Abstract:
A method and system for pre-shared-key-based network access control are disclosed. The method includes the following steps: 1) security policy negotiation is implemented between a REQuester(REQ) and Authentication Access Controller(AAC); 2) identity authentication and uni-cast key negotiation are implemented between REQ and AAC; 3) a group-cast key is notified between REQ and AAC. Applying the method and system, rapid bidirectional authentication can be implemented between a user and network.

Description:
[0001]    The present application claims the benefit of priority to Chinese patent application No. 200910023685.0, titled “METHOD AND SYSTEM FOR PRE-SHARED-KEY BASED NETWORK SECURITY ACCESS CONTROL”, filed on Aug. 25, 2009 with Chinese State Intellectual Property Office, which is hereby incorporated by reference in its entirety. 
       FIELD OF THE INVENTION 
       [0002]    The present invention relates to a method and system of pre-shared-key-based network security access control, and in particular to a method and system for pre-shared-key authentication mechanism based security access control in a wired local area network (LAN) while users access the network. 
       BACKGROUND OF THE INVENTION 
       [0003]    The wired LAN is generally a broadcast network, in which data sent by a node may be received by all other nodes. Channels are shared by the nodes in the network, which has brought great insecurity to the network. As long as a hacker accesses the network to monitor, he/she can capture all packets on the network to steal off key information. 
         [0004]    The local area network LAN, which is defined by the existing Chinese national standard GB 15629.3 (corresponding to ISO/IEC 8802.3), does not provide a secure access, and as long as the user can access the LAN control device (for example, a LAN Switch), he/she can access equipments or resources in the LAN. There was no obvious risk in the wired LAN application environment of early enterprise network; but with the large-scale development of the network, the user&#39;s requirements on information privacy continue to increase, and it is necessary to achieve user-level security access control and data confidentiality. 
         [0005]    For the wired LAN, IEEE is currently carrying out security enhancements on the IEEE802.3 to achieve the security of the data link layer, using typical security access architecture protocols IEEE 802.1x, IEEE802.1x authentication-based key management protocols and so on. Basic authentication method of IEEE802.1x is to use authentication servers in addition to the terminals and access point devices, and the access point devices use the authentication servers to authenticate the identity of the terminals and thus realize secure access control on the terminals. The access point devices directly forward the identification information between the terminals and the authentication servers, rather than participate in the process of identity authentication as separate entities. This mode only realizes the network authentication on the validity of the terminal identity; it can not meet the requirements for terminal authentication on the validity of the access network, and can not realize the bidirectional authentication between the terminals and the network. This authentication method is complex in procedure and can not implement rapid identity authentication and key management, so it can not support authentication protocols of different security levels, and can not meet the various needs of users. 
       SUMMARY OF THE INVENTION 
       [0006]    In order to solve technical problems mentioned above, this invention provides a method and system of pre-shared-key-based network security access control, which can implement rapid bidirectional authentication between a user and a network. 
         [0007]    Technical solutions of this invention are: this invention provides a method of pre-shared-key-based network security access control, which includes: 
         [0000]    1) performing a security policy negotiation between a REQuester (REQ) and an Authentication Access Controller(AAC);
 
2) performing an identity authentication and unicast key negotiation between the REQ and the AAC;
 
3) notifying a multicast key between the REQ and the AAC.
 
