CN104219217B - Security association negotiation method, device and system - Google Patents

Abstract

The invention discloses a security association (SA) negotiation method, device and system. The method includes: a key server generates a private key corresponding to the communication initiator and a private key corresponding to the communication for a communication initiator and a communication responder respectively. The private key of the responder; the communication initiator and the communication responder use their respective private keys to encrypt the digital digest of the message to be sent into signature information, encapsulate the signature information into the message to be sent and The communication initiator and the communication responder respectively determine the public key of the other party, and use the determined public key of the other party and the signature information in the respectively received message to authenticate the other party. The present invention can solve the problems of complex implementation process of SA negotiation and heavy communication load, and can perform security supervision and legal interception on the communication of the network deploying the Internet Protocol Security (IPSec) protocol.

Description

Security Association Negotiation Method, Device and System

technical field

The present invention relates to digital information transmission technology, in particular to a security association (SA, SecurityAssociation) negotiation method, device and system.

Background technique

At present, the limited address space defined by Internet Protocol version 4 (IPv4, Internet Protocol version 4) will be exhausted, and the lack of address space will inevitably hinder the further development of the Internet. Therefore, in order to expand the address space, based on Internet Protocol version 6 (IPv6, The network deployment of Internet Protocol version 6) has gradually been put on the agenda.

Compared with IPv4, IPv6 has made improvements in many aspects, such as: supporting the Internet Protocol Security (IPSec, Internet Protocol Security) protocol in security, so that IPv6 networks can realize end-to-end and gateway-to-gateway encrypted communication and authentication Authentication, thus ensuring the communication security of the network.

The scenarios in which IPSec is deployed on an IPv6 network can be divided into the following three scenarios:

(1) Site-to-Site or gateway-to-gateway. Correspondingly, the schematic diagram of the IPSec protocol deployment scenario is shown in Figure 1a. Three organizations of an enterprise are distributed in three different places on the Internet, and The three organizations use a gateway to establish IPSec tunnels with each other, and the data between several personal computers (PCs, Personal Computers) on the enterprise intranet is securely interconnected through the IPSec tunnels established by these gateways.

(2) End-to-End or PC-to-PC, the communication between the two PCs is protected by the IPSec session between the two PCs, not by the gateway.

(3) End-to-site or PC-to-gateway (End-to-Site), the communication between the two PCs is protected by the IPSec session between the gateway and the remote PC.

When deploying the IPSec protocol in an IPv6 network, it is difficult for mobile terminals to support the IPSec protocol. Therefore, in the initial stage of the application of the IPv6 network, the IPSec protocol is mainly deployed in the gateway-to-gateway scenario, mainly in the following two situations:

(1) The deployment of IPv6 network traffic traversing IPv4 network, Figure 1b is a schematic diagram of IPv6 network traffic traversing IPv4 network, as shown in Figure 1b, host A on an IPv6 network on an isolated island and host A on another isolated island Host B on the IPv6 network communicates, the IPv6 networks on the two isolated islands are connected through gateway A and gateway B, and gateway A and gateway B communicate in the IPv4 network through an IPSec tunnel;

(2) Deployment in an IPv6 network, Figure 1c is a schematic diagram of IPv6 traffic traversing an IPv6 network, as shown in Figure 1c, host A on an IPv6 network on an isolated island communicates with host B on an IPv6 network on another isolated island , the IPv6 networks on the two isolated islands are connected through gateway A and gateway B, and gateway A and gateway B communicate in the IPv6 network through an IPSec tunnel.

However, when the IPSec protocol is used in the IPv6 network to ensure the communication security of the network, the IPSec protocol itself has high requirements on resources and network performance, which brings great resistance to the actual deployment and implementation of the network. It is manifested in the following aspects:

First, the IPSec protocol stipulates that the key negotiation process requires support for the public key system and certificate system, which requires the IPSec support side to issue certificates, manage certificates, and verify certificates. The implementation process is too complicated and the communication load is heavy. .

The following takes the gateway-to-gateway scenario as an example to illustrate the IPSec protocol deployment process, which includes two stages:

The first stage: Internet Key Exchange (IKE, Internet Key Exchange) SA negotiation between gateways, that is, establishing an IKE Security Association (SA, Security Association) to protect the subsequent IPSec SA negotiation between gateways;

The second stage: IPSec SA negotiation is performed between gateways, that is, IPSec SA is established to protect subsequent communication between gateways.

