WO2009003404A1

WO2009003404A1 - A method and an apparatus for fast handover

Info

Publication number: WO2009003404A1
Application number: PCT/CN2008/071483
Authority: WO
Inventors: Guohui Zou; Bin Xia
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2007-06-29
Filing date: 2008-06-30
Publication date: 2009-01-08
Also published as: CN101335985A; CN101335985B

Abstract

A method and an apparatus for fast handover are disclosed in the present invention, the said method comprises steps: establishing a security association between a mobile node MN and an access router NAR of a target network; the said MN using the security association to perform the fast handover to access the said NAR. The corresponding system is also disclosed in the present invention. The present invention optimizes the procedure of generating the shared secret key during the fast handover by adjusting the parameters which are required by the generation of the secret key during the fast handover (i.e. establishing the security association between the mobile node and the NAR in advance), so as to ensure that the security mechanism does not impact the fast handover procedure when communicating data, and to make the handover procedure under the control of the network.

Description

Fast switching method and system

This application claims the priority of the Chinese Patent Application No. 200710123591. K, entitled "Safe and Fast Switching Method and System", which is incorporated herein by reference. in.

Technical field

The present invention relates to mobile communication technologies, and in particular, to a method and system for secure fast handover.

Background technique

The Mobile IP Version 6 (MIPv6, Mobile IP version 6) protocol is a mobile solution proposed by the Internet Engineering Task Force (IETF), which enables mobile nodes (MN, Mobile Node) to remain in the process of moving. Communication is not interrupted, but it also brings problems such as handover delay and security.

The MN cannot determine the time to send or receive a packet during the handover process. This period of time is called the switching delay. The main reasons for the handover delay are delays in link switching and the operation of the MIPv6 protocol, such as motion detection, new Care-of Address (CoA) configuration, and binding update. In real-time applications, such as handover delays in Voice over IP (VoIP), handover delays are often unacceptable.

The IETF's MIP working group defines the Fast Mobile IP (FMIP) protocol. The fundamental idea is to pre-configure related information to reduce handover delay and improve handover performance.

In the FMIP protocol, two types of switching are mainly defined, namely, a Predictive type switching and a Reactive type switching.

For predictive handover, the MN predicts the upcoming handover during the move and informs the original access router (PAR, Previous Access Router). The PAR obtains a new CoA used by the MN under the NAR through interaction with a new access router (NAR, New Access Router) or an access router (AR, Access Router) of the target network, thereby avoiding address configuration. The delay caused by the process. At the same time, the data packet sent by the MN to the PAR during the handover process is sent by the PAR to the NAR for buffering in the tunnel mode, which ensures that the MN can receive the data packet after switching to the new link and avoid the loss of the data packet.

If the MN moves too fast and the MN does not have time to complete the interaction process for obtaining a new CoA on the old link, the MN has arrived at the new link, and the handover in this case is called reactive handover. Although the above-described reactive type switching cannot reduce the switching delay, it is possible to avoid packet loss due to handover.

Currently, the MN and the AR use the authentication, authorization, and accounting (AAA, Authentication, Authorization and Accounting) server to establish a security alliance technical solution. The solution does not apply the above two handovers to the FMIP protocol, that is, in the handover. In the process, the integrity of the message is ensured by switching the key (HK, Handover Key), and the public key exchange between the MN and the NAR is completed under the protection of the FMIP protocol, so that the scheme for generating the shared key is not actually obtained. application.

The following describes the implementation process of switching key, fast switching in prediction mode, and fast switching in reactive mode.

The HK is used to generate the HK between the MN and the AR using the AAA-assisted key management protocol, which is used to protect the signaling messages of the FMIP protocol. Therefore, the key management protocol specifies the message exchange between the MN and the AR and the necessary premise. The protocol assumes that the Handover Master Key (HMK) is shared between the MN and the AAA server, and a security association exists between the AR and the AAA server. Under this assumption, as shown in FIG. 1 is a schematic diagram of a handover key generation process in the prior art, which specifically includes the following steps:

Step 101: First, the MN generates a handover integrity key (HIK, Handover Integrity Key) according to the HMK, and the formula is: HIK = gprf+ (HMK, "Handover Integrity Key"); Then, the MN sends a handover key request (ie, HK) – REQ) message to the AR, the message carrying the message ID, the pseudo-random function, the CoA, the random number nonce generated by the MN, the MN identity (MN ID), and the message authentication code (MAC, Message Authentication Code) generated using the HIK .

Step 102: After receiving the foregoing HK-REQ message, the AR forwards the message to the AAA server by using the AAA protocol to encapsulate the authentication, authorization, and accounting request (ie, AAARequest).

Step 103: After receiving the AAA Request message, the AAA server checks the correctness of the MAC carried in the AAA Request message by using the HIK calculated by itself. If the MAC address of the message is incorrect, the AAA server returns a message that the verification fails; otherwise, the AAA server sends a verification successful authentication, authorization, and accounting response (ie, AAAASPonse) message to the AR, which carries the HK and the AAA server generated HK and The random number nonce2 generated by the AAA server when the HK is generated. Among them, the formula for generating HK is: HK = gprf+ (HMK, MN nonce | AAA nonce I MN ID I AR ID I "Handover Key"). Step 104: After receiving the successfully verified AAARSPonse message, the AR intercepts the HK carried by the message, and then packages the rest of the message into a handover key response (ie, HK RSP) message, and sends the message to the MN, the HK RSP. The message also carries the message ID (consistent with HK-REQ), pseudo-random function, check success status information, Security Parameter Index (SPI), and integrity protection using the MAC generated by HK.

