CN100544247C - The negotiating safety capability method - Google Patents
The negotiating safety capability method Download PDFInfo
- Publication number
- CN100544247C CN100544247C CNB2004100057398A CN200410005739A CN100544247C CN 100544247 C CN100544247 C CN 100544247C CN B2004100057398 A CNB2004100057398 A CN B2004100057398A CN 200410005739 A CN200410005739 A CN 200410005739A CN 100544247 C CN100544247 C CN 100544247C
- Authority
- CN
- China
- Prior art keywords
- terminal
- message
- registration
- soft switch
- security capabilities
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related
Links
Images
Abstract
The present invention discloses a kind of negotiating safety capability method, is applied in the next generation network, comprises the steps: that mainly a) terminal sends login request message to soft switch; B) soft switch sends authentication request message to authentication center; C) authentication center authenticates terminal, and carries out negotiating safety capability by terminal and soft switch, and after negotiation was passed through, terminal and soft switch communicated according to the security capabilities that consults.The present invention is owing to realize negotiating safety capability in the authentication registration process, negotiating safety capability is not subject to concrete NGN network application agreement, it is a kind of method in common, therefore, applied range, extensibility is stronger, and it is simple also to have interaction flow simultaneously, the efficient advantage of higher of negotiating safety capability.
Description
Technical field
Safety management technology in the present invention relates to communicate by letter refers to the negotiating safety capability method among a kind of NGN of being applied to (next generation network) especially.
Background technology
NGN is the network architecture that the comprehensive opening of miscellaneous services such as comprising speech, data and multimedia can be provided, for the user provides real-time session service.Its network equipment is made up of a spot of nucleus equipment and a large amount of user terminals, in the network except with being based on circuit mode alternately of PSTN/PLMN the comparison safety, mutual between other network equipment all is based on packet core network and various packet access network transmits.On open IP network, the NGN network very easily is subjected to a large amount of block terminal of existing in the various illegal attacks, particularly NGN network, is easy to become the promoter of rogue attacks.
At the NGN network security, solution preferably not also at present, and how combining, a blank especially with the characteristics of NGN network as the negotiating safety capability process on network security basis.Only defined key agreement mechanism in the prior art, adopt IKE (internet key exchange), TLS (Transport Layer Security) to adopt the Handshake Protocol that defines in the TLS standard to carry out the negotiation of key, cryptographic algorithm parameter etc. as IPSec (IP Security), but go back neither one complete safe capability negotiation scheme.And along with the continuous development of security solution, having more security solution occurs, even adopt with a kind of security solution, its cryptographic algorithm, parameter etc. also can constantly be expanded, need the mechanism of a kind of dynamic negotiation and flexible expansion, while, this mechanism also needed to take into full account the characteristics of NGN network owing to the diversity of the rich and user access of the business of NGN network.
IETF has a draft to define the application layer security capability negotiation mechanism of SIP (session initiation protocol) at present, its basic ideas are the some SIP expansions of definition header fields, by described expansion header field terminal the security capabilities tabulation of oneself supporting is sent to server, server replies to terminal with the security capabilities tabulation of oneself simultaneously, terminal is by comparison self and the security capabilities of server and the priority of each security capabilities, the selection security capabilities that both sides support and priority is high is (as IPSec, TLS, the S/MIME of SIP etc.) communicate, the security capabilities tabulation that simultaneously server is sent returns to server, so that whether the tabulation of the security capabilities of server authentication oneself was modified, prevent man-in-the-middle attack, by server terminal is confirmed at last.
There is following shortcoming in technique scheme:
1, only define the expansion header field of SIP, only use at Session Initiation Protocol, range of application is narrow, and extensibility is not strong;
2, the protocol interaction flow process is too many, and the efficient of negotiating safety capability is not high;
3, the agreement flow process clearly definition how in the NGN network, to use, and how combine influence intercommunication in the future with conversation procedure in the NGN network;
4, security capabilities is determined by terminal, and terminal is normally incredible, and the negotiating safety capability process exposed the security capabilities of server, is unfavorable for the safety of system, and fail safe is lower.
Summary of the invention
It is wide that the technical problem that the present invention solves provides a kind of range of application, and the negotiating safety capability method that extensibility is strong adopts this negotiating safety capability method, can adapt to the characteristics of NGN network, and is safe.
For addressing the above problem, the invention provides a kind of negotiating safety capability method, comprise the steps:
A) terminal sends login request message to soft switch;
B) soft switch sends authentication request message to authentication center;
C) authentication center generates first authenticator to terminal according to the shared key K c with terminal; Terminal generates second authenticator according to the shared key K c with authentication center; The security capabilities tabulation of terminal support and the precedence information of every kind of security capabilities are obtained in soft switch; Second authenticator that described first authenticator that soft switch provides according to authentication center and terminal provide authenticates described terminal; After authentication was passed through, according to security capabilities tabulation and precedence information that terminal is supported, negotiating safety capability was carried out in terminal and soft switch; After negotiation was passed through, terminal and soft switch communicated according to the security capabilities that consults.