         [0008]    The step 1) includes: 
         [0009]    1.1) requesting for the security policy negotiation: when the REQ accesses the AAC, sending, by the AAC, a security policy negotiation request message to the REQ, the security policy negotiation request message including a TIE AAC  field; 
         [0010]    where: 
         [0011]    the TIE AAC  field represents a Tri-element peer authentication (TePA) information element supported by the AAC, and the TePA information element includes authentication and key management suites and cipher suites which are supported by the ACC; 
         [0012]    1.2) responding the security policy negotiation: after the REQ receives the security policy negotiation request message, performing: 
         [0013]    selecting, by the REQ, according to the authentication and key management suits and the cipher suits supported by the AAC in the TIE AAC  field of the security policy negotiation request message and in combination with a local policy, a common authentication and key management suit and a common cipher suit for the REQ and the AAC, constituting a security policy negotiation response message and sending the security policy negotiation response message to the AAC; if the REQ does not support any of the authentication and key management suits or the cipher suits supported by the AAC in the security policy negotiation request message, discarding the security policy negotiation request message according to the local policy; the security policy negotiation response message including a TIE REQ  field; 
         [0014]    where: 
         [0015]    the TIE REQ  field represents a TePA information element selected by the REQ, and the TePA information element includes the authentication and key management suit and the cipher suit selected by REQ; and 
         [0016]    1.3) after the AAC receives the security policy negotiation response message, performing: 
         [0017]    1.3.1) determining, by the AAC, whether the authentication and key management suit and the cipher suit selected by the REQ are supported by the AAC; if not, discarding the security policy negotiation response message; and if supported, proceeding to 1.3.2); and 
         [0018]    1.3.2) beginning the corresponding identity authentication according to the authentication and key management suit and the cipher suit selected by the REQ. 
         [0019]    In the above-described step 1.3), when the authentication and key management suit selected by the REQ is a pre-shared-key-based authentication and key management suit, a pre-shared-key-based LAN authentication protocol (SAAP) is used in the identity authentication to complete a bidirectional identity authentication between the REQ and the AAC and to complete a unicast key negotiation between the REQ and the AAC. 
         [0020]    The step 2) includes: 
         [0021]    2.1) activating the identity authentication and unicast key negotiation: when the REQ and the AAC negotiate to select the pre-shared-key-based authentication and key management suit in the security policy negotiation, sending, by the AAC, an identity authentication and unicast key negotiation activation message to the REQ for activating the REQ to start the identity authentication and unicast key negotiation, the identity authentication and unicast key negotiation activation message including a N AAC  field, 
         [0022]    where: 
         [0023]    the N AAC  field represents an identity authentication and unicast key negotiation identification; if the identity authentication and unicast key negotiation is performed for the first time, the N AAC  field is a random number generated by the ACC; and if the identity authentication and unicast key negotiation is an updated identity authentication and unicast key negotiation process, the N AAC  field has a value of the identity authentication and unicast key negotiation identification which is calculated in a previous identity authentication and unicast key negotiation process; 
         [0024]    2.2) requesting for the identity authentication and unicast key negotiation: after REQ receives identity authentication and unicast key negotiation activation message, performing: 
         [0025]    2.2.1) if the identity authentication and unicast key negotiation is the updated identity authentication and unicast key negotiation process, checking, by the REQ, whether the identity authentication and unicast key negotiation identification in the N AAC  field of the identity authentication and unicast key negotiation activation message is consistent with the identity authentication and unicast key negotiation identification calculated in the previous identity authentication and unicast key negotiation process; if the identity authentication and unicast key negotiation identification in the N AAC  field is not consistent with the identity authentication and unicast key negotiation identification calculated in the previous identity authentication and unicast key negotiation process, discarding the identity authentication and unicast key negotiation activation message; and if the identity authentication and unicast key negotiation identification in the N AAC  field is consistent with the identity authentication and unicast key negotiation identification calculated in the previous identity authentication and unicast key negotiation process, proceeding to 2.2.2); if the identity authentication and unicast key negotiation process is performed for the first time, proceeding to 2.2.2); 
         [0026]    2.2.2) generating, by the REQ, a REQ challenge N REQ , calculating a unicast key and the identity authentication and unicast key negotiation identification N AAC  for a next identity authentication and unicast key negotiation process by using the pre-shared-key, the identity authentication and unicast key negotiation identification N AAC  and the REQ challenge N REQ , and storing the unicast key and the identity authentication and unicast key negotiation identification N AAC  for the next identity authentication and unicast key negotiation process, where the unicast key includes a protocol data key (PDK) and a unicast key (UDK), the PDK is adapted to protect privacy of key data in protocol data and integrity of the protocol data between the REQ and the AAC, and the UDK is adapted to protect privacy and integrity of user data between the REQ and the AAC; and 
         [0027]    2.2.3) locally calculating, by the REQ, a message identifying code MIC1 by using the PDK, constituting an identity authentication and unicast key negotiation request message and sending the identity authentication and unicast key negotiation request message to the AAC; 
         [0028]    where if REQ needs to initiate the updated identity authentication and unicast key negotiation process, the steps 2.2.2) and 2.2.3) are performed directly, a value of the identity authentication and unicast key negotiation identification N AAC  field depends on the identity authentication and unicast key negotiation identification calculated in the previous identity authentication and unicast key negotiation process, and the identity authentication and unicast key negotiation request message is constituted and sent to the AAC without waiting for the AAC to send the identity authentication and unicast key negotiation activation message in advance; and 