Among them, in the first stage, the gateways need to conduct policy negotiation, key material exchange and authentication through six interactive messages, and the certificate used for authentication requires additional communication overhead. The payload is encapsulated as a message and sent to the peer (that is, another gateway for SA negotiation), or the gateway informs the peer certificate information through negotiation in advance, resulting in an overly complicated implementation process and a heavy communication load; and, a gateway When SA negotiation with multiple gateways is required, the identification operation of certificates corresponding to multiple gateways needs to be performed, which involves the system of distributing different public keys, that is, the intercommunication of the Certification Authority (CA, Certificate Authority) center, and the IPSec manufacturers Interoperability is also required between them, and the implementation process is too complicated and the communication load is heavy.

Second, the IPSec protocol stipulates that the communication at the support end of IPSec is encrypted and protected, which shields security supervision and lawful interception to a certain extent. deploy.

To sum up, how to solve the problems of complex implementation process of SA negotiation and heavy communication load, and how to conduct security supervision and legal interception of network communication deploying the IPSec protocol, have become problems to be solved urgently.

SUMMARY OF THE INVENTION

In view of this, the main purpose of the present invention is to provide a SA negotiation method, device and system, which can solve the problems of complex implementation process of SA negotiation and heavy communication load, and can perform security supervision and security supervision on the communication of the network deploying the IPSec protocol. Lawful interception.

In order to achieve the above object, the technical scheme of the present invention is achieved in this way:

The present invention provides a SA negotiation method, which sets a key server for key management; the method includes:

The key server generates a private key corresponding to the communication initiator and a private key corresponding to the communication responder for the communication initiator and the communication responder respectively;

The communication initiator and the communication responder encrypt the digital digest of the message to be sent into signature information using their private keys, and encapsulate the signature information into the message to be sent and send to the other party;

The communication initiator and the communication responder respectively determine the public key of the other party, and use the determined public key of the other party and the signature information in the respectively received message to authenticate the other party.

Preferably, the key server generates a private key corresponding to the communication initiator and a private key corresponding to the communication responder for the communication initiator and the communication responder, respectively, including:

The key server generates a master key, and determines a private key corresponding to the communication initiator according to the master key and the ID of the communication initiator, and, according to the master key and the communication responder ID determines the private key corresponding to the communication responder;

The communication initiator and the communication responder respectively determine the public key of the other party, including:

The key server generates public parameters and sends them to the communication initiator and the communication responder respectively;

The communication initiator and the communication responder determine the public key of the other party according to the ID of the other party and the public parameter sent by the key server.

Preferably, the method further includes: the key server further sends the exchange and key distribution (DH, Diffie-Hellman) public value and random number of the other party to the communication initiator and the communication responder respectively;

Correspondingly, the communication initiator and the communication responder respectively determine the encryption key and the integrity key according to the received DH public value and random number, use the respectively determined encryption key to encrypt the message to be sent, and use The integrity key determined by each of them performs integrity check on the received message.

Preferably, the communication initiator and the communication responder use the determined public key of the other party and the signature information in the respectively received message to authenticate each other, including: the communication initiator and the communication responder Each party decrypts the signature information in the received message according to the determined public key, and when the decrypted digital digest is consistent with the digital digest determined according to the ID of the other party and the DH public value sent by the key server, determine the Authentication succeeded.

Preferably, after the communication initiator and the communication responder successfully authenticate each other, the method further includes: encrypting the sent message with the encryption key by the communication initiator and the communication responder, and The integrity check is performed on the received message using the integrity key.

Preferably, the method further includes: the communication initiator forwards the IPSec policy negotiation message to the communication responder through the key server, and the communication responder forwards the communication initiator to the communication initiator through the key server IPSec policy negotiation result packet;

Wherein, the IPSec policy negotiation message and the IPSec policy negotiation result message carry the random number of the sender, a security parameter index (SPI, Security Parameters Index) and protocol information;

Correspondingly, the key server determines the communication according to the random number, SPI and protocol information carried in the IPSec policy negotiation message, or according to the random number, SPI and protocol information carried in the IPSec policy negotiation result message. Encryption key and integrity key used by the initiator and the communication responder for data communication.

The present invention also provides a key server, which includes: a key generation unit and a first communication unit; wherein,

The key generation unit is used to generate a private key corresponding to the communication initiator and a private key corresponding to the communication responder for the communication initiator in the communication device and the communication responder in the communication device respectively;

The first communication unit is configured to correspondingly send the private key generated by the key generation unit to the communication initiator and the communication responder.

Preferably, the key generation unit is further configured to generate a master key, and determine a private key corresponding to the communication initiator according to the master key and the ID of the communication initiator, and, according to the master key The secret key and the ID of the communication responder determine the private key corresponding to the communication responder.

Preferably, the first communication unit is further configured to send the DH public value and random number of the other party to the communication initiator and the communication responder, respectively.

