# Lightweight Authentication Billing Enhancement Mechanism Based on the Fourier Fast Transform Algorithm

Authors: Jing Zhou; Qingdong Wang
Journal: Mathematical Problems in Engineering
 (2022)

---

## Abstract

In recent years, with the development and extensive application of Internet technology and computer technology, and under the role of the continuous expansion and enrollment expansion of colleges and universities, how to effectively solve the Internet problems faced by teachers and students in colleges and universities has gradually become an important problem that the university information management department should solve in time. In order to continuously improve the efficiency of Internet access in universities, the Internet authentication and billing system for universities proposed in this paper take J2EE as the development platform and combines RADIUS protocol and PPPoE protocol to provide users with diversified Internet billing methods and strategies. At the same time, based on the Fourier fast transform algorithm, the development environment for the Internet authentication and billing system for colleges and universities is deployed, and after the Internet authentication and billing system is implemented, from the functional point of view of the system, the main functional modules are designed and implemented, including the authentication management function. module, billing management function module. The experimental results have shown that the throughput of PPPoE access server in the campus network using the Fourier rapid transform algorithm for traffic load balancing delay is small and stable between 200 ms and 300 ms after the optimization, which provides a feasible solution to promote the healthy and harmonious development of the university campus network.


---

## Body

## 1. Introduction

Due to the various problems in the Internet authentication and billing system selected by most colleges and universities, it cannot serve teachers and students efficiently and stably. Especially with the rapid development and increasing update of network technology, it cannot guarantee that people can get more information resources through the network and cannot meet their diversified needs. The traditional billing system cannot support high Internet speed, or does it support multiple connections and real-time traffic step-by-step billing for one account, but with the increasing demand of students to access the Internet, a new authentication and billing system must be designed and implemented to improve the billing method and realize real-time traffic step-by-step billing. It can optimize the general PC server structure and improve the forwarding performance of the billing gateway so as to fundamentally solve the problem of an unbalanced flow of multiple egresses on the campus network, improve bandwidth utilization, effectively schedule traffic from multiple exits, and optimize network resources. Therefore, according to the actual application status of digital campus, based on the introduction of J2EE architecture, PPPoE certification, and RADIUS protocol, this paper put forward a unified overall framework and solution of a campus certification system to improve the utilization and security of campus resources, and develop a set of Internet authentication billing system for universities, which not only can solve the Internet authentication billing management pressure but also can improve the service quality and management level of the campus network, with certain practical application value.The limited resources of mobile devices prevent it from doing large-scale computing, and it is a better way to securely outsource some computing from mobile payments to untrusted cloud servers. Liao et al. proposed a mobile payment protocol that outsources validation in untrusted cloud servers, improves the protocol, and analyzes its improved security [1]. Although smart meters (SM) have all their functions, they still cause some safety-related issues. Kumar et al. proposed a lightweight authentication and key protocol for trust, anonymity, integrity, and sufficient security in the SEN domain, demonstrating the feasibility of the proposed scheme using test platforms [2]. Pervasive computing must address issues such as access control and authentication. Based on this paradigm, Saadi et al. implement a trustless model that enables authorized users to roam and access trusted sites [3]. Hsu et al. used network coverage of D2D communications and network missing authentication key exchange protocol to guarantee responsible group anonymity, end-to-end security for network operators, and traceability and revocability of accounting and management requirements [4]. Sujatha et al. propose a mobility management scheme based on identifier (ID)/locator (LOC) separation for wireless sensor networks to further reduce control messages. Through numerical calculation and analysis, the scheme can significantly improve the registration accuracy, increase the data transmission rate, and reduce the delay at the same time [5]. However, the above studies basically choose the application of the port isolation method to prevent Trojan horses. However, the application of this method will affect the sharing of users' computers, and the port isolation method cannot play the stacking role of switches.Using Fourier fast transform algorithm applied in lightweight authentication billing enhancement mechanism has become very important. Bowman and Ghoggali proposed a valid algorithm for computing a dimensional partial fast Fourier transform and proved that the partial Fourier transform on the trapezoidal domain can also be simplified to convolution [6]. Garrido et al. compute the fast Fourier transform of the actual input signal in a serial fashion, achieving full-hardware utilization by mapping each stage of the fast Fourier transform (FFT) to a half-butterfly operation that operates on the actual input signal [7]. Yang et al. proposed the Doppler-FFT algorithm for FBMC, which can effectively eliminate the influence of the Doppler scale in satellite communication, and introduced the Doppler scale factor into the butterfly structure of the FFT algorithm, which eliminates the difference in the Doppler shift of the received subcarriers [8]. The FFT plays a vital role in signal processing applications that convert the time domain into the frequency domain. Turaka used the FFT architecture to evaluate the application-specific integrated circuit (ASIC) and field-programmable gate array (FPGA) performance of all architectures [9]. The FFT processor is a common tool for converting time domain signals to frequency domain. Hassan et al. presented an SNR study of a 16-point pipelined FFT processor implemented on a field FPGA [10]. However, the application of the Fourier fast transform algorithm in the above research has the problem of insufficient application in authentication and accounting.


