CN101569160A - Method for transmission of DHCP messages - Google Patents
Method for transmission of DHCP messages Download PDFInfo
- Publication number
- CN101569160A CN101569160A CN200780046508.3A CN200780046508A CN101569160A CN 101569160 A CN101569160 A CN 101569160A CN 200780046508 A CN200780046508 A CN 200780046508A CN 101569160 A CN101569160 A CN 101569160A
- Authority
- CN
- China
- Prior art keywords
- key
- dhcp
- dynamic host
- host configuration
- configuration protocol
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Landscapes
- Mobile Radio Communication Systems (AREA)
Abstract
The invention describes a method for transmission of a DHCP message between a telecommunication network, especially a telecommunication network according to the WiMAX-standard, and an Internet Protocol (IP) subscriber (SS/MS; MN) to the telecommunication network. Therein, an information secured with an encryption key is added to the DHCP message. The encryption key is derived from a basic key being provided by a network component of the telecommunication network.
Description
Technical field
The present invention relates to be used at telecommunications network, especially according to the method for transmission of dhcp messages between Internet protocol (IP) subscriber of the telecommunications network and the telecommunications network of WiMAX standard.
In the following description, explain problem with reference to the WiMAX telecommunications network as basis of the present invention.This reference to the WiMAX telecommunications network only is an example.In fact, the present invention relates to the telecommunications network of any kind of.
Background technology
The WiMAX network comprises with the WiMAX connectivity service network (CSN) of core net compatibility and has the WiMAX access service network (ASN) of the effect of wireless access network.ASN and CSN can be by different commercial entities or operator's operations.Total structure of WiMAX network is shown in Fig. 1, and Fig. 1 shows the reference model of WiMAX.The detailed description of network reference model can
Www.wimaxforum.org/technology/documents/In specification " WiMAXend-to-end network systems architecture (WiMAX point to point network system configuration) ", the 6th chapter " Network Reference Model (network reference model) ", find down.The content of this draft specification is attached in this specification by reference.
CSN usually comprises WiMAX subscriber's local agent (home agent).Local agent can not be arranged in ASN.Local agent has the task at subscriber's local address on the local network (CSN) of time defendance subscriber at it away from this locality.This means that subscriber's local address is correct in the topology of the sub-network that local agent is arranged in, like this, local address must be distributed by the CSN territory.WiMAX subscriber's local network can be dynamically allocated, and it can be or in this locality-CSN (H-CSN) or among the CSN (V-CSN) that is visited, and this depends on the roaming agreement between local and the WiMAX Internet service provider (NSP) that visited.
The feature of WiMAX network configuration is for the support as the subscriber of so-called " simple Internet protocol (IP) " terminal of the embodiment that does not comprise mobile IP storehouse.Mobility at network (IP) layer place for these equipment moves (proxy mobile) IP by ASN by means of the agency and manages.
Simple IP terminal uses DHCP to obtain IP address and other IP configuration parameter.The IP address that is used for simple IP terminal is distributed by CSN (H-CSN or V-CSN), but this address assignment is carried out by Access Network ASN to terminal.For this address assignment, DHCP relay device (relay) must provide in ASN.In contrast, the DPCH server is arranged in CSN, and the DHCP relay device in ASN is relayed to Dynamic Host Configuration Protocol server the CSN to dhcp message from simple IP terminal.In this case, authenticate during (subscriberauthentication) the subscriber, CSN provides the IP address of the Dynamic Host Configuration Protocol server among the CSN to ASN.The later use with handle by the DHCP relay device in ASN in this address comes the dhcp message of self terminal to be relayed to correct Dynamic Host Configuration Protocol server.Dynamic Host Configuration Protocol server can be arranged in V-CSN or be arranged in H-CSN.Under those situations, suppose that ASN and CSN can be separated by the IP cloud (for example public internet) of the unknown.With reference to Fig. 1, reference point R3 and R5 can move on such IP foundation structure of not trusted.
