CN100556027C - A kind of address renewing method of IKE Network Based - Google Patents
A kind of address renewing method of IKE Network Based Download PDFInfo
- Publication number
- CN100556027C CN100556027C CNB2004100871329A CN200410087132A CN100556027C CN 100556027 C CN100556027 C CN 100556027C CN B2004100871329 A CNB2004100871329 A CN B2004100871329A CN 200410087132 A CN200410087132 A CN 200410087132A CN 100556027 C CN100556027 C CN 100556027C
- Authority
- CN
- China
- Prior art keywords
- address
- initiating terminal
- responder
- subclauses
- clauses
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related
Links
- 238000000034 method Methods 0.000 title claims abstract description 25
- 230000000977 initiatory effect Effects 0.000 claims abstract description 60
- 230000027455 binding Effects 0.000 claims abstract description 45
- 238000009739 binding Methods 0.000 claims abstract description 45
- 238000013475 authorization Methods 0.000 claims description 20
- 238000012790 confirmation Methods 0.000 claims description 7
- 238000012217 deletion Methods 0.000 claims description 5
- 230000037430 deletion Effects 0.000 claims description 5
- 238000005516 engineering process Methods 0.000 abstract description 6
- 230000008859 change Effects 0.000 description 13
- 230000004048 modification Effects 0.000 description 10
- 238000012986 modification Methods 0.000 description 10
- 238000005538 encapsulation Methods 0.000 description 9
- 230000007246 mechanism Effects 0.000 description 8
- 230000005540 biological transmission Effects 0.000 description 6
- 238000007689 inspection Methods 0.000 description 6
- 230000008569 process Effects 0.000 description 6
- 230000004044 response Effects 0.000 description 4
- 238000001514 detection method Methods 0.000 description 2
- 238000011161 development Methods 0.000 description 2
- 230000006855 networking Effects 0.000 description 2
- 238000012545 processing Methods 0.000 description 2
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000001914 filtration Methods 0.000 description 1
- 230000008520 organization Effects 0.000 description 1
- 238000013519 translation Methods 0.000 description 1
Images
Abstract
The present invention relates to network technology, in order to solve the address replacement problem of IKEv2, a kind of address renewing method of IKE Network Based is provided, binding comprises the address list of privately owned address of initiating terminal main frame and public address in initiating terminal main frame and responder main frame, when privately owned address or public address that the acquisition of initiating terminal main frame is new are then set up new clauses and subclauses in this end host address tabulation, and the tabulation of request renewal responder host address, responder returns the affirmation lastest imformation and finishes the address renewal.Guaranteed the physical reachability distance of scheduler, prevented " third party's bombing " and " transparent pseudo-NAT attacks ".
Description
Technical field
The present invention relates to network technology, relate in particular to a kind of VPN (virtual private network) (VPN), is a kind of address renewing method of IKE Network Based concretely.
Background technology
Along with the continuous development of Internet, because it is convenient and swift, data are all transmitted with it in a lot of major companies and government department or non-government organization, each department of these units often all is trans-regional, a good distance off, if all with the special line of oneself, its price is very expensive.Just can save a large amount of expenses so utilize the such public network of Internet to transmit private data.But such consequence is exactly very dangerous, on Internet, data may be stolen or revise at any time by cankered hacker, therefore, data must be encrypted in transmission course, recipient and transmit leg come transmission information by a virtual secure tunnel, Here it is virtual private network technology.If at TCP or UDP infill layer, the data by intercepting IP layer can obtain confidential information equally so, and are just as safe as a house in IP layer use encryption and authentication, IPsec (IP Security Architecture) technology that Here it is.Utilize IPsec to realize that VPN (Virtual Private Network) becomes a kind of development trend at present.
Simultaneously, wish to allow the multiple pc on the dedicated network to share IPv4 address single, overall route along with the IPv4 address is not enough day by day.This is a main cause of disposing NAT, network address translation (nat) is an Internet engineering duty group (Internet Engineering Task Force, IETF) standard can realize that the IPv4 address expends problem (in IPv6 disposes but need not).
Under many circumstances, the IP address of user when VPN between the company is connected may change at any time, and for example mobile device is a notebook in the notebook roaming scence, and it can have several different methods to be connected on the Internet.Such as, use fixing Ethernet, WLAN and GPRS networking, and these modes can be used in the different time.People always attempt using the most effective connection, but these connections may often change, such as, a notebook has disconnected Ethernet and has connected the WLAN that brings into use company, afterwards, it has left company again, disconnects WLAN connection bringing into use GPRS on the way home.It may bring into use WLAN to connect (but with different IP addresses, and this user may be after NAT device) again after going home.