Wherein, described step c) specifically comprises:
C1) authentication center generates first authenticator to terminal according to the shared key K c with terminal, and described first authenticator is returned to soft switch;
C2) soft switch is returned the registration failure response message to terminal, requires the security capabilities tabulation of terminal feedback support and the precedence information of every kind of security capabilities simultaneously;
C3) terminal is according to generating second authenticator with the shared key K c of authentication center, sends the registration message of the precedence information that comprises described second authenticator, security capabilities tabulation that terminal is supported and every kind of security capabilities then to soft switch;
C4) second authenticator that provides of first authenticator that provides according to authentication center of soft switch and terminal authenticates described terminal, and after authentication is passed through, execution in step c5);
C5) soft switch is returned the response message that succeeds in registration to terminal, comprise the security capabilities parameter list of security capabilities item that the selected subsequent communications of security capabilities that soft switch supports according to terminal adopts and terminal and precedence information in the described response message that succeeds in registration so that terminal check, soft switch is simultaneously sent the terminal authentication success message so that the relevant information of new terminal more to authentication center.
Concrete, described step c1) further comprise:
Authentication center generates the session key between described terminal and the soft switch, then with described shared key K c to described session key, the session key after encrypting is returned to soft switch with first authenticator;
Step c5) also comprises authentication center in the described response message that succeeds in registration to share the session key that key K c encrypted;
Described step c) also further comprises:
C6) terminal is according to sharing key K c decrypted authentication center to share the session key that key K c encrypted.
Further, described next generation network also comprises Xin Lingdaili, and described step a) specifically comprises:
Terminal sends login request message to Xin Lingdaili, and Xin Lingdaili is transmitted the login request message of terminal to soft switch;
Described step c1) further comprise:
Authentication center according to the shared key K sp of Xin Lingdaili, session key is encrypted, will also return to soft switch through the session key that described shared key K sp encrypted then;
Described step c2) specifically comprise:
Soft switch is returned the registration failure response message to Xin Lingdaili, and Xin Lingdaili returns the registration failure response message to terminal, the security capabilities tabulation that requires the terminal feedback to support simultaneously;
Described step c3) specifically comprise:
Terminal will comprise second authenticator of generation, the security capabilities tabulation of terminal support and the registration message of every kind of security capabilities precedence information and send to Xin Lingdaili, Xin Lingdaili selects a suitable security capabilities to communicate according to the security capabilities of terminal support and the precedence information of every kind of security capabilities, transmits the registration message of terminal then to soft switch;
Described step c5) specifically comprise:
Soft switch is transmitted endpoint registration success response message to Xin Lingdaili, comprise authentication center in the described response message that succeeds in registration respectively to share the session key after key K c and Ksp encrypt, Xin Lingdaili is with sharing key K sp decrypted authentication center to share the session key that key K sp encrypted, and the session key that obtains with described deciphering calculates the authentication of message word to the response message message that succeeds in registration, Xin Lingdaili is transmitted the response message that succeeds in registration to terminal then, and this response message that succeeds in registration comprises authentication center to share key K c encrypted session key, the security capabilities item that the selected subsequent communications of the security capabilities that Xin Lingdaili is supported according to terminal adopts and security capabilities parameter list and the precedence information and the described authentication of message word of terminal;
Described step c6) further comprise:
The session key that obtains after the key K c deciphering is shared in the terminal utilization, the authentication of message word of checking Xin Lingdaili returned packet is with checking Xin Lingdaili identity, whether the security capabilities parameter of the terminal that the integrality of simultaneous verification message and Xin Lingdaili return is correct, and after checking is passed through, communicate according to selected security capabilities.
Wherein, described login request message and registration message are the Session Initiation Protocol registration message, and described registration failure response message is the Session Initiation Protocol response message, and the described response message that succeeds in registration is a Session Initiation Protocol register requirement success message.
Wherein, described login request message is restarted message for the MGCP protocol system, and the described registration failure response message and the response message that succeeds in registration are MGCP notice of settlement request message, and described registration message is a MGCP notice of settlement message.
Wherein, described login request message is H.248 order of protocol system service state change message and response message thereof, H.248 the described registration failure response message and the response message that succeeds in registration are protocol attribute change message, and described registration message is notice of settlement message H.248.
Wherein, described login request message is agreement gatekeeper GK request message H.323, described registration failure response message is agreement gatekeeper GK refuse information H.323, and described registration message is protocol registration request message H.323, and the described response message that succeeds in registration is protocol registration success message H.323.
Compared with prior art, the present invention has the following advantages:
1, the present invention because negotiating safety capability is not subject to concrete NGN network application agreement, is a kind of method in common by realize negotiating safety capability in the authentication registration process, therefore, applied range, extensibility is stronger;
2, the present invention realizes negotiating safety capability in the authentication registration process, and interaction flow is simple, and the efficient of negotiating safety capability is higher, owing to needn't consult to determine security capabilities in call establishment, does not influence call set-up time;
3, negotiating safety capability has general flow process, can specifically be applied to Session Initiation Protocol, MGCP agreement, agreement and H.323 in the application protocol of NGN network such as agreement H.248, and negotiating safety capability combines with session, helps intercommunication in the future;
4, security capabilities can be determined by Xin Lingdaili rather than terminal, does not expose the security capabilities of servers such as soft switch, has better guaranteed the safety of system.