## 2. Lightweight Authentication and Billing Enhancement Mechanism Method

### 2.1. Certification and Billing Enhancement Mechanism

The authentication billing system is adopted to authenticate the campus network, which solves the problems of user management and network cost management, and ensures that the campus network based on optimized charging can realize universal access and billing [11]. Therefore, to build a safe and harmonious digital campus network and to realize user authentication, billing, and management, the network management system and user self-service system is a perfect combination, which can flexibly change the billing method, greatly reduce manual operation, and effectively interact with network monitoring data [12]. In recent years, Chinese universities have also built large campus networks, and some colleges have developed and applied Internet authentication and billing systems to meet their own needs. Due to the different requirements and application starting points of campus Internet access authentication billing system in different schools, the Internet access authentication billing strategy adopted by each college is also different [13].Choosing the campus network online authentication and billing mechanism consistent with its own development situation can ensure the good operation of the authentication and billing system. Breaking through the limitations of traditional systems, and designing and realizing the Internet authentication and billing system for colleges and universities can more efficiently meet the needs of users for the system [14]. In addition, in the process of designing and realizing the Internet authentication billing system, the changing elements of the times should also be considered comprehensively. Based on the status quo of the rapid development of information technology, consider various possibilities that the campus network authentication and billing system may face in the future, and then provide the basis for the improvement and optimization of the system.


### 2.2. Extraction of Signal Time-Frequency Features Based on Short-Time Fourier Transform Theory

For the communication signal modulation recognition theory, the efficient extraction of signal features is the basis and the key link of the whole algorithm. The feature extraction of the 0FDM signal modulation recognition algorithm applying the short-time Fourier transform and VGG-16 convolutional neural network is based on the different modulation signals in the time or frequency domain. The main mathematical tool, the Fourier transform, is used to extract its different features in the time and frequency domains [15]. However, with the increasing complexity of the electromagnetic environment, the increasing density of communication signals, and the difficulty in feature extraction, under a low signal-to-noise ratio, only the characteristics of the signal in the time domain or frequency domain are analyzed, so it is necessary to introduce the time-frequency analysis method. For a continuous signal s (t), its continuous short-time Fourier transform (STFT) is defined as:(1)STFTsi,j=∫−∞+∞skg∗k−ie−t2πjkdk.Its inverse transformation is as follows:(2)si=∫−∞+∞∫−∞+∞STFTsi,jgk−iet2πjkdidj.whereg (i) is a window function of very short time and ∗ is complex conjugate. When g (t) = 1, Vt, the short-time Fourier transform is converted to the traditional Fourier transform [16]. Continuous STFT has the fundamental property of being a linear time-frequency representation and having frequency-shift invariance.(3)s∼i=siet2πj0i⟶STFTs∼i,j=STFTsi,j0,STFTs∼i,j=∫−∞+∞s∼kg∗k−ie−t2πjkdk=STFTsi,j0.No time-shift invariance:(4)s∼i=si−i0⟶STFTs∼i,j=STFTsi−i0,j0e−t2πjk.Time-frequency analysis is to construct a new function to combine the time domain and frequency domain of the signal to describe the characteristics of the signal from the two dimensions of time and frequency, which is suitable for nonstationary signals. It can convert the OFDM signal and several single-carrier signals in each symbol cycle into the corresponding time-frequency image by using a signal time-frequency feature extraction method based on the short-time Fourier transform theory [17].


### 2.3. System Requirements

The system requirements include: certification management requirements and billing management requirements. Among them, the certification management requirements are the most core part of the whole system; the billing management requirements fully consider the billing cycle and the billing method, specific to the deduction time.


#### 2.3.1. Certification Management Requirements

The application effect of the online authentication and accounting system shows that the function of user authentication has become the core part of the whole system. Only after passing the authentication, can the Internet be accessed through the authentication and accounting system [18]. In colleges and universities, users of the system all have identifications such as teachers' salary IDs or student IDs, which uniquely represent the identity category in the college. In this way, users can fully realize the standard of real-name authentication, and if there are certain drawbacks and risks, they can quickly locate the problem [19]. If the user's password is incorrect for 10 consecutive times, the system will identify the user as a malicious login through the authentication module and add the user to the blacklist. The user must prove his identity through the operation and maintenance group with a valid certificate before he can be removed from the blacklist.


#### 2.3.2. Billing and Management Requirements

For the supervisors in the online authentication and billing system, it not only formulates a variety of billing schemes suitable for the majority of users but also has a direct connection between billing methods and money. It is necessary to fully consider the length of the billing cycle and the billing method, and specifically, whether the deduction time is at the beginning of the month or the end of the month. If the system user changes the billing method to different degrees, he must recalculate the end and start times of the adjusted billing method. The above content must be clearly and fully considered in order to ensure that the system will not make mistakes in deduction [20]. For the supervisors in the system, it can not only provide users with rich services in the campus network but also create considerable benefits for the authentication and billing system. In addition, due to the flexibility of the billing method, it also lays a good foundation for the system to carry out refined management of the campus network.