This equipment does not use mobile IP v 6 or similar agreement, and it is just hoped with the security gateway of company and keeps VPN to be connected.Even interface or IP address modification, for example this equipment is positioned at after the NAT device, but still can use original Security Association, so just needs certain address update mechanism, makes Security Association can upgrade the IP address after the change automatically.
Another may use the scene of MOBIKE (working group under the IETF is devoted to the extended network IKE, makes it adapt to main frame mobility and many locals) is security gateway, and the other end of gateway is the notebook that can roam.That is to say that security gateway can provide different interfaces to different ISP, even and these connections broken down also and to want new connection can be provided.Security gateway can be known it in advance with the IP group of addresses of using, but it needs dynamic notice client to use which address.
But current IPsec and Internet Key Exchange (IKEv2:Internet Key ExchangeVersion 2) clear and definite the pointing out of document, Security Association is based upon on the IP address, and the IPsec Security Association uses the IP address identical with the IKE Security Association.This means and on the IKEv2 Security Association, have only the pair of IP address, just have only the gateway address of pair of IP address, and just can not change these addresses after the Security Association foundation as tunnel mode IPsec Security Association.But there are some scenes but to need the quick change of IP address, as the moving of main frame, roaming or VPN scene etc.Sometimes, can be after the IP address modification, IPsec and the IKE Security Associations all by re-encryption solve problem.But the re-encryption technology is unaccommodated in some scene, such as, may because equipment too slow re-encryption Security Association that can not be so frequent, perhaps re-encryption and (IKEv2 requires) authentication need user's participation (as Secur ID cards etc.).Owing to these reasons, just a kind of new mechanism of needs is bundled in the IP address on IPsec and the IKEv2 Security Association.
The main task of MOBIKE working group is expanded IKEv2 exactly, makes it to be applicable to the situation in main frame mobility and many locals.This working group has proposed several drafts at present, as the address administration (Address Management for IKE version 2) of IKEv2 and simple mobility and the expansion of many locals (Simple Mobility and Multihoming Extensions for IKEv2, SMOBIKE) these two drafts of IKEv2.First draft has defined new address notification load on the basis of former IKEv2 and load is upgraded in the address, and the mode of upgrading by address notification and address realizes address administration, solves mobility and many locals problem with this.Second draft expanded the NAT mechanism of IKEv2, forces it not carry out when having NAT device, realized the renewal of dynamic address.These two drafts have solved mobility and many locals problem to a certain extent by different modes, but they are not comprehensive, have the problem of some aspect, are not desirable solution.
The SMOBIKE protocol extension existing IKEv2, make it can support main frame to move and many locals.The SMOBIKE protocol modification pass through mechanism based on the NAT of IKEv2, allow under the situation that does not detect NAT, use dynamic address to upgrade and UDP encapsulates.The SMOBIKE protocol definition USE_DYNAMIC_ADDRESS_UPDATES notice load (use dynamic address to upgrade, it is a state information of NOTIFY load, be smobike oneself definition), by sending this notice load, main frame can be in the address update functions that does not have to enable under the situation of NAT the opposite end.
The SMOBIKE agreement does not define the address and upgrades load, and it is to judge from the source address that receives message whether the address, opposite end changes.That is to say that IKEv2 and ESP packet send to last legal data source address.Its address refresh routine depends on how the UDP encapsulation is used.
1., then directly use new address if main frame is not supported the UDP encapsulation.
2. if main frame is using the UDP encapsulation, and prepare to use always, then directly use new address.
3. if main frame can not determine that whether the current UDP configuring condition and the requirement of new address meet, and then begin NAT and detect.Promptly the result who detects according to NAT judges whether to use the UDP encapsulation.If current UDP package arrangements is correct, then directly use new address.
The address renewal will be carried out after receiving authentic packet in the opposite end.If the ESP that will send (safe bearing load header) packet not, main frame can send empty IKEv2 information exchange.
Sometimes need not have to use the UDP encapsulation under the situation of NAT.Typical example is a fire compartment wall of carrying out filtering function, because it does not change the IP address of packet, so can not be found by NAT_DETECTION (being writing a Chinese character in simplified form of NAT-DETECTION-DESTINATION-IP and NAT-DETECTION-SOURCE-IP).