Because this topology of telecommunications network, the Dynamic Host Configuration Protocol server in CSN is fragile for various types of attacks.Attack can from the network of not trusted that connects ASN and CSN and from authenticated but the WiMAX subscriber of misoperation the two initiate.If the sub-option of relay agent authentication (relayagent authentication suboption) that DHCP relay device in ASN and the Dynamic Host Configuration Protocol server in CSN are disposed as stipulated in RFC4030 (http://rfc.net/rfc4030.html) then can be avoided these attacks.The method of regulation provides authentication, integrity protection and playback (replay) protection of dhcp message in RFC 4030.Thus, suppose that DHCP relay device and Dynamic Host Configuration Protocol server share a privacy key (secretkey), this privacy key is used for calculating cryptographic checksum, and this provides above-mentioned protection.
Summary of the invention
So, the objective of the invention is to improve the fail safe when between telecommunications network and IP subscriber, exchanging dhcp message.
According to the present invention, provide and be used at telecommunications network, particularly according to the method for transmission of dhcp messages between Internet protocol (IP) subscriber of the telecommunications network and the telecommunications network of WiMAX standard, wherein the information of maintaining secrecy with encryption key is added in the dhcp message, and wherein encryption key obtains from the basic key that the network components by telecommunications network provides.
By using the encryption key that obtains from basic key some information of maintaining secrecy that the maximum security of antagonism misuse (against misuse) can be provided.Encryption key only is used for maintaining secrecy and is added to the information of dhcp message, but is not dhcp message itself.This means that encryption key is used for message is carried out digital signature.The entity that only has encryption key can compute signature, verifies the legitimacy (authenticity) of message thus.The entity that sends calculates information signature (using encryption key as a part of calculating), and signature is added in the message.Receiving entity (also having encryption key) oneself recomputates signature, and the result is compared with the signature that receives in message.If their couplings, then receiving entity can be sure of, the message of reception is had the entity signature (and route of no use is distorted message) of encryption key.Encryption key can dynamically obtain from basic key, so that the protection dhcp message.
In other embodiments, the encryption key dhcp message that is used for maintaining secrecy and between the Dynamic Host Configuration Protocol server of the heterogeneous networks (subnet) of telecommunications network and DHCP relay device, exchanges in optional status.Dynamic Host Configuration Protocol server can be positioned at core net, and such as CSN, and the DHCP relay device can be positioned at Access Network, such as the ASN in the WiMAX telecommunications network.Because the dhcp message that uses encryption key to come privacy protection to exchange between Dynamic Host Configuration Protocol server and DHCP relay device, message can transmit by the IP foundation structure of not trusted, and does not have Dynamic Host Configuration Protocol server may become the danger of target of attack.
In other embodiments, the dhcp message that the subscriber generates is intercepted by telecommunications network, wherein when dhcp message is finished safety and/or authenticity examination, adds the information by encryption keys.Intercepting and inspection dhcp message can be finished by the DHCP relay device.Intercepting and inspection comprise the unicast traffic of pointing to Dynamic Host Configuration Protocol server.Thereby, can finish checking to each dhcp message content.Just in case dhcp message is by various safety and/or authenticity examinations about deception, DoS attack etc., will be added in the message with the information of encryption keys, thereby guarantee for telecommunications network, Dynamic Host Configuration Protocol server especially, this is legal dhcp message.
In other embodiments, basic key is generated by using the random value that generates.Random value can be generated by the aaa server in subscriber's local network.Aaa server can be arranged in core net, for example CSN.For secret reason, basic key can be specific to Dynamic Host Configuration Protocol server.The key that is generated by aaa server can be sent to Dynamic Host Configuration Protocol server by using radius protocol.Radius protocol also can be used for transmitting basic key to extendible authentication protocol or authenticator (IAP), as will be described later.
In other embodiments, basic key and the key identifier that is associated identify the key that is associated of basic key respectively, preferably are sent to Access Network into subscriber's service from the aaa server of subscriber's local network in inserting request message.The key identifier that is associated can be generated by aaa server.