## 2.1. Certification and Billing Enhancement Mechanism

The authentication billing system is adopted to authenticate the campus network, which solves the problems of user management and network cost management, and ensures that the campus network based on optimized charging can realize universal access and billing [11]. Therefore, to build a safe and harmonious digital campus network and to realize user authentication, billing, and management, the network management system and user self-service system is a perfect combination, which can flexibly change the billing method, greatly reduce manual operation, and effectively interact with network monitoring data [12]. In recent years, Chinese universities have also built large campus networks, and some colleges have developed and applied Internet authentication and billing systems to meet their own needs. Due to the different requirements and application starting points of campus Internet access authentication billing system in different schools, the Internet access authentication billing strategy adopted by each college is also different [13].Choosing the campus network online authentication and billing mechanism consistent with its own development situation can ensure the good operation of the authentication and billing system. Breaking through the limitations of traditional systems, and designing and realizing the Internet authentication and billing system for colleges and universities can more efficiently meet the needs of users for the system [14]. In addition, in the process of designing and realizing the Internet authentication billing system, the changing elements of the times should also be considered comprehensively. Based on the status quo of the rapid development of information technology, consider various possibilities that the campus network authentication and billing system may face in the future, and then provide the basis for the improvement and optimization of the system.


## 2.2. Extraction of Signal Time-Frequency Features Based on Short-Time Fourier Transform Theory

For the communication signal modulation recognition theory, the efficient extraction of signal features is the basis and the key link of the whole algorithm. The feature extraction of the 0FDM signal modulation recognition algorithm applying the short-time Fourier transform and VGG-16 convolutional neural network is based on the different modulation signals in the time or frequency domain. The main mathematical tool, the Fourier transform, is used to extract its different features in the time and frequency domains [15]. However, with the increasing complexity of the electromagnetic environment, the increasing density of communication signals, and the difficulty in feature extraction, under a low signal-to-noise ratio, only the characteristics of the signal in the time domain or frequency domain are analyzed, so it is necessary to introduce the time-frequency analysis method. For a continuous signal s (t), its continuous short-time Fourier transform (STFT) is defined as:(1)STFTsi,j=∫−∞+∞skg∗k−ie−t2πjkdk.Its inverse transformation is as follows:(2)si=∫−∞+∞∫−∞+∞STFTsi,jgk−iet2πjkdidj.whereg (i) is a window function of very short time and ∗ is complex conjugate. When g (t) = 1, Vt, the short-time Fourier transform is converted to the traditional Fourier transform [16]. Continuous STFT has the fundamental property of being a linear time-frequency representation and having frequency-shift invariance.(3)s∼i=siet2πj0i⟶STFTs∼i,j=STFTsi,j0,STFTs∼i,j=∫−∞+∞s∼kg∗k−ie−t2πjkdk=STFTsi,j0.No time-shift invariance:(4)s∼i=si−i0⟶STFTs∼i,j=STFTsi−i0,j0e−t2πjk.Time-frequency analysis is to construct a new function to combine the time domain and frequency domain of the signal to describe the characteristics of the signal from the two dimensions of time and frequency, which is suitable for nonstationary signals. It can convert the OFDM signal and several single-carrier signals in each symbol cycle into the corresponding time-frequency image by using a signal time-frequency feature extraction method based on the short-time Fourier transform theory [17].


## 2.3. System Requirements

The system requirements include: certification management requirements and billing management requirements. Among them, the certification management requirements are the most core part of the whole system; the billing management requirements fully consider the billing cycle and the billing method, specific to the deduction time.


### 2.3.1. Certification Management Requirements

The application effect of the online authentication and accounting system shows that the function of user authentication has become the core part of the whole system. Only after passing the authentication, can the Internet be accessed through the authentication and accounting system [18]. In colleges and universities, users of the system all have identifications such as teachers' salary IDs or student IDs, which uniquely represent the identity category in the college. In this way, users can fully realize the standard of real-name authentication, and if there are certain drawbacks and risks, they can quickly locate the problem [19]. If the user's password is incorrect for 10 consecutive times, the system will identify the user as a malicious login through the authentication module and add the user to the blacklist. The user must prove his identity through the operation and maintenance group with a valid certificate before he can be removed from the blacklist.


### 2.3.2. Billing and Management Requirements

For the supervisors in the online authentication and billing system, it not only formulates a variety of billing schemes suitable for the majority of users but also has a direct connection between billing methods and money. It is necessary to fully consider the length of the billing cycle and the billing method, and specifically, whether the deduction time is at the beginning of the month or the end of the month. If the system user changes the billing method to different degrees, he must recalculate the end and start times of the adjusted billing method. The above content must be clearly and fully considered in order to ensure that the system will not make mistakes in deduction [20]. For the supervisors in the system, it can not only provide users with rich services in the campus network but also create considerable benefits for the authentication and billing system. In addition, due to the flexibility of the billing method, it also lays a good foundation for the system to carry out refined management of the campus network.


