CN111431858B - Centralized safe transmission and authentication method for routing message - Google Patents

Abstract

The invention discloses a centralized safe transmission and authentication method facing to a routing message, which comprises the following steps that firstly, newly added routing equipment establishes a neighbor relation with each equipment participating in routing through a neighbor table; secondly, the newly added routing equipment performs equipment authentication through a centralized authentication center; thirdly, before the message is sent, the centralized authentication center carries out authentication confirmation on the neighbor routing equipment; and secondly, after the neighbor routing equipment completes authentication and confirmation, encrypting and sending the message to the neighbor routing equipment by using an asymmetric encryption technology, and finally, after receiving the encrypted message, decrypting the message by using the asymmetric encryption technology to obtain an original message for a specific routing protocol to use. The method adds a mechanism of newly added routing equipment authentication, improves the safety of each routing equipment in the domain, and carries out authentication confirmation on the neighbor routing equipment before message transmission, thereby reducing the leakage risk of message transmission between the routing equipment and greatly improving the safety of message transmission between the routing equipment.

Description

A centralized secure transmission and authentication method for routing messages

technical field

The invention relates to the technical field of network communication, in particular to a centralized safe transmission and authentication method for routing messages.

Background technique

At present, common routing protocols in the Internet include RIP, OSPF, EIGRP, IS-IS, IGRP, BGP, etc. The security of each protocol mainly depends on the unique authentication method of each protocol, and the authentication among various protocols is incompatible with each other. However, in new applications such as software-defined networks, unified security management of different routing protocols is required in many scenarios, and there is currently no universal method to ensure the communication security of all routing protocols.

The present invention is mainly used to solve this problem, and the overall idea is to establish a new authentication mechanism outside the routing process of various routing protocols, and only after the authentication is successful, the specific routing communication is carried out. This method is "packed" outside the traditional routing protocol, thereby ensuring compatibility with various traditional routing protocols.

SUMMARY OF THE INVENTION

The invention provides a centralized security transmission and authentication method for routing messages, which effectively improves the security of message transmission between routes and reduces the risk of data leakage.

The present invention is realized by the following technical solutions: a centralized safe transmission and authentication method oriented to routing messages, which is characterized in that: it includes establishment of a neighbor table of routing equipment, centralized authentication of routing equipment, authentication and confirmation of neighboring routing equipment, There are four processes for message encryption and transmission, as follows:

First, the newly added routing device establishes a neighbor relationship with each device participating in routing through the neighbor table;

Secondly, the newly added routing equipment is authenticated by the centralized authentication center;

Thirdly, before the packet is sent, the centralized authentication center is used to authenticate and confirm the neighbor routing device;

Next, after the authentication and confirmation of the neighbor routing device is completed, the encryption technology is used to encrypt the packet and send it to the neighbor routing device;

Finally, after receiving the encrypted packet, the neighbor routing device decrypts the packet by using the encryption technology, and obtains the original packet for use by the specific routing protocol.

Preferably, each device participating in routing establishes a neighbor table, and each interface in the establishment of the neighbor relationship experiences five states, namely: Down state, Init state, Decide state, Success state, and Fail state; the specific design of each state is as follows :

(1) Down state: The port has not yet opened this method, and it is in the Down state by default;

(2) Init state: the port opens this method and sends the Discover discovery protocol packet, and has not yet obtained the other party's Coop packet. At the same time, if it receives the other party's Discover packet, it will reply to the Coop packet;

(3) Decide status: The Coop packet sent by the other party has been received, and it has not yet been determined whether the authentication is successful;

(4) Success state: After judging that the authentication in the Coop package is consistent with the authentication set by the local machine, it enters the Success state. In the Success state, every 5 Coop packages are received, and the test is performed once;

(5) Fail state: The authentication in the Coop package is inconsistent with the authentication set by the local machine, and the device enters the Fail state. In the Fail state, after receiving three Coop packets that are inconsistent with the authentication, it enters the Init state.

Preferably, the time period for sending various packets is as follows: Discover packets are sent every 5 seconds by default, and Coop packets are sent every 10 seconds by default. When the routing device is in Decide state, Coop packets are sent every 5 seconds. When the routing device is in Success In this state, Coop packets are sent every 30 seconds;

Preferably, the format of the Discover packet is: source address, destination address, and time-to-live.

