Network authentication method, method for client to request authentication, client, and device
View Patent ↗A network authentication method, a method for a client to request authentication, a client, and a device are provided. The method includes: receiving synchronize (SYN) data sent by a client, where the SYN data includes a sequence number SEQ 1 and a network parameter; sending synchronize acknowledge (SYN_ACK) data to the client in response to the SYN data, where the SYN_ACK data includes an acknowledgment number ACK 2 , and the value of ACK 2 is a value obtained by carrying out a function transformation according to the network parameter of the SYN data; receiving RESET (RST) data sent by the client in response to the SYN_ACK data, where the RST data includes a sequence number SEQ 3 or an acknowledgment number ACK 3 , and the value of SEQ 3 or ACK 3 is the same as that of ACK 2 , and the RST data further includes a network parameter the same as that of the SYN data; carrying out the function transformation according to the network parameter of the RST data to obtain a check value CHK; and passing the authentication of the client if CHK matches SEQ 3 or ACK 3 . Therefore, the occupation of storage resources is reduced.
1. A network authentication method, comprising:
receiving synchronize (SYN) data sent by a client, wherein the SYN data comprises a sequence number SEQ 1 and a network parameter;
sending synchronize acknowledge (SYN_ACK) data to the client in response to the SYN data, wherein the SYN_ACK data comprises an acknowledgment number ACK 2 , and a value of ACK 2 is the value obtained by carrying out a function transformation according to the network parameter of the SYN data;
receiving RESET (RST) data sent by the client in response to the SYN_ACK data, wherein the RST data comprises a sequence number SEQ 3 or an acknowledgment number ACK 3 , a value of SEQ 3 or ACK 3 is the same as that of ACK 2 , and the RST data further comprises a network parameter the same as that of the SYN data;
carrying out the function transformation according to the network parameter of the RST data to obtain a check value CHK; and
passing the authentication of the client if CHK matches the value of SEQ 3 or ACK 3 ;
wherein the network parameter comprises one or more of an Identification (ID), a Source Internet Protocol Address (SIP), a Source Port (SPORT), a Destination IP Address (DIP), a Destination Port (DPORT) a Protocol Type (Protocol), and a Time to Live (TTL) in an IP header of a data packet;
wherein the function transformation is constructed as
FUNC(TTL,ID,SIP,SPORT,DIP,DPORT,PROTOCOL)=( x *TTL+ y *ID+ z *HASH(SIP,SPORT,DIP,DPORT,PROTOCOL))Mod M,
where x, y z are three constant parameters; Mod indicates modulus operation; M indicates modulus 65536; HASH indicates a hash function.
2. The method according to claim 1 , wherein the passing the authentication of the client if CHK matches the value of SEQ 3 or ACK 3 comprises:
passing the authentication of the client if CHK is equal to SEQ 3 or ACK 3 .
3. The method according to claim 1 , wherein the passing the authentication of the client if CHK matches the value of SEQ 3 or ACK 3 comprises:
passing the authentication of the client if a difference between CHK and SEQ 3 or ACK 3 is in a set range.
4. A network server including a non-transitory computer readable medium including computer-executable instructions for carrying out a network authentication device, the network authentication device comprising:
a first receiving unit, configured to receive synchronize (SYN) data sent by a client, wherein the SYN data comprises a sequence number SEQ 1 and a network parameter;
a sending unit, configured to send synchronize acknowledge (SYN_ACK) data to the client in response to the SYN data received by the first receiving unit, wherein the SYN_ACK data comprises an acknowledgment number ACK 2 , and a value of ACK 2 is the value obtained by carrying out a function transformation according to the network parameter of the SYN data;
a second receiving unit, configured to receive RESET (RST) data sent by the client in response to the SYN_ACK data sent by the sending unit, wherein the RST data comprises a sequence number SEQ 3 or an acknowledgment number ACK 3 , and a value of ACK 3 is the same as that of SEQ 3 or ACK 2 , and the RST data further comprises a network parameter the same as that of the SYN data;
a calculating unit, configured to carry out the function transformation according to the network parameter of the RST data received by the second receiving unit to obtain a check value CHK; and
an authenticating unit, configured to pass the authentication of the client when CHK calculated by the calculating unit matches SEQ 3 or ACK 3 of the RST data;
wherein the network parameter comprises one or more of an Identification (ID), a Source Internet Protocol Address (SIP), a Source Port (SPORT), a Destination IP Address (DIPL a Destination Port (DPORT) a Protocol Type (Protocol) and a Time to Live (TTL) in an IP header of a data packet;
wherein the function transformation is constructed as
FUNC(TTL,ID,SIP,SPORT,DIP,DPORT,PROTOCOL)=( x *TTL+ y *ID+ z *HASH(SIP,SPORT,DIP,DPORT,PROTOCOL))Mod M,
where x, y, z are three constant parameters; Mod indicates modulus operation; M indicates modulus 65536; HASH indicates a hash function.
5. The device according to claim 4 , wherein the authenticating unit is specifically configured to pass the authentication of the client when CHK calculated by the calculating unit is equal to SEQ 3 or ACK 3 of the RST data.
6. The device according to claim 4 , wherein the authenticating unit is specifically configured to pass the authentication of the client when a difference between CHK calculated by the calculating unit and SEQ 3 or ACK 3 of the RST data is in a preset range.
7. A network client including a non-transitory computer readable medium including computer-executable instructions for carrying out a set of functional components, the functional components comprising:
a sending unit, configured to send synchronize (SYN) data to a gateway, wherein the SYN data comprises a sequence number SEQ 1 and a network parameter;
a receiving unit, configured to receive synchronize acknowledge (SYN_ACK) data sent by the gateway in response to the SYN data, wherein the SYN_ACK data comprises an acknowledgment number ACK 2 , and a value of ACK 2 is the value obtained by carrying out a function transformation according to the network parameter of the SYN data; and
a judging unit, configured to judge whether the value of ACK 2 is the same as an expected value, and if the value of ACK 2 is different from the expected value, send RESET (RST) data to the gateway in response to the SYN_ACK data, wherein the RST data comprises a sequence number SEQ 3 or an acknowledgment number ACK 3 , a value of SEQ 3 or ACK 3 is the same as that of ACK 2 , and the RST data further comprises a network parameter the same as that of the SYN data; and instruct the gateway to authenticate the client according to the RST data and SEQ 3 or ACK 3 ;
wherein the network parameter comprises one or more of an Identification (ID), a Source Internet Protocol Address (SIP), a Source Port (SPORT), a Destination IP Address (DIP), a Destination Port (DPORT), a Protocol Type (Protocol), and a Time to Live (TTL) in an IP header of a data packet;
wherein the function transformation is constructed as
FUNC(TTL,ID,SIP,SPORT,DIP,DPORT,PROTOCOL)=( x *TTL+ y *ID+ z *HASH(SIP,SPORT,DIP,DPORT,PROTOCOL))Mod M,
where x, y, z are three constant parameters; Mod indicates modulus operation; M indicates modulus 65536; HASH indicates a hash function.