## 2.3.1. Certification Management Requirements

The application effect of the online authentication and accounting system shows that the function of user authentication has become the core part of the whole system. Only after passing the authentication, can the Internet be accessed through the authentication and accounting system [18]. In colleges and universities, users of the system all have identifications such as teachers' salary IDs or student IDs, which uniquely represent the identity category in the college. In this way, users can fully realize the standard of real-name authentication, and if there are certain drawbacks and risks, they can quickly locate the problem [19]. If the user's password is incorrect for 10 consecutive times, the system will identify the user as a malicious login through the authentication module and add the user to the blacklist. The user must prove his identity through the operation and maintenance group with a valid certificate before he can be removed from the blacklist.


## 2.3.2. Billing and Management Requirements

For the supervisors in the online authentication and billing system, it not only formulates a variety of billing schemes suitable for the majority of users but also has a direct connection between billing methods and money. It is necessary to fully consider the length of the billing cycle and the billing method, and specifically, whether the deduction time is at the beginning of the month or the end of the month. If the system user changes the billing method to different degrees, he must recalculate the end and start times of the adjusted billing method. The above content must be clearly and fully considered in order to ensure that the system will not make mistakes in deduction [20]. For the supervisors in the system, it can not only provide users with rich services in the campus network but also create considerable benefits for the authentication and billing system. In addition, due to the flexibility of the billing method, it also lays a good foundation for the system to carry out refined management of the campus network.


## 3. Design and Implementation of Wireless Access Authentication Mode

### 3.1. Implementation Foundation

The development of a university Internet authentication billing system includes two aspects: to design and develop the main interface of the system, and to realize the main function of authentication billing [21, 22]. In the steps of realizing the certification billing system, it is necessary to have a simple understanding of the user's application habits. The development and design of the campus network certification system should not only have good practicability, but also make all the teachers and students carry out real-time interaction. The development environment of the university Internet authentication billing system is shown in Table 1:Table 1
List of system development environments.
ClassificationNameVersionOperating systemWindowsXP/7Database platformMysql5.6Development languageJAVA—Development platformJ2EEJDK1.6Development toolsDreamweaverCC2017As shown in Table1, the creation and improvement of the authentication billing system play a critical role due to the diversity of system users. Internet authentication plays a key role in the operational security of the campus network billing system, the reason is that in the system for authentication to the name and password of campus network account make multiple protection settings, and authentication system for the Internet overall security check. If found loopholes, it will give prompt and warning. Using the Internet charging system can allocate network resources reasonably and prevent the waste of network resources.


### 3.2. IPoE Authentication Architecture

Wireless coverage is set up within the campus to meet the needs of Internet access of mobile terminal devices. The campus wireless network authentication adopts IPoE access mode, namely, DHCP + Portal access authentication mode, which is suitable for mobile client access authentication based on physical location. IPoE authentication and PPPoE are deployed at the convergence layer, and eventually BRAS. The wired and wireless access authentication architecture is shown in Figure1.Figure 1
Wired and wireless access authentication architecture.As shown in Figure1, since IPoE access cannot provide point-to-point communication and has poor security performance compared with PPPoE, its security issues need attention. The equipment required for the IPoE access authentication system includes DHCP server, WWW authentication server, and Portal server. The system realizes accurate control and perfect management through user mobile terminal access authentication, dynamic address allocation, and dynamic bandwidth adjustment.


### 3.3. Certification Process and Network Structure of DHCP + Portal

IPoE access authentication as DHCP + Portal way. Portal authentication is a kind of access authentication, also known as web authentication. Users who access the Internet do not need a local client but the web login and page login processes; first, access wired or wireless network, and when using the browser to access the external network, login interface will pop up, namely, Portal authentication interface. Through this authentication method, user login is more convenient and quicker, and at the same time, user self-service customization or information push can be realized on the authentication page. The Portal certification uses the Inquiry Handshake Certification Agreement (CHAP). Certification success occurs when the client receives a CHAP response message with zero error code. The Portal authentication network structure is shown in Figure2.Figure 2
The Portal authentication network structure diagram.As shown in Figure2, in the gateway mode, the transparent gateway is between the campus network and the external network, and all the exchanged data will pass through the gateway. Therefore, all data packets can be controlled and processed according to the policy, and only forward the certified data packets, and then control the network communication. RADIUS accounting mode uses RADIUS authentication technology to enable customers to support, capture, save, and share usage data for each user. The biggest advantage of RADIUS billing model is that it is easy to control and can easily realize a variety of billing strategies, which is suitable for the campus network with rich Intranet resources and service applications. It can realize different billing strategies for the internal and external network resources, do not charge the data traffic of the internal network, and adopt the billing mode for the address data of the external network, which is conducive to user network management.