Main frame can be configured to always be to use the UDP encapsulation, or, can use the UDP encapsulation according to receiving that not the ESP message is inferred.In some mobile network, always should be configured to be to use UDP to encapsulate, because the change of route may cause the packet passing through NAT in the network, even the end main frame does not move.
Main frame can comprise USE_UDP_ENCAPSULATION notice load in NAT_DETECTION, force to use the UDP encapsulation.
And the SMOBIKE agreement is subjected to " transparent pseudo-NAT attacks " easily.Because in the SMOBIKE agreement, address information is arranged in the external IP head, is not authenticated and integrity protection, and the assailant can the intercepted data bag and revised their source IP address (and port numbers).The result makes the recipient bring into use address, incorrect opposite end, and sends the data traffic that is subjected to the IPsec protection to this address.If the address that the assailant provides is " black hole ", the flow that sends to this address so all can be lost.This shows as DoS attack.
Draft Address Management for IKE version 2 (hereinafter to be referred as addrmgmt) provide address management function, and perfect existing IKEv2 makes it can support main frame mobility and many locals.
Current IKEv2 draft always supposes that the IP address can identify a node, when node is positioned at after the NAT, the situation of the shared same IP of a lot of nodes address (public address) just may occur, and a node can have a plurality of different IP addresses.These problems must be paid attention to when using.Therefore, the addrmgmt agreement has been introduced the function of address notification and renewal.
The opposite end address notification has adopted prior NAT-DETECTION-SOURCE-IP (to be carried by NOTIFY load, this state information is by its receiving terminal use, judge that source address is whether after NAT) and NAT-DETECTION-DESTINATION-IP (carry by NOTIFY load, this state information is by its receiving terminal use, judge that oneself is whether after NAT), these two state informations are that (NOTIFY load is one of load of IKEv2 definition to NOTIFY load, be used for transmit information data between the opposite end, as error situation and state exchange) a part of load.They have comprised opposite end source address or destination address, and and the related protocol of these addresses bunch and command code.These load must be encrypted.The operation here refers to modification priority, increases and deletion.
These messages belong to IKE_AUTH (third and fourth message in four messages of IKE initial exchange, its function is the message of authentication front, exchange identity and certificate, with set up first IPsec SA) or CREATE_CHILD_SA (after initial exchange is finished, be used for setting up more IPsec SA) exchange, load is upgraded in they or carrying address, opposite end, perhaps is the management (increase/deletion) to the opposite end group of addresses purely.The load of these encryptions can prove that the address, opposite end is not changed in routing procedure, and has enabled the operation to group of addresses, that is to say, changes the main address of opposite end, or increases in the group of addresses of opposite end and delete an address.
Load is upgraded in the address that the Addrmgmt agreement is new for the address update mechanism has defined, and the definition of new load is with reference to the original DELETE load of IKEv2.
The Addrmgmt agreement is the occasion that the address update mechanism only is applicable to does not have NAT to exist.
The receiving terminal of update request need be checked the legitimacy of new IP address, but it can use and return route inspection, having NONCE load to the transmission of new address (is one of load of IKEv2 definition, comprise random number, be used for guaranteeing activity and anti-replay attack in exchange) information exchange requests and wait-for-response.Because information exchange is shielded, do not needed other measure.
But the Addrmgmt protocol definition return the route inspection program as shown in Figure 1, initiating terminal sends address update request message (Request) to responder, the address in the message is upgraded load and is comprised the address that will upgrade.Responder will be checked the legitimacy of scheduler after receiving request, but promptly begins to return route inspection.Responder comprises NONCE load in the message that initiating terminal sends, the inside is a random number.Initiating terminal returns this NONCE value, can reach on scheduler to prove it.At last, responder sends the address and upgrades response message (Reply), and presentation address upgrades to be finished.
But the Addrmgmt agreement is consideration and the compatible problem of using of NAT not, and the regulation of current document is to avoid occurring an end and use NAT to pass through and the situation of other end use MOBIKE.When this situation occurs, just must force two ends all to use NAT to pass through, this has obviously limited the scope of application of MOBIKE.