FIG. 2 is a schematic diagram of a fast switching process of a prediction mode in the prior art, which includes the following steps:

Step 201: The MN sends a Fast Binding Update (FBU) message to the PAR, where the message carries an MN Public Key (PK, Public Key) and a HK-REQ message, and the HK-REQ message uses between the MN and the PAR. The shared key HK generated MAC is integrity protected.

Step 202: After receiving the FBU message, the PAR first uses the HK calculated by itself to verify the correctness of the MAC. If the verification succeeds, the PAR sends a handover initiation (HI, Handover Initiate) message to the NAR, and the message carries the HK. – The MN PK is included in the REQ message.

Step 203: The NAR obtains the MN PK from the received HI message, and generates a HK RSP message carrying the NAR PK, and then sends the message to the PAR through a handover acknowledgement (HAck, Handover Acknowledgement) message.

Step 204: The PAR performs integrity protection using the MAC generated by the HK in the received HK RSP message, and sends it to the MN through a fast binding confirmation (FBAck, Fast Binding Acknowledgement).

Step 205: The MN performs correctness verification on the MAC of the received FBAck message. If the authentication passes, the MN adopts an asymmetric key mechanism, that is, uses the MN PK and the NAR PK to generate a shared key. When the MN enters the new link where the NAR is located, the MN sends a Fast Neighbor Advertisement (FNA) message to the NAR, and the message is integrity-protected using the MAC generated by the shared key, so that the MN completes the PAR to the NAR. Switch.

FIG. 3 is a schematic diagram of a fast switching process of a reaction mode in the prior art, which specifically includes the following steps:

Step 301: If the switching of the foregoing prediction mode fails, when the MN arrives at the new link where the NAR is located, the FNA sends an FNA message to the NAR, where the message carries the MN PK and the HK_REQ.

Step 302: After receiving the FNA message, the NAR sends the HK_REQ through the FBU message. For PAR, the message also carries the NAR PK.

Step 303: After receiving the FBU message, the PAR checks the MAC in the HK-REQ, and sends a FBAck message carrying the HK RSP to the NAR, where the message also carries the NAR PK.

Step 304: After receiving the HK RSP message, the NAR forwards the message to the UI. At this point, ΜΝ completes the switch from PAR to NAR.

According to the technical solution disclosed above, the prior art has the following drawbacks:

1. The prior art security mechanism does not completely generate a shared key according to the existing AAA architecture. This asymmetric key generation mechanism is different from the existing mechanism, which is not conducive to implementation; meanwhile, the sharing is generated. The calculation of the key is large, which will consume a large amount of computing resources of MN and AR;

2. During the handover process, the AAA server is completely agnostic to the shared key, which is not conducive to the operator's management of the MN handover;

3. In the fast handover of the existing prediction mode, if the MN does not receive the FBAck message sent by the PAR, the handover cannot be performed, and the computing resources of the shared key by the NAR are wasted;

4. In the fast switching of existing reaction modes, security issues will cause switching delays.

Summary of the invention

Embodiments of the present invention provide a method and system for secure fast handover, which establishes a security association between a mobile node and an access router of a target network to ensure secure fast handover and reduce handover delay.

The embodiment of the invention provides a method for fast switching, and the method includes the following steps:

Establishing a security alliance between the mobile node and the access router NAR of the target network;

The MN performs fast mobile handover using the security association to access the NAR.

In addition, the embodiment of the present invention further provides a fast handover system, where the system includes: a security association establishing unit, configured to establish a security association between the mobile node and the access router NAR of the target network;

a security protection execution unit, configured to use the security association to enable the mobile node to access the

NAR.

According to the foregoing solution, the embodiment of the present invention establishes a security association (such as a shared switching key, a switching key, and the like) between the mobile node and the access router of the target network before the handover of the mobile node, and switches to the target network. Afterwards, the above security alliance is used to ensure that the mobile node is securely connected to the target network. Access router. That is, by adjusting the parameters required for key generation in the handover process, the generation process of the shared key is optimized, thereby reducing the impact of the security mechanism on fast handover, reducing the handover delay, and ensuring that the handover process is controllable in the network. Inside.

DRAWINGS

1 is a schematic diagram of a process of generating a handover key in the prior art;

2 is a schematic diagram of a fast switching process of a prediction mode in the prior art;

3 is a schematic diagram of a fast switching process of a reaction mode in the prior art;

4 is a flowchart of a method for secure fast handover according to an embodiment of the present invention;

FIG. 5 is a schematic diagram of a fast switching process of a prediction mode according to Embodiment 1 of the present invention; FIG.

6 is a schematic diagram of a fast switching process of a prediction mode according to Embodiment 2 of the present invention;

7 is a schematic diagram of a fast switching process of a reaction mode according to Embodiment 3 of the present invention;

8 is a schematic flowchart of a fast switching mode of a prediction mode according to Embodiment 4 of the present invention;

9 is a schematic diagram of a fast switching process of a prediction mode according to Embodiment 5 of the present invention;

10 is a schematic diagram of a fast switching process of a reaction mode according to Embodiment 6 of the present invention;

11 is a schematic flowchart of a fast switching mode of a prediction mode according to Embodiment 7 of the present invention;

FIG. 12 is a schematic diagram of a fast switching process of a prediction mode according to Embodiment 8 of the present invention.

detailed description

BRIEF DESCRIPTION OF THE DRAWINGS The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without departing from the inventive scope are the scope of the present invention.