### 3.4. Design and Implementation of the User Authentication and Billing System

Due to the complex characteristics of the campus network, the campus network user billing system needs to have a complete billing function for both IPv4 and IPv6 networks. It supports a variety of billing strategies, can accurately distinguish the traffic inside and outside the campus in real time, and uses full WEB management to provide a convenient and flexible management mode. On the one hand, the campus network IPv4 and IPv6 coexist, whereas students and teachers need different billing strategies. The intracampus network is free of traffic charges, and the extracampus network is included in the charging traffic. The management system that charges by traffic requires precise traffic control and charging measurement. The campus integrated user network management system adopts ShenLan security authentication network management and billing system, and on the basis of the basic data service module, the data are taken out and applied to the office automation software system (0A) independently developed by the information and network center, which improves the network management ability and network service quality of the campus network.


#### 3.4.1. Distributed Authentication and Billing System Architecture

Based on complex and rich campus network applications, the distributed authentication structure combines RADIUS billing mode and gateway billing mode. The two billing servers connect to the same data server to realize the linkage of authentication and billing. The system uses the RADIUS server system as the main billing system and access the authentication subgateway to realize the distributed billing system architecture. The system architecture is shown in Figure3.Figure 3
Distributed authentication and billing system architecture.As shown in Figure3, the campus wireless network adopts the IPoE access authentication method of DHCP + Portal. The authentication message is redirected through the BRAS, connected to the Portal server, and provided to the user login page, and then the user login information is transmitted to the RADIUS authentication server through the BRAS for authentication. Query and compare the login information with the account and password stored on the authentication server, and implement user authentication if the two match. After successful authentication, the RADIUS server sends the policy to the BRAS, and the BRAS completes traffic statistics and user control. The BRAS sends user traffic statistics to the RADIUS accounting server, which completes user traffic accounting, and the RADIUS server processes user authentication and accounting requests. Then, the user database account is connected to complete the recording of new billing information and update the Internet access log.Campus wired network users use the access authentication mode of PPPoE, and use the gateway accounting mode to complete the accounting after completing the identity authentication. The traffic statistics are completed through the charging gateway, and the traffic and service information is transmitted to the charging server to complete the charging.


#### 3.4.2. Billing Strategy

The main user groups of the campus network are students and teachers. The two have different requirements for network access and authentication methods. The actual charging method of the campus network is based on traffic and monthly billing. At the same time, the campus network provides diversified data services for different users or locations. The access traffic of campus network users to the campus network resources is not included in the charging range, and only traffic statistics and billing are performed for the data traffic accessing Internet resources. For on-campus users, the access traffic of the campus network is not included in the fee, and only the data traffic of the external network is billed for management. On-campus and off-campus billing traffic is differentiated according to the destination address of user access. The data traffic whose destination IP address is the campus address is not included in the billing traffic, and only the data traffic accessing the external network is billed. The original billing system distinguishes between on-campus and off-campus billing based on the collected traffic, which requires the service server to collect the intranet and extranet traffic separately and upload them to the Radius billing server. The charging server applies different rates for charging two different traffic groups. Effective and diverse billing strategies greatly improve the service quality of the campus network.


### 3.5. System Safety and Reliability Design

The security and reliability of the campus authentication billing system is the key factor to measure the performance of the system and guarantee the smooth progress of user authentication and billing process. The design of the authentication and billing subsystem adopts the architecture of server dual-machine hot backup and realizes the synchronization mechanism between the main and standby servers, which ensures the reliability of the system. Security is guaranteed by the firewall, and set up at the exit of the subsystem server group and the internal and external network interface to prevent external network attacks. In addition, the server host on the firewall is set for self-protection. A schematic diagram of the reliable safety design of the system is shown in Figure4.Figure 4
Reliable safety design of the system.As shown in Figure4, dual-machine hot backup (HA) can ensure that when the main server is down, switch to the backup server to prevent unauthentication or billing interruption. The main and standby are connected through the HA heartbeat line, which connects the two host serial ports to monitor the working state of themselves and the other party in real time. If the main server is wrong, the backup server will take over the work. When the main server detects its own problems, it will also actively send switching requirements to the backup server. Primary and standby servers deliver synchronization messages using the extensible Markup language (XML) to enable real-time synchronization.In order to ensure that the system service equipment is not accessed and attacked by the outside world, the system does network isolation. Users and system devices are set to different network segments, and a user access control policy that prohibits users from accessing the system server is set on the core switch device. Configure VLAN settings on the access switch so that the management VLAN port does not include the user's port.


## 3.1. Implementation Foundation

The development of a university Internet authentication billing system includes two aspects: to design and develop the main interface of the system, and to realize the main function of authentication billing [21, 22]. In the steps of realizing the certification billing system, it is necessary to have a simple understanding of the user's application habits. The development and design of the campus network certification system should not only have good practicability, but also make all the teachers and students carry out real-time interaction. The development environment of the university Internet authentication billing system is shown in Table 1:Table 1
List of system development environments.
ClassificationNameVersionOperating systemWindowsXP/7Database platformMysql5.6Development languageJAVA—Development platformJ2EEJDK1.6Development toolsDreamweaverCC2017As shown in Table1, the creation and improvement of the authentication billing system play a critical role due to the diversity of system users. Internet authentication plays a key role in the operational security of the campus network billing system, the reason is that in the system for authentication to the name and password of campus network account make multiple protection settings, and authentication system for the Internet overall security check. If found loopholes, it will give prompt and warning. Using the Internet charging system can allocate network resources reasonably and prevent the waste of network resources.