Preferably, the first communication unit further sends the IPSec policy negotiation message from the communication initiator to the communication responder, and sends the IPSec policy negotiation result message from the communication responder to the communication responder. the originator of the communication;

The key generation unit is also used for random number, SPI and protocol information carried in the IPSec policy negotiation message received by the first communication unit, or according to the IPSec policy negotiation result message received by the first communication unit The carried random number, SPI and protocol information determine the encryption key and the integrity key used when the communication initiator and the communication responder perform data communication.

The present invention also provides a communication device, the communication device includes: a second communication unit and an authentication unit; wherein,

The second communication unit is used to encrypt the digital digest of the message to be sent into signature information by using the local private key, and encapsulate the signature information into the message to be sent and send it to the other party's communication device;

The authentication unit is configured to determine the public key of the counterpart communication device, and use the determined public key and the signature information in the message received by the second communication unit to authenticate the counterpart communication device.

Preferably, the authentication unit is further configured to determine the public key of the counterpart communication device according to the ID of the counterpart communication device and the public parameter generated by the key server.

Preferably, the second communication unit is further configured to receive the DH public value and random number of the counterpart communication device sent by the key server;

The authentication unit is further configured to determine an encryption key and an integrity key according to the DH public value and random number of the counterpart communication device received by the second communication unit, and to use the encryption key to perform an encryption key for the second communication device. The message to be sent by the unit is encrypted, and the integrity check is performed on the message received by the second communication unit by using the integrity key.

Preferably, the authentication unit is further configured to decrypt the signature information in the message received by the second communication unit according to the determined public key, and compare the decrypted digital digest with the ID and When the digital digest determined by the DH public value received by the second communication unit is consistent, it is determined that the authentication is successful.

Preferably, the second communication unit is further configured to encrypt the sent message with the encryption key determined by the authentication unit, and perform an integrity check on the received message with the integrity key determined by the authentication unit test.

Preferably, the second communication unit is further configured to send an IPSec policy negotiation message or an IPSec policy negotiation result message to the key server, wherein the IPSec policy negotiation message and the IPSec policy negotiation result message The file carries the sender's random number, SPI and protocol information.

The present invention also provides an SA negotiation system, which includes: a key server and a communication device; wherein,

the key server, for generating a private key corresponding to the communication device for the communication device;

The communication device is configured to encrypt the digital digest of the message to be sent into signature information by using a local private key, encapsulate the signature information into the message to be sent and send it to the communication device of the other party; determine the information of the communication device of the other party. the public key, and use the determined public key and the signature information in the received message to authenticate the counterpart communication device.

Preferably, the key server key includes a generating unit and a first communication unit; the communication device includes a second communication unit and an authentication unit; the functions of each unit are the same as those described above.

Through the technical solution of the present invention, when the communication initiator performs SA negotiation with a plurality of communication responders, the key server uniformly generates corresponding keys for the communication initiator and the communication responders, the implementation process is simple, and the communication load is low; and , the key server determines the encryption key and the integrity key used when the communication initiator and the communication responder communicate according to the random number, SPI and protocol information carried in the negotiation message of the communication parties, which can realize the communication Security supervision and legal interception of both parties.

Description of drawings

Figure 1a is a schematic diagram of a site-to-site or gateway-to-gateway deployment of IPSec protocol;

Figure 1b is a schematic diagram of a scenario in which the IPSec protocol is deployed when IPv6 network traffic traverses an IPv4 network;

Figure 1c is a schematic diagram of a scenario where the IPSec protocol is deployed when IPv6 network traffic traverses an IPv4 network;

FIG. 2 is a schematic flowchart of an implementation of an SA negotiation method according to an embodiment of the present invention;

3 is a schematic diagram of a composition structure of an SA negotiation system according to an embodiment of the present invention;

4 is a schematic diagram 1 of an implementation flow of SA negotiation according to an embodiment of the present invention;

FIG. 5 is a schematic diagram 2 of an implementation flow of SA negotiation according to an embodiment of the present invention.

Detailed ways

The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

An embodiment of the present invention describes an SA negotiation method, and FIG. 2 is a schematic flowchart of the implementation of the SA negotiation method according to an embodiment of the present invention, as shown in FIG. 2 , including:

Step 201: the key server respectively generates a private key corresponding to the communication initiator and a private key corresponding to the communication responder for the communication initiator and the communication responder;

The key server is provided for key management.

