CN101183936B

CN101183936B - IPv6 identification load switching method in internet cipher key switch

Info

Publication number: CN101183936B
Application number: CN2007101959129A
Authority: CN
Inventors: 秦春华
Original assignee: ZTE Corp
Current assignee: ZTE Corp
Priority date: 2007-12-04
Filing date: 2007-12-04
Publication date: 2011-04-20
Anticipated expiration: 2027-12-04
Also published as: CN101183936A

Abstract

The invention provides an IPv6 identity load exchange method in internet key exchange, comprising the following steps: the identity load content in the message is written in ipv6-address/prefix-length when the sending end negotiating with IPv6 strategy sends internet key exchange message with ID_IPV6_ADDR_SUBNET type identity load; the responding end analyzes the inner identity load after receiving the message, and sends the internet key exchange response message to the sending end. The invention has the advantages that the length of the identity load is shortened, the process of the sending end and the receiving end is simplified, and the method is compatible with the original protocol.

Description

The method of IPv6 identification load exchange in a kind of the Internet Key Exchange

Technical field

The present invention relates to data communication field, relate in particular to the method for Pv6 identification load exchange in a kind of IKE (the Internet Key Exchange) exchange.

Background technology

Safety has become more and more important requirement in the data communication field.

IPsec has provided a whole set of architecture that is applied to network data security on the IP layer, comprises network authenticating protocol, encapsulating security payload (esp), IKMP and is used for network authentication and some algorithms of encryption etc.; Psec has stipulated how to select security protocol between peer layer, has determined security algorithm and cipher key change, Network Security Service such as access control, data source authentication, data encryption upwards are provided.

Wherein IKMP mainly is meant the Internet Key Exchange (IKE), and it has solved problem how to set up or to upgrade shared key in unsafe network environment (in the internet) safely.Used the identification load (Identification Payload) of definition among the RFC2407 " The Internet IP Security Domain of Interpretation forISAKMP " in the IKE exchange, this load allows both sides to exchange identity information, and the information that wherein comprises is used to confirm the identity of SA negotiation initiator.The respondent decides the security strategy that is applied to security association (SA) with identity information.

When IKE supports IPv6, can use the strategy that the ID_IPV6_ADDR_SUBNET type is consulted both sides, payload content is the value of 2 16 bytes, first 16 byte representation IPv6 address, second 16 byte representation IPv6 netmask.

This method has following weak point:

Describe according to RFC2373 " IP Version 6 Addressing Architecture ", adopt the ipv6-address/prefix-length form to represent the IPv6 address, inconsistent with the form of stipulating in the RFC2407 agreement.

Adopt the mode of 16 byte netmasks additionally to take loaded length when sending the identification load of ID_IPV6_ADDR_SUBNET type in the RFC2407 agreement, and owing to use 32 mask method for expressing, need step-by-step to carry out and operation, difficult treatment during parsing.

Summary of the invention

The technical problem to be solved in the present invention provides the method for IPv6 identification load exchange in a kind of the Internet Key Exchange, when solving the identification load that sends the ID_IPV6_ADDR_SUBNET type in the prior art, netmask additionally takies the defective of loaded length and difficult treatment in original mode of filling in payload content.

In order to address the above problem, the invention provides the method for IPv6 identification load exchange in a kind of the Internet Key Exchange, comprising:

When originating end negotiation IPv6 strategy sends the Internet Key Exchange message of the identification load that carries the ID_IPV6_ADDR_SUBNET type, the content of the identification load in the described message is filled in the ipv6-address/prefix-length form;

After responder is received described message, resolve identification load wherein, and send the Internet Key Exchange back message using to originating end.

Further, after described originating end sends described the Internet Key Exchange message, if receive error message that described responder is sent or overtime after do not receive that the Internet Key Exchange back message using that described responder is sent then resends described the Internet Key Exchange message.

Further, described originating end is each when sending described the Internet Key Exchange message, at first read count value, if being 0, described count value fills in wherein identification load with the ipv6-address/prefix-length form, if described count value is that 1 form with 32 bytes is filled in described identification load, first 16 byte is the IPv6 address, and second 16 byte is the IPv6 netmask, fills in the described count value of change after the content of described identification load.

Further, after described responder is received described message, at first judge whether to resolve identification load wherein, can then resolve described identification load, otherwise send error message to originating end.

Further, when described responder is resolved described identification load, if the length of described identification load is that 20 bytes are then by the described identification load of ipv6-address/prefix-length format analysis; If the length of described identification load is that 32 bytes are the IPv6 address by first 16 byte then, the form that second 16 byte are the IPv6 netmask is resolved described identification load.

Further, at originating end one switch is set and identifies described count value, represent that when switch open the count value value is 0, the count value value was 1 when switch cut out.

Further, the described count value of change is meant after filling in the content of described identification load: switch is that opening then is changed to closed condition with described switch after filling in the content of described identification load when reading count value, and switch is that closed condition then is changed to opening with described switch after filling in the content of described identification load when reading count value.

In sum, the invention provides the method for IPv6 identification load exchange in a kind of the Internet Key Exchange, when sending the identification load of ID_IPV6_ADDR_SUBNET type, the preferential form of ipv6-address/prefix-length that adopts is filled in payload content, shortened the length of identification load, simplified the processing of originating end and receiving terminal, and can with original protocol-compliant.

Description of drawings

Fig. 1 is application scenarios figure of the present invention;

Fig. 2 be among the present invention in the Internet Key Exchange the flow chart during as originating end;

Fig. 3 is the flow chart of holding in response in the Internet Key Exchange among the present invention.