Preferably, the format of the Coop packet is: routing device name, source address, destination address, survival time, sending time, and authentication identifier.

Preferably, the authentication process in the Coop packet is as follows: after the routing device receives the Coop packet, it determines that the authentication identifier in the packet is consistent with the authentication identifier set by the local machine; Enter the Init state; if they are consistent, record the routing device name and source address in the neighbor table.

Preferably, the newly added routing device is authenticated by the centralized authentication center. If the authentication succeeds, it is included in the authentication table. If the authentication fails, the newly added routing device is required to be authenticated again. The centralized authentication process of the routing device is as follows:

(1) In the same domain, when adding a routing device, assign a pair of public key and private key to it and assign a unique device-id;

(2) Use the new route to send a data packet to the centralized authentication center, and the data packet fields include device-id, public key, and its own IP;

(3) After the centralized authentication center receives the data packet sent by the new route, it records the device-id, public key and IP of the routing device;

(4) The centralized certification center returns its own public key to the newly added routing device;

(5) After the new routing device receives the public key, it encrypts the authentication key with the public key, and returns it to the centralized authentication center after encryption;

(6) After receiving the encrypted authentication key, the centralized authentication center uses its own private key to decrypt, and compares the decrypted authentication key with the original authentication key;

(7) If the comparison is consistent, record the device-id, public key and IP in the authentication table and return the authentication success information to the newly added routing device. If the comparison is inconsistent, send the authentication failure information to the newly added routing device for Recertify.

Preferably, before the packet is sent, the neighbor routing device is authenticated and confirmed by the centralized authentication center. If the neighbor routing device has not been authenticated by the centralized authentication center, it will directly stop sending packets to the neighbor router. If the neighbor routing device is in the centralized authentication center After authentication, if there is no record in the local public key storage table, the secondary authentication is performed to the centralized authentication center. If there is a record in the local public key storage table, the packet is prepared for encrypted transmission; the authentication and confirmation process of neighbor routing is as follows:

(1) After the routing engine generates the message, it obtains the IP of the neighbor routing device according to the neighbor table;

(2) The routing device sends the target IP to the centralized authentication center, and performs the authentication and confirmation request of the neighbor routing device;

(3) After the centralized authentication center receives the authentication confirmation request, it queries whether the IP of the neighbor routing device exists in the authentication table;

(4) If the neighbor routing device IP does not exist, return authentication confirmation failure information to the routing device;

(5) If the neighbor routing IP exists, return the device-id corresponding to the neighbor routing device IP to the router;

(6) After the router receives the device-id of the neighbor route, it queries the device-id in the local public key storage table. If the device-id exists in the table, it prepares the encrypted transmission of the message. This process ends. If the device-id exists - If the id does not exist in the table, send a secondary authentication confirmation request to the centralized authentication center;

(7) After the centralized authentication center receives the secondary authentication confirmation request, it sends its own public key to the neighbor routing device for the authentication confirmation request;

(8) After receiving the authentication confirmation request, the neighbor routing device encrypts the authentication key with the received public key, and returns it to the centralized authentication center after encryption;

(9) After receiving the encrypted authentication key, the centralized authentication center uses its own private key to decrypt, and compares the decrypted authentication key with the original authentication key;

(10) If the comparison is inconsistent, return the authentication confirmation failure information and the device-id of the neighbor routing device to the router, and send a re-authentication request to the neighbor router;

(11) After the routing device receives the authentication confirmation failure information, it will stop sending packets to the neighboring routing device;

(12) If the comparison is consistent, the centralized authentication center returns the authentication confirmation success information, the device-id and the public key of the neighbor routing device to the routing device;

(13) After the routing device receives the authentication confirmation success information, it records the device-id and public key of the neighboring routing device into the local public key storage table and prepares for encrypted transmission of the message.

