CN104283757A - IPsec based VPN quick-connection method - Google Patents

Abstract

The invention provides an IPsec based VPN quick-connection method. Excessive negotiation during IPsec VPN connection is avoided in the mode that information and masks required to be negotiated by IPsec correspond to each other. When the IPsec VPN connection is established, the information required to be negotiated is transmitted in CRC and mask modes so that two communicating parties can perform safety communication without negotiation. Used IPsec negotiation information is determined in advance and the mode of the information is transmitted in a safety mode, so that complicated and excessive negotiation in the IPsec VPN connection process is avoided, the whole communication process is performed in a safe environment, unnecessary signal transmission is reduced, efficiency is improved, and good user experience is obtained.

Description

A kind of VPN quick connecting method based on IPsec

Technical field

The present invention relates to communication technical field, particularly relate to the method for attachment of a kind of VPN.

Background technology

The development of information technology and widely using of Internet, while bringing great convenience to people's live and work, make people extremely worry the safety of communication data on the Internet based on open protocol platform TCP/IP and the safety of computer system operation also always.Multiple safety communication technology has been had at present to be applied to transfer of data in the Internet, wherein network layer realize internet protocol secure (IPSec) communication protocol due to completely transparent to application layer, therefore be highly suitable in existing TCP/IP network, by increasing IPSec security module, and do not need the setting revising application system, software, be the secure network communications environment that disparate networks application build one is general.

Along with network, especially the development of network economy, enterprise expands day by day, client distributes increasingly extensive, affiliate is increasing, this situation has impelled the benefit of enterprise growing, also more and more highlight on the other hand the functional defect of traditional forms of enterprises's net: so traditional forms of enterprises's net demand enterprise of being difficult to adapt to modern enterprise based on the private line access mode of fixed physical location proposes higher demand for self networking, be mainly manifested in the aspects such as the flexibility of network, fail safe, economy, autgmentability.In this context, the advantage that VPN shows unique characteristics with it has won the favor of increasing enterprise, makes enterprise less can pay close attention to the operation and maintenance of network, and is devoted to the realization of the business goal of enterprise more.

VPN (Virtual Private Network) refers to by comprehensive utilization network technology, access control technology and encryption technology, and by certain user management mechanism, set up safe " special " network in the public network, ensure that data carry out the technology of safe transmission in " encrypted tunnel ".The network interconnection is realized by tunnel (TUNNEL) or virtual circuit (VIRTUAL CIRCUIT); support user safety management; can network monitoring, failure diagnosis be carried out, have economical, select flexibly, speed is fast, fail safe good, realize the advantages such as the protection of investment.

In the prior art, by the expansion to IP layer, ipsec protocol can be supported, comprise network security protocol (AH, Authentication Header) and encapsulating security payload (esp) (ESP, Encapsulating Security Payload), IKMP (IKE, Internet Key Exchange) agreement.When creating a security strategy, be in charge of by security strategy process and safeguarded, and activate IKE process and the other side's vpn gateway consults a SA (Security Association).When sending data, the protocol encapsulation of being specified by SA by output process, and by regulation algorithm for encryption and generation verify data; When receiving data, unpacked by SA specified protocol by input process, and deciphering and checking.

Visible prior art is need between communicating pair, consult a lot of information carrying out IPSec connection, time required when the negotiation of these information increases connection undoubtedly, if and Internet Transmission is wrong, the connection failure failed to understand can be caused, have impact on quality, reduce Consumer's Experience.

Summary of the invention

The invention provides a kind of VPN quick connecting method based on IPsec, it is characterized in that, comprise the following steps:

Step 202, initiation VPN connect before, IKE and SA of the n group IPSec related to during regulation communication next time between communicating pair, and be that IKE and SA often organizing IPSec arranges corresponding mask, the node of communicating pair stores the mask of this n group IKE and SA and its correspondence;

IKE and SA of any one group of IPSec selects in step 204, session setup side, and IKE and SA of IPSec selected by record and the mask of its correspondence;

Step 206, to the data that will transmit, use IKE and SA of the IPSec of described record, obtain the outgoing data bag after using ipsec protocol encapsulation;

Step 208, the data in described outgoing data bag except IP packet header are carried out CRC computing, obtain CRC code;

Step 210, the mask of described record is used to carry out scrambling to CRC code;

Step 212, using the part behind described outgoing data bag removing IP packet header and the CRC code after scrambling as payload user data, after adding corresponding IP packet header, send, the IP packet header of wherein said correspondence comprise indicate in described outgoing data bag source, destination-address information;

Step 214, follow-up data send in, use IKE and SA and the mask of the IPSec of described record, rear transmission processed to data.