In other embodiments, encryption key obtains specific to each the Access Network gateway in each access service network, and the Access Network gateway is used as the DHCP relay device that is used for the subscriber.This means; obtain specific to the right additional encryption key of each DHCP relay device/Dynamic Host Configuration Protocol server from basic key, wherein these keys are used for protecting the dhcp message that particularly exchanges between telecommunications network and the subscriber between DHCP relay device and Dynamic Host Configuration Protocol server.Basic key and the key that obtains also are not tied to unique user or authen session, but are tied to specific Dynamic Host Configuration Protocol server and DHCP relay device/Dynamic Host Configuration Protocol server is right.
The specific encryption key of Access Network gateway is generated by using basic key.
In a further embodiment, the specific encryption key of Access Network gateway is used for calculating the sub-option of relay agent authentication as security information.This means, for the calculating of the sub-option of relay agent authentication, do not use basic key and be to use obtain from basic key and be for the specific encryption key of Access Network gateway.The Access Network gateway is used as subscriber's DHCP relay device.The encryption key of being advised, obtain is the IP address of application network gateway to be included in key obtain in the process specific to the method for each application network gateway.
When the reception of the Dynamic Host Configuration Protocol server in core net comprised the dhcp message of the sub-option of relay agent authentication, it must the sub-option of authentication verification.Just in case also not corresponding to the basic key of the key identifier in the sub-option of the authentication that is comprised in reception, Dynamic Host Configuration Protocol server will be from aaa server request basic key for Dynamic Host Configuration Protocol server.This can be with external agent-local agent (FA-HA) authentication extension that need verify when local agent in mobile IP register request message the time, and the identical mode of local agent request local agent-root key (HA-RK) is finished.Dynamic Host Configuration Protocol server can use the access request message to come from aaa server request basic key.Dynamic Host Configuration Protocol server must be included in the value from the key identifier field of the sub-option of authentication of the dhcp message that receives in access barred (access except) message.Aaa server is accepting the Dynamic Host Configuration Protocol server of the request that is delivered in the message corresponding to the key identifier of the basic key of Dynamic Host Configuration Protocol server and indication in access.Just in case key identifier is unknown for aaa server, then aaa server sends to Dynamic Host Configuration Protocol server to admission reject.On the other hand, if the basic key that is associated with the key identifier that receives is available in Dynamic Host Configuration Protocol server, then Dynamic Host Configuration Protocol server does not need to aaa server request basic key.In this case, Dynamic Host Configuration Protocol server will use available basic key.In case basic key is available at the Dynamic Host Configuration Protocol server place, it just generates the encryption key specific to this DHCP relay device, and uses the key that generates to come the sub-option of authentication verification.Dynamic Host Configuration Protocol server also calculates it by the encryption key that uses request and the sub-option of relay agent authentication is included in its answer.
In additional embodiments of the present invention, to be maintained in the Access Network gateway that is used as extendible authentication protocol (EAP) authenticator, till expire the life cycle of basic key the life cycle of basic key, the key identifier that is associated and basic key.
In other embodiments, will be held being used as Access Network gateway encryption key, key identifier and the playback detection counter of the DHCP relay device that is used for the subscriber (replay detection counter).
In other embodiments, with key identifier and playback detected value, via WiMAX especially, specific signaling message is sent to new DHCP relay device as a contextual part from old DHCP relay device.
At any time, aaa server can have several effective basic keys specific to single Dynamic Host Configuration Protocol server.These basic keys must have different key identifiers and can have different life cycles.Thus, guarantee that the no seam of basic key refreshes, make oldly can in certain time interval, exist jointly with new basic key and be used simultaneously.
In a further embodiment, when the Dynamic Host Configuration Protocol server in the local network the subscriber when the DHCP relay device of Access Network receives dhcp message, also unavailable for its encryption key, represent that key identifier is known for Dynamic Host Configuration Protocol server but authenticate sub-option, Dynamic Host Configuration Protocol server generates new encryption key from the known basic key that is associated with the key identifier that receives.
In other embodiments, be used for encryption key and the derived rule that is used for basic key.