Description of drawings
Fig. 1 is a kind of NGN network environment schematic diagram that negotiating safety capability method of the present invention is used;
Fig. 2 is a negotiating safety capability method specific embodiment communication process schematic diagram of the present invention under network environment shown in Figure 1;
Fig. 3 is a kind of NGN network environment schematic diagram with Xin Lingdaili that negotiating safety capability method of the present invention is used;
Fig. 4 is a negotiating safety capability method specific embodiment communication process schematic diagram of the present invention under network environment shown in Figure 3;
Fig. 5 is an embodiment communication process schematic diagram of realizing negotiating safety capability in Session Initiation Protocol authentication registration process;
Fig. 6 is an embodiment communication process schematic diagram of realizing negotiating safety capability in MGCP protocol registration verification process;
Fig. 7 is an embodiment communication process schematic diagram of realizing negotiating safety capability in protocol registration verification process H.248;
Fig. 8 is an embodiment communication process schematic diagram of realizing negotiating safety capability in protocol registration verification process H.323.
Embodiment
In the NGN network, network security is a major issue of running in the actual operation of present NGN network, if can not well solve the safety problem of NGN network, the NGN network can't be used on a large scale.
In the NGN network, the network equipment mainly comprises terminal, gateway and soft switch etc., and Fig. 1 is NGN simple single domain networking diagram, promptly has only a soft switch (being also referred to as Media Gateway Controller) equipment, and actual networking has a plurality of Softswitch.In the NGN network environment as shown in Figure 1, soft switch by IP network respectively with Trunk Media Gateway, SIP (session initiation protocol) terminal, H.323 terminal links to each other with terminal H.248, and wherein Trunk Media Gateway meets analog telephone T1, T2, and soft switch also links to each other with the AuC of authentication center in addition.
The present invention is in conjunction with the characteristics of NGN network, by authentication registration process and negotiating safety capability process are combined, initiate registration in terminal to soft switch, soft switch is after authentication center's request authentication, authentication center authenticates terminal, and carry out negotiating safety capability by terminal and soft switch, after consulting to pass through, terminal and soft switch communicate according to the security capabilities that consults.Owing in the authentication registration process, finish negotiating safety capability, can make the process of the authentication registration of terminal and negotiating safety capability simpler and more direct, improved the efficient and the performance of system, lower to the requirement of terminal.
Fig. 2 is a kind of simple negotiating safety capability communication process schematic diagram, is described as follows:
Terminal is at first initiated register requirement to soft switch, concrete message packet is relevant with the agreement that terminal is supported, after described login request message is received in soft switch, request authenticates terminal to authentication center, authentication center generates corresponding authenticator (being convenient to be called first authenticator after the difference) according to end message, then to soft switch return authentication response message, comprise described first authenticator in the described authentication response message, soft switch is after receiving described authentication response message, send the registration failure response message to terminal, the requirement terminal re-registers, require the security capabilities tabulation of terminal feedback support and the precedence information of every kind of security capabilities simultaneously, terminal generates authenticator (being convenient to be called second authenticator after the difference), again initiate registration to soft switch then, comprise the security capabilities tabulation of described second authenticator and terminal support and the precedence information of every kind of security capabilities in the log-on message, first authenticator that soft switch comparison authentication center and terminal are submitted to respectively and second authenticator, if it is inequality, then return the registration failure response message to terminal, the requirement terminal re-registers, if it is identical, then authentication is passed through, send the response message that succeeds in registration to terminal, the precedence information that comprises the security capabilities parameter list of security capabilities item that the selected subsequent communications of security capabilities that soft switch supports according to terminal adopts and terminal and every kind of security capabilities in the described response message that succeeds in registration is so that terminal check, simultaneously send the terminal authentication success message, more the relevant information of new terminal to authentication center.
In above-mentioned negotiating safety capability process, also can realize the fail safe of key distribution with further raising network, concrete, a shared key is respectively arranged between all-network equipment, terminal and the AuC of authentication center among the present invention, the network equipment can adopt manual configuration or webmaster to issue, and terminal equipment is imported by system assignment or user when equipment is opened an account.
The shared key of all and the AuC of authentication center is the basic key of whole system, need obtain appropriate keeping, requires the network equipment and terminal to have the ability of not leaking this key and having anti-this key of unauthorized theft to the third party.
In addition, the AuC of authentication center also generates the session key between terminal and the soft switch, then with described shared key K c to described session key, session key after encrypting is returned to soft switch with first authenticator, and after succeeding in registration, in the response message that succeeds in registration that terminal is returned, comprise described authentication center to share the session key that key K c encrypted, terminal is according to sharing key K c decrypted authentication center to share the session key that key K c encrypted like this, can decipher the session key that obtains thus and distinguish derived cipher key and authenticate key, be used for encryption or the authentication of communication process signaling by algorithm.
In fact the safety in order to communicate by letter, also can comprise Xin Lingdaili (SP) in the network environment that the present invention uses, in the whole network environment, communication between the network equipment more than the Xin Lingdaili is believable, need guarantee in networking that promptly these network equipments are to be in the trusted domain, terminal is incredible, and the communication between terminal and the Xin Lingdaili is unsafe, be that terminal and Xin Lingdaili are positioned at non-trusted domain, Xin Lingdaili is the border of trusted domain and non-trusted domain.
Xin Lingdaili can be used as a functional module and is integrated in the IP gateway with the module of handling the medium forwarding, the framework mode that also can adopt signaling to separate with medium, independently become an independent Xin Lingdaili entity, describe with specific embodiment below.
Fig. 3 is the network environment that a kind of Xin Lingdaili is integrated in IP gateway, and in described network environment, terminal realizes communicating by letter with soft switch by Xin Lingdaili.