## 3.2. IPoE Authentication Architecture

Wireless coverage is set up within the campus to meet the needs of Internet access of mobile terminal devices. The campus wireless network authentication adopts IPoE access mode, namely, DHCP + Portal access authentication mode, which is suitable for mobile client access authentication based on physical location. IPoE authentication and PPPoE are deployed at the convergence layer, and eventually BRAS. The wired and wireless access authentication architecture is shown in Figure1.Figure 1
Wired and wireless access authentication architecture.As shown in Figure1, since IPoE access cannot provide point-to-point communication and has poor security performance compared with PPPoE, its security issues need attention. The equipment required for the IPoE access authentication system includes DHCP server, WWW authentication server, and Portal server. The system realizes accurate control and perfect management through user mobile terminal access authentication, dynamic address allocation, and dynamic bandwidth adjustment.


## 3.3. Certification Process and Network Structure of DHCP + Portal

IPoE access authentication as DHCP + Portal way. Portal authentication is a kind of access authentication, also known as web authentication. Users who access the Internet do not need a local client but the web login and page login processes; first, access wired or wireless network, and when using the browser to access the external network, login interface will pop up, namely, Portal authentication interface. Through this authentication method, user login is more convenient and quicker, and at the same time, user self-service customization or information push can be realized on the authentication page. The Portal certification uses the Inquiry Handshake Certification Agreement (CHAP). Certification success occurs when the client receives a CHAP response message with zero error code. The Portal authentication network structure is shown in Figure2.Figure 2
The Portal authentication network structure diagram.As shown in Figure2, in the gateway mode, the transparent gateway is between the campus network and the external network, and all the exchanged data will pass through the gateway. Therefore, all data packets can be controlled and processed according to the policy, and only forward the certified data packets, and then control the network communication. RADIUS accounting mode uses RADIUS authentication technology to enable customers to support, capture, save, and share usage data for each user. The biggest advantage of RADIUS billing model is that it is easy to control and can easily realize a variety of billing strategies, which is suitable for the campus network with rich Intranet resources and service applications. It can realize different billing strategies for the internal and external network resources, do not charge the data traffic of the internal network, and adopt the billing mode for the address data of the external network, which is conducive to user network management.


## 3.4. Design and Implementation of the User Authentication and Billing System

Due to the complex characteristics of the campus network, the campus network user billing system needs to have a complete billing function for both IPv4 and IPv6 networks. It supports a variety of billing strategies, can accurately distinguish the traffic inside and outside the campus in real time, and uses full WEB management to provide a convenient and flexible management mode. On the one hand, the campus network IPv4 and IPv6 coexist, whereas students and teachers need different billing strategies. The intracampus network is free of traffic charges, and the extracampus network is included in the charging traffic. The management system that charges by traffic requires precise traffic control and charging measurement. The campus integrated user network management system adopts ShenLan security authentication network management and billing system, and on the basis of the basic data service module, the data are taken out and applied to the office automation software system (0A) independently developed by the information and network center, which improves the network management ability and network service quality of the campus network.


### 3.4.1. Distributed Authentication and Billing System Architecture

Based on complex and rich campus network applications, the distributed authentication structure combines RADIUS billing mode and gateway billing mode. The two billing servers connect to the same data server to realize the linkage of authentication and billing. The system uses the RADIUS server system as the main billing system and access the authentication subgateway to realize the distributed billing system architecture. The system architecture is shown in Figure3.Figure 3
Distributed authentication and billing system architecture.As shown in Figure3, the campus wireless network adopts the IPoE access authentication method of DHCP + Portal. The authentication message is redirected through the BRAS, connected to the Portal server, and provided to the user login page, and then the user login information is transmitted to the RADIUS authentication server through the BRAS for authentication. Query and compare the login information with the account and password stored on the authentication server, and implement user authentication if the two match. After successful authentication, the RADIUS server sends the policy to the BRAS, and the BRAS completes traffic statistics and user control. The BRAS sends user traffic statistics to the RADIUS accounting server, which completes user traffic accounting, and the RADIUS server processes user authentication and accounting requests. Then, the user database account is connected to complete the recording of new billing information and update the Internet access log.Campus wired network users use the access authentication mode of PPPoE, and use the gateway accounting mode to complete the accounting after completing the identity authentication. The traffic statistics are completed through the charging gateway, and the traffic and service information is transmitted to the charging server to complete the charging.