Preferably, the key server generates a master key, and determines the private key corresponding to the communication initiator according to the master key and the identity (ID, Identity) of the communication initiator, and, according to the The master key and the ID of the communication responder determine the private key corresponding to the communication responder;

Step 202: The communication initiator and the communication responder encrypt the digital digest of the message to be sent into signature information using their respective private keys, encapsulate the signature information into the message to be sent, and send it to the other party ;

Preferably, the key server generates public parameters and sends them to the communication initiator and the communication responder respectively; the communication initiator and the communication responder send the public parameters to the key server according to the ID of the other party The public parameter of , determines the public key of the other party.

Preferably, the key server further sends the DH public value and random number of the other party to the communication initiator and the communication responder respectively;

Correspondingly, the communication initiator and the communication responder respectively determine the encryption key and the integrity key according to the received DH public value and random number, and use the respectively determined encryption key to perform the processing on the message to be sent in step 202. Encryption, and use the respective determined integrity key to perform integrity check on the received message.

Step 203: The communication initiator and the communication responder respectively determine the public key of the other party, and use the determined public key of the other party and the signature information in the respectively received message to authenticate the other party.

Preferably, the communication initiator and the communication responder decrypt the signature information in the received message according to the determined public key, and then compare the decrypted digital digest with the key server according to the ID of the other party and the key server. When the digital digest determined by the sent DH public value is consistent, it is determined that the authentication is successful.

Preferably, after the communication initiator and the communication responder successfully authenticate each other, the communication initiator and the communication responder encrypt the sent message with the encryption key, and use the integrity The key performs integrity check on the received message.

Preferably, the communication initiator forwards the IPSec policy negotiation message to the communication responder through the key server, and the communication responder forwards the IPSec policy negotiation result message to the communication initiator through the key server arts;

Wherein, the IPSec policy negotiation message and the IPSec policy negotiation result message carry the random number, SPI and protocol information of the sender;

Correspondingly, the key server determines the communication according to the random number, SPI and protocol information carried in the IPSec policy negotiation message, or according to the random number, SPI and protocol information carried in the IPSec policy negotiation result message. Encryption key and integrity key used by the initiator and the communication responder for data communication.

The embodiment of the present invention also describes an SA system. FIG. 3 is a schematic diagram of the composition and structure of the SA negotiation system according to the embodiment of the present invention. As shown in FIG. 3 , it includes: a communication device 31 and a key server 32; wherein,

The key server 32 is configured to generate a private key corresponding to the communication device 31 for the communication device 31;

The communication device 31 is used to encrypt the digital digest of the message to be sent into signature information by using the local private key, encapsulate the signature information into the message to be sent and send it to the communication device 31 of the opposite party; determine the communication of the opposite party the public key of the device 31, and use the determined public key and the signature information in the received message to authenticate the counterpart communication device 31.

The key server 32 includes: a key generation unit 321 and a first communication unit 322; wherein,

The key generation unit 321 is used to generate a private key corresponding to the communication initiator and a private key corresponding to the communication responder for the communication initiator in the communication device 31 and the communication responder in the communication device 31 respectively;

The first communication unit 322 is configured to send the private key generated by the key generation unit 321 to the communication initiator and the communication responder correspondingly.

The key generation unit 321 is further configured to generate a master key, and determine a private key corresponding to the communication initiator according to the master key and the ID of the communication initiator, and, according to the master key The secret key and the ID of the communication responder determine the private key corresponding to the communication responder.

The first communication unit 322 is further configured to send the DH public value and random number of the other party to the communication initiator and the communication responder, respectively.

The first communication unit 322 is further configured to send the IPSec policy negotiation message from the communication initiator to the communication responder, and send the IPSec policy negotiation result message from the communication responder to the communication responder. the communication initiator;

The key generation unit 321 is further configured to negotiate the random number, SPI and protocol information carried in the IPSec policy negotiation packet received by the first communication unit 322, or according to the IPSec policy negotiation received by the first communication unit 322. The random number, SPI and protocol information carried in the result message determine the encryption key and the integrity key used when the communication initiator and the communication responder perform data communication.

The communication device 31 includes: a second communication unit 311 and an authentication unit 312; wherein,

The second communication unit 311 is configured to encrypt the digital digest of the message to be sent into signature information by using the local private key, encapsulate the signature information into the message to be sent and send it to the communication device 31 of the opposite party;

The authentication unit 312 is configured to determine the public key of the counterpart communication device 31 and use the determined public key and the signature information in the message received by the second communication unit 311 to authenticate the counterpart communication device 31 .

The authentication unit 312 is further configured to determine the public key of the counterpart communication device 31 according to the ID of the counterpart communication device 31 and the public parameter generated by the key server 32 .