Preferably, after the neighbor routing device is authenticated and confirmed, the asymmetric encryption technology is used to encrypt the packet and send it to the neighbor routing device. After receiving the encrypted packet, the neighbor routing device decrypts the packet using the asymmetric encryption technology to obtain the original packet. The message supply business needs; the message encryption transmission process is as follows:

(1) After the routing device generates the packet and the neighbor routing device is authenticated and confirmed, the device-id of the neighbor routing device is obtained;

(2) Use the neighbor routing device device-id to query in the public key storage table to obtain the public key of the corresponding neighbor routing device;

(3) Use the public key of the neighbor routing device to encrypt the original message and send it to the neighbor routing device;

(4) After receiving the encrypted message, the neighbor routing device decrypts it with the private key to obtain the original message, and uses the routing engine to process it.

Compared with the prior art scheme, the beneficial effects of the present invention:

(1) In the routing protocol, a new routing authentication mechanism is added, which improves the security of each routing device in the domain;

(2) Before packet transmission, it is necessary to perform authentication and confirmation on neighboring routing devices to reduce the leakage risk of packet transmission between routing devices;

(3) The asymmetric encryption technology is used to reduce the risk of packets being captured and cracked during transmission between routing devices, and the security of packet transmission between routing devices is greatly improved.

Description of drawings

The present invention will be further described below in conjunction with the accompanying drawings.

Fig. 1 is the schematic diagram of the present invention;

Fig. 2 is a flow chart of neighbor establishment in the present invention;

Fig. 3 is a schematic diagram of the flow of centralized routing authentication in the present invention;

Fig. 4 is the schematic flow chart of neighbor route authentication confirmation in the present invention;

5 is a schematic diagram of a message encryption transmission process flow diagram in the present invention;

6 is a schematic diagram of a public key storage table format in the present invention;

7 is a schematic diagram of the authentication table format in the present invention;

8 is a schematic diagram of a neighbor table format in the present invention;

Fig. 9 is the schematic diagram of the Discover package format in the present invention;

FIG. 10 is a schematic diagram of a Coop packet format in the present invention.

Detailed ways

As shown in Figure 1, a centralized secure transmission and authentication method for routing packets includes four processes: neighbor table establishment of routing devices, centralized authentication of routing devices, authentication and confirmation of neighboring routing devices, and encrypted transmission of packets. First, the newly added routing device establishes a neighbor relationship with each device participating in the routing through the neighbor table; secondly, the newly added route is authenticated by the centralized authentication center; Authentication confirmation; secondly, after the neighbor routing device is authenticated and confirmed, it uses asymmetric encryption technology to encrypt the packet and send it to the neighbor routing device. Finally, after the neighbor routing device receives the encrypted packet, it uses asymmetric encryption technology to decrypt the packet. message to obtain the original message for business needs.

As shown in Figure 2, each device participating in routing establishes a neighbor table, and each interface in the establishment of a neighbor relationship experiences five states, namely: Down state, Init state, Decide state, Success state, Fail state; is designed as follows:

(1) Down state: the port has not yet opened the method designed in the present invention, and is in the Down state by default;

(2) Init state: the port opens the method designed in the present invention, and sends the Discover exploration protocol package, and has not obtained the other party's Coop package, and at the same time, if the other party's Discover package is received, it will reply the Coop package;

(3) Decide status: The Coop packet sent by the other party has been received, and it has not yet been determined whether the authentication is successful;

(4) Success state: After judging that the authentication in the Coop package is consistent with the authentication set by the local machine, it enters the Success state. In the Success state, every 5 Coop packages are received, and the test is performed once;

(5) Fail state: The authentication in the Coop package is inconsistent with the authentication set by the local machine, and the device enters the Fail state. In the Fail state, after receiving three Coop packets that are inconsistent with the authentication, it enters the Init state.

In the above states: Discover packets are sent every 5 seconds by default, and Coop packets are sent every 10 seconds by default. When the routing device is in Decide state, Coop packets are sent every 5 seconds. When the routing device is in Success state, Coop packets are sent every 30 seconds. Sent every second. As shown in Figure 9, the format of the Discover packet is: source address, destination address, and time-to-live. As shown in Figure 10, the format of the Coop packet is: routing device name, source address, destination address, survival time, sending time, and authentication identifier.