Fig. 4 is a communication process of realizing negotiating safety capability in the network environment of tool Xin Lingdaili shown in Figure 3, also realizes key distribution in this embodiment communication process, specifies as follows.
Send login request message by the agreement flow process to Xin Lingdaili in step s1. terminal, normal protocol registration message, concrete message packet is relevant with the agreement that terminal is supported, it is a common protocol registration message, message not encrypted authentication processing comprises following information in the described login request message message:
IDc‖IDsp‖N1‖TS1
-IDc: marking terminal
-IDsp: sign Xin Lingdaili
-N1: random number or sequence number, be used to identify this message, need comprise this number in the response message that returns, be used for preventing that message from retransmitting (this of subsequent message count implication identical)
-TS1: whether the clock that is used for the clock of Xin Lingdaili verification terminal and Xin Lingdaili is synchronous;
In the login request message of step s2. Xin Lingdaili, comprise following information in this message packet to soft switch forwarding terminal:
IDc‖IDsp
-IDc: marking terminal
-IDsp: sign Xin Lingdaili;
Do not have the authentication information of terminal in step s3. soft switch, send authentication request message to terminal to authentication center (AuC), terminal iidentification ID and Xin Lingdaili sign ID is provided, it is as follows to comprise information in this message packet:
IDc‖IDsp
-IDc: marking terminal;
-IDsp: the Xin Lingdaili of marking terminal access network;
In step s4. authentication center according to terminal iidentification ID, Xin Lingdaili sign ID, obtain with the shared key K c of terminal and with shared key K sp and other authentication information of Xin Lingdaili, generate a challenge word random number R and, by Rand, IDc and shared key K c etc. generate the first authenticator Authenticatorc to terminal together, generate the session key Kc between terminal and the Xin Lingdaili simultaneously, sp, and respectively by shared key K c and Ksp to described session key Kc, sp encrypts, with Rand, authenticator, session key Kc after the encryption, sp returns to soft switch as the response of soft switch authentication request, comprises following information in this authentication response message message:
IDc‖IDsp‖Rand‖Authenticatorc‖EKc[Kc，sp]‖EKsp[Kc，sp]
Wherein: Authenticatorc=fm (Kc, Rand, IDc)
-IDc: marking terminal
-IDsp: sign Xin Lingdaili
-Rand: random number, be used for authentication center and calculate authenticator, authentication center issues soft switch with Rand, and Xin Lingdaili is issued in soft switch again, issues terminal by Xin Lingdaili again
-Authenticatorc: authenticator, be used for the soft switch verification terminal, authentication center issues soft switch after generating
-EKc[Kc, sp]: authentication center is to share the session key Kc that key K c encrypted, sp
-EKsp[Kc, sp]: authentication center is to share the session key Kc that key K sp encrypted, sp
Return the registration failure response message in step 5. soft switch to Xin Lingdaili, registration failure need authenticate terminal, comprises challenge word Rand in the registration failure response message message parameter, comprises following information in this message packet:
IDc‖IDsp‖Rand
-IDc: marking terminal
-IDsp: sign Xin Lingdaili
-Rand: the random number of issuing Xin Lingdaili for authentication center;
Return the registration failure response message at step 6. Xin Lingdaili to terminal, registration failure, need authenticate terminal, comprise challenge word Rand in the same registration failure response message message, require the security capabilities tabulation of terminal feedback support and the precedence information of every kind of security capabilities simultaneously, comprise following information in this message:
IDc‖IDsp‖N1‖N2‖TS2‖Rand
-IDc: marking terminal
-IDsp: sign Xin Lingdaili
-N1: issue the N1 in the registration message message of Xin Lingdaili with terminal, be used for response to logon message
-N2: be used to identify this message
-TS2: be used for terminal proving time stamp
-Rand: be the random number of authentication center's generation;
Pass through to share key K c in step 7. terminal, the random number R and that client identification IDc and Xin Lingdaili return recomputates authenticator, again initiate registration to Xin Lingdaili, comprise the second authenticator Authenticatorc that newly calculates in the registration message message, the security capabilities tabulation that comprises the terminal support simultaneously in the registration message message is (as IP Security IPSec, Transport Layer Security TLS or application layer security etc.), and the precedence information of each security capabilities, Xin Lingdaili will select a suitable security capabilities to communicate according to the security capabilities and the precedence information of terminal, comprise following information in this registration message message:
IDc‖N1‖N2‖TS3‖Authenticatorc‖Security?mechanism?list
Wherein: Authenticatorc=f (Kc, Rand, IDc)
-IDc: marking terminal;
-N1: new random number or sequence number are used to identify this message
-N2: be used to identify response to a message on the Xin Lingdaili
-TS3: allow the Xin Lingdaili proving time stab
-Authenticatorc: authenticator is generated by terminal
-Security mechanism list: the security capabilities of terminal and priority list;
At the registration message message of step 8. Xin Lingdaili to soft switch forwarding terminal, can transmit for the security capabilities and the precedence information parameter of terminal, can not transmit yet, soft switch does not need this information, comprises following information in this registration message message:
IDc‖IDsp‖Authenticatorc
-IDc: marking terminal
-IDsp: sign Xin Lingdaili
-Authenticatorc: authenticator is generated by terminal;
First authenticator that second authenticator in the registration message message that step 9. soft switch sends Xin Lingdaili and authentication center send compares, terminal is verified, if both are inconsistent, authentication failed then, can retransmit the registration failure response message, if both unanimities, then show being proved to be successful to terminal, return the response message message that succeeds in registration to Xin Lingdaili, comprise two process Kc respectively and terminal after the Ksp encryption and session key Kc between the Xin Lingdaili that generate by authentication center in this message packet simultaneously, sp comprises following information in this message packet:
