CN102739657A - Enable authentication method and method for butt TACACS (Terminal Access Controller Access Control System) + server - Google Patents

Abstract

The invention discloses an enable authentication method and system for docking with a TACACS+ server. The method includes: in an IP network, a TACACS+ client sends an enable authentication request message containing an enable authentication type to a TACACS+ server, and requests the TACACS+ server to perform authentication; After receiving the enable authentication request message, the TACACS+ server extracts the enable authentication type therein, and generates an enable authentication response message for responding to the enable authentication request message according to the enable authentication type and sends it to the TACACS+ client; The TACACS+ client judges whether the enable authentication is connected to the TACACS+ server according to the enable authentication response message; when the judgment result is unsuccessful, the TACACS+ client modifies the enable authentication type in the enable authentication request message, and repeats the above steps until The enable authentication successfully connects to the TACACS+ server.

Description

An enable authentication method and system for connecting to a TACACS+ server

technical field

The invention relates to the communication field, in particular to a processing technique for TACACS+enable authentication of different authentication types.

Background technique

TACACS+ (Terminal Access Controller Access Control System) is a terminal access controller access control system, which is an AAA (Authentication, Authorization, Accounting) type network application protocol. TACACS+ supports independent authentication, authorization, and accounting functions, and allows different TACACS+ security servers to serve as authentication, authorization, and accounting servers for authentication, authorization, and accounting functions.

This protocol realizes remote control of user access. Enable authentication means that TACACS+ server authentication is used when the user performs enable authentication. TACACS+draft stipulates that for enable authentication, the authen_type (authentication type) of the message is not used (not used).

At present, there are many TACACS+ servers, and different TACACS+ servers process the authentication type field of the enable authentication request message differently. All interconnection with different TACACS+ servers using enable authentication will fail. Since TACACS+draft does not clearly specify the specific value of the enable authentication type in the enable authentication request message, how to ensure that the enable authentication is successfully interconnected with different TACACS+ servers has become an urgent problem to be solved.

Contents of the invention

The purpose of the present invention is to provide an enable authentication method and system for docking with TACACS+ servers, which can better solve the problem of failure of enable authentication for docking with different TACACS+ servers.

According to one aspect of the present invention, a kind of enable authentication method of docking TACACS+ server is provided, comprising:

In the IP network, the TACACS+ client sends an enable authentication request message containing the enable authentication type to the TACACS+ server, requesting the TACACS+ server to perform authentication;

After receiving the enable authentication request message, the TACACS+ server extracts the enable authentication type therein, and generates an enable authentication response message for responding to the enable authentication request message according to the enable authentication type, and sends it to the TACACS+ client;

The TACACS+ client judges whether the enable authentication is connected to the TACACS+ server successfully according to the enable authentication response message;

When the judgment result is unsuccessful, the TACACS+ client modifies the enable authentication type in the enable authentication request message, and repeats the above steps until the enable authentication is connected to the TACACS+ server successfully.

Preferably, the TACACS+ client performs timing processing after sending the enable authentication request message, and waits for the TACACS+ server to respond to the enable authentication request message within a predetermined time.

Preferably, when the TACACS+ client does not receive the enable authentication response message responded by the TACACS+ server within a predetermined time after sending the enable authentication request message, it is determined that the enable authentication interconnection with the TACACS+ server is unsuccessful.

Preferably, when the TACACS+ client receives the enable authentication response message responded by the TACACS+ server within a predetermined time after sending the enable authentication request message, it parses the enable authentication response message and uses the analysis result Check whether enable authentication succeeds in interconnecting with the TACACS+ server.

Preferably, the enable authentication type includes none, ascii, pap, chap, arap, mschap.

According to another aspect of the present invention, a kind of enable authentication system docking TACACS+ server is provided, including TACACS+ client and TACACS+ server running on IP network, it is characterized in that,

The TACACS+ client is used to send an enable authentication request message that includes the enable authentication type to the TACACS+ server, request the TACACS+ server to perform enable authentication, and judge whether the enable authentication is connected to the TACACS+ server successfully according to the received enable authentication response message, When the judgment result is unsuccessful, modify the enable authentication type in the enable authentication request message, and repeat the enable authentication until the enable authentication successfully connects to the TACACS+ server;

The TACACS+ server is configured to, after receiving the enable authentication request message, extract the enable authentication type therein, and generate an enable authentication response message for responding to the enable authentication request message according to the enable authentication type and send it to the TACACS+ client.

Preferably, the TACACS+ client includes:

A client message sending and receiving unit, configured to send an enable authentication request message containing an enable authentication type, and receive the enable authentication response message responded by the TACACS+ server;

The client timing unit is used to perform timing processing after the message transceiver unit sends the enable authentication request message, and waits for the TACACS+ server to respond to the enable authentication request message within a predetermined time;

A client parsing unit, configured to parse the received enable authentication response message;

The client authentication judging unit is configured to determine whether the enable authentication is connected to the TACACS+ server successfully according to the enable authentication response message.