As shown in Figure 3, the newly added routing device is authenticated by the centralized authentication center. If the authentication is successful, it will be included in the authentication table. If the authentication fails, the new routing device will be required to be authenticated again. The centralized authentication process of the routing device is as follows:

(1) In the same domain, when adding a route, assign a pair of public key and private key and assign a unique device-id (in practical applications, device-id is recommended to use dotted decimal notation format, for example: 10.10. 10.1);

(2) Use the new route to send data packets to the centralized authentication center. The data packet fields include device-id, public key, and its own IP (in practical applications, it is recommended to use the JSON data packet format, for example: {"device-id": "10.10.10.1", "key": "xxx", "ip": "10.10.10.1"});

(3) After the centralized authentication center receives the data packet sent by the new route, it records the device-id, public key and IP of the route;

(4) The centralized certification center returns its own public key to the newly added routing device;

(5) After the new routing device receives the public key, it encrypts the authentication key with the public key, and returns it to the centralized authentication center after encryption;

(6) After receiving the encrypted authentication key, the centralized authentication center uses its own private key to decrypt, and compares the decrypted authentication key with the original authentication key;

(7) After the comparison is consistent, the device-id, public key and IP are recorded in the authentication table and the authentication success information is returned to the new route. If the comparison is inconsistent, the authentication failure information is sent to the new route device for re-authentication.

As shown in Figure 4-8, before the packet is sent, the centralized authentication center authenticates the neighbor routing device. If the neighbor routing device has not been authenticated by the centralized authentication center, it stops sending packets to the neighbor router directly. If the device has been authenticated in the centralized authentication center, but it is not recorded in the local public key storage table, it will perform secondary authentication to the centralized authentication center. If there is a record in the local public key storage table, it is ready to encrypt the transmission of the message; the authentication of neighbor routing is confirmed The process is as follows:

(1) After the routing engine generates the message, it obtains the IP of the neighbor routing device according to the neighbor table;

(2) The routing device sends the target IP to the centralized authentication center, and performs the authentication and confirmation request of the neighbor routing device;

(3) After the centralized authentication center receives the authentication confirmation request, it queries whether the IP of the neighbor routing device exists in the authentication table;

(4) If the neighbor routing device IP does not exist, return authentication confirmation failure information to the routing device;

(5) If the neighbor routing IP exists, return the device-id corresponding to the neighbor routing device IP to the router;

(6) After the router receives the device-id of the neighbor route, it queries the device-id in the local public key storage table. If the device-id exists in the table, it prepares the encrypted transmission of the message. This process ends. If the device-id exists - If the id does not exist in the table, send a secondary authentication confirmation request to the centralized authentication center;

(7) After the centralized authentication center receives the secondary authentication confirmation request, it sends its own public key to the neighbor routing device for the authentication confirmation request;

(8) After receiving the authentication confirmation request, the neighbor routing device encrypts the authentication key with the received public key, and returns it to the centralized authentication center after encryption;

(9) After receiving the encrypted authentication key, the centralized authentication center uses its own private key to decrypt, and compares the decrypted authentication key with the original authentication key;

(10) If the comparison is inconsistent, return the authentication confirmation failure information and the device-id of the neighbor routing device to the router, and send a re-authentication request to the neighbor router;

(11) After the routing device receives the authentication confirmation failure information, it will stop sending packets to the neighboring routing device;

(12) If the comparison is consistent, the centralized authentication center returns the authentication confirmation success information, the device-id and the public key of the neighbor routing device to the routing device;

(13) After the routing device receives the authentication confirmation success information, it records the device-id and public key of the neighboring routing device into the local public key storage table and prepares for encrypted transmission of the message.

As shown in Figure 5, after the neighbor routing device is authenticated and confirmed, it uses asymmetric encryption technology to encrypt the packet and send it to the neighbor routing device. After the neighbor routing device receives the encrypted packet, it uses asymmetric encryption technology to decrypt the packet. Obtain the original message for business needs; the message encryption transmission process is as follows:

(1) After the route generates the packet, and after the neighbor routing authentication is confirmed, the neighbor routing device-id is obtained;

(2) Use the neighbor routing device-id to query in the public key storage table to obtain the public key of the corresponding neighbor routing;

(3) Use the public key of the neighbor router to encrypt the original message and send it to the neighbor router;

(4) After the neighbor router receives the encrypted message, it decrypts it with the private key to obtain the original message, and uses the routing engine to process it.