Meanwhile, present invention also offers a kind of VPN quick connecting method based on IPSec, it is characterized in that, comprise the following steps:

Step 202, initiation VPN connect before, IKE and SA of the n group IPSec related to during regulation communication next time between communicating pair, and be that IKE and SA often organizing IPSec arranges corresponding mask, the node of communicating pair stores the mask of this n group IKE and SA and its correspondence;

Step 204, reception IP packet, obtain the payload in packet;

Step 206, CRC check is carried out to payload, obtain the CRC code after verifying; Use each mask of described storage to carry out descrambling to the CRC code in the payload received successively, obtain the CRC code after descrambling; CRC code after more described verification is consistent with the CRC code after descrambling described in which;

If step 208 finds consistent, then record this mask, and according to this consistent mask, search IKE and SA that corresponding relation obtains corresponding IPSec, and record;

Step 210, in follow-up communication process, according to IKE and SA of IPSec and the mask of record, CRC check, descrambling, solution IPSec encapsulation are carried out to the packet received, completes session.

In the present invention, by determining used IPSec negotiation information in advance, and the mode of use safety transmits the mode of this information, avoid the complicated too much negotiations process in IPSec VPN connection procedure, whole communication process can not only be carried out in the environment of safety, and decrease unnecessary signal transmission, improve efficiency, obtain better Consumer's Experience.

Accompanying drawing explanation

In order to be illustrated more clearly in the technical scheme in the embodiment of the present invention, be briefly described to the accompanying drawing used required in embodiment or description of the prior art below, apparently, the accompanying drawing in the following describes is only some embodiments of the present invention.For those of ordinary skill in the art, under the prerequisite not paying creative work, other accompanying drawing can also be obtained according to these accompanying drawings.

Fig. 1 is the flow chart of the embodiment of the present invention one.

Fig. 2 is the flow chart of the embodiment of the present invention two.

Embodiment

For making object of the present invention, technical scheme and advantage clearly understand, below by specific embodiment and relevant drawings, the present invention will be described in further detail.

Embodiment one

The embodiment of the present invention one provides a kind of VPN quick connecting method based on IPsec, it is characterized in that, comprises the following steps:

Step 202, initiation VPN connect before, IKE and SA of the n group IPSec related to during regulation communication next time between communicating pair, and be that IKE and SA often organizing IPSec arranges corresponding mask, the node of communicating pair stores the mask of this n group IKE and SA and its correspondence;

IKE and SA of any one group of IPSec selects in step 204, session setup side, and IKE and SA of IPSec selected by record and the mask of its correspondence;

Step 206, to the data that will transmit, use IKE and SA of the IPSec of described record, obtain the outgoing data bag after using ipsec protocol encapsulation;

Step 208, the data in described outgoing data bag except IP packet header are carried out CRC computing, obtain CRC code;

Step 210, the mask of described record is used to carry out scrambling to CRC code;

Step 212, using the part behind described outgoing data bag removing IP packet header and the CRC code after scrambling as payload user data, after adding corresponding IP packet header, send, the IP packet header of wherein said correspondence comprise indicate in described outgoing data bag source, destination-address information;

Step 214, follow-up data send in, use IKE and SA and the mask of the IPSec of described record, rear transmission processed to data.

Embodiment two

Meanwhile, the embodiment of the present invention two additionally provides a kind of VPN quick connecting method based on IPsec, it is characterized in that, comprises the following steps:

Step 202, initiation VPN connect before, IKE and SA of the n group IPSec related to during regulation communication next time between communicating pair, and be that IKE and SA often organizing IPSec arranges corresponding mask, the node of communicating pair stores the mask of this n group IKE and SA and its correspondence;

Step 204, reception IP packet, obtain the payload in packet;

Step 206, CRC check is carried out to payload, obtain the CRC code after verifying; Use each mask of described storage to carry out descrambling to the CRC code in the payload received successively, obtain the CRC code after descrambling; CRC code after more described verification is consistent with the CRC code after descrambling described in which;

If step 208 finds consistent, then record this mask, and according to this consistent mask, search IKE and SA that corresponding relation obtains corresponding IPSec, and record;

Step 210, in follow-up communication process, according to IKE and SA of IPSec and the mask of record, CRC check, descrambling, solution IPSec encapsulation are carried out to the packet received, completes session.