In current IKEv2 document, Security Association is based upon on the IP address, and this address is unique and is constant.When the IP of main frame address modification (as main frame mobility or many locals), just can only re-encryption or rebulid Security Association.But do the burden that can increase the weight of main frame like this, and when re-encryption needs artificial the participation, also seem easy inadequately.Sometimes to pass through be incompatible for MOBIKE and NAT.Whether NAT passes through and attempts to work with the irrelevant mode in IP address, just no matter the someone has revised its IP address.The purpose of MOBIKE is the change of authentication IP address, and just, when the IP address modification, we will prove that this change is the legal change that other node carries out, rather than the assailant does on the path.This is the principal contradiction between MOBIKE and the NAT.Therefore need a kind of mechanism can upgrade the IP address of Security Association dynamically.
Summary of the invention
The object of the present invention is to provide a kind of address renewing method of IKE Network Based, solve the address replacement problem of IKE Network Based, but simultaneously public address (is applied to the NAT scene, refers to the IP address that packet was revised by NAT by returning routing mechanism.Can the public public address in a plurality of privately owned addresses) and privately owned address (be applied to the NAT scene, the IP address that refers to main frame itself) confirms, authenticated the change of address, satisfied the requirement of MOBIKE, made NAT can meet the MOBIKE standard operation at secure context.
A kind of address renewing method of IKE Network Based, binding comprises the address list of privately owned address of initiating terminal main frame and public address in initiating terminal main frame and responder main frame, when obtaining new privately owned address, the initiating terminal main frame then in this end host address tabulation, sets up new clauses and subclauses, privately owned address in the described new clauses and subclauses is identical with public address, and the tabulation of responder host address is upgraded in request, determine that two ends connect privately owned address and the public address that uses, responder returns the affirmation lastest imformation and finishes the address renewal.
Also comprise the steps, when responder receives the scheduler request, whether the public address of binding clauses and subclauses is the same in the source address of comparing data bag and this request message, if identically then directly upgrade responder address binding address list and send to upgrade confirmation to initiating terminal and finish the address and upgrade, if different then send the source address load of authorization information and this initiating terminal to initiating terminal;
If initiating terminal receives the source address load of authorization information and this initiating terminal, then according to the public address of corresponding clauses and subclauses in this initiating terminal bind address tabulation of the content update of this source address load, and when returning authorization information, return the binding clauses and subclauses of upgrading behind the public address;
Responder receives the packet that initiating terminal sends, and judges authorization information, if inequality then abandon this packet, then handles new binding clauses and subclauses if authorization information is identical, with new binding clauses and subclauses renewal responder address list.
Source address to packet when source address that responder receives scheduler request judgment data bag is identical with the public address of binding clauses and subclauses in this request message sends authorization information, initiating terminal then returns this information to responder if only receive this authorization information, responder judges whether the identical address list clauses and subclauses that then send with initiating terminal with the authorization information of sending are upgraded the corresponding address list clauses and subclauses of this responder to this authorization information, send the renewal confirmation to initiating terminal after renewal is finished, finish the address and upgrade.
After initiating terminal and responder had all upgraded address list, initiating terminal upgraded tabulation to the address that other nodes send and is the address list after upgrading.
Described authorization information is a random number, is used to prevent assailant's data falsification.
Old binding clauses and subclauses can be in the IP address useless or exceed life cycle after deletion automatically.
The operating parameter that described scheduler adopted is NAT-DETECTION-SOURCE-IP and the NAT-DETECTION-DESTINATION-IP state information of IKEv2.
Described address is upgraded load and is encapsulated by ESP.
The invention solves the address replacement problem of IPsec Security Association.Make Security Association no longer be confined to unique IP address, Security Association also can upgrade automatically when the IP address modification, and its process does not need artificial participation, also can be as the consume system resources of re-encryption.And abundant safeguard protection is provided, and the address is upgraded load and is encapsulated by ESP, is encrypted and integrity protection, can guarantee that message can not altered in transmission.But the program of returning route inspection has been adopted in the address renewal, guaranteed the physical reachability distance of scheduler, prevented " third party's bombing " and " transparent pseudo-NAT attacks ".
Description of drawings
But Fig. 1 be existing Addrmgmt protocol definition return the route inspection work sheet;
Fig. 2 is a message switching work sheet of the present invention.