Wherein, the second communication unit 311 is further configured to receive the DH public value and random number of the counterpart communication device 31 sent by the key server 32;

The authentication unit 312 is further configured to determine an encryption key and an integrity key according to the DH public value and random number of the counterpart communication device 31 received by the second communication unit 311, and use the encryption key to verify the The message to be sent by the second communication unit 311 is encrypted, and the integrity check is performed on the message received by the second communication unit 311 by using the integrity key.

Wherein, the authentication unit 312 is further configured to decrypt the signature information in the message received by the second communication unit 311 according to the determined public key. When it is consistent with the digital digest determined by the DH public value received by the second communication unit 311, it is determined that the authentication is successful.

The second communication unit 311 is further configured to encrypt the sent message with the encryption key determined by the authentication unit 312, and complete the received message with the integrity key determined by the authentication unit 312. sex check.

The second communication unit 311 is further configured to send an IPSec policy negotiation message or an IPSec policy negotiation result message to the key server 32, wherein the IPSec policy negotiation message and the IPSec policy negotiation result The message carries the sender's random number, SPI and protocol information.

FIG. 4 is a schematic diagram 1 of an implementation process of security association negotiation according to an embodiment of the present invention. As shown in FIG. 4 , the following steps are included:

Steps 401 to 402: Gateway 1 (initiator) and gateway 2 (responder) conduct policy negotiation, that is, gateway 1 sends a policy proposal to gateway 2, and gateway 2 returns the matched policy to gateway 1;

In step 401, gateway 1 sends one or more groups of policy proposals to gateway 2, the policy proposals are encapsulated in the SA payload of the message, and the message is also encapsulated in the Internet Security Connection and Key Management Protocol (ISAKMP, Internet Security Association and Key). Management Protocol) corresponding header (HDR, HeaDeR);

Here, the SA payload includes one or more groups of policy proposals, and the policy proposal includes a quintuple, specifically: encryption algorithm, hash algorithm, exchange and key distribution (DH, Diffie-Hellman) algorithm, authentication method , and the IKE SA life cycle.

In step 402, according to the policy proposal of the SA payload in the received message, the gateway 2 locally queries the policy that matches the policy proposal, and after matching, sends the message encapsulating the HDR and SA payload to the gateway 1. The SA payload includes matched policy information.

Step 403: Gateway 1 requests from the key server the private key Pri1 of gateway 1, public parameters params generated by the key server, DH public value g^xr and random number Nr of gateway 2, and sends the key server DH public value g^xi and random number Ni.

Among them, Pri1=Fuc(MasterKey, IDi), IDi is the ID of gateway 1, MasterKey is the master key generated by the key server, Fuc() represents the algorithm of multiplying a point on the preset elliptic curve by an integer, Pri1( private key) and Pub1 (public key) are paired keys corresponding to gateway 1.

The gateway DH public value includes address and port information bound to the gateway.

Step 404: The key server forwards the request of the gateway 1 for g^xr and Nr to the gateway 2, and sends the params, the private key Pri2, g^xr and Nr corresponding to the gateway 2 to the gateway 2.

Wherein, Pri2=Fuc(MasterKey, IDr), IDr is the ID of the gateway 2; Pri2 (private key) and Pub2 (public key) are the paired keys corresponding to the gateway 2 .

Step 405: Gateway 2 sends g^xr and Nr to the key server;

Step 406: The key server sends params, Pri1, g^xr and Nr to gateway 1;

Step 407: Gateway 1 and Gateway 2 determine the public key of the corresponding counterparty according to the counterparty ID and number params, and determine the key material;

The public key Pub2=Fuc(params, IDr) corresponding to the gateway 2, and the public key Pub1=Fuc(params, IDi) corresponding to the gateway 1.

Gateway 1 and Gateway 2 determine the first key material SKEYID as prf(Ni_b|Nr_b, g^xy) according to g^xi, g^xr, Ni and Nr, and determine the following key materials according to SKEYID:

SKEYID_d=prf(SKEYID, g^xy|CKY-I|CKY-R|0) (1)

prf() is the hash function used to derive the key material.

SKEYID_d is used to determine the new key material used for encryption during the second-phase IPSec SA negotiation;

SKEYID_a=prf(SKEYID, SKEYID_d|g^xy|CKY-I|CKY-R|1) (2)

SKEYID_a is an integrity key, which is used to perform integrity verification on the message negotiated by the IKE SA after step 407 and the message negotiated by the IPSEC SA in the second stage of this embodiment;

SKEYID_e=prf(SKEYID, SKEYID_a|g^xy|CKY-I|CKY-R|2) (3)

SKEYID_e is an encryption key, which is used to encrypt the message of the IKE SA negotiation after step 407 and the message of the second phase of the IPSEC SA negotiation in this embodiment.