Preferably, when the client message sending and receiving unit does not receive the enable authentication response message responded by the TACACS+ server within a predetermined time after sending the enable authentication request message, the client authentication judging unit determines enable Failed to connect to the TACACS+ server through authentication.

Preferably, when the client message sending and receiving unit receives the enable authentication response message responded by the TACACS+ server within a predetermined time after sending the enable authentication request message, the client authentication judging unit utilizes the The client parsing unit parses the parsing result of the enable authentication response message to determine whether the enable authentication is connected to the TACACS+ server successfully.

Preferably, the TACACS+ server includes:

A server message sending and receiving unit, configured to receive the enable authentication request message containing the enable authentication type from the TACACS+ client, and send an enable authentication response for responding to the enable authentication request message to the TACACS+ client message;

A server parsing unit, configured to parse the enable authentication request message received by the server message sending and receiving unit, and extract the enable authentication type therein;

The server authentication unit is configured to generate the enable authentication response message according to the enable authentication type.

Compared with the prior art, the beneficial effects of the present invention are:

When the present invention fails to connect to the TACACS+ server using enable authentication, it can try to modify the field of the enable authentication type of the enable authentication request message, and re-dock the TACACS+ server until the field is modified to the corresponding enable authentication type supported by the TACACS+ server, enabling enable authentication Successfully connected to different TACACS+ servers.

Description of drawings

Fig. 1 is the block diagram of the enable authentication method of docking TACACS+ server provided by the embodiment of the present invention;

Fig. 2 is the network topology diagram of the enable authentication system connected to the TACACS+ server provided by the embodiment of the present invention;

FIG. 3 is a specific flow chart of enabling authentication for different authentication types provided by an embodiment of the present invention.

Detailed ways

The preferred embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described below are only used to illustrate and explain the present invention, and are not intended to limit the present invention.

Fig. 1 is a block diagram of an enable authentication method for docking with a TACACS+ server provided by an embodiment of the present invention, as shown in Fig. 1 , including:

Step S101 , in the IP network, the TACACS+ client sends an enable authentication request message including the enable authentication type to the TACACS+ server, requesting the TACACS+ server to perform authentication.

Further, the TACACS+ client performs timing processing after sending the enable authentication request message, and waits for the TACACS+ server to respond to the enable authentication request message within a predetermined time.

Step S102, after the TACACS+ server receives the enable authentication request message, extracts the enable authentication type therein, and according to the enable authentication type, generates an enable authentication response message for responding to the enable authentication request message and sends it to the TACACS+ client.

Step S103 , the TACACS+ client judges whether the enable authentication interconnection with the TACACS+ server is successful according to the enable authentication response message.

Step S104, when the judging result is unsuccessful, the TACACS+ client modifies the enable authentication type in the enable authentication request message, and repeats the above steps until the enable authentication is connected to the TACACS+ server successfully.

Further, when the TACACS+ client does not receive the enable authentication response message responded by the TACACS+ server within a predetermined time after sending the enable authentication request message, it is determined that the enable authentication interconnection with the TACACS+ server is unsuccessful.

Further, when the TACACS+ client receives the enable authentication response message responded by the TACACS+ server within a predetermined time after sending the enable authentication request message, analyze the enable authentication response message, and use the analysis result Check whether enable authentication succeeds in interconnecting with the TACACS+ server.

The enable authentication types above include none, ascii, pap, chap, arap, and mschap.

When using enable authentication to connect to a TACACS+ server, the enable authentication type first adopts the default value of the application. If the connection to the TACACS+ server fails, try to modify the field values of the corresponding enable authentication type other than the default value (none, ascii, pap, chap, arap, mschap), and re-initiate the enable authentication until the TACACS+ server is successfully connected.

FIG. 2 is a network topology diagram of an enable authentication system connected to a TACACS+ server provided by an embodiment of the present invention. As shown in FIG. 2 , it includes a TACACS+ client and a TACACS+ server running on an IP network. When the user performs enable authentication, the TACACS+ client sends an enable authentication request message to the TACACS+ server, and waits for the TACACS+ server to respond to the enable authentication request message. in:

The TACACS+ client is used to send an enable authentication request message that includes the enable authentication type to the TACACS+ server, request the TACACS+ server to perform enable authentication, and judge whether the enable authentication is connected to the TACACS+ server successfully according to the received enable authentication response message, If the judgment result is unsuccessful, modify the enable authentication type in the enable authentication request packet, and repeat the enable authentication until the enable authentication is successfully interconnected with the TACACS+ server.