FIG. 4 is a flowchart of a method for secure fast handover according to an embodiment of the present invention, which specifically includes the following steps:

Step 401: Establish a security association between the mobile node and the access router of the target network before the fast handover;

Step 402: In the fast handover process of the mobile node, the security association is used to ensure that the mobile node securely switches to the access router.

In the embodiment of the present invention, before the mobile node switches, a security association (such as a shared switching key, a handover key, and the like) between the mobile node and the access router of the target network is established, and after switching to the target network, The above-mentioned security alliance is used to ensure that the above mobile node securely accesses the access router of the target network. That is, by adjusting the parameters required for key generation in the handover process, the generation process of the shared key is optimized, thereby reducing the impact of the security mechanism on fast handover, reducing the handover delay, and ensuring that the handover process is controllable in the network. Inside.

FIG. 5 is a schematic diagram of a fast switching process of a prediction mode according to Embodiment 1 of the present invention. Compared with the prior art, the MN in the embodiment of the present invention completes the handover preparation with the multiple candidate ARs before determining the handover target, and specifically includes the following steps:

Step 501: The MN obtains an identifier (AP-ID, Access Point-Identifier) of the surrounding access point, and then sends a message requesting RX (RtSolPr, Router Solicitation for Proxy Advertisement) message to the PAR to obtain a message corresponding to the target AP-ID. AR information.

Step 502: After receiving the RtSolPr message, the PAR sends a proxy routing advertisement (PrRtAdv, Proxy Router Advertisement) message to the MN, where the PAR includes the AR information corresponding to the target AP-ID.

Step 503: After receiving the foregoing PrRtAdv message, the MN sends a HK_REQ message to all NARs, where the message carries the message ID, the pseudo-random function, the CoA, the random number nonce generated by the MN, the MN ID, and the MAC generated by using the HIK. Sex protection, where the MN ID may be a Media Access Control Identifier (MAC ID) of the mobile node, or a Net Access Identifier (NAI). This message uses the original security association between the MN and AAA for integrity protection.

There are three ways to send the above HK-REQ messages to NAR:

1. The source address is used as the original care-of address (pCoA, previous Care-of Address), and the destination address is sent in the form of a data packet of the NAR address. The method can be used in a simple IP network.

2. Sended by nested Internet Protocol (IP-in-IP), the external IP address is the pCoA and PAR address of the MN, and the internal IP address is the pCoA and NAR address of the MN respectively. This method can be used for the multicast Internet protocol. (MIP, Multicast Internet Protocol) in the network;

3. The destination address subheader is used to indicate the IP packet destination. The IP header address is the MN's pCoA and PAR addresses respectively. After receiving the IP packet, the PAR reconstructs the IP packet with the destination address subheader as the destination address, and Send it to the address represented by the destination address sub-header (that is, the NAR address). This method can be used in the MIP network. Step 504: After receiving the above HK-REQ message, the NAR encapsulates the HK-REQ message and forwards it to the AAA server.

Step 505: After receiving the AA REQ message, the AAA server verifies the MAC correctness of the encapsulated HK-REQ message, and sends an authentication authorization response (AA RSP) message carrying the verification result to the NAR. If the verification is passed, the AA RSP message carries a new handover key (nHK, new Handover Key) between the MN and the NAR.

Step 506: The NAR records the identity of the MN (such as the MAC_ID) and the nHK, and sends a HK-RSP message to the MN, indicating that the security association is successfully established.

Step 507: When determining to perform fast handover, the RP sends an FBU message to the PAR, and the message is completed by using a message authentication code (pHK-MAC) generated by the original handover key (pHK, previous Handover Key) shared by the MN and the PAR. Sexual protection.

Step 508: PAR verifies the correctness of the above pHK-MAC. If the verification passes, PAR and NAR complete the interaction between the HI message and the HAck message (not shown), and the PAR sends the FBAck message carrying the pHK-MAC to the MN.

Step 509: After the MN arrives at the new link, it sends an FNA message to the NAR, where the message carries

MN's identity, and use nHK to generate MAC for integrity protection. At this point, the MN completes the fast handover process from PAR to NAR.

It can be seen from the above steps that the technical solution of the first embodiment can be implemented in two phases: Before the MN determines the handover target, the MN attempts to perform a key interaction process with all the NARs related to the AR information provided by the PrRtAdv message, and then accesses the AAA by the NAR. The server completes the establishment of the security association; after the MN determines the handover target, the MN protects the FBU message with the original security association and protects the FNA message with the corresponding new security association. It can be seen that this embodiment reduces the handover delay in the handover process since the security association has been established before the handover.

It can be further understood that the embodiment of the present invention may be further modified to: add the configuration of the MN and NAR information to the new care-of address (nCoA) in steps 503 and 506. This ensures the uniqueness of the nCoA in the HI/HAck interaction message between the PAR and the NAR, thereby avoiding handover delays that may be caused by nCoA collisions.