IDc‖IDsp‖EKc[Kc，sp]‖EKsp[Kc，sp]
-IDc: marking terminal
-IDsp: sign Xin Lingdaili
-EKc[Kc, sp]: be the authentication center terminal of shared key K c encryption and the session key Kc between the Xin Lingdaili, sp
-EKsp[Kc, sp]: be the authentication center terminal of shared key K sp encryption and the session key Kc between the Xin Lingdaili, sp;
Receive the registration response success message of soft switch at step 10. Xin Lingdaili, transmit the response message that succeeds in registration to terminal, comprise the session key Kc after the shared key K c encryption of process the terminal that generates by authentication center in this message packet, sp, succeed in registration simultaneously and comprise the security capabilities item that Xin Lingdaili adopts according to the selected subsequent communications of the security capabilities parameter of terminal and the security capabilities parameter list and the precedence information (whether be used for these parameters of terminal check is revised by the third party in Network Transmission) of terminal in the response message, at last with the session key Kc that shares after key K sp encrypts the process Ksp that is generated by authentication center, sp is decrypted processing, obtain Kc, sp, and use Kc, sp calculates authentication of message word MAC to whole response message message, be used to guarantee the integrality of message, and terminal comprises following information to the authentication of Xin Lingdaili in the message:
IDc‖IDsp‖N1‖N2‖TS4‖EKc[Kc，sp]‖‖Security?mechanism‖Security
Mechanism list (c) ‖ fm (Kc, sp, message)
-IDc: marking terminal
-IDsp: sign Xin Lingdaili
-N1: be used to identify response to the endpoint registration message
-N2: be used to identify this message
-TS4: be used for terminal proving time stamp
-EKc[Kc, sp]: be the authentication center terminal of shared key K c encryption and the session key Kc between the Xin Lingdaili, sp
-Security mechanism: Xin Lingdaili is according to the security capabilities and the selected security capabilities of priority list of terminal
-Security mechanism list: the security capabilities of terminal oneself and priority list are used for the security capabilities tabulation that the terminal check Xin Lingdaili receives and were not illegally modified
-fm (Kc, sp, message): use session key Kc, sp carries out source and integrated authentication to whole message, terminal is by untiing session key, and message successfully differentiated the authentication that realizes Xin Lingdaili, otherwise Xin Lingdaili can't obtain the session key Kc that signed and issued by authentication center, sp;
Send the terminal authentication success message in step 11. soft switch to authentication center, the relevant information of new terminal more, terminal obtains Kc to the session key deciphering through after the Kc encryption that is generated by authentication center simultaneously, sp, and use Kc, the MAC of sp checking Xin Lingdaili returned packet, realization is to the authentication of Xin Lingdaili, the integrality of simultaneous verification message, and whether the security capabilities parameter of the terminal self returned of Xin Lingdaili is correct, if it is correct, illustrate that then the selected security capabilities that Xin Lingdaili returns is correct, subsequent communications will be carried out the message safe handling by this security capabilities, if terminal is incorrect to Xin Lingdaili authentification failure or security capabilities parameter, can initiate registration again, comprise following information in this terminal authentication success message message:
IDc‖IDsp‖IPc‖...
-IDc: marking terminal
-IDsp: sign Xin Lingdaili
-IPc: the IP address of endpoint registration may be through the IP address after the Xin Lingdaili conversion process.
The negotiations process of above-mentioned security capabilities is definite by consulting between terminal and the Xin Lingdaili (being integrated in the IP gateway), Xin Lingdaili can be finished the effect of hiding core network device, Xin Lingdaili is placed on edge access layer, even malicious attack paralysis, influence to whole network is also very little, negotiations process is finished in endpoint registration authentication and encryption key distribution process simultaneously, referring to step s6, s7, s10 in the above-mentioned flow process, specifically illustrate as followsly, can in the registration message message of terminal, increase following information:
Security-Client:tls; P=1 // terminal is supported TLS, and priority is 1
Security-Client:digest/Interim AH/H.235; The p=2/* different terminals is supported different application layer securities, authenticate/ H.248-Interim*/AH/H.323-H.235 wait as SIP-digest, priority be 2*/
Security-Client:IPSec; P=3 // terminal is supported IPSec, and priority is 3
Xin Lingdaili is responded following information in the response message message that succeeds in registration:
Security-Verify:IPSec; P=3 // Xin Lingdaili is specified according to both sides' security capabilities and is adopted IPSec, and priority is 3
/ * issues terminal again with the tabulation of the security capabilities of terminal simultaneously, the security capabilities that is used for terminal checking oneself transmission course be not modified */
Security-Client：tls；p＝1
Security-Client：digest/Interim?AH/H.235；p＝2
Security-Client：IPSec；p＝3
Said process is finished the safe implementation except that consulting, and also can consult to finish the parameters such as algorithm of security service, encryption or the authentication adopted in the communication process simultaneously;
Except the network layer and Transport Layer Security implementation that adopt standard, also can adopt self-defining application layer security implementation, in the encryption key distribution process, consult to finish session key and associated safety parameters such as encryption and identifying algorithm, by session key derived cipher key and authenticate key, message format when defining application layer applications encryption and authentication service simultaneously, promptly can between communicating pair, begin to provide the security service of application layer, as a kind of self-defining security capabilities, can constantly be expanded by this mode security capabilities.