The present invention also comprises the one or more telecommunications network parts that are used to realize according to the method for previously described any way.
The present invention enables to be connected DHCP relay device in the Access Network and the Dynamic Host Configuration Protocol server in core net via the IP network of not trusted such as the Internet.By effective key management mechanism is provided, might in dhcp message, provide relay agent authentication sub-option, it avoids the Dynamic Host Configuration Protocol server in the core net to be subjected to various types of attacks.Because the limited life cycle of the life cycle that is tied to session of subscriber is dynamically derived and had to the encryption key that is used for secret dhcp message, the method that is provided can be disposed very widely.
Description of drawings
To the present invention be described by example with to the reference of accompanying drawing.
Fig. 1 shows the network reference model according to the WiMAX telecommunications network,
Fig. 2 shows WiMAX key hierarchy (hierarchy),
Fig. 3 shows the process of initial DHCP key distribution, and
It is not the schematic diagram of arranging DHCP key distribution under the situation of (collocate) together that Fig. 4 is presented at authenticator (authenticator) and DHCP relay device.
Embodiment
With reference to the WiMAX telecommunications network the present invention is described.Known WiMAX network reference model is shown in Fig. 1.The feature of WiMAX architecture of a telecommunication network is to support " simple IP " terminal SS/MS.These simple IP terminal SS/MS use DHCP (DHCP) to obtain IP address and other IP configuration parameter.The IP address of IP terminal SS/MS that is used for being called as the subscriber is by WiMAX connectivity service network (CSN) (perhaps this locality-CSN (local VSP) or institute visit-CSN (CSN that is visited)) distribution.Carry out for subscriber SS/MS by the WiMAX access service network (ASN) that is called as Access Network IP address assignment.
According to the present invention, the distribution of IP address will be finished by using the DHCP relay device in ASN.Thus, suppose that Dynamic Host Configuration Protocol server is arranged in CSN and ASN provides the DHCP relay device.The purpose of DHCP relay device is that a dhcp message from subscriber SS/MS is relayed to the Dynamic Host Configuration Protocol server in CSN.During the subscriber authenticated, CSN was provided at the IP address of the Dynamic Host Configuration Protocol server among the CSN to ASN.This IP address is used by the DHCP relay device afterwards so that coming the dhcp message of self terminal to be relayed to correct Dynamic Host Configuration Protocol server.Owing to CSN and ASN can be arranged in the different sub-network that the IP network (for example public internet) via the unknown is connected.As a result, can on the IP foundation structure of not trusted, move (consulting node R 3 and R5) in the data that exchange between DHCP relay device and the Dynamic Host Configuration Protocol server.
May be under attack for fear of Dynamic Host Configuration Protocol server, the present invention advises using encryption key (after this being called the DHCP key) to come secret (secure) dhcp message between DHCP relay device and Dynamic Host Configuration Protocol server.Similarly method has been used by WiMAX Forum NWG standard and has been generated HA-RK, and this HA-RK is used for the authentication of the mobile IP signaling between HA and FA.Fig. 2 shows how WiMAX key hierarchy with various keys and they obtain.Can in RFC 4030, find this known illustrated explanation.The DHCP key generates from the basic key that will be called as DHCP-RK (root key (Root Key)).The DHCP-RK key is generated by the aaa server that is arranged in CSN.By using aaa protocol that key is transported to DHCP relay device and Dynamic Host Configuration Protocol server.Draw additional DHCP key from DHCP-RK, to being specific, and these DHCP keys are used for the dhcp message that protection exchanges between DHCP relay device (several) and Dynamic Host Configuration Protocol server for each DHCP relay device/Dynamic Host Configuration Protocol server for it.
