X communication based on group management | |
| CN1859415A (en) | Method and device for forced verifying from end-to-end protocol | |
| CN1266919C (en) | Method for reacquiring 802.1 X customer terminal IP address |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20060719 Termination date: 20200923 |
|
| CF01 | Termination of patent right due to non-payment of annual fee |