Step 408: Gateway 2 authenticates gateway 1;

Taking the use of digital signature for authentication as an example, gateway 1 determines the digital digest HASH_I of the message to be sent to gateway 2 according to the following formula:

HASH_I=prf(SKEYID, g^xi|g^xr|CKY-I|CKY-R|SAi_b|IDi_b) (4)

Gateway 1 utilizes Pri1 to encrypt HASH_I to generate signature SIG_I, encapsulates the SIG_I payload and the IDi payload into the message to be sent, and utilizes the SKEYID_e determined in step 407 to encrypt the payload and send it to gateway 2;

Gateway 2 determines HASH_I according to formula (4), and decrypts SIG_I using Pub1 determined in step 407, and compares the decrypted HASH_I with HASH_I determined according to formula (4), if they are consistent, the authentication gateway 1 succeeds, otherwise, the processing is terminated .

Step 409: Gateway 1 authenticates gateway 2;

Taking the use of digital signature for authentication as an example, gateway 2 determines the digital digest HASH_R of the message to be sent to gateway 1 according to the following formula:

HASH_R=prf(SKEYID, g^xr|g^xi|CKY-R|CKY-I|SAi_b|IDr_b) (5)

Gateway 2 utilizes Pri2 to encrypt HASH_R to generate signature SIG_R, encapsulates the SIG_R payload IDr payload into the message to be sent, and utilizes the SKEYID_e determined in step 407 to encrypt the payload of the message to be sent to gateway 2;

Gateway 1 determines HASH_R according to formula (5), and decrypts SIG_R using Pub2 determined in step 407, compares the decrypted HASH_R with the HASH_R determined according to formula (5), if they are consistent, the authentication gateway 2 succeeds, otherwise, the processing is terminated .

The second stage: IPSec SA negotiation between gateways.

FIG. 5 is a schematic diagram 2 of the implementation process of security association negotiation according to an embodiment of the present invention. As shown in FIG. 5 , the following steps are included:

Step 501: Gateway 1 sends an SA negotiation message to the key server;

Among them, the negotiation packet encapsulates HDR*, HASH[1] payload, SA payload (including IPSec policy proposal) and random number (NONCE) payload, and the negotiation message can also encapsulate DH payload, KE payload and ID payload, NONCE payload It includes the random number Ni of gateway 1, the DH load includes the DH public value of gateway 1, and HASH[1] is determined according to formula (6):

HASH[1]=prf(SKEYID_a, M-ID|SA|Ni[|KE][|IDci|IDcr) (6)

The HDR* indicates that the load in the message is encrypted and transmitted by the SKEYID_e determined in the first stage step 407; the HASH[1] load includes the HASH_I re-determined by the gateway 1 according to the formula (4), and the gateway 2 does the integrity check according to the HASH_I , to re-authenticate gateway 1; IPSEC SA policy includes security protocol (AH or ESP), SPI, hash algorithm, mode (tunnel mode or transmission mode) and IPSEC SA life cycle;

The payload in the message uses the SKEYID_a determined in step 407 of the first stage to perform integrity check.

Step 502: the key server forwards the message of step 501 to the gateway 2;

Step 503: The gateway 2 returns a message carrying the negotiation result to the key server;

The gateway 2 locally queries the policy matching the policy proposal according to the policy proposal forwarding the message by the key server, and returns a matched message carrying the matching result to the key server.

The packet returned by gateway 2 encapsulates SA payload (including IPSec policy proposal matching results), NONCE payload (including random number Nr of gateway 2), and HASH[2] payload. The determined HASH_R, when the DH payload, KE payload and ID payload are encapsulated in the message received by gateway 2, correspondingly, the message sent by gateway 2 to the key server is also encapsulated with DH payload, KE payload and ID payload. HASH[ 2] Determine according to formula (7):

HASH[2]=prf(SKEYID_a, M-ID|Ni_b|SA|Nr[|KE][|IDci|IDcr) (7) The packet encapsulated payload returned by gateway 2 passes the encryption key determined in step 407 of the first stage The key SKEYID_e is encrypted, and the integrity check is performed through the integrity key SKEYID_a determined in step 407 of the first stage.

The gateway 2 determines a new key material KEYMAT according to the random number Ni carried in the message, and determines the key material based on the KEYMAT, and the processing is specifically:

If perfect forward secrecy (PFS, Perfect Forward Secrecy) is not required and the KE payload is not encapsulated in the received message, the new key material is determined according to formula (8):

KEYMAT=prf(SKEYID_d, protocol|SPI|Ni_b|Nr_b) (8)

If PFS is required and the KE payload is encapsulated in the received message, the new key material is determined according to formula (9):

KEYMAT=prf(SKEYID_d, g(qm)^xy|protocol|SPI|Ni_b|Nr_b) (9)

Among them, the protocol (protocol) and SPI are obtained from the SA payload.