With concrete application protocol environment negotiating safety capability method of the present invention is described below.
Fig. 5 is that the present invention adopts Session Initiation Protocol to carry out the concrete communication process of authentication registration, be example for having Xin Lingdaili still with network environment, just registration in the above-mentioned generalized flowsheet and response message are refined as concrete Session Initiation Protocol message in the described communication process, the entrained parameter of the message of each step is consistent with definition in the above-mentioned generalized flowsheet in the flow process.
Concrete protocol message in the described communication process, at step s1, step s2, login request message is the registration message in the Session Initiation Protocol; At step s5, step s6, the registration failure response message is the response message code in the Session Initiation Protocol, wherein 401: be the response message code in the Session Initiation Protocol, implication is for authenticating terminal, 407: be the response message code in the Session Initiation Protocol, implication, re-registers message and also is the registration message in the Session Initiation Protocol at step s7, step s8 for need the agency being authenticated; At step s9, step s10, the response message that succeeds in registration is the response message code in the Session Initiation Protocol, and expression is asked successfully, i.e. OK; And the message among step s3, s4, the s11, then it doesn't matter with concrete hello protocol, can be general authentication protocol, according to the difference of application scenario, can take different agreements, as Radius, Diameter etc.
Fig. 6 is that the present invention adopts MGCP (MGCP) agreement to carry out the concrete communication process of authentication registration, be example for having Xin Lingdaili still with network environment, just registration in the above-mentioned generalized flowsheet and response message are refined as concrete MGCP protocol message in the described communication process, the entrained parameter of the message of each step is consistent with definition in the above-mentioned generalized flowsheet in the flow process.
Concrete protocol message in the described communication process, at step s1, step s2, login request message is that the system in the MGCP agreement restarts information order RSIP and response message thereof; At step s5, step s6, the registration failure response message is notification request message order RQNT and the response message thereof in the MGCP agreement, the expression system need authenticate terminal, at step s7, step s8, re-register message and be notification message order NOTIFY and response message thereof in the MGCP agreement, the expression terminal is initiated authentication; At step s9, step s10, the response message that succeeds in registration is notification request message order RQNT and the response message thereof in the MGCP agreement, the success of notice terminal authentication; And the message among step s3, s4, the s11, then it doesn't matter with concrete hello protocol, can be general authentication protocol, according to the difference of application scenario, can take different agreements, as Radius, Diameter etc.
Fig. 7 is that the present invention adopts agreement H.248 to carry out the concrete communication process of authentication registration, be example for having Xin Lingdaili still with network environment, just registration in the above-mentioned generalized flowsheet and response message are refined as concrete H.248 protocol message in the described communication process, the entrained parameter of the message of each step is consistent with definition in the above-mentioned generalized flowsheet in the flow process.
Concrete protocol message in the described communication process, at step s1, step s2, login request message is system service state variation information order SERVICE CHANGE and the response message thereof in the agreement H.248, and show that system begins to enter service state this moment, initiates registration; At step s5, step s6, the registration failure response message is attribute changes information order MODIFY and the response message thereof in the agreement H.248, the expression system need authenticate terminal, at step s7, step s8, re-register message and be notification message order NOTIFY and response message thereof in the agreement H.248, the expression terminal is initiated authentication; At step s9, step s10, the response message that succeeds in registration is attribute changes information order MODIFY and response message thereof in the agreement H.248, the success of notice terminal authentication; And the message among step s3, s4, the s11, then it doesn't matter with concrete hello protocol, can be general authentication protocol, according to the difference of application scenario, can take different agreements, as Radius, Diameter etc.
Fig. 8 is that the present invention adopts agreement H.323 to carry out the concrete communication process of authentication registration, be example for having Xin Lingdaili still with network environment, just registration in the above-mentioned generalized flowsheet and response message are refined as concrete H.323 protocol message in the described communication process, the entrained parameter of the message of each step is consistent with definition in the above-mentioned generalized flowsheet in the flow process.
Concrete protocol message in the described communication process, at step s1, step s2, login request message is the gatekeeper's request message in the agreement H.323, implication for Whom is my gatekeeper; At step s5, step s6, the registration failure response message is the gatekeeper's refuse information in the agreement H.323, implication is not registered terminal for the gatekeeper, expression herein needs authentication, at step s7, step s8, re-register message and be the login request message in the agreement H.323, will carry authentication information in the message this moment, and the expression terminal is initiated authentication; At step s9, step s10, the response message that succeeds in registration is the message that succeeds in registration in the agreement H.323, the success of notice terminal authentication; And the message among step s3, s4, the s11, then it doesn't matter with concrete hello protocol, can be general authentication protocol, according to the difference of application scenario, can take different agreements, as Radius, Diameter etc.
The above only is the preferred embodiments of the present invention, and is non-so promptly limit to interest field of the present invention, and the equivalence that all utilizations specification of the present invention and accompanying drawing content are done changes, and all reason is with being contained in the claim scope of the present invention.