         [0029]    where the identity authentication and unicast key negotiation request message includes a N REQ  filed, a N AAC  field, a TIE REQ  filed and a MIC1 field, 
         [0030]    in which: 
         [0031]    the N REQ  field represents the REQ challenge and is a random number generated by the REQ, 
         [0032]    the N AAC  field represents the identity authentication and unicast key negotiation identification; if the identity authentication and unicast key negotiation process is performed for the first time, the value of the N AAC  field directly dependents on the value of the N AAC  field in the identity authentication and unicast key negotiation activation message; and if the identity authentication and unicast key negotiation process is the updated identity authentication and unicast key negotiation process, the value of the N AAC  field is the value of the identity authentication and unicast key negotiation identification which is calculated in the previous identity authentication and unicast key negotiation process; 
         [0033]    the TIE REQ  field represents the authentication and key management suit and the cipher suit selected by the REQ, and has a same value as that of the TIE REQ  field in the security policy negotiation response message; and the MIC1 field represents a message identifying code, which is a hash value calculated by the REQ from all the fields in the identity authentication and unicast key negotiation request message besides the MIC1 field with the generated PDK; 
         [0034]    2.3) responding the identity authentication and unicast key negotiation: after the AAC receives the identity authentication and unicast key negotiation request message, performing: 
         [0035]    2.3.1) when the identity authentication and unicast key negotiation process is the updated identity authentication and unicast key negotiation process, checking whether the N AAC  field in the identity authentication and unicast key negotiation request message is consistent with the identity authentication and unicast negotiation identification calculated in the previous identity authentication and unicast key negotiation process, if the N AAC  field in the identity authentication and unicast key negotiation request message is not consistent with the identity authentication and unicast negotiation identification calculated in the previous identity authentication and unicast key negotiation process, discarding the identity authentication and unicast key negotiation request message, and if the N AAC  field in the identity authentication and unicast key negotiation request message is consistent with the identity authentication and unicast negotiation identification calculated in the previous identity authentication and unicast key negotiation process, proceeding to 2.3.2); when the identity authentication and unicast key negotiation process is performed for the first time, checking whether the N AAC  field of the identity authentication and unicast key negotiation request message is consistent with the N AAC  field of the identity authentication and unicast negotiation activation message, if the N AAC  field of the identity authentication and unicast key negotiation request message is not consistent with the N AAC  field of the identity authentication and unicast negotiation activation message, discarding the identity authentication and unicast key negotiation request message, and if the N AAC  field of the identity authentication and unicast key negotiation request message is consistent with the N AAC  field of the identity authentication and unicast negotiation activation message, proceeding to 2.3.2); 
         [0036]    2.3.2) verifying whether the TIE REQ  field is consistent with the TIE REQ  field of the security policy negotiation response message received in the security policy negotiation, if the TIE REQ  field is not consistent with the TIE REQ  field of the security policy negotiation response message received in the security policy negotiation, discarding the identity authentication and unicast key negotiation request message, and if the TIE REQ  field is consistent with the TIE REQ  field of the security policy negotiation response message received in the security policy negotiation, proceeding to 2.3.3); 
         [0037]    2.3.3) calculating a unicast key and the identity authentication and unicast key negotiation identification N AAC  for a next identity authentication and unicast key negotiation process by using the pre-shared-key, the identity authentication and unicast key negotiation identification N AAC  and the REQ challenge N REQ , and storing the unicast key and the identity authentication and unicast key negotiation identification N AAC  for the next identity authentication and unicast key negotiation process, where the unicast key includes a protocol data key (PDK) and a unicast key (UDK); 
         [0038]    2.3.4) verifying the MIC1 field of the identity authentication and unicast key negotiation request message with the PDK, if a value of the MIC1 is not correct, discarding the identity authentication and unicast key negotiation request message; and if the value of the MIC1 is correct, completing, by the AAC, the identity authentication of the REQ and negotiating the unicast key between the AAC and the REQ, and then proceeding to 2.3.5); and 
         [0039]    2.3.5) locally calculating a message identifying code MIC2 with the PDK, constituting an identity authentication and unicast key negotiation response message and sending the identity authentication and unicast key negotiation response message to the REQ; 
         [0040]    where the identity authentication and unicast key negotiation response message include a N REQ  field, a TIE AAC  field and a MIC2 field; 
         [0041]    in which: 
         [0042]    the N REQ  field represents the REQ challenge and is a random number generated by the REQ, which has a same value as the N REQ  field in the identity authentication and unicast key negotiation request message; 
         [0043]    the TIE AAC  field represents the authentication and key management suits and the cipher suits supported by the AAC, which has a same value as the TIE AAC  field in the security policy negotiation request message; and 
         [0044]    the MIC2 field represents a message identifying code, which is a hash value calculated by the AAC from all the fields in the identity authentication and unicast key negotiation response message besides the MIC2 field and the negotiated identity authentication and unicast key negotiation identification N AAC  for the next identity authentication and unicast key negotiation process with the generated PDK; and 
         [0045]    2.4) after the REQ receives the identity authentication and unicast key negotiation response message, performing: 
         [0046]    2.4.1) checking whether the N REQ  field in the identity authentication and unicast key negotiation response message is the same as the N REQ  field in the identity authentication and unicast negotiation request message previously sent, if not, discarding the identity authentication and unicast key negotiation response message, and if yes, proceeding to 2.4.2); 