Embodiment
Below in conjunction with description of drawings the specific embodiment of the present invention:
The invention provides a kind of address renewing method of IKE Network Based, need safeguard the bind address tabulation of a privately owned address and public address at initiating terminal and responder main frame.Privately owned address is the IP address of initiating terminal main frame itself, and this IP address may be the privately owned address in certain subnet, is used to identify Security Association; Public address is a packet through reformed address behind the NAT, and the disclosure address is that Internet goes up real IP address, and this address adds that transport layer port number just can finish NAT and pass through.The bind address tabulation is divided into two parts:
A part is an initiating terminal host binding address list, and list of entries is initiating terminal main frame private IP address and public address thereof.After the initiating terminal main frame obtains new private IP address (if not having under the situation of NAT) for obtaining new public address, just in initiating terminal host binding address list, set up new clauses and subclauses automatically, and to responder main frame transmission address update request, old binding clauses and subclauses can be in the IP address useless or exceed life cycle after deletion automatically, if the initiating terminal main frame is not after NAT, then public address is identical with privately owned address, what no matter the initiating terminal main frame obtained is new privately owned address or new public address, and default situations all is that public address is arranged to the address identical with privately owned address.List content is upgraded automatically according to the return information of responder main frame.
Another part is a responder host binding address list, and list of entries is initiating terminal host IP address and public address thereof.The content of bind address tabulation is upgraded automatically according to the notice of responder main frame.Each binding clauses and subclauses all has a life cycle, and the clauses and subclauses that exceed life cycle can be deleted automatically.
Wherein, initiating terminal host binding address list is mainly used in the address and upgrades, and respective end host binding address list is mainly used in the sign and the NAT of Security Association and passes through.
When mobile device is a notebook, it can have several different methods to be connected on the Internet.Such as, use fixing Ethernet, WLAN and GPRS networking, and these modes can be used in the different time.People always attempt using the most effective connection, but these connections may often change, such as, a notebook has disconnected Ethernet and has connected the WLAN that brings into use company, afterwards, it has left company again, disconnects WLAN connection bringing into use GPRS on the way home.It may bring into use WLAN to connect (still with different IP addresses) again after going home.
This equipment does not use mobile IP v 6 or similar agreement, and it is just hoped with the security gateway of company and keeps VPN to be connected.Here user's notebook is an initiating terminal, and the VPN security gateway of company is a responder, and the address renewal process comprises the exchange of four messages, and detailed process as shown in Figure 2.
When initiating terminal obtains new private IP address, just in this host binding address list, set up new clauses and subclauses (this moment, public address was set to identical with privately owned address), and send the address update request to responder.
When responder is received the address update request, the public address in the source address of meeting comparing data bag and this request data package binding clauses and subclauses.If identical, then the source address to packet sends NONCE load; If different, then the source address to packet sends NONCE load and NAT-DETECTION-DESTINATION-IP state information, and wherein, the data in the NAT-DETECTION-DESTINATION-IP state information are source addresses of article one message.
Initiating terminal can be according to the mode of content of message selection processing after receiving the second message.If have only NONCE load in the message, then initiating terminal returns this NONCE value.If in the message NAT-DETECTION-DESTINATION-IP state information is arranged, then according to the public address of corresponding clauses and subclauses in the content update initiating terminal host binding address list of NAT-DETECTION-DESTINATION-IP state information, except NONCE load, also to comprise the binding clauses and subclauses after the renewal in the 3rd message that send this moment, promptly upgrade the binding clauses and subclauses of public address.
After responder is received the 3rd message, NONCE value at first relatively, as if the NONCE value of returning with send identical, then handling other content of message; If the NONCE difference then directly abandons this message.Then check other content after message is accepted,, then upgrade the bind address tabulation with new binding clauses and subclauses if in the message new binding clauses and subclauses are arranged; Do not upgrading the bind address tabulation with the binding clauses and subclauses in article one message if there are new binding clauses and subclauses.After handling list of bindings, responder also will send the address and upgrade confirmation message, upgrades with presentation address and finishes.
Initiating terminal receives that whole address, renewal affirmation back, address renewal process finishes.
After the address was upgraded and finished, responder had obtained the new IP address (comprising privately owned address and public address) of initiating terminal, and initiating terminal has also upgraded the Binding Update tabulation of oneself, promptly knew the public address of oneself.Like this, when initiating terminal when second node sends the address and upgrades, can directly use the binding clauses and subclauses after the renewal.When being applied to minimum system, but just can avoid returning routing program, the message of exchange is reduced to two from four, alleviate the burden of system, simplify refresh routine.
In four above message switching, but second and the 3rd message just finished the function of returning route inspection.The second message is sent to the source address of article one message, if can receive the 3rd bar response message, just illustrates that this source address is reliable.The NONCE value that adds is a random number, for the forgery response message that prevents that the assailant is random.Even interface or IP address modification like this, but still can use original Security Association make Security Association can upgrade the IP address after the change automatically.