Based on the above new key material, substitute KEYMAT into the SKEYID in equations (1), (2) and (3), determine the new SKEYID_e and SKEYID_a, and use SKEYID_e to perform the subsequent communication between gateway 1 and gateway 2. Encryption, and use SKEYID_a to check the integrity of the packets transmitted by gateway 1 and gateway 2 during subsequent communication.

Step 504: the key server forwards the message returned by gateway 2 to gateway 1;

Step 505: Gateway 1 sends a confirmation message to gateway 2.

The message encapsulates the HASH[3] payload, confirms receipt of the message from gateway 2, and proves that gateway 1 is in the Active state, that is, the message sent by gateway 1 in step 501 is not forged, HASH[3] is based on formula ( 10) Determine:

HASH[3]=prf(SKEYID_a, 0|M-ID|Ni_b|Nr_b) (10)

The definitions of the parameters in the formulas (1) to (10) in this embodiment are the same as those in the specification RFC2409.

Gateway 1 re-determines the key material KEYMAT according to the Nr in the message, and determines new key materials SKEYID_e and SKEYID_a based on the KEYMAT. The specific processing is the same as step 503. Gateway 1 and gateway 2 use SKEYID_e for subsequent communication messages The payload is encrypted, and SKEYID_a is used to perform integrity check on the payload of subsequent communication packets.

In the above interaction steps, the key server saves the SA load and random numbers Ni and Nr in the messages sent by the gateway 1 and the gateway 2. When the communication between the gateway 1 and the gateway 2 needs to be monitored, the KEYMAT is determined according to step 502, and the KEYMAT is Substitute the parameter SKEYID in equations (1), (2), and (3) to determine the new SKEYID_e and SKEYID_a, so that the encrypted data transmitted during the communication between gateway 1 and gateway 2 can be decrypted to achieve the communication between gateway 1 and gateway 2. regulatory purposes.

After step 505, gateway 1 and gateway 2 protect the communication session and data through SKEYID_e and SKEYID_a negotiated in the second stage.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention.

Claims (17)

1. A security association SA negotiation method is characterized in that a key server for key management is arranged; the method comprises the following steps:

the key server respectively generates a private key corresponding to the communication initiator and a private key corresponding to the communication responder for the communication initiator and the communication responder;

the communication initiator and the communication responder encrypt the digital digests of respective messages to be sent into signature information by using respective private keys, and the signature information is packaged into the messages to be sent and sent to the other party;

the communication initiator and the communication responder respectively determine a public key of the other party through the key server, and authenticate the other party by using the determined public key of the other party and the signature information in the messages received by the communication initiator and the communication responder respectively;

and the communication initiator and the communication responder determine a public key of the opposite party according to the identity of the opposite party and the public parameter determined by the key server.

2. The method of claim 1, wherein the key server generates a private key corresponding to the communication initiator and a private key corresponding to the communication responder for the communication initiator and the communication responder, respectively, and comprises:

the key server generates a master key, determines a private key corresponding to the communication initiator according to the master key and the ID of the communication initiator, and determines a private key corresponding to the communication responder according to the master key and the ID of the communication responder;

the determining, by the communication initiator and the communication responder, public keys of each other includes:

the key server generates public parameters and respectively sends the public parameters to the communication initiator and the communication responder;

and the communication initiator and the communication responder determine the public key of the other party according to the ID of the other party and the public parameter sent by the key server.

3. The method according to claim 1 or 2, characterized in that the method further comprises: the key server also sends the exchange and key distribution DH public value and the random number of the other party to the communication initiator and the communication responder respectively;

correspondingly, the communication initiator and the communication responder respectively determine an encryption key and an integrity key according to the received DH public value and the random number, encrypt the message to be sent by using the respective determined encryption key, and perform integrity check on the received message by using the respective determined integrity key.

4. The method of claim 3, wherein the communication initiator and the communication responder authenticate the counterpart by using the determined public key of the counterpart and signature information in each received message, and comprising: and the communication initiator and the communication responder decrypt the signature information in the respectively received message according to the determined public key, and when the decrypted digital digest is consistent with the digital digest determined according to the ID of the opposite party and the DH public value sent by the key server, the successful authentication is determined.

5. The method of claim 3, wherein after the communication initiator and the communication responder successfully authenticate the other party, the method further comprises: and the communication initiator and the communication responder encrypt the sent messages by the encryption key and carry out integrity check on the received messages by the integrity key.