         [0047]    2.4.2) verifying whether the TIE AAC  field in the identity authentication and unicast key negotiation response message is consistent with the TIE AAC  field of the security policy negotiation request message received in the security policy negotiation process, if not, discarding the identity authentication and unicast key negotiation response message, and if yes, proceeding to 2.4.3); 
         [0048]    2.4.3) verifying a value of the MIC2 field of the identity authentication and unicast key negotiation response message by using the PDK, if the value of the MIC2 field is not correct, discarding the identity authentication and unicast key negotiation response message, and if the value of the MIC2 field is correct, completing, by the REQ, the identity authentication of AAC, negotiating the common unicast key between the AAC and the REQ, and proceeding to 2.4.4); and 
         [0049]    2.4.4) locally calculating a MIC3 with the PDK, constituting an identity authentication and unicast key negotiation confirmation message, and sending the identity authentication and unicast key negotiation confirmation message to the AAC; the identity authentication and unicast key negotiation confirmation message being optional. 
         [0050]    The identity authentication and unicast key negotiation confirmation message include a N AAC  field and a MIC3 field, 
         [0051]    in which: 
         [0052]    the N AAC  field represents an identity authentication and unicast key negotiation identification, and has a same value as the N AAC  field of the identity authentication and unicast key negotiation request message; and 
         [0053]    the MIC3 field represents a message identifying code, which is a hash value calculated by the REQ from all the fields in the identity authentication and unicast key negotiation response message besides the MIC3 field and the negotiated identity authentication and unicast key negotiation identification for the next identity authentication and unicast key negotiation process with the generated PDK. 
         [0054]    2.5) After the AAC receives the identity authentication and unicast key negotiation confirmation message, performing: 
         [0055]    2.5.1) checking whether a value of the N AAC  field in the identity authentication and unicast key negotiation confirmation message is the same as that of the N AAC  field in the identity authentication and unicast negotiation request message, if not, discarding the identity authentication and unicast key negotiation confirmation message, and if yes, proceeding to 2.5.2); and 
         [0056]    2.5.2) verifying the MIC3 field of the identity authentication and unicast key negotiation confirmation message by using the PDK, if a value of the MIC3 field is not correct, discarding the identity authentication and unicast key negotiation confirmation message, and if the value of the MIC3 field is correct, confirming, by the AAC, that the REQ has acquired a unicast key consistent with that of the AAC. 
         [0057]    The step 3) includes: 
         [0058]    3.1) notifying the multicast key: 
         [0059]    a multicast key notification message including a KN field, a E MDK  field and a MIC4 field; 
         [0060]    in which: 
         [0061]    the KN field represents a key notification identification, which is initialized to be an integer and is incremented by 1 for each key update notification, and is kept constant if the notified key is unchanged; 
         [0062]    the E MDK  field represents key-encrypted data, which is generated by the AAC via encrypting multicast data key (MDK) with the PDK generated in the identity authentication and unicast key negotiation process, where the MDK is a random number generated by the AAC, and is adapted to protect a secure communication of the multicast data after secure access; and 
         [0063]    the MIC4 field represents a message identifying code, which is calculated by the AAC from all the fields in the multicast key notification message besides the MIC5 field with the PDK generated in the identity authentication and unicast key negotiation process; 
         [0064]    3.2) responding the multicast key: 
         [0065]    after the REQ receives the multicast key notification message, performing: 
         [0066]    3.2.1) checking whether the KN field is monotonically increasing, if not, discarding the multicast key notification message, and if yes, proceeding to 3.2.2); 
         [0067]    3.2.2) verifying the MIC4 field by using the PDK generated in the identity authentication and unicast key negotiation process, if the MIC4 field is not correct, discarding the multicast key notification message, and if the MIC4 field is correct, proceeding to 3.2.3); 
         [0068]    3.2.3) decrypting the E MDK  field with the PDK generated in the identity authentication and unicast key negotiation process to obtain the MDK; and 
         [0069]    3.2.4) storing the value of the key notification identification KN field, generating a multicast key response message, and sending the multicast key response message to the AAC, 
         [0070]    where the multicast key response message include a KN field and a MIC5 field; 
         [0071]    in which: 
         [0072]    the KN field represents a key notification identification, and has a same value as the KN field of the multicast key notification message; and 
         [0073]    the MIC5 field represents a message identifying code, which is calculated by the REQ from all the fields in the multicast key response message besides the MIC5 field with the PDK generated in the identity authentication and unicast key negotiation process; and 
         [0074]    3.3) after the AAC receives the multicast key response message, performing: 
         [0075]    3.3.1) determining whether the KN field in the multicast key response message is consistent with the KN field of the multicast key notification message previously sent, if not, discarding the multicast key response message, and if yes, proceeding to 3.3.2); and 
         [0076]    3.3.2) verifying the MIC5 field by using the PDK generated in the identity authentication and unicast key negotiation process, if the value of the MIC5 field is not correct, discard the multicast key response message, and if the value of the MIC5 field is correct, completing the process of notifying the multicast key to the REQ. 
         [0077]    A system of pre-shared-key-based network security access control, including a REQuester (REQ) and an Authentication Access Controller (AAC), where the AAC is connected to the REQ, and provides service ports for the REQ. 
         [0078]    In the method and system of pre-shared-key-based network security access control provided by the present invention, the identity authentication process and the unicast key negotiation process are combined together, in which the unicast key negotiation is completed while the identity authentication process is completed without a third party being involved, thereby simplifying the process and calculation of the security access control and achieving rapid secure access. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0079]      FIG. 1  is a diagram of the security policy negotiation process in the invention; 
           [0080]      FIG. 2  is a diagram of the identity identification and unicast key negotiation process of the SAAP in the invention; and 
           [0081]      FIG. 3  is a diagram of the multicast key notification process in the invention. 
       