Another scene that may use MOBIKE is a security gateway, and the other end of gateway is the notebook that can roam.That is to say that security gateway can provide different interfaces to different ISP, even and these connections broken down also and to want new connection can be provided.Security gateway can be known it in advance with the IP group of addresses of using, but it needs dynamic notice client to use which address.
When initiating terminal obtains new private IP address, just in this host binding address list, set up new clauses and subclauses (this moment, public address was set to identical with privately owned address), and send the address update request to responder.
When responder is received the address update request, suppose in this occasion, the identity of communicating pair can be trusted fully, but only when communicating pair has sufficiently high reliability rating, just can remove and return routing program, or be applied to minimum system, this has just got rid of the possibility that the third party bombs, but at this moment can be configured to not need to return the route inspection program.After responder was received article one message, still if the public address of binding clauses and subclauses in the source address of comparing data bag and the request message identical, then can directly upgrade the bind address tabulation respective entries of responder and send and upgrade confirmation message.If different, then the source address to packet sends NONCE load and NAT-DETECTION-DESTINATION-IP state information, and wherein, the data in the NAT-DETECTION-DESTINATION-IP state information are source addresses of article one message.
Initiating terminal can be according to the mode of content of message selection processing after receiving the second message.Comprise NONCE load and NAT-DETECTION-DESTINATION-IP state information in the message, public address according to corresponding clauses and subclauses in the content update initiating terminal host binding address list of NAT-DETECTION-DESTINATION-IP state information, except NONCE load, also to comprise the binding clauses and subclauses after the renewal in the 3rd message that send this moment, promptly upgrade the binding clauses and subclauses of public address.
After responder is received the 3rd message, NONCE value at first relatively, as if the NINCE value of returning with send identical, then handling other content of message; If the NONCE difference then directly abandons this message.Then check other content after message is accepted,, then upgrade the bind address tabulation with new binding clauses and subclauses with new binding clauses and subclauses in the message; After handling list of bindings, responder also will send the address and upgrade confirmation message, upgrades with presentation address and finishes.
Initiating terminal receives that whole address, renewal affirmation back, address renewal process finishes.
The present invention does not define new load, and NAT-DETECTION-SOURCE-IP and the NAT-DETECTION-DESTINATION-IP state information of the former IKEv2 that is to use upgraded in the address.Wherein, the corresponding privately owned address of NAT-DETECTION-SOURCE-IP state information, the corresponding public address of NAT-DETECTION-DESTINATION-IP state information.
Beneficial effect of the present invention has been to solve the address replacement problem of IPsec Security Association.Make Security Association no longer be confined to unique IP address, Security Association also can upgrade automatically when the IP address modification, and its process does not need artificial participation, also can be as the consume system resources of re-encryption.Abundant safeguard protection is provided.The address is upgraded load and is encapsulated by ESP, is encrypted and integrity protection, can guarantee that message can not altered in transmission.But the program of returning route inspection has been adopted in the address renewal, guaranteed the physical reachability distance of scheduler, prevented " third party's bombing " and " transparent pseudo-NAT attacks ".Solved the compatibling problem of MOBIKE and NAT.By setting up Binding Update tabulation and to the upgrading in time of address modification, can in time find NAT device and finish NAT and pass through, when upgrading, the address also verified the accessibility of initiating terminal main frame finishing in new address.
Above embodiment only is used to illustrate the present invention, but not is used to limit the present invention.
Claims (9)
1. the address renewing method of an IKE Network Based, it is characterized in that, binding comprises the address list of privately owned address of initiating terminal main frame and public address in initiating terminal main frame and responder main frame, when obtaining new privately owned address, the initiating terminal main frame then in this end host address tabulation, sets up new clauses and subclauses, privately owned address in the described new clauses and subclauses is identical with public address, and the tabulation of responder host address is upgraded in request, determine that two ends connect privately owned address and the public address that uses, responder returns the affirmation lastest imformation and finishes the address renewal.
2. the address renewing method of a kind of IKE Network Based according to claim 1, it is characterized in that also comprising the steps, when responder receives the scheduler request, whether the public address of binding clauses and subclauses is the same in the source address of comparing data bag and this request message, if identically then directly upgrade responder address binding address list and send to upgrade confirmation to initiating terminal and finish the address and upgrade, if different then send the source address load of authorization information and this initiating terminal to initiating terminal;
If initiating terminal receives the source address load of authorization information and this initiating terminal, then according to the public address of corresponding clauses and subclauses in this initiating terminal bind address tabulation of the content update of this source address load, and when returning authorization information, return the binding clauses and subclauses of upgrading behind the public address;
Responder receives the packet that initiating terminal sends, and judges authorization information, if inequality then abandon this packet, then handles new binding clauses and subclauses if authorization information is identical, with new binding clauses and subclauses renewal responder address list.
