Patent ID: 8646055

Claim:
A system of pre-shared-key-based network security access control, comprising a REQuester (REQ) and an Authentication Access Controller (AAC), wherein the REQ and the AAC are network devices, and wherein the AAC is connected to the REQ, and provides service ports for the REQ; the REQ to perform a security policy negotiation with the AAC, wherein, a common authentication and key management suit and a common cipher suit for the REQ and the AAC is determined, and perform an identity authentication and perform an unicast key negotiation according to the authentication determined in security policy negotiation with the AAC, the REQ to access the AAC and receive a security policy negotiation request message to the REQ sent from the AAC; wherein the security policy negotiation request message comprises a TIEAAC field and the TIEAAC field representing a Tri-element peer authentication (TePA) information element supported by the AAC, and the TePA information element comprises authentication and key management suits and cipher suits which are supported by the ACC; the REQ to select the common authentication and key management suit and the common cipher suit for the REQ and the AAC according to the authentication and key management suits and the cipher suits supported by the AAC in the TIEAAC field of the security policy negotiation request message and in combination with a local policy; to constitute a security policy negotiation response message and to send the security policy negotiation response message to the AAC; if the REQ does not support any of the authentication and key management suits or the cipher suits supported by the AAC in the security policy negotiation request message, the REQ to discard the security policy negotiation request message according to the local policy, wherein the security policy negotiation response message comprises a TIEREQ field and the TIEREQ field representing a TePA information element selected by the REQ, and the TePA information element comprises the authentication and key management suit and the cipher suit selected by REQ; and the AAC to determine whether the authentication and key management suit and the cipher suit selected by the REQ are supported by the AAC; if not, the AAC to discard the security policy negotiation response message; and if supported, the AAC to begin the corresponding identity authentication according to the authentication and key management suit and the cipher suit selected by the REQ; the AAC to perform a security policy negotiation with the REQ and to perform an identity authentication and perform an unicast key negotiation according to the authentication determined in security policy negotiation with the REQ, wherein an unicast key is established; and the AAC to notify the REQ of a multicast key according to the unicast key established during the unicast key negotiation between the REQ and the AAC.