FIG. 6 is a schematic diagram of a fast switching process of a prediction mode according to Embodiment 2 of the present invention. Steps 601 to 602 and steps 607 to 609 of the embodiment of the present invention are the same as the corresponding steps in the first embodiment: Step 603: After receiving the foregoing PrRtAdv message, the MN sends a HK-REQ message to the PAR, where the identity carried by the message may be the MAC ID of the mobile node, or the NAI. This message uses the original security association between the MN and AAA for integrity protection.

The above three manners of sending the HK-REQ message to the NAR are the same as those in the first embodiment, and are not described again. Step 604: After receiving the above HK-REQ message, the PAR passes the authentication authorization request (AA)

The REQ) message encapsulates it and forwards it to the AAA server.

Step 605: After receiving the AA REQ message, the AAA server verifies the MAC correctness of the encapsulated HK-REQ message, and sends an authentication authorization response (AA RSP) message carrying the verification result to the PAR. If the verification is passed, the AARSP message carries a new handover key (nHK, new Handover Key) between the MN and the NAR.

Step 605: The AAA server sends an AA RSP message to the NAR, where the message carries the handover key nHK between the MN and the NAR.

Step 606: The PAR records the identity of the MN and the nHK, and sends the HK-RSP message to the MN, indicating that the security association is successfully established.

It can be seen from the above steps that the difference between the second embodiment and the first embodiment is that the key interaction process between the MN and the NAR is performed by the MN indirectly interacting with the AAA server (through the PAR, and the NAR is not involved), and then the AAA server. The key generated for each NAR is delivered to each NAR. Therefore, when the MN needs to establish a security association with multiple NARs, the MN and the AAA server only need to complete an interaction process, which saves signaling overhead.

If the fast handover procedure shown in the foregoing prediction mode embodiment is not successfully completed, the first embodiment is used as an example, that is, only the establishment of the first-stage security alliance is completed, and the MN does not have time to send the FBU message to the PAR to reach the NAR. The new link, then, the switching mode will be converted from the prediction mode in the first embodiment to the reaction mode.

FIG. 7 is a schematic diagram of a fast switching process of a reaction mode according to Embodiment 3 of the present invention. The embodiment of the present invention is based on the first stage of the foregoing prediction mode embodiment (that is, the establishment of the security association is completed). Since the MN does not send the FBU message to the PAR before reaching the new link where the NAR is located, the MN does not enter the response mode. The specific steps are as follows:

Step 701: The MN has not accessed the NAR by sending a FBU message to the PAR, and the MN actively sends an UNA (Unsolicited Neighbor Advertisement) message to the NAR, such as If the MN knows nHK before sending the message, the message is integrity protected by the MAC generated by nHK; if the MN does not know nHK, then integrity protection is not performed.

Step 702: The MN sends an FBU message to the PAR, where the message carries the pCoA, and uses the MAC generated by the PHK for integrity protection. Since the MN has reached the new link where the NAR is located, the message may use the source address as nCoA. The IP message with the address PAR is sent.

Step 703: After receiving the FBU message, the PAR performs correctness verification on the pHK-MAC, and sends an FBAck message carrying the verification result to the MN. Since the MN has arrived at the new link where the NAR is located, the message may be used. The IP address of the source address is nCoA and the destination address is MN. At the same time, PAR forwards the buffered data destined for pCoA to the MN's nCoA through the IP-in-IP tunnel.

FIG. 8 is a schematic diagram of a fast switching process of a prediction mode according to Embodiment 4 of the present invention. Compared with the prior art, in the embodiment of the present invention, before the MN determines the handover target, the PAR first obtains the AAA nonce of the AAA server, and prepares for the subsequent handover, which includes the following steps:

Step 801: The PAR learns that the MN is about to switch by using a link layer trigger (for example, a media-independent handover in IEEE 802.21, a MIH-MN-Candidate-Query request message), but no A clear handover target. At this point, the PAR sends an AAAREQ message to the AAA server requesting to obtain an AAAnonce. In practical applications, this step should occur after the PAR sends a PrRtAdv message to the MN, before the MN sends an FBU message to the PAR.

Step 802: After receiving the AAA REQ message, the AAA server sends the generated AAA RSP message to the PAR, where the message carries the AAA nonce and its corresponding AAA nonce index. After the PAR receives the message, The AAA nonce extracted from it and its corresponding AAA nonce Index are saved.

Step 803: When the MN decides to perform fast handover, the MN sends an FBU message to the PAR, and the message carries the requesting AAA server to generate nHK_Req of nHK, and uses the pHK MAC generated by the pHK for integrity protection.

Step 804: The PAR verifies the correctness of the MN's pHK-MAC. If the verification succeeds, the HI message is sent to the NAR, and the message carries the nHK-Req and the AAAnonce Index. The HI message must be encrypted and protected. The specific encryption is the same as the prior art, and is not mentioned here.

Step 804: The PAR sends an acknowledgement message FAck of the FBU to the MN, and the message carries the AAA. Nonce, and pHK-MAC generated by pHK for integrity protection. The MN verifies the correctness of the pHK-MAC of the message. If the verification passes, the following formula can be used to generate nHK.

nHK = gprf+ (HMK,匪 nonce | AAA nonce|匪 ID | AR ID | "Handover Key")

Step 805: After receiving the HI message, the NAR obtains the nHK_Req carried in the message, and generates an AAA REQ message to be sent to the AAA server, where the message carries the AAA nonce Index. At the same time, in step 805, the NAR sends a HAck message to the PAR.