    
    
     DETAILED DESCRIPTION OF THE INVENTION 
       [0082]    The invention is explained in detail below by the specific embodiments in combination with the drawings. 
         [0083]      FIG. 1  is the diagram of the security policy negotiation process in the invention;  FIG. 2  is the diagram of the identity identification and unicast key negotiation process of the SAAP in the invention; and  FIG. 3  is the diagram of the multicast key notification process in the invention. Referring to  FIGS. 1-3 , the present invention provides a wired LAN secure access control method. The method is divided into three parts: the security policy negotiation process, the identity authentication and unicast key negotiation process and the multicast key notification process. The detailed description is as follows: 
         [0084]    1) The security policy negotiation process is shown in  FIG. 1 , which is as follows: 
         [0085]    1.1) requesting for the security policy negotiation: when the REQ (REQuester) accesses the AAC (Authentication Access Controller), the AAC sends a security policy negotiation request message to the REQ. 
         [0086]    The main content of the security policy negotiation request message includes: 
         [0087]    Where: 
         [0000]    
       
                 
         
             
             
         
       
     
         [0088]    TIE AAC  field: represents a Tri-element peer authentication (TePA) information element supported by the AAC, and the TePA information element includes the authentication and key management suits and the cipher suits supported by the AAC. 
         [0089]    1.2) responding the security policy negotiation: after the REQ receives the security policy negotiation request message, the process is as follows: 
         [0090]    According to the authentication and key management suits and the cipher suits supported by AAC in the TIE AAC  field of the security policy negotiation request and in combination with a local policy, the REQ selects the common authentication and key management suit and the common cipher suit shared by the REQ and the AAC, constitutes a security policy negotiation response message and sends the security policy negotiation response message to AAC; if REQ does not support any of the authentication and key management suits and cipher suits supported by the AAC in the security policy negotiation request message, the security policy negotiation request message according to the local policy is discarded. 
         [0091]    The main content of the security policy negotiation response message includes: 
         [0000]    
       
                 
         
             
             
         
       