Embodiment three

In embodiment one, before end session, generate and store IKE and SA of n group IPSec involved by next session and the mask of correspondence, as the messaging parameter carried out next time when IPSec VPN connects session, and send this n group information to session recipient.

Embodiment four

In embodiment two, before end session, receive IKE and SA of n group IPSec and the mask of correspondence that transmit leg sends, and to store, as messaging parameter when carrying out IPSec VPN connection session next time.

One of ordinary skill in the art will appreciate that all or part of flow process realized in above-described embodiment method, that the hardware that can carry out instruction relevant by mainframe program has come, described program can be stored in a main frame read/write memory medium, this program, when performing, can comprise the flow process of the embodiment as above-mentioned each side method.Wherein, described storage medium can be magnetic disc, CD, read-only store-memory body (Read-Only Memory, ROM) or random store-memory body (Random Access Memory, RAM) etc.

Above-listed preferred embodiment; the object, technical solutions and advantages of the present invention are further described; be understood that; the foregoing is only preferred embodiment of the present invention; not in order to limit the present invention; within the spirit and principles in the present invention all, any amendment done, equivalent replacement, improvement etc., all should be included within protection scope of the present invention.

Claims (4)

1., based on a VPN quick connecting method of IPSec, it is characterized in that, comprise the following steps:

Step 202, initiation VPN connect before, IKE and SA of the n group IPSec related to during regulation communication next time between communicating pair, and be that IKE and SA often organizing IPSec arranges corresponding mask, the node of communicating pair stores the mask of this n group IKE and SA and its correspondence;

IKE and SA of any one group of IPSec selects in step 204, session setup side, and IKE and SA of IPSec selected by record and the mask of its correspondence;

Step 206, to the data that will transmit, use IKE and SA of the IPSec of described record, obtain the packet after using ipsec protocol encapsulation;

Step 208, the data in described outgoing data bag except IP packet header are carried out CRC computing, obtain CRC code;

Step 210, the mask of described record is used to carry out scrambling to CRC code;

Step 212, using the part behind described outgoing data bag removing IP packet header and the CRC code after scrambling as payload user data, after adding corresponding IP packet header, send, the IP packet header of wherein said correspondence comprise indicate in described outgoing data bag source, destination-address information;

Step 214, follow-up data send in, use IKE and SA and the mask of the IPSec of described record, rear transmission processed to data.

2. method according to claim 1, it is characterized in that, before end session, generate and store IKE and SA of n group IPSec involved by next session and the mask of correspondence, as the messaging parameter carried out next time when IPSec VPN connects session, and send this n group information to session recipient.

3., based on a VPN quick connecting method of IPSec, it is characterized in that, comprise the following steps:

Step 202, initiation VPN connect before, IKE and SA of the n group IPSec related to during regulation communication next time between communicating pair, and be that IKE and SA often organizing IPSec arranges corresponding mask, the node of communicating pair stores the mask of this n group IKE and SA and its correspondence;

Step 204, reception IP packet, obtain the payload in packet;

Step 206, CRC check is carried out to payload, obtain the CRC code after verifying; Use each mask of described storage to carry out descrambling to the CRC code in the payload received successively, obtain the CRC code after descrambling; CRC code after more described verification is consistent with the CRC code after descrambling described in which;

If step 208 finds consistent, then record this mask, and according to this consistent mask, search IKE and SA that corresponding relation obtains corresponding IPSec, and record;

Step 210, in follow-up communication process, according to IKE and SA of IPSec and the mask of record, CRC check, descrambling, solution IPSec encapsulation are carried out to the packet received, completes session.

4. method according to claim 3, is characterized in that, before end session, receives IKE and SA of n group IPSec and the mask of correspondence that transmit leg sends, and to store, as messaging parameter when carrying out IPSec VPN connection session next time.