Step 806: After receiving the HAck message, the PAR sends an FBAck message to the MN, and uses the pHK-MAC generated by the pHK for integrity protection.

Step 806: After receiving the AAA REQ message carrying the AAA nonce index, the AAA server queries the corresponding AAA nonce through the index, generates nHK according to the formula in step 804, and then sends an AAA RSP message carrying the nHK to the NAR.

Step 807: When the MN arrives at the new link where the NAR is located, it sends an FNA message to the NAR, and the message uses the MAC generated by the nHK for integrity protection. At this point, the MN completes the fast handover process from PAR to NAR.

If the fast handover procedure shown in the embodiment of the present invention is not successfully completed, that is, the MN does not send the FBU message to the PAR before reaching the new link where the NAR is located, and then proceeds to the reaction mode. For the specific implementation, refer to Embodiment 3 of the present invention.

In the embodiment of the present invention, the PAR obtains the AAA nonce parameter from the AAA, and returns the AAA nonce parameter through an acknowledgement message after the MN sends the FBU, so that the MN can generate the fast binding confirmation FBAck without receiving the fast binding confirmation FBAck. New switching key, complete the switching process, reduce switching delay

FIG. 9 is a schematic diagram of a fast switching process of the prediction mode in the fifth embodiment. In the embodiment of the present invention, when the MN decides to switch, the establishment of the temporary security alliance with the target NAR is completed, thereby implementing a secure and fast handover.

The preparation before the MN decides to switch includes the following steps:

First, the MN and the PAR generate a HK according to the switching key generation process of the prior art;

Then, MN and PAR respectively derive a standard handover key (SHK, Standard Handover Key) and a temporary handover key (THK, Temporary Handover Key), and the calculation formulas of the two are as follows: SHK = gprf(HK,匪pCoA| PAR IP| "normal handover key")

THK = gprf (HK, 丽 pCoA | NAR IP| "temporary handover key")

The embodiment of the invention specifically includes the following steps:

Step 901: When the MN decides to perform fast handover, the MN sends an FBU message to the PAR, and the message uses the MAC generated by the SHK for integrity protection.

Step 902: After receiving the FBU message, the PAR performs correctness verification on the MAC. If the verification succeeds, the PAR sends an HI message to the NAR, where the message carries the THK. The HI message must be encrypted. The encryption technology is the same as the prior art and will not be described here.

Step 903: After receiving the HI message, the NAR extracts the THK from the message and sends a HAck message to the PAR.

Step 904: After receiving the HAck message, the PAR sends an FBAck message to the MN, and the message uses the SHK to generate a MAC for integrity protection.

Step 905: After the MN arrives at the new link where the NAR is located, the MN sends an FNA message to the NAR, and the message uses the MAC generated by the THK for integrity protection. At this point, the MN completes the fast handover process from PAR to NAR.

Step 906: After the handover process ends, the MN or PAR immediately acquires the new SHK and THK through the handover key generation process shown in the prior art for the next handover.

It can be seen from the above steps that the embodiment of the present invention adds the key generation hierarchy of SHK and THK based on the existing handover key generation technology, wherein SHK is used to establish a security association between MN and PAR, and THK is transmitted by PAR. The NAR is used to establish a temporary security association between the MN and the NAR.

If the fast handover procedure shown in the embodiment of the present invention is not successfully completed, that is, the MN and the PAR complete the calculation process of the SHK and the THK, but the MN does not have time to send the FBU message to the PAR and has arrived at the new link where the NAR is located, then, the handover The mode will be converted from the prediction mode in the fifth embodiment to the corresponding reaction mode.

FIG. 10 is a schematic diagram of a fast switching process of a reaction mode according to Embodiment 6 of the present invention. Embodiments of the present invention include the following steps:

Step 1001: The MN sends an UNA message to the NAR. Optionally, the message is generated using THK The MAC is integrity protected.

Step 1002: The MN sends an FBU message to the PAR, where the message carries the pCoA, and uses the pHK-MAC generated by the PHK for integrity protection. Since the MN has reached the new link where the NAR is located, the message can be sourced with nCoA, The IP address of the destination address is PAR.

Step 1003: After receiving the FBU message, the PAR performs correctness verification on its pHK-MAC. If the verification succeeds, the FBAck message carrying the verification result is sent to the MN. Since the MN has arrived at the new link where the NAR is located, the message can be sent by using an IP message whose source address is nCoA and whose destination address is MN. At the same time, the PAR forwards the buffered data destined for the pCoA to the MN's nCoA through the IP-in-IP tunnel. At this point, the MN completes the fast handover process from PAR to NAR.

Step 1004: After the handover process ends, the MN or NAR will initiate a new HK generation process, and the MN and the PAR respectively derive SHK and THK.

It can be seen that the embodiment of the present invention is relatively easy to implement. Because the symmetric key mechanism is completely used, the calculation amount is small, and the computing resources are saved. In addition, in the handover process, the MN can be completed without accessing the AAA server. The authorization of the handover ensures that after the FNB message is sent on the original link, the MN should not cause handover delay or handover failure for security reasons, nor increase the probability of switching from predictive handover to reactive handover.