     
         [0092]    in which: 
         [0093]    TIE REQ  field: represents TePA information element selected by the REQ, and the TePA information element includes the authentication and key management suit and the cipher suit selected by the REQ. 
         [0094]    1.3) After AAC receives the security policy negotiation response message, the process is as follows: 
         [0095]    1.3.1) AAC determines whether the authentication and key management suit and the cipher suit selected by the REQ are supported by the AAC, if not, then the security policy negotiation response message is discarded; if supported, then 1.3.2) is performed; 
         [0096]    1.3.2) The corresponding identity authentication process begins according to the authentication and key management suit and the cipher suit selected by REQ. 
         [0097]    In the present invention, there is provided a shared-key-based lAn authentication protocol (SAAP). 
         [0098]    2) The SAAP process is shown is  FIG. 2 , in which the identity authentication is completed while the unicast key negotiation is implemented. The specific process is as follows: 
         [0099]    2.1) activating the identity authentication and unicast key negotiation: When REQ and AAC negotiate to select the pre-shared-key authentication and key management suit in the security policy negotiation process, AAC sends an identity authentication and unicast key negotiation activation message to REQ for activating the REQ to start the identity authentication and unicast key negotiation process. The main content of the identity authentication and unicast key negotiation activation message includes: 
         [0000]    
       
                 
         
             
             
         
       
     
         [0100]    In which: 
         [0101]    N AAC  field: represents an identity authentication and unicast key negotiation identification, if the identity authentication and unicast key negotiation is performed for the first time, the field is a random number generated by the ACC; and if the identity authentication and unicast key negotiation is an updated identity authentication and unicast key negotiation process, the field has a value of the identity authentication and unicast key negotiation identification which is calculated in the previous identity authentication and unicast key negotiation process; 
         [0102]    2.2) requesting for the identity authentication and unicast key negotiation: after REQ receives identity authentication and unicast key negotiation activation message, the process is as follows: 
         [0103]    2.2.1) If the identity authentication and unicast key negotiation process is the updated identity authentication and unicast key negotiation process, REQ checks whether the identity authentication and unicast key negotiation identification N AAC  field of the identity authentication and unicast key negotiation activation message is consistent with the identity authentication and unicast key negotiation identification calculated in the previous identity authentication and unicast key negotiation process, if not, the identity authentication and unicast key negotiation activation message is discarded; if yes, 2.2.2) is performed; and if the identity authentication and unicast key negotiation process is performed for the first time, then 2.2.2) is directly performed; 
         [0104]    2.2.2) The REQ generates a REQ challenge N REQ , calculates a unicast key and the identity authentication and unicast key negotiation identification N AAC  for the next identity authentication and unicast key negotiation process by using the pre-shared-key, the identity authentication and unicast key negotiation identification N AAC  and REQ challenge N REQ , and stores the unicast key and the identity authentication and unicast key negotiation identification N AAC  for the next identity authentication and unicast key negotiation process, where the unicast key includes a protocol data key (PDK) and a unicast key (UDK). PDK is used to protect the privacy of the key data in protocol data and integrity of the protocol data between the REQ and the AAC, and the UDK is used to protect the privacy and integrity of the user data between the REQ and the AAC; 
         [0105]    2.2.3) REQ locally calculates a message identifying code MIC1 using PDK, constructs an identity authentication and unicast key negotiation request message and sends the identity authentication and unicast key negotiation request message to AAC. 
         [0106]    Notes: if REQ needs to initiate the updated identity authentication and unicast key negotiation, then the above 2.2.2) and 2.2.3) are directly implemented, where a value of the identity authentication and unicast key negotiation identification N AAC  field depends on the identity authentication and unicast key negotiation identification value calculated in the previous identity authentication and unicast key negotiation process, and the identity authentication and unicast key negotiation request message is constituted and sent to AAC without waiting for the AAC to send the identity authentication and unicast key negotiation activation message in advance. 
         [0107]    The main content of identity authentication and unicast key negotiation request message includes: 
         [0000]    
       
                 
         
             
             
         
       