### 3.4.2. Billing Strategy

The main user groups of the campus network are students and teachers. The two have different requirements for network access and authentication methods. The actual charging method of the campus network is based on traffic and monthly billing. At the same time, the campus network provides diversified data services for different users or locations. The access traffic of campus network users to the campus network resources is not included in the charging range, and only traffic statistics and billing are performed for the data traffic accessing Internet resources. For on-campus users, the access traffic of the campus network is not included in the fee, and only the data traffic of the external network is billed for management. On-campus and off-campus billing traffic is differentiated according to the destination address of user access. The data traffic whose destination IP address is the campus address is not included in the billing traffic, and only the data traffic accessing the external network is billed. The original billing system distinguishes between on-campus and off-campus billing based on the collected traffic, which requires the service server to collect the intranet and extranet traffic separately and upload them to the Radius billing server. The charging server applies different rates for charging two different traffic groups. Effective and diverse billing strategies greatly improve the service quality of the campus network.


## 3.4.1. Distributed Authentication and Billing System Architecture

Based on complex and rich campus network applications, the distributed authentication structure combines RADIUS billing mode and gateway billing mode. The two billing servers connect to the same data server to realize the linkage of authentication and billing. The system uses the RADIUS server system as the main billing system and access the authentication subgateway to realize the distributed billing system architecture. The system architecture is shown in Figure3.Figure 3
Distributed authentication and billing system architecture.As shown in Figure3, the campus wireless network adopts the IPoE access authentication method of DHCP + Portal. The authentication message is redirected through the BRAS, connected to the Portal server, and provided to the user login page, and then the user login information is transmitted to the RADIUS authentication server through the BRAS for authentication. Query and compare the login information with the account and password stored on the authentication server, and implement user authentication if the two match. After successful authentication, the RADIUS server sends the policy to the BRAS, and the BRAS completes traffic statistics and user control. The BRAS sends user traffic statistics to the RADIUS accounting server, which completes user traffic accounting, and the RADIUS server processes user authentication and accounting requests. Then, the user database account is connected to complete the recording of new billing information and update the Internet access log.Campus wired network users use the access authentication mode of PPPoE, and use the gateway accounting mode to complete the accounting after completing the identity authentication. The traffic statistics are completed through the charging gateway, and the traffic and service information is transmitted to the charging server to complete the charging.


## 3.4.2. Billing Strategy

The main user groups of the campus network are students and teachers. The two have different requirements for network access and authentication methods. The actual charging method of the campus network is based on traffic and monthly billing. At the same time, the campus network provides diversified data services for different users or locations. The access traffic of campus network users to the campus network resources is not included in the charging range, and only traffic statistics and billing are performed for the data traffic accessing Internet resources. For on-campus users, the access traffic of the campus network is not included in the fee, and only the data traffic of the external network is billed for management. On-campus and off-campus billing traffic is differentiated according to the destination address of user access. The data traffic whose destination IP address is the campus address is not included in the billing traffic, and only the data traffic accessing the external network is billed. The original billing system distinguishes between on-campus and off-campus billing based on the collected traffic, which requires the service server to collect the intranet and extranet traffic separately and upload them to the Radius billing server. The charging server applies different rates for charging two different traffic groups. Effective and diverse billing strategies greatly improve the service quality of the campus network.


## 3.5. System Safety and Reliability Design

The security and reliability of the campus authentication billing system is the key factor to measure the performance of the system and guarantee the smooth progress of user authentication and billing process. The design of the authentication and billing subsystem adopts the architecture of server dual-machine hot backup and realizes the synchronization mechanism between the main and standby servers, which ensures the reliability of the system. Security is guaranteed by the firewall, and set up at the exit of the subsystem server group and the internal and external network interface to prevent external network attacks. In addition, the server host on the firewall is set for self-protection. A schematic diagram of the reliable safety design of the system is shown in Figure4.Figure 4
Reliable safety design of the system.As shown in Figure4, dual-machine hot backup (HA) can ensure that when the main server is down, switch to the backup server to prevent unauthentication or billing interruption. The main and standby are connected through the HA heartbeat line, which connects the two host serial ports to monitor the working state of themselves and the other party in real time. If the main server is wrong, the backup server will take over the work. When the main server detects its own problems, it will also actively send switching requirements to the backup server. Primary and standby servers deliver synchronization messages using the extensible Markup language (XML) to enable real-time synchronization.In order to ensure that the system service equipment is not accessed and attacked by the outside world, the system does network isolation. Users and system devices are set to different network segments, and a user access control policy that prohibits users from accessing the system server is set on the core switch device. Configure VLAN settings on the access switch so that the management VLAN port does not include the user's port.