DHCP-RK and do not depend on master session key (MSK) that generates owing to specific EAP authentication or the master session key of expanding (EMSK) from the DHCP key that it draws.Therefore, DHCP-RK and the DHCP key that draws also are not tied to (bind to) unique user or authen session, but are tied to specific Dynamic Host Configuration Protocol server and DHCP relay device/Dynamic Host Configuration Protocol server is right.DHCP-RK only is generated on request, rather than is used for each EAP (again) authentication that takes place.In any case the DHCP-RK key is passed to authenticator together with key identifier and lifetime values (lifetime value) during subscriber's network access authentication.Life cycle and by Dynamic Host Configuration Protocol server that generate and key identifier that identify specific DHCP-RK manage by aaa server.Aaa server is responsible for before DHCP-RK expires new DHCP-RK being delivered to authenticator.
DHCP-RK is generated by the aaa server that distributes Dynamic Host Configuration Protocol server to the authentication subscriber.Generate different DHCP-RK for each Dynamic Host Configuration Protocol server.DHCP-RK can be generated as follows by aaa server:
DHCP-RK=HMAC-SHA1 (RAND, " DHCP application root key ").
Thus, RAND is the random value that is generated by aaa server.Aaa server also is associated each DHCP-RK with unique key identifier.Key identifier is defined in RFC 4030.Key identifier is unique in the scope of single Dynamic Host Configuration Protocol server.Exist simultaneously for single Dynamic Host Configuration Protocol server under the situation of several DHCP-RK, they must have different key identifiers.The DHCP-RK that belongs to different Dynamic Host Configuration Protocol server can use same key identifier.Aaa server is delivered to EAP authenticator and Dynamic Host Configuration Protocol server to DHCP-RK.
If asked by specific DHCP relay device, then the EAP authenticator generates from DHCP-RK and is used for the right DHCP key of specific DHCP relay device/Dynamic Host Configuration Protocol server.DHCP key specific to DHCP relay device (it is also referred to as application network gateway A SN-GW) can followingly draw:
DHCP-key=HMAC SHA1 (DHCP-RK, " DHCP AUTH ", DHCP-repeater-IP, the DHCP-server-IP); Also promptly: DHCP-key=HMAC SHAl (DHCP-RK, " DHCP AUTH ", DHCP-Relay-IP, DHCP-Server-IP).
This key is drawn by EAP authenticator and Dynamic Host Configuration Protocol server.It is sent to the DHCP relay device by the EAP authenticator.
At any time, aaa server can have the several effective DHCP-RK key specific to single Dynamic Host Configuration Protocol server.These DHCP-RK keys must have different key identifiers and can have different life cycles.This is that to enable the seamless renewal of DHCP-RK needed, this make old and new DHCP-RK can a period of time at interval in common existence and can being used simultaneously.
The key that is generated by aaa server can be sent to Dynamic Host Configuration Protocol server and authenticator by using radius protocol.The DHCP key (drawing from DHCP-RK) that is generated by authenticator for example is sent to the DHCP relay device via the specific R4 signaling of WiMAX.Never be transported to the outside of Dynamic Host Configuration Protocol server by the key of Dynamic Host Configuration Protocol server generation.
With reference to Fig. 3, show distribution for the DHCP key of DHCP relay device under the situation that the EAP authenticator is arranged.
As mentioned above, authenticator and DHCP relay device are arranged in ASN, and aaa server, EAP server and key retainer (holder) are arranged in CSN together with Dynamic Host Configuration Protocol server.The subscriber of telecommunications network describes with MN.
During the verification process of the subscriber MN of telecommunications network, will carry out key distribution.So subscriber MN sends a request message to the Access Network gateway A SN-GW that is used as authenticator and DHCP relay device.The Access Network gateway is inserting request (Access-Request) message transport to CSN, especially aaa server.Because successful subscriber authenticates, authenticator is received in according to radius protocol and inserts the Dynamic Host Configuration Protocol server address of accepting in (Access-Accept) message.Can obtain at the aaa server place under the situation of several DHCP-RK of being associated with Dynamic Host Configuration Protocol server, aaa server should be included in the DHCP-RK with the longest remaining life cycle and accept in the message.Except DHCP-RK, accept life cycle and key identifier that message also comprises DHCP-RK, the latter is provided by Dynamic Host Configuration Protocol server.For example by using the method for definition in RFC-2868 joint 3.5, DHCP-RK is transferred on RADIUS, and encrypted.The key that is generated by aaa server is stored in (not shown) in the key retainer in the authenticator at ASN place.