Specifically, the TACACS+ client includes:

A client message sending and receiving unit, configured to send an enable authentication request message containing an enable authentication type, and receive the enable authentication response message responded by the TACACS+ server;

The client timing unit is used to perform timing processing after the message transceiver unit sends the enable authentication request message, and waits for the TACACS+ server to respond to the enable authentication request message within a predetermined time;

A client parsing unit, configured to parse the received enable authentication response message;

The client authentication judging unit is configured to determine whether the enable authentication is connected to the TACACS+ server successfully according to the enable authentication response message. That is, when the client message sending and receiving unit does not receive the enable authentication response message responded by the TACACS+ server within a predetermined time after sending the enable authentication request message, the client authentication judging unit determines that the enable authentication is docked TACACS+ server was unsuccessful. When the client message sending and receiving unit receives the enable authentication response message responded by the TACACS+ server within a predetermined time after sending the enable authentication request message, the client authentication judging unit uses the client to analyze The unit analyzes the analysis result of the enable authentication response message, and determines whether the enable authentication is connected to the TACACS+ server successfully.

The TACACS+ server is configured to, after receiving the enable authentication request message, extract the enable authentication type therein, and generate an enable authentication response message for responding to the enable authentication request message according to the enable authentication type, and sent to the TACACS+ client.

Specifically, the TACACS+ server includes:

A server message sending and receiving unit, configured to receive the enable authentication request message containing the enable authentication type from the TACACS+ client, and send an enable authentication response for responding to the enable authentication request message to the TACACS+ client message;

A server parsing unit, configured to parse the enable authentication request message received by the server message sending and receiving unit, and extract the enable authentication type therein;

The server authentication unit is configured to generate the enable authentication response message according to the enable authentication type.

The workflow of the enable authentication system connected to the TACACS+ server is specifically described as follows:

1. Firstly, TACACS+enable authentication is adopted. The TACACS+ client initiates an authentication request by sending an enable authentication request message to the TACACS+ server, and records the default value of the enable authentication type in the enable authentication request message.

2. The TACACS+ server judges whether the value filled in the field corresponding to the enable authentication request message complies with the provisions of the TACACS+ draft (The TACACS+ Protocol Version 1.78), so as to judge whether the enable authentication succeeds or fails. The draft stipulates that the enable authentication request message should be filled with the following fields:

action=TAC_PLUS_AUTHEN_LOGIN

priv_lvl=implementation dependent

authen_type=not used

service=TAC_PLUS_AUTHEN_SVC_ENABLE

Since TACACS+ is a draft and no RFC has been formed, different TACACS+ servers have different requirements for filling in the authen_type field.

When the value filled in the authen_type field corresponding to the enable authentication request message meets the filling requirements of the TACACS+ server, the TACACS+ server sends an enable authentication response message to the TACACS+ client to indicate that the connection is successful; otherwise, it sends a message to the TACACS+ client to indicate the connection Failed enable authentication response packet.

3. The TACACS+ client receives the enable authentication response message and parses it, and ends the process when it judges that the enable authentication is connected to the TACACS+ server successfully. For example, if the status value of the enable authentication response message received by the TACACS+ client is not TAC_PLUS_AUTHEN_STATUS_ERROR (0x07), then the enable authentication is successfully interconnected with the TACACS+ server, that is, the TACACS+ client uses the TACACS+ server to perform enable authentication successfully.

4. When the TACACS+ client confirms that the enable authentication fails to connect to the TACACS+ server, modify the enable authentication type to the next enable authentication type, and judge that the enable authentication type of the current enable authentication request message is not the default value of the application and all enable authentication types If the attempt is not completed, continue to initiate authentication requests to the TACACS+ server until the enable authentication is successfully connected to the TACACS+ server.

The situation of the docking failure, that is, the situation where the TACACS+ client uses the TACACS+ server to perform enable authentication to connect to the TACACS+ server fails includes:

(1) The status value of the enable authentication response message returned by the TACACS+ client to the TACACS+ server is TAC_PLUS_AUTHEN_STATUS_ERROR (0x07).

(2) Under normal conditions of the TACACS+ client and the network connection, the enable authentication response message responded by the TACACS+ server cannot be received within a predetermined time after sending the enable authentication request message.

Fig. 3 is the specific process of the embodiment of the present invention to provide different authentication types of enable authentication, as shown in Fig. 3, including:

Step S301 , first adopt the TACACS+enable authentication mode, the authentication type adopts the default value of the application (such as none), and record the default value.

In step S302, the TACACS+ client initiates authentication by sending an enable authentication request message containing the enable authentication type to the TACACS+ server.

Step S303, if the TACACS+ client confirms that the enable authentication is successfully connected to the TACACS+ server, then end the process; otherwise, execute step S304.

Step S304, if the TACACS+ client confirms that the enable authentication fails to connect to the TACACS+ server, then modify the enable authentication type to the next enable authentication type.