## 4. Results and Analysis

### 4.1. Comparison of PPPoE Access Performance between Kernel Mode and User Mode

At 10 : 00 pm on nonweekends, the main PPPoE access server on the campus network is sampled for 3 consecutive days, and the average value is obtained. The performance comparison chart of kernel mode and user mode PPPoE is shown in Figure5.Figure 5
CPU occupancy and throughput comparison diagram. (a) CPU occupancy comparison chart. (b) Throughput comparison chart.
(a)(b)As shown in Figure5, with the increasing number of users, the system resources occupied by PPPoE continue to increase. When the number of users exceeds 200, the system response speed becomes very slow and the client access speed slows down significantly; while the increase in PPPoE users changes little, the system response speed is still very fast, and the server can theoretically withstand parallel access of more than 2000 users. Figure 5(b) is a comparison of the throughput performance of kernel mode and user mode PPPoE access in the case of 250 users. In the case of the same number of users, the load of the system will be significantly increased. The throughput of the kernel-mode PPPoE access server can exceed 250 Mb/s in the environment of multiple egress lines on the campus network.


### 4.2. Latency Test Before and After Traffic Load Balancing Optimization

Multiple-exit link flow load balancing and the average delay pair of single-exit link IP address disconnection are shown in Figure6.Figure 6
Comparison diagram of data packet average delay before and after flow load balancing optimization.As can be seen from Figure6, the optimized delay is small and stable between 200 ms and 300 ms, while the data delay is large, so the average delay of each IP address segment is improved.


### 4.3. Performance Test Results

Based on the above test content, the operability, security, and advanced technology of the Internet billing system are tested, and the performance test results of the system are as follows: the Internet authentication billing system meets the design requirements and can complete all the work smoothly. The corresponding time is shown in Figure7.Figure 7
Comparison of test delay throughput rates. (a) Corresponding time diagram of system test. (b) The throughput rate of system test.
(a)(b)As shown in Figure7, there is no denial of service in the online authentication and billing system of colleges and universities during the peak visit period (at the same time login into the university Internet authentication billing system is more). In the university Internet authentication billing system test running process, the firewall records malicious attack system phenomenon, but no hackers can enter the system affecting the safe operation of the system.


## 4.1. Comparison of PPPoE Access Performance between Kernel Mode and User Mode

At 10 : 00 pm on nonweekends, the main PPPoE access server on the campus network is sampled for 3 consecutive days, and the average value is obtained. The performance comparison chart of kernel mode and user mode PPPoE is shown in Figure5.Figure 5
CPU occupancy and throughput comparison diagram. (a) CPU occupancy comparison chart. (b) Throughput comparison chart.
(a)(b)As shown in Figure5, with the increasing number of users, the system resources occupied by PPPoE continue to increase. When the number of users exceeds 200, the system response speed becomes very slow and the client access speed slows down significantly; while the increase in PPPoE users changes little, the system response speed is still very fast, and the server can theoretically withstand parallel access of more than 2000 users. Figure 5(b) is a comparison of the throughput performance of kernel mode and user mode PPPoE access in the case of 250 users. In the case of the same number of users, the load of the system will be significantly increased. The throughput of the kernel-mode PPPoE access server can exceed 250 Mb/s in the environment of multiple egress lines on the campus network.


## 4.2. Latency Test Before and After Traffic Load Balancing Optimization

Multiple-exit link flow load balancing and the average delay pair of single-exit link IP address disconnection are shown in Figure6.Figure 6
Comparison diagram of data packet average delay before and after flow load balancing optimization.As can be seen from Figure6, the optimized delay is small and stable between 200 ms and 300 ms, while the data delay is large, so the average delay of each IP address segment is improved.


## 4.3. Performance Test Results

Based on the above test content, the operability, security, and advanced technology of the Internet billing system are tested, and the performance test results of the system are as follows: the Internet authentication billing system meets the design requirements and can complete all the work smoothly. The corresponding time is shown in Figure7.Figure 7
Comparison of test delay throughput rates. (a) Corresponding time diagram of system test. (b) The throughput rate of system test.
(a)(b)As shown in Figure7, there is no denial of service in the online authentication and billing system of colleges and universities during the peak visit period (at the same time login into the university Internet authentication billing system is more). In the university Internet authentication billing system test running process, the firewall records malicious attack system phenomenon, but no hackers can enter the system affecting the safe operation of the system.


## 5. Conclusions

In order to meet the diversified needs of users of the university online authentication billing system, this paper analyzed the research results in the campus network authentication billing system, understands the problems of the campus network authentication billing system, and the fundamental reasons for the shortcomings. In this regard, in order to help colleges and universities improve the level of online authentication and accounting management, this paper uses J2EE as the development platform, and combines the RADIUS protocol with the PPPOE protocol. University Internet authentication and billing system were tested. After successfully passing the functional module test in this study, we readjusted the functional deployment, and on this basis, conducted in-depth tests on the performance, security, and stability of the system. According to the test and operation results of colleges and universities, the authentication and billing system can effectively solve the shortcomings of the old system, and optimize the user charging, user authentication and management mechanism. Thus, it is committed to provide the university online authentication billing system users with the required authentication traffic billing strategy, and improve the users' satisfaction with the system, although still need to improve the security of the system. In the early design stage, various situations of network tools were not considered comprehensively, and uncommon network security vulnerabilities were not designed into the system. It is expected that later studies can improve this regret.



---

*Source: 2943526-2022-09-05.xml*