During dhcp process, the DHCP relay device obtains the DHCP key that drawn from the key retainer at authenticator.The key retainer draws specific to the DHCP key of the DHCP relay device of request from DHCP-RK, and the key, its life cycle that draw and the key identifier that is associated with DHCP-RK are delivered to the DHCP relay device.The DHCP relay device uses the DHCP key that receives to calculate the sub-option of authentication, and the bundle option is included in the dhcp message.When Dynamic Host Configuration Protocol server received the message with the sub-option of authentication, it was by the corresponding DHCP key of key identifier search in its local cache buffer memory device of DHCP relay device address and reception.If do not find corresponding key, then Dynamic Host Configuration Protocol server obtains new DHCP key specific to this DHCP relay device from DHCP-RK.If several DHCP-RK are available at the Dynamic Host Configuration Protocol server place, then it uses the key identifier that receives to select correct DHCP-RK.If do not find the DHCP-RK that is associated with the key identifier that receives, then Dynamic Host Configuration Protocol server obtains DHCP-RK from aaa server.This can carry out to obtain the identical mode of local agent root key with local agent.Dynamic Host Configuration Protocol server must be included in the key identifier that receives and insert in the request message.This will make aaa server can be used for the correct DHCP-RK in location under the situation of this specific Dynamic Host Configuration Protocol server at the several DHCP-RK in aaa server place.
Fig. 4 is described in the DHCP relay device and authenticator is not the distribution of DHCP key under the situation of arranging together.When the DHCP relay device when the subscriber intercepts dhcp message, it must provide authentication sub-option to it, as setting forth in RFC 4030.If the key corresponding to Dynamic Host Configuration Protocol server is unavailable at DHCP relay device place, then the DHCP relay device will by transmission have empty DHCP cipher key T LV (empty DHCP-key TLV) context request (Context-Request) message and to authenticator request key.Authenticator will obtain necessary key and resulting key, its life cycle and the key identifier that is associated reported in (Context-Report) message at context being delivered to the DHCP relay device.After obtaining the DHCP key, DHCP relay device such as abovely proceed as described in the embodiments of figure 3 when place together at DHCP relay device and authenticator place.
Claims (16)
1. one kind is used at telecommunications network, particularly according to Internet protocol (IP) subscriber (SS/MS of the telecommunications network and the telecommunications network of WiMAX standard; MN) method of transmission of dhcp messages between, wherein the information of maintaining secrecy with encryption key is added in the dhcp message, and wherein encryption key draws from the basic key that the network components by telecommunications network provides.
2. in accordance with the method for claim 1, it is characterized in that the dhcp message that encryption key is used for maintaining secrecy and exchanges between Dynamic Host Configuration Protocol server in the different network at telecommunications network alternatively and the DHCP relay device.
3. according to claim 1 or 2 described methods, it is characterized in that the dhcp message that is generated by the subscriber is intercepted by telecommunications network, wherein when dhcp message is finished secret and/or validity check, add and come information encrypted with encryption key.
4. according to claim 1 or 2 described methods, it is characterized in that basic key is generated by using the random value that generates.
5. in accordance with the method for claim 4, it is characterized in that random value is generated by the aaa server in the local network of subscriber (SS/MS).
6. according to claim 4 or 5 described methods, it is characterized in that basic key is specific to Dynamic Host Configuration Protocol server.
7. according to each described method of aforementioned claim, it is characterized in that, basic key and the key identifier that is associated, identify the key that is associated of basic key respectively, preferably the aaa server from subscriber's local network is sent to the (SS/MS into the subscriber in inserting request message; MN) Fu Wu Access Network (ASN).
8. in accordance with the method for claim 7, it is characterized in that, specific in each access service network (ASN) and be used as and be used for subscriber (SS/MS; MN) each Access Network gateway (ASN-GW) of DHCP relay device and obtain encryption key (DHCP key).