Step S305, the TACACS+ client judges whether the enable authentication type of the enable authentication request message is the default value of the application, if it is the default value, then execute step S304, re-modify the enable authentication type of the enable authentication request message, otherwise, execute Step S306.

Step S306 , the TACACS+ client judges whether all enable authentication types in the enable authentication request message have been tried, and if so, ends the process, otherwise executes step S302 .

In summary, the present invention has the following technical effects:

The invention overcomes the defect that the enable authentication type of the enable authentication request message cannot be modified, and realizes the function of successfully docking different TACACS+ servers by adaptively modifying the enable authentication type of the enable authentication request message.

Although the present invention has been described in detail above, the present invention is not limited thereto, and various modifications can be made by those skilled in the art based on the principle of the present invention. Therefore, any modifications made according to the principles of the present invention should be understood as falling within the protection scope of the present invention.

Claims (10)

1. an enabling authentication method of docking terminal access controller access control system TACACS+ server, it is characterized in that, comprising: In the IP network, the TACACS+ client sends an enable authentication request message containing the enable authentication type to the TACACS+ server, requesting the TACACS+ server to perform authentication; After receiving the enable authentication request message, the TACACS+ server extracts the enable authentication type, generates an enable authentication response message for responding to the enable authentication request message according to the enable authentication type, and sends it to the TACACS+ client end; The TACACS+ client judges whether the enable authentication is connected to the TACACS+ server successfully according to the enable authentication response message; When the judgment result is unsuccessful, the TACACS+ client modifies the enable authentication type in the enable authentication request message, and repeats the above steps until the enable authentication is connected to the TACACS+ server successfully. 2. The method according to claim 1, wherein the TACACS+ client performs timing processing after sending the enable authentication request message, and waits for the TACACS+ server to respond to the enable authentication request message within a predetermined time. 3. The method according to claim 2, wherein, when the TACACS+ client does not receive the enable authentication response message of the TACACS+ server response within a predetermined time after sending the enable authentication request message, Make sure that the enable authentication fails to interconnect with the TACACS+ server. 4. The method according to claim 2, characterized in that, when the TACACS+ client receives the enable authentication response message of the TACACS+ server response within a predetermined time after sending the enable authentication request message, parsing The enable authentication response message, and use the analysis result to determine whether the enable authentication is successfully connected to the TACACS+ server. 5. The method according to any one of claims 1-4, wherein the enable authentication type includes none, ascii, pap, chap, arap, mschap. 6. an enable authentication system for docking terminal access controller access control system TACACS+ server, comprising TACACS+ client and TACACS+ server running on IP network, characterized in that, The TACACS+ client is used to send an enable authentication request message containing the enable authentication type to the TACACS+ server, request the TACACS+ server to perform authentication, and judge whether the enable authentication is connected to the TACACS+ server according to the received enable authentication response message. If the judgment result is unsuccessful, modify the enable authentication type in the enable authentication request message, and repeat the enable authentication until the enable authentication successfully connects to the TACACS+ server; The TACACS+ server is configured to, after receiving the enable authentication request message, extract the enable authentication type therein, and generate an enable authentication response message for responding to the enable authentication request message according to the enable authentication type and send it to the TACACS+ client. 7. The system according to claim 6, wherein the TACACS+ client comprises: A client message sending and receiving unit, configured to send an enable authentication request message containing an enable authentication type, and receive the enable authentication response message responded by the TACACS+ server; The client timing unit is used to perform timing processing after the message transceiver unit sends the enable authentication request message, and waits for the TACACS+ server to respond to the enable authentication request message within a predetermined time; A client parsing unit, configured to parse the received enable authentication response message; The client authentication judging unit is configured to determine whether the enable authentication is connected to the TACACS+ server successfully according to the enable authentication response message. 8. The system according to claim 7, wherein, when the client message transceiver unit does not receive the enable authentication response message from the TACACS+ server response within a predetermined time after sending the enable authentication request message In this case, the client authentication judging unit determines that the connection between the enable authentication and the TACACS+ server is not successful. 9. The system according to claim 7, wherein, when the client message transceiver unit receives the enable authentication response message of the TACACS+ server response within a predetermined time after sending the enable authentication request message , the client authentication judging unit uses the client parsing unit to parse the parsing result of the enable authentication response message to determine whether the enable authentication is connected to the TACACS+ server successfully. 10. The system according to claim 8 or 9, wherein the TACACS+ server comprises: A server message sending and receiving unit, configured to receive the enable authentication request message containing the enable authentication type from the TACACS+ client, and send an enable authentication response for responding to the enable authentication request message to the TACACS+ client message; A server parsing unit, configured to parse the enable authentication request message received by the server message sending and receiving unit, and extract the enable authentication type therein; The server authentication unit is configured to generate the enable authentication response message according to the enable authentication type.

Images