Embodiment

The invention provides the method for IPv6 identification load exchange in a kind of the Internet Key Exchange, Fig. 1 is application scenarios figure of the present invention, and the IPsec peers include both interconnects by IP network, by the ike negotiation key; IP network is the IPv6 network.When the originating end of IKE exchange sends the identification load of ID_IPV6_ADDR_SUBNET type, the preferential form of ipv6-address/prefix-length that adopts is filled in the identification load content, promptly use 20 byte lengths to fill in identification load, first 16 byte is the IPv6 address, the least-significant byte sign prefix length of next 4 bytes, high 24 are filled to 0.

Describe the inventive method below with reference to accompanying drawing in detail with the mode of embodiment:

The operation of originating end when being illustrated in figure 2 as local terminal as negotiation IPv6 strategy:

Step 201: the beginning consulting tactical is ready for sending the IKE message that carries ID load;

Step 202: judging whether the ID load type is ID_IPV6_ADDR_SUBNET, is execution in step 203 then;

Step 203: checking whether count value is 0, is execution in step 204 then, otherwise execution in step 205;

Can but be not limited to one switch to be set and identify count value at originating end, represent during switch open that the count value value is 0, the count value value was 1 when switch cut out.

Step 204: the ID payload content is extended this as the ipv6-address/prefix-length form, take 20 byte lengths altogether, first 16 byte is the IPv6 address, the least-significant byte sign prefix length of 4 bytes in back, and high 24 are filled to 0; And change the switch state of this moment, and switch is changed to closed condition, be about to count value and be made as 1.Execution in step 206;

Step 205: the count value that sends ID load is carried out clearly 0, promptly change the switch state of this moment, switch is changed to opening; And fill in the ID payload content by the form of the ID_IPV6_ADDR_SUBNET type of the former regulation of agreement, be about to the value that ID load extends this as 2 16 bytes, first 16 byte representation IPv6 address, second 16 byte representation IPv6 netmask; Execution in step 206;

Step 206: the IKE message that sends packaged ID load is to the opposite end, is about to packaged ID load and sends to responder together with the remainder of IKE message, herein the same prior art of remainder content of IKE message;

Do not receive the IKE back message using that responder is sent if receive error message or overtime back originating end that responder is sent after the step 206, then resend the IKE message that carries ID load.When resending the IKE message, send by the ipv6-address/prefix-length form, send if count value is 1 form by 32 bytes of the former regulation of agreement if count value is 0.The same prior art of overtime herein implication.

Be illustrated in figure 3 as the opposite end handling process of termination receipts IKE message in response:

Step 301: the IKE message that receives originating end;

Step 302: the IKE message that judge to receive if ID load judges whether the ID load type is ID_IPV6_ADDR_SUBNET, is an execution in step 303 then;

Step 303: can judgement resolve the ID load in the IKE message of receiving, promptly judges whether to support the ID load of ipv6-address/prefix-length form, can resolve then execution in step 304, otherwise execution in step 309;

Step 304: judging whether the ID loaded length in the IKE message is 20 bytes, is execution in step 305 then, otherwise execution in step 306;

Step 305: with ipv6-address/prefix-length format analysis ID load, take 20 byte lengths altogether, first 16 byte is the IPv6 address, the least-significant byte sign prefix length of 4 bytes in back, and high 24 are filled to 0; Execution in step 308;

Step 306: judging whether the ID loaded length in the IKE message is 32 bytes, is execution in step 307 then;

Step 307: the ID load by in the definition parsing IKE message of former protocols having ordinance load content, take 32 byte lengths altogether, first 16 byte is the IPv6 address, second 16 byte is the IPv6 netmask; Execution in step 308;

Step 308: send corresponding IKE back message using to originating end; This goes on foot same prior art.

Step 309: send error message to originating end.

Claims

1. the method for IPv6 identification load exchange in the Internet Key Exchange comprises:

2. the method for claim 1 is characterized in that:

After described originating end sends described the Internet Key Exchange message, if receive error message that described responder is sent or overtime after do not receive that the Internet Key Exchange back message using that described responder is sent then resends described the Internet Key Exchange message.

3. method as claimed in claim 2 is characterized in that:

Described originating end is each when sending described the Internet Key Exchange message, at first read count value, if being 0, described count value fills in wherein identification load with the ipv6-address/prefix-length form, if described count value is that 1 form with 32 bytes is filled in described identification load, first 16 byte is the IPv6 address, second 16 byte is the IPv6 netmask, fills in the described count value of change after the content of described identification load.

4. the method for claim 1 is characterized in that:

After described responder is received described message, at first judge whether to resolve identification load wherein, can then resolve described identification load, otherwise send error message to originating end.

5. method as claimed in claim 3 is characterized in that:

When described responder is resolved described identification load, if the length of described identification load is that 20 bytes are then by the described identification load of ipv6-address/prefix-length format analysis; If the length of described identification load is that 32 bytes are the IPv6 address by first 16 byte then, the form that second 16 byte are the IPv6 netmask is resolved described identification load.

6. method as claimed in claim 3 is characterized in that:

At originating end one switch is set and identifies described count value, represent that when switch open the count value value is 0, the count value value was 1 when switch cut out.

7. method as claimed in claim 6 is characterized in that:

The described count value of change is meant after filling in the content of described identification load: switch is that opening then is changed to closed condition with described switch after filling in the content of described identification load when reading count value, and switch is that closed condition then is changed to opening with described switch after filling in the content of described identification load when reading count value.