AAA is the abbreviation of three English words: authentication, authorization, and accounting. The main purpose is to manage which users can access the network server, which services can be obtained by users with access permissions, and how to keep accounts for users who are using network resources. Specifically:
1. Authentication: verify whether the user can obtain the access permission;
2. Authorization: services that can be used by authorized users;
3. Accounting: records the usage of network resources by users.
Currently, the radius (Remote Authentication Dial In User Service) protocol is the only AAA standard defined in RFC 2865 and 2866 of IETF. Radius is a UDP-Based Client/Server protocol. A radius client is a network access server. It is usually a vro, vswitch, or wireless access point. A radius server is usually a monitoring program running on a Unix or Windows 2000 Server. The authentication port of the RADIUS protocol is 1812, And the billing port is 1813. Main features of RADIUS protocol
In summary, radius has the following main features:
1. Customer/service mode (Client/Server)
Radius is a C/S-structured Protocol. Its client is initially a Network Access Server (NAS ), the radius client software running on any hardware can become the radius client. The client's task is to pass user information (username, password, etc.) to the specified RADIUS server and be responsible for executing the returned response.
The RADIUS server is responsible for receiving user connection requests, Authenticating user identities, and returning all necessary configuration information for the client to provide services to users.
One RADIUS server can act as a proxy for other RADIUS servers or other type of Authentication servers.
2. Network Security
The interaction between the client and the RADIUS server is authenticated by sharing confidential words. In addition, to avoid the possibility that some people may listen on insecure networks to obtain the user password, any user password between the client and the RADIUS server is encrypted and transmitted.
3. Flexible authentication mechanism
The RADIUS server can identify the legality of users in multiple ways. After the user provides the user name and password, the RADIUS server supports point-to-point pap authentication (ppp pap), point-to-point CHAP authentication (ppp chap), and Unix login operations) and other authentication mechanisms.
4. Extended protocols
All interactions include variable-length attribute fields. To meet your actual needs, you can add new property values. You can define new attributes without interrupting the execution of existing protocols.
Radius Process
The RADIUS protocol is designed to simplify the authentication process. The typical authentication and authorization process is:
1. Enter the user name, password, and other information to the client or connect to NAs;
2. The client or NAS generates an "Access-request" message to the RADIUS server, including the user name and port
Command, client (NAS) ID, and user access port ID. The password is encrypted using the MD5 algorithm.
3. the RADIUS server authenticates users;
4. If the authentication succeeds, the RADIUS server sends an access-accept packet to the client or Nas. Otherwise, the request is rejected.
Access-reject (access-reject );
5. If the client or NAS receives the permitted access package, it establishes a connection for the user, authorizes the user, provides services, and transfers the package to 6. If
When the access request is rejected, the user's connection request is rejected and the negotiation process ends;
6. The client or NAS sends a billing request packet to the RADIUS server;
7. After receiving the billing request package, the RADIUS server starts billing and returns the billing response package to the client or NAs;
8. the user is disconnected, and the client or NAS sends a stop billing package to the RADIUS server;
9. After receiving the billing package, the RADIUS server stops billing and returns the billing response package to the client or NAs.
One billing record.
AAA system in Streaming Media
The AAA Server is a very important part of the streaming media system. It performs access authentication, authorization, and billing functions. Currently, because the RADIUS protocol is still the only AAA protocol standard, the implementation of AAA servers in our system still uses the RADIUS Protocol to implement the AAA service functions provided in the RADIUS protocol. At the same time, the system provides users and billing information storage and management functions.
Our AAA system mainly includes authentication and billing servers, storage of user and billing information, user and billing policy management, etc. In the AAA system, communication between the RADIUS server and the RADIUS Authentication server and the client follows the RADIUS protocol standard. User Information and billing information are stored in the MySQL database.
1. User Authentication
When you apply to enjoy the service, you must obtain the user information Authentication. In this system, the client sends an AAA authentication data packet to the server. The data packet includes the user ID and password. The server verifies the data packet and provides the result. Encrypted transmission during verification.
2. User Service Authorization
In this system, different users can enjoy different services. After passing the user's authentication request, the AAA Server determines whether the user can enjoy the requested service content based on the user's permissions.
3. Service Billing
The system provides basic billing information and algorithms, supports certain billing policies, and stores intermediate data generated during the billing process. The system meets the requirements of real-time billing. The minimum Billing Unit is minute, and the user will not be overdrawn.
4. User Information Management
Main functions include user registration, Fee Management query, and permission settings. The management platform can manage user information databases and billing information databases. Generally, you can only query the basic information of this account, such as your basic information and account balance. You can modify your basic information; administrators can query and modify basic user information, recharge users, query user balances, and edit, access, and modify billing policies. |