3. the address renewing method of a kind of IKE Network Based according to claim 2, it is characterized in that, source address to packet when source address that responder receives scheduler request judgment data bag is identical with the public address of binding clauses and subclauses in this request message sends authorization information, initiating terminal then returns this information to responder if only receive this authorization information, responder judges whether the identical address list clauses and subclauses that then send with initiating terminal with the authorization information of sending are upgraded the corresponding address list clauses and subclauses of this responder to this authorization information, send the renewal confirmation to initiating terminal after renewal is finished, finish the address and upgrade.
4. the address renewing method of a kind of IKE Network Based according to claim 1, it is characterized in that, after initiating terminal and responder had all upgraded address list, initiating terminal upgraded tabulation to the address that other nodes send and is the address list after upgrading.
5. according to the address renewing method of claim 2 or 3 described a kind of IKEs Network Based, it is characterized in that described authorization information is a random number, be used to prevent assailant's data falsification.
6. according to the address renewing method of claim 2 or 3 described a kind of IKEs Network Based, it is characterized in that, old binding clauses and subclauses can be in the IP address useless or exceed life cycle after deletion automatically.
7. according to the address renewing method of claim 2 or 3 described a kind of IKEs Network Based, it is characterized in that the operating parameter that described scheduler adopted is the NAT-DETECTION-SOURCE-IP and the NAT-DETECTION-DESTINATION-IP state information of Internet Key Exchange.
8. according to the address renewing method of arbitrary described a kind of IKE Network Based among the claim 1-3, it is characterized in that described address is upgraded load and encapsulated by ESP.
9. the address renewing method of a kind of IKE Network Based according to claim 7 is characterized in that, described address is upgraded load and encapsulated by ESP.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CNB2004100871329A CN100556027C (en) | 2004-11-01 | 2004-11-01 | A kind of address renewing method of IKE Network Based |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CNB2004100871329A CN100556027C (en) | 2004-11-01 | 2004-11-01 | A kind of address renewing method of IKE Network Based |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN1770761A CN1770761A (en) | 2006-05-10 |
| CN100556027C true CN100556027C (en) | 2009-10-28 |
Family
ID=36751753
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CNB2004100871329A Expired - Fee Related CN100556027C (en) | 2004-11-01 | 2004-11-01 | A kind of address renewing method of IKE Network Based |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN100556027C (en) |
Families Citing this family (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| RU2413376C2 (en) * | 2006-06-07 | 2011-02-27 | Квэлкомм Инкорпорейтед | Efficient methods and devices of addressing wireless communication lines |
| CN101212425A (en) * | 2006-12-28 | 2008-07-02 | 北京交通大学 | Multi-service supporting integrated network construction method and routing device |
| WO2008080416A1 (en) * | 2006-12-28 | 2008-07-10 | Telecom Italia S.P.A. | Method and apparatus to control application messages between a client and a server having a private network address |
| CN101197664B (en) * | 2008-01-03 | 2010-12-08 | 杭州华三通信技术有限公司 | Method, system and device for key management protocol negotiation |
| CN101217482B (en) * | 2008-01-18 | 2010-09-08 | 杭州华三通信技术有限公司 | A method traversing NAT sending down strategy and a communication device |
| CN101426030B (en) * | 2008-12-09 | 2012-06-27 | 华为技术有限公司 | Method and terminal for acquiring network address |
| CN104410728B (en) * | 2014-11-27 | 2017-10-10 | 中国科学院计算机网络信息中心 | Network DNS security update method in a kind of MIPv6 |
-
2004
- 2004-11-01 CN CNB2004100871329A patent/CN100556027C/en not_active Expired - Fee Related
Non-Patent Citations (2)
| Title |
|---|
| Dynamic Host Configuration Protocol. R. Droms.RFC2131. 1997 |
| Dynamic Host Configuration Protocol. R. Droms.RFC2131. 1997 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN1770761A (en) | 2006-05-10 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN100539501C (en) | Unified Identity sign and authentication method based on domain name | |
| US6976177B2 (en) | Virtual private networks | |