It can be seen from the above technical solutions that this method adds a new route authentication mechanism to the routing protocol, improves the security of each routing device in the domain, and needs to authenticate and confirm the neighbor routes before the packet is transmitted, reducing the number of routes. In addition, the asymmetric encryption technology is used to reduce the risk of packets being captured and cracked during transmission, which greatly improves the security of packet transmission between routes.

Claims (8)

1. A centralized safe transmission and authentication method facing to routing message is characterized in that: the method comprises four processes of establishing a neighbor table of the routing equipment, performing centralized authentication on the routing equipment, confirming authentication of the neighbor routing equipment and encrypting and transmitting a message, and specifically comprises the following steps:

firstly, the newly added routing equipment establishes a neighbor relation with each equipment participating in routing through a neighbor table;

secondly, the newly added routing equipment carries out equipment authentication through a centralized authentication center;

thirdly, before the message is sent, the centralized authentication center carries out authentication confirmation on the neighbor routing equipment;

secondly, after the neighbor routing equipment completes authentication confirmation, the message is encrypted and sent to the neighbor routing equipment by using an encryption technology;

finally, after receiving the encrypted message, the neighbor routing equipment decrypts the message by using an encryption technology to obtain an original message for a specific routing protocol to use;

before sending the message, the centralized authentication center authenticates and confirms the neighbor routing equipment, if the neighbor routing equipment is not authenticated in the centralized authentication center, the message is directly stopped to be sent to the neighbor routing equipment, if the neighbor routing equipment is authenticated in the centralized authentication center and is not recorded in the local public key storage table, the message is secondarily authenticated in the centralized authentication center, and if the local public key storage table has records, the message is prepared for encrypted transmission; the authentication confirmation process of the neighbor route is as follows:

(1) after the routing engine generates a message, acquiring a neighbor routing device IP according to a neighbor table;

(2) the routing equipment generates a target IP to a centralized authentication center and carries out authentication confirmation request of neighbor routing equipment;

(3) after receiving the authentication confirmation request, the centralized authentication center inquires whether the IP of the neighbor routing equipment exists in an authentication table;

(4) if the neighbor routing equipment IP does not exist, returning authentication confirmation failure information to the routing equipment;

(5) if the neighbor route IP exists, returning the device-id corresponding to the neighbor route equipment IP to the route;

(6) after receiving the neighbor route device-id, the route inquires the device-id in a local public key storage table, if the device-id exists in the table, message encryption transmission is prepared, the process is finished, and if the device-id does not exist in the table, a secondary authentication confirmation request is sent to a centralized authentication center;

(7) after receiving the secondary authentication confirmation request, the centralized authentication center sends the public key of the centralized authentication center to the neighbor routing equipment for carrying out the authentication confirmation request;

(8) after receiving the authentication confirmation request, the neighbor routing equipment encrypts the authentication key by using the received public key and returns the encrypted authentication key to the centralized authentication center;

(9) after receiving the encrypted authentication key, the centralized authentication center decrypts the encrypted authentication key by using a private key of the centralized authentication center, and compares the decrypted authentication key with the original authentication key;

(10) if the comparison is inconsistent, returning authentication confirmation failure information and the device-id of the neighbor routing equipment to the router, and sending a re-authentication request to the neighbor router;

(11) after receiving the authentication confirmation failure information, the routing equipment stops sending the message to the neighbor routing equipment;

(12) if the comparison is consistent, the centralized authentication center returns the authentication and confirmation success information, the neighboring routing equipment device-id and the public key to the routing equipment;

(13) and after receiving the authentication and confirmation success information, the routing equipment records the neighbor routing equipment device-id and the public key into a local public key storage table and prepares for message encryption transmission.