9. in accordance with the method for claim 8, it is characterized in that the specific encryption key of Access Network gateway (ASN-GW) is generated by using basic key.
10. according to each described method of claim 7 to 9, it is characterized in that the specific encryption key of Access Network gateway (ASN-GW) is used for calculating the sub-option of relay agent authentication as security information.
11. each described method according to claim 7 to 10, it is characterized in that, remained in the Access Network gateway (ASN-GW) that is used as Extensible Authentication Protocol (EAP) authenticator the life cycle of basic key, the key identifier that is associated and basic key, expire until the life cycle of basic key.
12. each the described method according to claim 7 to 11 is characterized in that, encryption key, key identifier and playback detection counter is remained on to be used as be used for subscriber (SS/MS; In the Access Network gateway (ASN-GW) of DHCP relay device MN).
13. each described method according to claim 6 to 12, it is characterized in that, with key identifier and playback detected value, via WiMAX especially, specific signaling message is sent to new DRCP repeater as a contextual part from old DHCP relay device.
14. each described method according to aforementioned claim, it is characterized in that, Dynamic Host Configuration Protocol server in the local network the subscriber receives dhcp message from the DHCP relay device of Access Network, also unavailable for its encryption key, but when authenticating sub-option and representing that key identifier is known for Dynamic Host Configuration Protocol server, Dynamic Host Configuration Protocol server generates new encryption key from the known basic key that is associated with the key identifier that receives.
15. each the described method according to aforementioned claim is characterized in that, is used for encryption key and the derived rule that is used for basic key.
16. be used to realize one or more telecommunications network parts according to each described method of aforementioned claim.
Applications Claiming Priority (7)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| EP06021659.5 | 2006-10-16 | ||
| EP06021659 | 2006-10-16 | ||
| EP060216595 | 2006-10-16 | ||
| EP07007443.0 | 2007-04-11 | ||
| EP07007443A EP1914960B1 (en) | 2006-10-16 | 2007-04-11 | Method for transmission of DHCP messages |
| EP070074430 | 2007-04-11 | ||
| PCT/EP2007/060977 WO2008046813A1 (en) | 2006-10-16 | 2007-10-15 | Method for transmission of dhcp messages |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN101569160A true CN101569160A (en) | 2009-10-28 |
| CN101569160B CN101569160B (en) | 2013-10-30 |
Family
ID=41284185
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN200780046508.3A Active CN101569160B (en) | 2006-10-16 | 2007-10-15 | Method for transmission of DHCP messages |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN101569160B (en) |
| ES (1) | ES2407258T3 (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101945387A (en) * | 2010-09-17 | 2011-01-12 | 中兴通讯股份有限公司 | Method and system of binding access layer secret key and device |
| CN102413103A (en) * | 2010-09-20 | 2012-04-11 | 华为技术有限公司 | Message verification method, system and equipment |
| CN103368726A (en) * | 2012-03-28 | 2013-10-23 | 株式会社东芝 | Communication apparatus and key managing method |
| CN105338125A (en) * | 2014-06-25 | 2016-02-17 | 华为技术有限公司 | Message processing method and apparatus |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101222354A (en) * | 2002-10-01 | 2008-07-16 | 华为技术有限公司 | Intelligent terminal management method |
-
2007
- 2007-04-11 ES ES07007443T patent/ES2407258T3/en active Active
- 2007-10-15 CN CN200780046508.3A patent/CN101569160B/en active Active
Cited By (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101945387A (en) * | 2010-09-17 | 2011-01-12 | 中兴通讯股份有限公司 | Method and system of binding access layer secret key and device |
| CN101945387B (en) * | 2010-09-17 | 2015-10-21 | 中兴通讯股份有限公司 | The binding method of a kind of access layer secret key and equipment and system |
| CN102413103A (en) * | 2010-09-20 | 2012-04-11 | 华为技术有限公司 | Message verification method, system and equipment |
