Patent ID: 8037306

Claim:
A method for realizing network access authentication, wherein a network access authentication device pre-storing a system integrity value of a device waiting to access which is calculated by the device waiting to access itself, and a correspondence between each device waiting to access and its system integrity value, the method comprises the following steps: a). the device waiting to access acquires its current system integrity value, and sends an authentication request including information containing the current system integrity value to the network access authentication device; b). the network access authentication device judges whether the current system integrity value of the device waiting to access in the received authentication request and its stored system integrity value of the device waiting to access are identical or not, according to the received authentication request and the correspondence; and, in a case where the received current system integrity value of the device waiting to access in the received authentication request and its stored system integrity value of the device waiting to access are identical, the network access authentication device determines that the network access is authenticated, so that the device waiting to access is allowed to access the network; otherwise, the network access authentication device determines that the network access is unauthenticated, so that the device waiting to access is not allowed to access the network, wherein the device waiting to access is a computer, and the process of calculating its basic system integrity value comprises the following steps: i) when basic input/output system (BIOS) or extensible firmware interface (EFI) is initiated, integrity values for all configured system parameters, main booting sector and system booting partition are calculated and stored in the secure storage unit; ii) using the integrity values mentioned in the step i) as the basic system integrity value, iii) before BIOS or EFI is loaded into booting OS (operating system), an integrity value for codes to be loaded into the OS is calculated and stored in the secure storage unit; iv) when the codes are loaded into the OS, integrity values for OS kernel, system initiation files, system configuration files and driver software are calculated and stored in the secure storage unit; v) when the OS is initiated, an integrity value for application software is calculated and stored in the secure storage unit; and vi) the basic system integrity value is calculated based on all the integrity values obtained in step i) to step vi) and wherein the configured system parameters comprise: central processing unit (CPU) microcode software, enable or disable status configuration of various system functions, various authentication passwords, disk configuration parameters, peripheral configuration parameters and security function configuration parameters.