| US20010054158A1 (en) | Computer systems, in particular virtual private networks | |
| US8104082B2 (en) | Virtual security interface | |
| CN103875226A (en) | System and method for host-initiated firewall discovery in a network environment | |
| JP2004241976A (en) | Mobile communication network system and method for authenticating mobile terminal | |
| US11784813B2 (en) | Crypto tunnelling between two-way trusted network devices in a secure peer-to-peer data network | |
| CN102111326A (en) | Method, system and device for realizing mobility in layer 2 tunnel protocol virtual private network | |
| Fan | Analysis on the security architecture of zigbee based on ieee 802.15. 4 | |
| Parthasarathy | Protocol for carrying authentication and network access (PANA) threat analysis and security requirements | |
| CN101478485A (en) | Method for local area network access control and network gateway equipment | |
| CN102571811A (en) | User access authority control system and method thereof | |
| US20230209345A1 (en) | Device-specific selection between peer-to-peer connections and core-based hybrid peer-to-peer connections in a secure data network | |
| CN100556027C (en) | A kind of address renewing method of IKE Network Based | |
| CN103188228A (en) | Method for achieving safety protection from end to end, security gateway and system | |
| CN114726523B (en) | Password application service system and quantum security capability open platform | |
| US11582201B1 (en) | Establishing and maintaining trusted relationship between secure network devices in secure peer-to-peer data network based on obtaining secure device identity containers | |
| CN102281287B (en) | TLS (transport layer security)-based separation mechanism mobile signaling protection system and method | |
| CN105898720B (en) | A kind of processing method of short message, apparatus and system | |
| US20220400011A1 (en) | Anti-replay protection based on hashing encrypted temporal key in a secure peer-to-peer data network | |
| CN102447710A (en) | Method and system for controlling access right of user | |
| KR20170017860A (en) | Network virtualization system based of network vpn | |
| CN100536471C (en) | Method for effective protecting signalling message between mobile route and hometown agent | |
| JP2004266516A (en) | Network management server, communication terminal, edge switch device, program for communication, and network system | |
| JPH1132088A (en) | Network system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| TR01 | Transfer of patent right | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20171205 Address after: Tiefu iron rich street Pizhou city 221331 Jiangsu city of Xuzhou province (Cultural Center) Patentee after: Pan Rongqiong Address before: 510640 Guangdong City, Tianhe District Province, No. five, road, public education building, unit 371-1, unit 2401 Patentee before: GUANGDONG GAOHANG INTELLECTUAL PROPERTY OPERATION Co.,Ltd. Effective date of registration: 20171205 Address after: 510640 Guangdong City, Tianhe District Province, No. five, road, public education building, unit 371-1, unit 2401 Patentee after: GUANGDONG GAOHANG INTELLECTUAL PROPERTY OPERATION Co.,Ltd. Address before: 518129 Bantian HUAWEI headquarters office building, Longgang District, Guangdong, Shenzhen Patentee before: HUAWEI TECHNOLOGIES Co.,Ltd. |
|
| CB03 | Change of inventor or designer information | ||
| CB03 | Change of inventor or designer information |
Inventor after: Qian Shuanghua Inventor before: Miao Fuyou Inventor before: Wang Jianglin Inventor before: Gao Shuai Inventor before: Qin Yajuan Inventor before: Liu Ying Inventor before: Zhang Hongke Inventor before: Zhang Sidong Inventor before: Yang Shen Inventor before: Su Wei Inventor before: Ren Yan Inventor before: Yang He Inventor before: Zheng Zuzhou Inventor before: Chen Jian |
|
| TR01 | Transfer of patent right | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20180124 Address after: Qidong City, Jiangsu province 226200 Nantong lvsigang Lu Bei Cun Fisheries Group No. 54 Patentee after: Qian Shuanghua Address before: Tiefu iron rich street Pizhou city 221331 Jiangsu city of Xuzhou province (Cultural Center) Patentee before: Pan Rongqiong |
|
| TR01 | Transfer of patent right | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20181102 Address after: 221300 Liu Gou Village, Zou Zhuang Town, Pizhou City, Xuzhou, Jiangsu Patentee after: Xuzhou Yong Wei Wood Industry Co.,Ltd. Address before: 226200 No. 54 fishing group, Lubei village, Lusi Gang Town, Qidong, Nantong, Jiangsu Patentee before: Qian Shuanghua |
|
| CF01 | Termination of patent right due to non-payment of annual fee | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20091028 Termination date: 20181101 |