2. The centralized secure transmission and authentication method for routing-oriented packets according to claim 1, wherein: each device participating in routing establishes a neighbor table, and each interface in the established neighbor relation experiences 5 states, which are respectively: down state, Init state, delete state, Success state and Fail state; the specific design of each state is as follows:

(1) down state: the port is not started, and is in a Down state by default;

(2) the Init state: the port starts the method, sends a Discover exploration protocol packet, does not acquire a Coop packet of the other side, and replies the Coop packet if the Discover packet of the other side is received;

(3) decide status: receiving a Coop packet sent by the other party, and judging whether the authentication is successful or not;

(4) the Success state: after judging that the authentication in the Coop packet is consistent with the authentication set by the local computer, entering a Success state, and detecting once every 5 Coop packets are received in the Success state;

(5) a Fail state: the authentication in the Coop packet does not accord with the authentication set by the local computer, the state of Fail is entered, and the state of Init is entered after the authentication of 3 Coop packets is not accord with the authentication set by the local computer in the state of Fail.

3. The centralized secure transmission and authentication method for routing-oriented packets according to claim 2, wherein: the packet transmission time periods of various packets are as follows: the Discover packet is sent once every 5 seconds in a default mode, the Coop packet is sent once every 10 seconds in a default mode, the Coop packet is sent once every 5 seconds when the routing equipment is in a delete state, and the Coop packet is sent once every 30 seconds when the routing equipment is in a Success state.

4. The centralized secure transmission and authentication method for routing-oriented packets according to claim 2, wherein: the Discover packet format is: source address, destination address, time to live.

5. The centralized secure transmission and authentication method for routing-oriented packets according to claim 2, wherein: the format of the Coop packet in the step is as follows: the routing device comprises a routing device name, a source address, a destination address, a survival time, a sending time and an authentication identifier.

6. The centralized secure transmission and authentication method for routing-oriented packets according to claim 5, wherein: the authentication process in the Coop packet is as follows: after receiving the Coop packet, the routing equipment judges that the authentication identifier in the packet is consistent with the authentication identifier set by the local machine; if the two are not consistent, entering a Fail state, and if the two are not successfully authenticated for 3 times continuously, entering an Init state; and if the routing device name and the source address are consistent, recording the routing device name and the source address into the neighbor table.

7. The centralized secure transmission and authentication method for routing-oriented packets according to claim 1, wherein: the newly added routing equipment carries out equipment authentication through the centralized authentication center, if the authentication is successful, the newly added routing equipment is included in the authentication table, and if the authentication is failed, the newly added routing equipment is required to carry out authentication again; the centralized authentication process of the routing equipment is as follows:

(1) in the same domain, when a routing device is added, a pair of public key and private key is distributed for the routing device, and a unique device-id is distributed;

(2) sending a data packet to a centralized authentication center by using a newly added route, wherein the field of the data packet comprises device-id, a public key and own IP;

(3) after receiving a data packet sent by a newly added route, the centralized authentication center records device-id, a public key and IP of the route equipment;

(4) the centralized authentication center returns the public key to the newly added routing equipment;

(5) after receiving the public key, the newly added routing equipment encrypts the authentication key by using the public key and returns the encrypted authentication key to the centralized authentication center;

(6) after receiving the encrypted authentication key, the centralized authentication center decrypts the encrypted authentication key by using a private key of the centralized authentication center, and compares the decrypted authentication key with the original authentication key;

(7) if the comparison is consistent, the device-id, the public key and the IP are recorded in an authentication table, authentication success information is returned to the newly added routing equipment, and if the comparison is inconsistent, authentication failure information is sent to the newly added routing equipment for re-authentication.

8. The centralized secure transmission and authentication method for routing-oriented packets according to claim 1, wherein: after the neighbor routing equipment completes authentication confirmation, the message is encrypted and sent to the neighbor routing equipment by using an asymmetric encryption technology, and after the neighbor routing equipment receives the encrypted message, the message is decrypted by using the asymmetric encryption technology to obtain an original message for service requirement; the message encryption transmission flow is as follows:

(1) after the routing equipment generates a message and the neighbor routing equipment authenticates and confirms, obtaining the device-id of the neighbor routing equipment;

(2) inquiring in a public key storage table by using the neighbor routing equipment device-id to obtain a public key corresponding to the neighbor routing equipment;

(3) encrypting the original message by using a public key of the neighbor routing equipment, and sending the original message to the neighbor routing equipment;

(4) and after receiving the encrypted message, the neighbor routing equipment decrypts the encrypted message by using the private key to obtain an original message and processes the original message by using the routing engine.

Images