二层以太网WebAuth认证系统的设计与实现

发布时间：2018-05-08 14:11

本文选题：WebAuth + 网页认证　；参考：《北京邮电大学》2017年硕士论文

【摘要】：随着互联网技术的快速发展,信息社会日臻成熟,对网络接入安全和网络资源配置合理化的需求促使了安全认证技术的更新进步。高端分布式交换机以其高速的数据转发能力在园区网等大型局域网中得到了广泛的部署,同时网页认证方式以其灵活和扩展性强的优势被越来越多的应用于安全认证领域。为了将二者的优势结合起来,本文设计并实现了以MAC地址为用户身份标识,工作于二层以太网的分布式交换机网页认证系统——WebAuth认证系统。首先,本文分析了主流认证技术的优缺点,阐述了WebAuth的基本概念和组网方式,对高端分布式交换机的硬件和软件体系结构以及RADIUS认证协议进行了论述,奠定了开发WebAuth认证系统的理论基础。然后,本文从整体上对WebAuth认证系统进行了规划,论述了它与底层驱动模块、HTTP重定向和本地网页模块、MAC地址管理模块和AAA模块的交互关系,并提出了更改报文过滤规则和建立暂态MAC地址表等改进方案。之后,将WebAuth系统划分为五个不同的模块,分别进行了详细的功能和结构设计,提出了统一配置数据封装、分布式消息队列和独立工作线程等设计思路。接着,制定了用户状态机的轮转模型,并采用了通道切换机制解决分布式时序问题。最后,本文对WebAuth认证系统进行了功能测试和大用户性能测试,验证了系统功能的完整性和性能的稳定性,在以太网分布式交换机上实现了网页认证系统。
[Abstract]:With the rapid development of Internet technology and the maturation of information society, the demand for network access security and the rationalization of network resource allocation has promoted the update and progress of security authentication technology. High-end distributed switches have been widely deployed in large local area networks (LAN) such as campus networks because of their high-speed data forwarding capability. Meanwhile, the authentication mode of web pages is more and more widely used in the field of security authentication because of its advantages of flexibility and expansibility. In order to combine the advantages of the two, this paper designs and implements a Web Auth authentication system, which uses MAC address as user identity and works in layer 2 Ethernet. Firstly, this paper analyzes the advantages and disadvantages of mainstream authentication technology, expounds the basic concept and networking mode of WebAuth, and discusses the hardware and software architecture of high-end distributed switch and RADIUS authentication protocol. It lays a theoretical foundation for developing WebAuth authentication system. Then, this paper plans the WebAuth authentication system as a whole, and discusses its interaction with the bottom driver module and the local web page module, the WebAuth address management module and the AAA module. Some improved schemes, such as changing packet filtering rules and establishing transient MAC address table, are proposed. After that, the WebAuth system is divided into five different modules, and the detailed function and structure design are carried out, and the design ideas such as unified configuration data encapsulation, distributed message queue and independent worker thread are proposed. Then, the rotation model of the user state machine is established, and the channel switching mechanism is adopted to solve the distributed timing problem. Finally, the WebAuth authentication system is tested by function test and large user performance test, which verifies the integrity and performance stability of the system, and implements the web page authentication system on Ethernet distributed switch.
【学位授予单位】：北京邮电大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP311.52;TP393.08

【相似文献】