6. The method of claim 5, further comprising: the communication initiator forwards an internet protocol security (IPSec) strategy negotiation message to the communication responder through the key server, and the communication responder forwards an IPSec strategy negotiation result message to the communication initiator through the key server;

the IPSec policy negotiation message and the IPSec policy negotiation result message carry a random number, a Security Parameter Index (SPI) and protocol information of a sender;

correspondingly, the key server determines an encryption key and an integrity key used when the communication initiator and the communication responder perform data communication according to the random number, the SPI and the protocol information carried by the IPSec policy negotiation message or according to the random number, the SPI and the protocol information carried by the IPSec policy negotiation result message.

7. A key server, comprising: a key generation unit and a first communication unit; wherein,

the key generation unit is used for respectively generating a private key corresponding to the communication initiator and a private key corresponding to the communication responder for a communication initiator in the communication equipment and a communication responder in the communication equipment;

the first communication unit is used for correspondingly sending the private key generated by the key generation unit to the communication initiator and the communication responder;

the key generation unit is further configured to generate public parameters and send the public parameters to the communication initiator and the communication responder, respectively, where the communication initiator and the communication responder determine a public key of the other party according to an identity of the other party and the public parameters determined by the key server.

8. The key server of claim 7,

the key generation unit is further configured to generate a master key, determine a private key corresponding to the communication initiator according to the master key and the ID of the communication initiator, and determine a private key corresponding to the communication responder according to the master key and the ID of the communication responder.

9. The key server of claim 7,

the first communication unit is further configured to send a DH public value and a random number of the other party to the communication initiator and the communication responder, respectively.

10. The key server according to claim 7, 8 or 9,

the first communication unit is further configured to send the IPSec policy negotiation packet from the communication initiator to the communication responder, and send the IPSec policy negotiation result packet from the communication responder to the communication initiator;

the key generation unit is further configured to determine an encryption key and an integrity key used when the communication initiator and the communication responder perform data communication according to the random number, the SPI, and the protocol information carried in the IPSec policy negotiation packet received by the first communication unit, or according to the random number, the SPI, and the protocol information carried in the IPSec policy negotiation result packet received by the first communication unit.

11. A communication device, characterized in that the communication device comprises: a second communication unit and an authentication unit; wherein,

the second communication unit is used for encrypting the digital abstract of the message to be sent into signature information by using a private key of the communication equipment, packaging the signature information into the message to be sent and sending the message to the communication equipment of the other party;

the authentication unit is used for determining a public key of the communication equipment of the other party through a key server and authenticating the communication equipment of the other party by using the determined public key and the signature information in the message received by the second communication unit;

the authentication unit is further configured to determine a public key of the opposite communication device according to the ID of the opposite communication device and the public parameter generated by the key server.

12. The communication device of claim 11,

the second communication unit is further configured to receive a DH public value and a random number of the opposite communication device, which are sent by the key server;

the authentication unit is further configured to determine an encryption key and an integrity key according to the DH public value and the random number of the opposite communication device received by the second communication unit, encrypt a message to be sent by the second communication unit using the encryption key, and perform integrity check on the message received by the second communication unit using the integrity key.

13. The communication device of claim 12,

the authentication unit is further configured to decrypt, according to the determined public key, signature information in the message received by the second communication unit, and when the decrypted digital digest is consistent with a digital digest determined according to the ID of the opposite communication device and the DH public value received by the second communication unit, determine that authentication is successful.

14. The communication device of claim 12,

the second communication unit is further configured to encrypt the sent message with the encryption key determined by the authentication unit, and perform integrity check on the received message with the integrity key determined by the authentication unit.

15. The communication device according to any one of claims 11 to 14,

the second communication unit is further configured to send an IPSec policy negotiation packet or an IPSec policy negotiation result packet to the key server, where the IPSec policy negotiation packet and the IPSec policy negotiation result packet carry a random number, an SPI, and protocol information of a sender.

16. An SA negotiation system, comprising: a key server and a communication device; wherein,

the key server is used for generating a private key corresponding to the communication equipment for the communication equipment;

the communication equipment is used for encrypting the digital abstract of the message to be sent into signature information by using a local private key, packaging the signature information into the message to be sent and sending the message to the opposite communication equipment; determining a public key of the communication equipment of the opposite party through the key server, and authenticating the communication equipment of the opposite party by using the determined public key and the signature information in the received message;

and the key server is further configured to generate public parameters and send the public parameters to the communication initiator and the communication responder respectively, and the communication initiator and the communication responder determine a public key of the other party according to an identity of the other party and the public parameters determined by the key server.

17. The SA negotiation system of claim 16,

the key server is the key server of any one of claims 7 to 10; the communication device is as claimed in any one of claims 11 to 15.

Images