Network authentication method, method for client to request authentication, client, and device

• US 8,453,208 B2
• Filed: 04/27/2011
• Issued: 05/28/2013
• Est. Priority Date: 10/27/2008
• Status: Active Grant

• Current Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Chengdu Huawei Symantec Technologies Company Limited (Huawei Investment & Holding Co., Ltd.)
• Inventors: Jiang, Wu
• Primary Examiner(s): Arani, Taghi
• Assistant Examiner(s): VICTORIA, NARCISO F
• Application Number:
  US13/095,413
• Publication Number:
  US 20110202972A1
• Time in Patent Office: 762 Days
• Field of Search: 726/3
• US Class Current: 726/3
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures

Abstract

A network authentication method, a method for a client to request authentication, a client, and a device are provided. The method includes: receiving synchronize (SYN) data sent by a client, where the SYN data includes a sequence number SEQ1 and a network parameter; sending synchronize acknowledge (SYN_ACK) data to the client in response to the SYN data, where the SYN_ACK data includes an acknowledgment number ACK2, and the value of ACK2 is a value obtained by carrying out a function transformation according to the network parameter of the SYN data; receiving RESET (RST) data sent by the client in response to the SYN_ACK data, where the RST data includes a sequence number SEQ3 or an acknowledgment number ACK3, and the value of SEQ3 or ACK3 is the same as that of ACK2, and the RST data further includes a network parameter the same as that of the SYN data; carrying out the function transformation according to the network parameter of the RST data to obtain a check value CHK; and passing the authentication of the client if CHK matches SEQ3 or ACK3. Therefore, the occupation of storage resources is reduced.

Claims

1. A network authentication method, comprising:

receiving synchronize (SYN) data sent by a client, wherein the SYN data comprises a sequence number SEQ1 and a network parameter;

sending synchronize acknowledge (SYN_ACK) data to the client in response to the SYN data, wherein the SYN_ACK data comprises an acknowledgment number ACK2, and a value of ACK2 is the value obtained by carrying out a function transformation according to the network parameter of the SYN data;

receiving RESET (RST) data sent by the client in response to the SYN_ACK data, wherein the RST data comprises a sequence number SEQ3 or an acknowledgment number ACK3, a value of SEQ3 or ACK3 is the same as that of ACK2, and the RST data further comprises a network parameter the same as that of the SYN data;

carrying out the function transformation according to the network parameter of the RST data to obtain a check value CHK; and

passing the authentication of the client if CHK matches the value of SEQ3 or ACK3;

wherein the network parameter comprises one or more of an Identification (ID), a Source Internet Protocol Address (SIP), a Source Port (SPORT), a Destination IP Address (DIP), a Destination Port (DPORT) a Protocol Type (Protocol), and a Time to Live (TTL) in an IP header of a data packet;

wherein the function transformation is constructed as

FUNC(TTL,ID,SIP,SPORT,DIP,DPORT,PROTOCOL)=(x*TTL+y*ID+z*HASH(SIP,SPORT,DIP,DPORT,PROTOCOL))Mod M,

where x, y z are three constant parameters;

Mod indicates modulus operation;

M indicates modulus 65536;

HASH indicates a hash function.

2. The method according to claim 1, wherein the passing the authentication of the client if CHK matches the value of SEQ3 or ACK3 comprises:

passing the authentication of the client if CHK is equal to SEQ3 or ACK3.

3. The method according to claim 1, wherein the passing the authentication of the client if CHK matches the value of SEQ3 or ACK3 comprises:

passing the authentication of the client if a difference between CHK and SEQ3 or ACK3 is in a set range.

4. A network server including a non-transitory computer readable medium including computer-executable instructions for carrying out a network authentication device, the network authentication device comprising:

a first receiving unit, configured to receive synchronize (SYN) data sent by a client, wherein the SYN data comprises a sequence number SEQ 1 and a network parameter;

a sending unit, configured to send synchronize acknowledge (SYN_ACK) data to the client in response to the SYN data received by the first receiving unit, wherein the SYN_ACK data comprises an acknowledgment number ACK2, and a value of ACK2 is the value obtained by carrying out a function transformation according to the network parameter of the SYN data;

a second receiving unit, configured to receive RESET (RST) data sent by the client in response to the SYN_ACK data sent by the sending unit, wherein the RST data comprises a sequence number SEQ3 or an acknowledgment number ACK3, and a value of ACK3 is the same as that of SEQ3 or ACK2, and the RST data further comprises a network parameter the same as that of the SYN data;

a calculating unit, configured to carry out the function transformation according to the network parameter of the RST data received by the second receiving unit to obtain a check value CHK; and

an authenticating unit, configured to pass the authentication of the client when CHK calculated by the calculating unit matches SEQ3 or ACK3 of the RST data;

wherein the network parameter comprises one or more of an Identification (ID), a Source Internet Protocol Address (SIP), a Source Port (SPORT), a Destination IP Address (DIPL a Destination Port (DPORT) a Protocol Type (Protocol) and a Time to Live (TTL) in an IP header of a data packet;

wherein the function transformation is constructed as

FUNC(TTL,ID,SIP,SPORT,DIP,DPORT,PROTOCOL)=(x*TTL+y*ID+z*HASH(SIP,SPORT,DIP,DPORT,PROTOCOL))Mod M,

where x, y, z are three constant parameters;

Mod indicates modulus operation;

M indicates modulus 65536;

HASH indicates a hash function.

5. The device according to claim 4, wherein the authenticating unit is specifically configured to pass the authentication of the client when CHK calculated by the calculating unit is equal to SEQ3 or ACK3 of the RST data.

6. The device according to claim 4, wherein the authenticating unit is specifically configured to pass the authentication of the client when a difference between CHK calculated by the calculating unit and SEQ3 or ACK3 of the RST data is in a preset range.

7. A network client including a non-transitory computer readable medium including computer-executable instructions for carrying out a set of functional components, the functional components comprising:

a sending unit, configured to send synchronize (SYN) data to a gateway, wherein the SYN data comprises a sequence number SEQ 1 and a network parameter;

a receiving unit, configured to receive synchronize acknowledge (SYN_ACK) data sent by the gateway in response to the SYN data, wherein the SYN_ACK data comprises an acknowledgment number ACK2, and a value of ACK2 is the value obtained by carrying out a function transformation according to the network parameter of the SYN data; and

a judging unit, configured to judge whether the value of ACK2 is the same as an expected value, and if the value of ACK2 is different from the expected value, send RESET (RST) data to the gateway in response to the SYN_ACK data, wherein the RST data comprises a sequence number SEQ3 or an acknowledgment number ACK3, a value of SEQ3 or ACK3 is the same as that of ACK2, and the RST data further comprises a network parameter the same as that of the SYN data; and

instruct the gateway to authenticate the client according to the RST data and SEQ3 or ACK3;

wherein the network parameter comprises one or more of an Identification (ID), a Source Internet Protocol Address (SIP), a Source Port (SPORT), a Destination IP Address (DIP), a Destination Port (DPORT), a Protocol Type (Protocol), and a Time to Live (TTL) in an IP header of a data packet;

wherein the function transformation is constructed as

FUNC(TTL,ID,SIP,SPORT,DIP,DPORT,PROTOCOL)=(x*TTL+y*ID+z*HASH(SIP,SPORT,DIP,DPORT,PROTOCOL))Mod M,

where x, y, z are three constant parameters;

Mod indicates modulus operation;

M indicates modulus 65536;

HASH indicates a hash function.