     
         [0108]    in which: 
         [0109]    N REQ  field: represents the REQ challenge and is a random number generated by the REQ; 
         [0110]    N AAC  field: represents the identity authentication and unicast key negotiation identification; if the identity authentication and unicast key negotiation process is performed for the first time, the value of the N AAC  field directly dependents on the value of the N AAC  field in the identity authentication and unicast key negotiation activation message; and if the identity authentication and unicast key negotiation process is the updated identity authentication and unicast key negotiation process, the value of the N AAC  field is the value of the identity authentication and unicast key negotiation identification which is calculated in the previous identity authentication and unicast key negotiation process; 
         [0111]    TIE REQ  field: represents the authentication and key management suit and the cipher suit selected by the REQ; its value is same as the TIE REQ  field value of security policy negotiation response message; 
         [0112]    MIC1 field: represents a message identifying code, which is a hash value calculated by REQ from all the fields of the identity authentication and unicast key negotiation request message besides the MIC1 field with the generated PDK. 
         [0113]    2.3) Responding the identity authentication and unicast key negotiation response: after AAC receives the identity authentication and unicast key negotiation request message, the process is as follows: 
         [0114]    2.3.1) If the identity authentication and unicast key negotiation process is the updated process, whether N AAC  field of the message is consistent with the identity authentication and unicast negotiation identification calculated in the previous identity authentication and unicast key negotiation process is checked; if not, then the message is discarded, and if yes, then 2.3.2) is performed. If the key negotiation process is performed for the first time, then whether N AAC  field of the message is consistent with N AAC  field of the identity authentication and unicast negotiation activation message is checked, if not, then the message is discarded, and if yes, then 2.3.2) is performed; 
         [0115]    2.3.2) Whether TIE REQ  field is consistent with TIE REQ  field of security policy negotiation response message received in the security policy negotiation process is checked, if not, then the message is discarded, and if yes, then 2.3.3) is performed; 
         [0116]    2.3.3) The unicast key and the identity authentication and unicast key negotiation identification N AAC  for the next identity authentication and unicast key negotiation process is calculated by using the pre-shared-key, the identity authentication and unicast key negotiation identification N AAC  and the REQ challenge N REQ , and then is stored, where the unicast key includes PDK and UDK; 
         [0117]    2.3.4) The correctness of the MIC1 field in the identity authentication and unicast key negotiation request message is verified by using the PDK, if it is not correct, then the message is discarded, and if it is correct, the AAC completes the identity authentication of REQ, negotiates the unicast key between the AAC and the REQ, and then 2.3.5) is performed; 
         [0118]    2.3.5) A message identifying code MIC1 is locally calculated with the PDK, an identity authentication and unicast key negotiation response message is constructed and sent to the REQ. 
         [0119]    The main content of the identity authentication and unicast key negotiation response message includes: 
         [0000]    
       
                 
         
             
             
         
       
     
         [0120]    in which: 
         [0121]    N REQ  field: represents the REQ challenge and is a random number generated by the REQ. Its value is as the same as with the N REQ  field value of the identity authentication and unicast key negotiation request message; 
         [0122]    TIE AAC  field: represents the authentication and key management suits and the cipher suits supported by the AAC; its value is the same as the TIE AAC  field value of the security policy negotiation request message; 
         [0123]    MIC2 field: represents a message identifying code, which is a hash value calculated by AAC from all the fields of the identity authentication and unicast key negotiation response message besides the MIC1 field and the negotiated identity authentication and unicast key negotiation identification N AAC  for the next identity authentication and unicast key negotiation process with the generated PDK. 
         [0124]    2.4) after the REQ receives the identity authentication and unicast key negotiation response message, the process is as follows: 
         [0125]    2.4.1) Whether N REQ  field is the same as the N REQ  field of the identity authentication and unicast negotiation request message previously sent is checked, if not, then the message is discarded, and if yes, then 2.4.2) is performed; 
         [0126]    2.4.2) Whether TIE AAC  field value is consistent with TIE AAC  field value of security policy negotiation response message received in the security policy negotiation process is verified, if not, then the message is discarded, and if yes, then 2.4.3) is performed; 
         [0127]    2.4.3) The correctness of MIC2 field of the identity authentication and unicast key negotiation response message is verified by using the PDK, if it is not correct, then the message is discarded, and if it is correct, the REQ completes the identity authentication of AAC, negotiates the common unicast key between AAC and REQ, and then 2.4.4) is performed; and 
         [0128]    2.4.4) A message identifying code MIC3 is locally calculated with the PDK, an identity authentication and unicast key negotiation confirmation message is constructed and sent to AAC; the identity authentication and unicast key negotiation confirmation message is optional, that is, REQ may send the unicast key negotiation confirmation message to AAC, or may not send the unicast key negotiation confirmation message to AAC. 
         [0129]    The main content of the identity authentication and unicast key negotiation confirmation message includes: 
         [0000]    
       
                 
         
             
             
         
       