FIG. 11 is a schematic diagram of a fast switching process of the prediction mode in the seventh embodiment. In the embodiment of the present invention, after the MN decides to perform the handover, multiple security associations are established with the target NAR in succession to ensure that one of the multiple keys generated by the MN is valid during the handover process, thereby implementing security. Fast switching.

First, define the shared key between MN and NAR: nHK, and nHK.

Among them, the calculation formula of nHK is as follows:

Formula 111:

nHK' = gprf + (HMK, solid nonce | MN ID | AR ID | "Handover Key") Equation 112:

nHK = prf(nHK', NAR nonce)

Embodiments of the present invention include the following steps:

Step 1101: When the MN decides to perform fast handover, send an FBU message to the PAR, where the message carries the nHK_Req requesting the AAA server to generate nHK, and uses the pHK-MAC generated by the pHK. Integrity protection.

Step 1102: The PAR verifies the correctness of the pHK-MAC of the MN. If the verification succeeds, the HI message carrying the nHK_Req is sent to the NAR. The message must be cryptographically protected. The specific encryption is the same as the prior art and will not be described here.

Step 1103: After receiving the HI message, the NAR obtains the nHK_Req carried in the message, and generates an AAA REQ message to be sent to the AAA server, where the message carries the NAR nonce. At the same time, in step 1103, the NAR sends a HAck message to the PAR, which carries the NAR nones for generating nHK.

Step 1104: After receiving the HAck message, the PAR sends an FARck message carrying the NAR nonce to the MN, and uses the pHK-MAC generated by the pHK for integrity protection.

Step 1104: After receiving the AAAREQ message carrying the NAR nonce, the AAA server generates ηΗΚ according to the formula 111, and sends an AAA RSP message carrying the nHK to the NAR. After receiving the message, the NAR generates nHK according to formula 112.

Step 1105: When the MN arrives at the new link where the NAR is located, if the MN receives the FBAck message sent by the PAR, and uses the NAR nonce in the message and the formula 112 to generate the nHK, the FNA message sent by the MN to the NAR does not carry the FBU, and is used. The MAC generated by the nHK performs integrity protection (as shown in FIG. 11); if the MN does not receive the FBAck message sent by the PAR, and generates ηΗΚ' according to the formula 111, the FNA message sent by the MN to the NAR carries the FBU, and uses nHK, The generated MAC is integrity protected (not shown in Figure 11). Correspondingly, the NAR determines whether the MN has received the FBAck according to whether the FNA is carried in the received FNA. If the FNA message received by the NAR carries the FBU, the NAR considers that the MN does not receive the FBAck message, and therefore uses the MAC generated by nHK'. The FBU's MAC is correctly verified. If the FNA message received by the NAR does not carry the FBU, the NAR considers that the MN has received the FBAck message, and therefore uses the MAC generated by the nHK to perform the correctness-risk on the FBU's MAC. At this point, the MN completes the fast handover process from PAR to NAR.

According to the foregoing steps, in the embodiment of the present invention, the MN performs message exchange with the NAR via PAR to generate a first handover key nHK, and a second handover key nHK; and the NAR receives the first handover key η generated by the AAA server. And generating a second handover key nHK accordingly, thereby establishing two security associations between the MN and the NAR. When the MN decides to switch, the MN sends an FNA to the NAR. The message, NAR determines the content of the message and decides which switch key to use. Therefore, the embodiment of the present invention avoids the handover problem caused by the FBAck message in the prior art, and ensures fast and secure handover.

If the fast handover procedure shown in the embodiment of the present invention is not successfully completed, that is, the MN does not send an FBU message to the PAR before the new link where the NAR is located, the handover mode is converted into the response mode by the prediction mode of the embodiment of the present invention, and the specific The implementation is similar to the third embodiment of the present invention, except that the UNA message sent by the MN to the NAR is integrity protected using the MAC generated by nHK'. The NAR determines which key (nHK or ηΗΚ') the MAC used to verify its correctness is determined by judging the UNA flag. The NAR can also use the two keys (nHK or ηΗΚ') to generate the MAC-to-UNA message. For correctness verification, the corresponding key verified will be used as the shared key between the NAR and the MN.

The embodiment of the present invention can also be divided into two phases: In the first phase, before the MN decides to switch the target, the PAR first acquires the random number of the AAA server (AAA nonce); in the second phase, after the MN decides to switch the target, the MN and the MN The target NAR establishes multiple security alliances in succession to ensure that one of the multiple keys generated by the MN is valid during the handover process, thereby achieving secure fast handover.

FIG. 12 is a schematic diagram of a fast switching process of a prediction mode in Embodiment 8. The first stage of the embodiment of the present invention is the same as the fourth embodiment of the present invention, and the steps 1201 to 1204 are the same as the steps 801 to 804. The second phase of the embodiment of the present invention specifically includes the following steps:

Step 1205': After receiving the HI message, the NAR obtains the nHK_Req carried in the message, and generates an AAA REQ message to be sent to the AAA server, where the message carries the AAA nonce Index. At the same time, in step 1205, the NAR sends a HAck message to the PAR.

Step 1206: After receiving the HAck message, the PAR sends an FBAck message carrying the AAA nonce to the MN, and uses the pHK-MAC generated by the pHK for integrity protection.

Step 1206, after receiving the AAA REQ message, the AAA server queries the corresponding AAA nonce through the Index, generates ηΗΚ' according to the formula 111, and then sends and carries nHK, and

AAA nonce AAA RSP message to NAR. After receiving the message, the NAR generates nHK: according to Equation 112.