Claims (9)
1, a kind of negotiating safety capability method is applied in the next generation network, and described next generation network comprises terminal, soft switch and authentication center, it is characterized in that, comprises the steps:
A) terminal sends login request message to soft switch;
B) soft switch sends authentication request message to authentication center;
C) authentication center generates first authenticator to terminal according to the shared key K c with terminal;
Terminal generates second authenticator according to the shared key K c with authentication center;
The security capabilities tabulation of support of terminal feedback and the precedence information of every kind of security capabilities are obtained in soft switch; Second authenticator that described first authenticator that soft switch provides according to authentication center and terminal provide authenticates described terminal;
After authentication was passed through, according to security capabilities tabulation and precedence information that terminal is supported, negotiating safety capability was carried out in terminal and soft switch; After negotiation was passed through, terminal and soft switch communicated according to the security capabilities that consults.
2, according to the described negotiating safety capability method of claim 1, it is characterized in that described step c) specifically comprises:
C1) authentication center generates first authenticator to terminal according to the shared key K c with terminal, and described first authenticator is returned to soft switch;
C2) soft switch is returned the registration failure response message to terminal, requires the security capabilities tabulation of terminal feedback support and the precedence information of every kind of security capabilities simultaneously;
C3) terminal is according to generating second authenticator with the shared key K c of authentication center, sends the registration message of the precedence information that comprises described second authenticator, security capabilities tabulation that terminal is supported and every kind of security capabilities then to soft switch;
C4) second authenticator that provides of first authenticator that provides according to authentication center of soft switch and terminal authenticates described terminal, and after authentication is passed through, execution in step c5);
C5) soft switch is returned the response message that succeeds in registration to terminal, comprise the security capabilities parameter list of security capabilities item that the selected subsequent communications of security capabilities that soft switch supports according to terminal adopts and terminal and precedence information in the described response message that succeeds in registration so that terminal check, soft switch is simultaneously sent the terminal authentication success message so that the relevant information of new terminal more to authentication center.
3, according to the described negotiating safety capability method of claim 2, it is characterized in that described step c1) further comprise:
Authentication center generates the session key between described terminal and the soft switch, then with described shared key K c to described session key, the session key after encrypting is returned to soft switch with first authenticator;
Step c5) also comprises authentication center in the described response message that succeeds in registration to share the session key that key K c encrypted;
Described step c) also further comprises:
C6) terminal is according to sharing key K c decrypted authentication center to share the session key that key K c encrypted.
4, according to the described negotiating safety capability method of claim 3, it is characterized in that described next generation network also comprises Xin Lingdaili, described step a) specifically comprises:
Terminal sends login request message to Xin Lingdaili, and Xin Lingdaili is transmitted the login request message of terminal to soft switch;
Described step c1) further comprise:
Authentication center according to the shared key K sp of Xin Lingdaili, session key is encrypted, will also return to soft switch through the session key that described shared key K sp encrypted then;
Described step c2) specifically comprise:
Soft switch is returned the registration failure response message to Xin Lingdaili, and Xin Lingdaili returns the registration failure response message to terminal, the security capabilities tabulation that requires the terminal feedback to support simultaneously;
Described step c3) specifically comprise:
Terminal will comprise second authenticator of generation, the security capabilities tabulation of terminal support and the registration message of every kind of security capabilities precedence information and send to Xin Lingdaili, Xin Lingdaili selects a suitable security capabilities to communicate according to the security capabilities of terminal support and the precedence information of every kind of security capabilities, transmits the registration message of terminal then to soft switch;
Described step c5) specifically comprise:
Soft switch is transmitted endpoint registration success response message to Xin Lingdaili, comprise authentication center in the described response message that succeeds in registration respectively to share the session key after key K c and Ksp encrypt, Xin Lingdaili is with sharing key K sp decrypted authentication center to share the session key that key K sp encrypted, and the session key that obtains with described deciphering calculates the authentication of message word to the response message message that succeeds in registration, Xin Lingdaili is transmitted the response message that succeeds in registration to terminal then, and this response message that succeeds in registration comprises authentication center to share key K c encrypted session key, the security capabilities item that the selected subsequent communications of the security capabilities that Xin Lingdaili is supported according to terminal adopts and security capabilities parameter list and the precedence information and the described authentication of message word of terminal;
Described step c6) further comprise:
The session key that obtains after the key K c deciphering is shared in the terminal utilization, the authentication of message word of checking Xin Lingdaili returned packet is with checking Xin Lingdaili identity, whether the security capabilities parameter of the terminal that the integrality of simultaneous verification message and Xin Lingdaili return is correct, and after checking is passed through, communicate according to selected security capabilities.
5, according to each described negotiating safety capability method among the claim 2-4, it is characterized in that, described registration message is the Session Initiation Protocol registration message, and described registration failure response message is the Session Initiation Protocol response message, and the described response message that succeeds in registration is a Session Initiation Protocol register requirement success message.
According to each described negotiating safety capability method among the claim 2-4, it is characterized in that 6, the described registration failure response message and the response message that succeeds in registration are MGCP notice of settlement request message, described registration message is a MGCP notice of settlement message.
According to each described negotiating safety capability method among the claim 2-4, it is characterized in that 7, H.248 the described registration failure response message and the response message that succeeds in registration are protocol attribute change message, described registration message is notice of settlement message H.248.