     
         [0130]    in which: 
         [0131]    N AAC  field: represents an identity authentication and unicast key negotiation identification, and its value is the same as N AAC  field value of the identity authentication and unicast key negotiation request message; 
         [0132]    MIC3 field: represents a message identifying code, which is a hash value calculated by REQ from all the fields of the identity authentication and unicast key negotiation response message besides MIC1 field and the negotiated identity authentication and unicast key negotiation identification of the next identity authentication and unicast key negotiation process with the generated PDK. 
         [0133]    2.5) after AAC receives the identity authentication and unicast key negotiation confirmation message, the process is as follows: 
         [0134]    2.5.1) whether N AAC  field value is the same as N AAC  field value of the identity authentication and unicast negotiation request message is checked, if not, then the message is discarded, and if yes, then 2.5.2) is performed; 
         [0135]    2.5.2) the correctness of MIC3 field of the identity authentication and unicast key negotiation confirmation message is verified by using PDK, if it is not correct, then the message is discarded, and if it is correct, AAC confirms that REQ has acquired the unicast key consistent with that of the AAC. 
         [0136]    3) The multicast key notification message process is shown in  FIG. 3 , and the specific process is as follows 
         [0137]    3.1) multicast key notification: 
         [0138]    The main content of the multicast key notification message includes: 
         [0000]    
       
                 
         
             
             
         
       
     
         [0139]    in which: 
         [0140]    KN field: represents the key notification identification, which is initialized to be an integer and is incremented by 1 for each key update notification, and is kept constant if the notified key is unchanged; 
         [0141]    E MDK  field: represents key-encrypted data, which is generated by the AAC via encrypting the multicast data key (MDK) with the PDK generated in the identity authentication and unicast key negotiation process, where MDK is a random number generated by AAC, and is used to protect the secure communication of the multicast data after secure access; and 
         [0142]    MIC4 field: represents a message identifying code, which is calculated by AAC from all the fields besides MIC4 field of the multicast key request message with the PDK generated in the identity authentication and unicast key negotiation process. 
         [0143]    3.2) responding the multicast key: 
         [0144]    After REQ receives the multicast key notification message, the process is as follows: 
         [0145]    3.2.1) Whether KN field is monotonically increasing is checked, if not, then the message is discarded, and if yes, then 3.2.2) is performed; 
         [0146]    3.2.2) MIC4 field is verified by using the PDK generated in the identity authentication and unicast key negotiation process, if not, then the message is discarded, and if yes, then 3.2.3) is performed; 
         [0147]    3.2.3) The E MDK  field is verified by using the PDK generated in the identity authentication and unicast key negotiation process to obtain the MDK; and 
         [0148]    3.2.4) the value of key notification identification KN field is stored, and a multicast key response message is generated and sent to AAC. 
         [0149]    The main content of the multicast key response message includes: 
         [0000]    
       
                 
         
             
             
         
       
     
         [0150]    in which: 
         [0151]    KN field: represents the key notification identification, and its value is the same as KN field of the multicast key notification message; 
         [0152]    MIC5 field: represents message identifying code, which is calculated by REQ from all the fields besides MIC5 field of the multicast key response message with the PDK generated in the identity authentication and unicast key negotiation process. 
         [0153]    3.3) After AAC receives the multicast key response message, the process is as follows: 
         [0154]    3.3.1) Whether KN field is consistent with the KN field value of the multicast key notification message previously sent is determined, if not, then the message is discarded, and if yes, then 3.3.2) is performed; and 
         [0155]    3.3.2) The correctness of the MIC5 field is verified by using the PDK generated in the identity authentication and unicast key negotiation process, if not, then the message is discarded, and if yes, then the process of notifying the multicast key notification to the REQ is completed. 
         [0156]    When the AAC successfully completes the process of notifying the multicast key to the REQ, data transmitted between the AAC and the REQ can be communicated secretly by using the negotiated or notified unicast data key and multicast data key. 
         [0157]    In addition to the method of pre-shared-key-based network security access control, the present invention further provides a system of pre-shared-key-based network security access control pre-shared key-based access control. The control system includes a REQ and a AAC; the ACC is connected to the REQ, and provides service ports for the REQ. 
         [0158]    By the description of the above embodiments, it should be clearly understood by the ordinary skilled people in the art that the present invention can be implemented by hardware, or can be implemented by software and a necessary universal hardware platform. Based on this understanding, the technical solutions of the invention can be embodied in the form of software products. The software product can be stored in a nonvolatile storage medium (CD-ROM, U disk, mobile hard disk etc.), with a number of instructions for enabling a computer device (which may be a personal computer, a server or a network device, etc.) to perform the methods of the various embodiments of the invention. 
         [0159]    Finally, it should be noted that the above embodiments are only intended to explain the technical solutions of the invention rather than limit the invention; although the invention has been described in detail with reference to the above embodiments, the ordinary skilled people in the art should be understood that modifications may be made to the technical solutions recorded in the foregoing embodiments, or equivalent replacement may be made to some technical features; and the modifications and replacements do not make the nature of the technical solutions departs from the spirit and scope of the various embodiments of the invention.