| CN102413103B (en) * | 2010-09-20 | 2014-07-30 | 华为技术有限公司 | Message verification method, system and equipment |
| CN103368726A (en) * | 2012-03-28 | 2013-10-23 | 株式会社东芝 | Communication apparatus and key managing method |
| CN105338125A (en) * | 2014-06-25 | 2016-02-17 | 华为技术有限公司 | Message processing method and apparatus |
| CN105338125B (en) * | 2014-06-25 | 2019-11-05 | 华为技术有限公司 | Message processing method and device |
| US10574572B2 (en) | 2014-06-25 | 2020-02-25 | Huawei Technologies Co., Ltd. | Packet processing method and apparatus |
| US11405314B2 (en) | 2014-06-25 | 2022-08-02 | Huawei Technologies Co., Ltd. | Packet processing method and apparatus |
| US11855891B2 (en) | 2014-06-25 | 2023-12-26 | Huawei Technologies Co., Ltd. | Packet processing method and apparatus |
Also Published As
| Publication number | Publication date |
|---|---|
| CN101569160B (en) | 2013-10-30 |
| ES2407258T3 (en) | 2013-06-12 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN101507235B (en) | Method and arrangement for provision of wire-free mesh network | |
| US7298847B2 (en) | Secure key distribution protocol in AAA for mobile IP | |
| CN100388852C (en) | Method and system for challenge-response user authentication | |
| JP4913909B2 (en) | Route optimization in mobile IP networks | |
| CN101965722B (en) | Re-establishment of a security association | |
| US20060078119A1 (en) | Bootstrapping method and system in mobile network using diameter-based protocol | |
| US8000704B2 (en) | Fast network attachment | |
| JP4824086B2 (en) | Authentication method for wireless distributed system | |
| CN101150572B (en) | Binding and update method and device for mobile node and communication end | |
| CN101160924A (en) | Method for distributing certificates in a communication system | |
| CN101502078A (en) | Method and system for providing an access specific key | |
| KR20030019336A (en) | Authentication in a packet data network | |
| Khan et al. | Defeating the downgrade attack on identity privacy in 5G | |
| JP2004241976A (en) | Mobile communication network system and method for authenticating mobile terminal | |
| KR20080053177A (en) | The generation method and the update method of authorization key for mobile communication | |
| US8447981B2 (en) | Method and system for generating and distributing mobile IP security key after re-authentication | |
| CN101039181B (en) | Method for preventing service function entity of general authentication framework from attack | |
| CN105656901A (en) | Method and apparatus of communicating authorization to dual-stack operation | |
| US8275987B2 (en) | Method for transmission of DHCP messages | |
| CN101569160B (en) | Method for transmission of DHCP messages | |
| CN101568107A (en) | Bill distribution device, fast authentication device, access point and method thereof | |
| CN101232369A (en) | Method and system for distributing cryptographic key in dynamic state host computer collocation protocol | |
| Laurent-Maknavicius et al. | Inter-domain security for mobile Ipv6 | |
| CN101056307B (en) | A method for secure registration with the agent mobile IP | |
| EP1562340A1 (en) | Method and apparatus for establishing a temporary secure connection between a mobile network node and an access network node during a data transmission handover |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| C56 | Change in the name or address of the patentee |
Owner name: NOKIA COMMUNICATION GMBH + CO. KG Free format text: FORMER NAME: NOKIA SIEMENS NETWORKS GMBH |
|
| CP01 | Change in the name or title of a patent holder |
Address after: Munich, Germany Patentee after: NOKIA SIEMENS NETWORKS GmbH & Co.KG Address before: Munich, Germany Patentee before: NOKIA SIEMENS NETWORKS GmbH & Co.KG |
|
| TR01 | Transfer of patent right |
Effective date of registration: 20171215 Address after: Espoo, Finland Patentee after: HMD Global Corp. Address before: Espoo, Finland Patentee before: NOKIA SOLUTIONS AND NETWORKS OY Effective date of registration: 20171215 Address after: Espoo, Finland Patentee after: NOKIA SOLUTIONS AND NETWORKS OY Address before: Munich, Germany Patentee before: NOKIA SIEMENS NETWORKS GmbH & Co.KG |
|
| TR01 | Transfer of patent right |