8, according to each described negotiating safety capability method among the claim 2-4, it is characterized in that, described registration failure response message is agreement gatekeeper GK refuse information H.323, described registration message is protocol registration request message H.323, and the described response message that succeeds in registration is protocol registration success message H.323.
9, according to the described negotiating safety capability method of claim 4, it is characterized in that described login request message is:
Session Initiation Protocol registration message, or the MGCP protocol system restarts message, or H.248 order of protocol system service state change message and response message thereof, or agreement gatekeeper GK request message H.323.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CNB2004100057398A CN100544247C (en) | 2004-02-16 | 2004-02-16 | The negotiating safety capability method |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CNB2004100057398A CN100544247C (en) | 2004-02-16 | 2004-02-16 | The negotiating safety capability method |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN1658551A CN1658551A (en) | 2005-08-24 |
| CN100544247C true CN100544247C (en) | 2009-09-23 |
Family
ID=35007826
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CNB2004100057398A Expired - Fee Related CN100544247C (en) | 2004-02-16 | 2004-02-16 | The negotiating safety capability method |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN100544247C (en) |
Families Citing this family (12)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1983921B (en) * | 2005-12-16 | 2010-05-05 | 华为技术有限公司 | Method and system for realizing end to end media fluid safety |
| CN101098230B (en) * | 2006-06-29 | 2010-12-08 | 联想(北京)有限公司 | Method and system for checking user facility operation application |
| WO2009089015A1 (en) * | 2008-01-07 | 2009-07-16 | Security First Corporation | Systems and methods for securing data using multi-factor or keyed dispersal |
| CN102355701B (en) * | 2011-09-19 | 2017-12-29 | 中兴通讯股份有限公司 | Access the method and terminal of WLAN focus |
| CN103841082B (en) * | 2012-11-22 | 2017-05-31 | 中国电信股份有限公司 | Safety ability consultation method and system, service server, user terminal |
| US11127001B2 (en) * | 2013-05-09 | 2021-09-21 | Wayne Fueling Systems Llc | Systems and methods for secure communication |
| CN104113547B (en) * | 2014-07-23 | 2017-04-26 | 中国科学院信息工程研究所 | SIP (session initiation protocol) security protection video monitoring network access control system |
| CN107276969B (en) * | 2016-04-08 | 2019-11-22 | 杭州海康威视数字技术股份有限公司 | A kind of transmission method and device of data |
| CN109873972B (en) * | 2019-02-13 | 2022-02-18 | 苏州科达科技股份有限公司 | Registration method, calling method, medium and device for preventing renegotiation DoS attack |
| CN110311921B (en) * | 2019-07-11 | 2022-02-25 | 南方电网科学研究院有限责任公司 | Power distribution terminal encryption and decryption method, system, equipment and computer storage medium |
| CN112688907B (en) * | 2019-10-17 | 2023-06-30 | 华为技术有限公司 | Combined equipment remote proof mode negotiation method, related equipment and storage medium |
| CN112953718A (en) * | 2019-11-26 | 2021-06-11 | 中国移动通信集团安徽有限公司 | Authentication method and device for IMS network user and call session control function entity |
-
2004
- 2004-02-16 CN CNB2004100057398A patent/CN100544247C/en not_active Expired - Fee Related
Also Published As
| Publication number | Publication date |
|---|---|
| CN1658551A (en) | 2005-08-24 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| EP1717986B1 (en) | Key distribution method | |
| US9537837B2 (en) | Method for ensuring media stream security in IP multimedia sub-system | |
| EP1946479B1 (en) | Communication securiy | |
| CN100592731C (en) | Lawful interception of end-to-end encrypted data traffic | |
| US8990569B2 (en) | Secure communication session setup | |
| CN109347809A (en) | A kind of application virtualization safety communicating method towards under autonomous controllable environment | |
| CN100369430C (en) | A protection method for access security of IP multimedia subsystem | |
| US20080222714A1 (en) | System and method for authentication upon network attachment | |
| US20090068988A1 (en) | Sim based authentication | |
| KR20080089500A (en) | Authentication method, system and authentication center based on end to end communication in the mobile network | |
| US20080137859A1 (en) | Public key passing | |
| CN1716953B (en) | Method for identifying conversation initial protocol | |
| CN100544247C (en) | The negotiating safety capability method | |
| CN106534050A (en) | Method and device for realizing key agreement of virtual private network (VPN) | |
| CN100561909C (en) | A kind of IP Multimedia System access security guard method based on TLS | |
| CN100571133C (en) | The implementation method of media flow security transmission | |
| CN112399407B (en) | 5G network authentication method and system based on DH ratchet algorithm | |
| WO2007093079A1 (en) | Implementation method of crossdomain multi-gatekeeper packet network key negotiation security policy | |
| GB2411086A (en) | Secure communication between terminals over a local channel using encryption keys exchanged over a different network | |
| CN116017429A (en) | 5G network encryption networking method, system, device and storage medium | |
| CN1323509C (en) | Conversation key distribution method of crossing gate-guard management range under direct route mode | |
| CN110933673B (en) | Access authentication method of IMS network | |
| CN113114644B (en) | SIP architecture-based multi-stage cross-domain symmetric key management system | |
| CN102027704A (en) | Secure communication method and apparatus based on IBE algorithm in the store and forward manner | |
| Jacobsen | A Modular Security Analysis of EAP and IEEE 802.11 |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20090923 Termination date: 20220216 |