Step 1207: When the MN arrives at the new link where the NAR is located, if the MN receives the PAR transmission If the FBAck message is sent, the FNA message sent by the MN to the NAR is integrity-protected using the MAC generated by the nHK. If the MN does not receive the FBAck message sent by the PAR, the FNA message sent by the MN to the NAR is completed using the MAC generated by nHK'. Sexual protection. Correspondingly, if the FNA message received by the NAR carries the FBU, the NAR considers that the MN does not receive the FBAck message, and therefore uses the generated MAC to verify the correctness of the FBU's MAC; if the NAR receives the FNA message, Carrying the FBU, the NAR considers that the MN has received the FBAck message, and therefore uses the MAC generated by nHK to perform correctness-risk on the MAC of the FBU. At this point, the MN completes the fast handover process from PAR to NAR.

If the fast handover procedure shown in the embodiment of the present invention is not successfully completed, that is, the MN does not send an FBU message to the PAR before the new link where the NAR is located, the handover mode is converted into the response mode by the prediction mode of the embodiment of the present invention, and the specific The implementation is the same as that of the sixth embodiment of the present invention.

In the embodiment of the present invention, by adding the MN and the NAR to configure the nCoA information, the uniqueness of the nCoA in the HI/HAck interaction message between the PAR and the NAR can be ensured, thereby avoiding the handover delay that may be caused by the nCoA collision.

In addition, an embodiment of the present invention further provides a system for secure fast handover, where the system includes: a security alliance establishing unit and a security protection executing unit. The security association establishing unit is configured to establish a security association between the mobile node and the access router NAR of the target network before the fast handover; the security protection execution unit is configured to use the security association to access the mobile node. To the NAR.

Preferably, the security association establishing unit includes one or more units in the first type of security alliance establishing unit, the second type of security alliance establishing unit, the third type of security alliance establishing unit, and the fourth type of security alliance establishing unit:

The first type of security association establishing unit is configured to perform a key interaction between the mobile node and the at least one NAR to generate a security association, and the NAR interacts with the AAA server to complete the establishment of the security association. Or the MN performs information exchange with the AAA server through the PAR, and the AAA server generates an security association corresponding to the at least one NAR, and sends the security association to the NAR to complete the establishment of the security association;

The second type of security association establishing unit is configured to obtain, in advance, the key information required by the mobile node to generate a key, and return the key information by using a confirmation message after the mobile node sends the fast binding update message. The mobile node generates a handover key according to the key information, and completes the security alliance. Establishment

The third type of security association establishing unit is configured to calculate a standard handover key and a temporary handover key between the mobile node and the PAR before the fast handover; when the mobile node needs to switch, the PAR is in the handover trigger message Transmitting the temporary handover key to the NAR, establishing a security association between the mobile node and the NAR;

The fourth type of security association establishing unit is configured to obtain key information required for generating a key from the mobile node through message interaction between the PAR and the NAR, and generate first and second handovers before the fast change The AAA server generates a first switching key according to the received key request message, and feeds back the generated result to the NAR, and the NAR generates a second switching key according to the key information to complete multiple security alliances. The establishment of.

For details of the functions and functions of the above-mentioned four types of security associations, see the corresponding functions and functions in the above embodiments, which are not mentioned here.

That is to say, the security association establishing unit is responsible for establishing an security association before the handover occurs, and the security association establishment process may need to send and receive messages independently, or may be sent together with other messages; the security protection execution unit first needs to be established from the security association. The unit obtains the key, and then uses the key to perform integrity protection (ie, calculating the message authentication code) on the signaling message required for fast handover, and sends the message authentication code together with the message. At the same time, it is responsible for triggering various fast switching related messages, and provides message content and is responsible for sending and receiving messages.

The above is only a preferred embodiment of the present invention, and it should be noted that those skilled in the art can also make several improvements and retouchings without departing from the principles of the present invention. It is considered as the scope of protection of the present invention.

Claims

Rights request

A method for fast switching, characterized in that it comprises:

Establishing a security association between the mobile node MN and the access router NAR of the target network; the MN uses the security association to perform fast mobile handover and access to the NAR.

The method according to claim 1, wherein the establishing a security association between the MN and the NAR comprises:

The MN performs key interaction with at least one NAR;

The NAR acquires a new handover key between the NAR and the MN from the AAA server.

3. The method of claim 2, wherein

The process of obtaining the new handover key between the NAR and the MN by the NAR is: the NAR receives a handover key request message sent by the MN, where the handover key request message includes an identity of the MN, and Performing integrity protection by using a first message authentication code generated by a key between the MN and the AAA server;

The NAR forwards the key switch request message to an AAA server;

The NAR receives a verification message that is sent by the AAA server and includes the new handover key; the NAR records the new handover key and an identity of the MN, and sends a handover key response message to the MN. ;

Or,

The process of the NAR acquiring the new handover key between the NAR and the MN from the AAA server is: the source network access router PAR receives the handover key request message sent by the MN, and sends the handover key request message to the AAA. a server, where the handover key request message includes an identity of the MN, where the message uses the first message authentication code for integrity protection;

And if the AAA server verifies that the first message authentication code is correct, sending the new handover key to the PAR and the NAR;

The PAR sends a handover key response message carrying the new handover key to the MN.

The method according to claim 3, wherein the method for the MN to send the handover key request message is specifically:

Sending with a packet whose source address is the original care-of address and whose destination address is the address of the NAR; or, by means of a nested Internet protocol; or The destination address subheader is used as the destination address of the IP packet.

The method according to claim 3, wherein, for the fast switching of the prediction mode, the specific process for the MN to access the NAR by using the security association is:

Sending, by the MN, a fast binding update message to the PAR, where the message is integrity protected by using a second message verification code generated by the original switching key between the MN and the PAR;

And if the PAR verifies that the second message verification code is correct, sending, to the MN, a fast binding acknowledgement message carrying the second message authentication code;

The MN sends a fast neighbor advertisement message to the NAR, and uses the third message authentication code generated by the new handover key to perform integrity protection.

The method according to claim 3, wherein the handover request message sent by the NAR receiving MN and the handover key response message sent by the NAR to the MN both include a new care-of address of the MN.

Before the MN decides to switch, the PAR obtains the key information required by the MN to generate a key from the AAA server.

The method according to claim 7, wherein, for the fast switching of the prediction mode, the method is specifically:

When a handover occurs, the MN sends a fast binding update message carrying a handover key request to the PAR, and the message is integrity using a third message verification code generated by the original handover key between the MN and the PAR. Protection

And if the PAR verifies the third message verification code, the handover initiation message carrying the handover key request and the AAA random number index is sent to the NAR, and the fast binding update acknowledgement message carrying the AAA random number is sent to the MN, where the message is sent. Performing integrity protection by using the third message verification code; if the MN verifies the third message verification code, generating a new handover key according to the AAA random number;

The NAR sends the handover key request and the AAA random number index to an AAA server;

The NAR receives the new handover key sent by the AAA server.

9. The method according to claim 1 or 3 or 7, wherein, for the reaction mode, the process by which the MN accesses the NAR by using the security association is:

The MN sends an active neighbor advertisement message to the NAR, where the message is not integrity protected, or the fourth message verification code generated by using the new handover key is used for integrity protection;

The MN sends a fast binding update message to the PAR, and uses the original switching key fifth message verification code between the MN and the PAR for integrity protection;

If the PAR verifies that the fifth message verification code is correct, a fast binding acknowledgement message is sent to the MN.

The method according to claim 1, wherein the process of establishing a security association between the MN and the NAR comprises:

Calculating a standard switching key and a temporary switching key between the MN and the PAR;

When the MN wants to perform handover, the MN acquires a temporary handover key from the PAR to establish the security association.

The MN sends a handover key request message to the AAA server through the NAR;

The NAR receives the first handover key sent by the AAA server, and generates a second handover key according to the first handover key.

12. The method of claim 11, wherein the process of the MN sending a handover key request message to the AAA server by using the NAR is specifically:

The MN sends a fast binding update message carrying the handover key request message to the PAR, and performs integrity protection using the sixth message authentication code generated by the original handover key between the MN and the PAR; The sixth message authentication code is verified, and the switching key request message is sent to the NAR;

The NAR sends an AAA request message carrying a handover key request and a random number of the NAR to the AAA server.

13. The method of claim 12, wherein

For the fast switching of the prediction mode, the process in which the MN accesses the NAR by using the security association is: When the MN arrives at the NAR, if the fast binding acknowledgement message is received, the neighbor message is integrity-protected using the verification message code generated by the second key, otherwise, the verification message code generated by using the first handover key is used. Completely protect neighbor advertisement messages; or,

For the fast switching of the response mode, the process in which the MN accesses the NAR by using the security association is:

The MN sends an active neighbor advertisement message to the NAR, where the message is not integrity protected, or the message verification code generated by the first handover key is used for integrity protection;

Sending, by the MN, a fast binding update message to the PAR, and performing integrity protection by using the sixth message verification code;

If the PAR verifies that the sixth message verification code is correct, the MN confirms the message quickly.

14. A fast switching system, comprising:

a security association establishing unit, configured to establish a security association between the mobile node and the access router NAR of the target network;

And a security protection execution unit, configured to use the security association to quickly move the mobile node to the NAR.

The system according to claim 14, wherein the security association establishing unit comprises one or more of the following units:

The first type of security association is configured to perform a key interaction between the MN and the at least one NAR to generate a security association, and the NAR interacts with the AAA server to complete the establishment of the security association; The MN performs information exchange with the AAA server through the PAR, and the AAA server generates a security association corresponding to the at least one NAR, and sends the security association to the NAR to complete the establishment of the security association.

The second type of security association establishing unit is configured to obtain the key information required by the mobile node to generate a key before the fast handover, and return the key information by using the confirmation message after the mobile node sends the fast binding update message. The node generates a switching key according to the key information, and completes establishment of the security association;

A third type of security association establishing unit is configured to calculate a standard handover key and a temporary handover key between the mobile node and the PAR before the fast handover; when the mobile node needs to switch, the PAR is switched. Sending the temporary handover key to the NAR in the trigger message, establishing a security association between the mobile node and the NAR;

a fourth type of security association establishing unit, configured to obtain key information required for generating a key from the mobile node through a message interaction between the PAR and the NAR, and generate first and second switching keys before the fast change The AAA server generates a first switching key according to the received key request message, and feeds back the generated result to the NAR, and the NAR generates a second switching key according to the key information to complete establishment of multiple security associations. .