CN114374564A - Internal gateway routing link safety management system and method - Google Patents
Internal gateway routing link safety management system and method Download PDFInfo
- Publication number
- CN114374564A CN114374564A CN202210069334.9A CN202210069334A CN114374564A CN 114374564 A CN114374564 A CN 114374564A CN 202210069334 A CN202210069334 A CN 202210069334A CN 114374564 A CN114374564 A CN 114374564A
- Authority
- CN
- China
- Prior art keywords
- routing
- authentication
- routing table
- address
- security
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000000034 method Methods 0.000 title claims abstract description 48
- 101001109137 Homo sapiens Receptor-interacting serine/threonine-protein kinase 2 Proteins 0.000 claims abstract description 15
- 101000733257 Homo sapiens Rho guanine nucleotide exchange factor 28 Proteins 0.000 claims abstract description 15
- 102100022502 Receptor-interacting serine/threonine-protein kinase 2 Human genes 0.000 claims abstract description 15
- 230000008569 process Effects 0.000 claims description 25
- 239000003999 initiator Substances 0.000 claims description 18
- 238000007726 management method Methods 0.000 claims description 16
- 239000013598 vector Substances 0.000 claims description 10
- 235000008694 Humulus lupulus Nutrition 0.000 claims description 7
- 230000004044 response Effects 0.000 claims description 7
- 239000004576 sand Substances 0.000 claims description 7
- 230000007704 transition Effects 0.000 claims description 6
- 230000005540 biological transmission Effects 0.000 claims description 4
- 239000011159 matrix material Substances 0.000 claims description 4
- 238000004364 calculation method Methods 0.000 claims description 3
- 238000012795 verification Methods 0.000 claims description 3
- 230000001172 regenerating effect Effects 0.000 claims description 2
- 230000007246 mechanism Effects 0.000 abstract description 14
- 238000005516 engineering process Methods 0.000 description 6
- 238000010586 diagram Methods 0.000 description 5
- 230000002457 bidirectional effect Effects 0.000 description 3
- 101100148729 Caenorhabditis elegans sar-1 gene Proteins 0.000 description 2
- 230000006399 behavior Effects 0.000 description 2
- 238000004891 communication Methods 0.000 description 2
- 239000000284 extract Substances 0.000 description 2
- 238000012545 processing Methods 0.000 description 2
- 230000003044 adaptive effect Effects 0.000 description 1
- 238000013459 approach Methods 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000009956 central mechanism Effects 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 239000000470 constituent Substances 0.000 description 1
- 238000007796 conventional method Methods 0.000 description 1
- 238000005336 cracking Methods 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 230000007812 deficiency Effects 0.000 description 1
- 238000005538 encapsulation Methods 0.000 description 1
- 230000002452 interceptive effect Effects 0.000 description 1
- 238000012423 maintenance Methods 0.000 description 1
- 239000000463 material Substances 0.000 description 1
- 230000009466 transformation Effects 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
- H04L63/205—Network architectures or network communication protocols for network security for managing network security; network security policies in general involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
- H04L63/0435—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
- H04L63/061—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key exchange, e.g. in peer-to-peer networks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
- H04L9/0643—Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
- H04L9/085—Secret sharing or secret splitting, e.g. threshold schemes
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Power Engineering (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention relates to a security management system and method of inner gateway routing link, the invention utilizes the security association negotiation mechanism that IKE agreement provides oneself, set up unified security association and key negotiation system between all router nodes and security negotiation node deployed in distributed way, adopt RIP2 agreement to broadcast the routing table updated locally to the adjacent router node to the registered router node already, and utilize already negotiated security association to carry on the message encryption and authentication of the routing table that is transmitted between the router nodes; an unsafe authentication mechanism used in the original RIP2 protocol is abandoned, and meanwhile, on the premise that the used RIP2 protocol is not greatly adjusted, a safety strategy which is completely suitable for the RIP2 protocol is constructed through the IKE protocol, a safety channel between routing protocols is established, and meanwhile, a joint authentication mechanism with participation of multiple parties is provided, so that the transmitted routing information has higher safety and reliability.
Description
Technical Field
The invention relates to the technical field of network routing security, in particular to a routing link security management system and method applied to an internal gateway.
Background
The internet is a network of routers deployed in a distributed manner, and a data packet may pass through a plurality of routers from a source address to a destination address. A router receives packets from a network and forwards the packets to another network according to the routes indicated in the routing table. Thus, a router is the core infrastructure of the internet and plays a crucial role in whether a packet can reach its destination successfully.
With the increasing number of network connection points and the diversification of network topology structures, the dynamic routing protocol is widely applied to various fields, no matter the gateway is an internal gateway or an external gateway. In order to reduce the complexity of dynamic routing update, the internet is increasingly complicated to divide the whole internet into different regions and different levels. An autonomous system belongs to an independent autonomous network, and the most important characteristic is that the autonomous system has the right to autonomously determine which routing protocol is applied in the system, and after a routing link is established in the system, each network node communicates with the outside through a boundary routing node of the system, so that the establishment of an internal gateway route is the basis for realizing the communication between the network node and other networks, and therefore, the safety of the routing link of the internal network is especially important.
RIPv1(Routing Information Protocol) is the most known one of interior gateway protocols, and because it adopts a distributed Routing Path algorithm based on distance vectors, compared with OSPF (open short Path first) adopting a link state algorithm, it has the characteristics of simple operation and convenient maintenance, and becomes a Routing Protocol widely used by interior networks of various enterprises at present. However, RIPv1 is vulnerable to attacks such as forgery of RIP protocol packets because it has inherent security defects, i.e., it does not support authentication and uses an unreliable UDP protocol as a transport protocol. For this reason, a RIPv2 version protocol (detailed rules are defined in RFC 1721 and RFC 1722) is further designed, and RIPv2 adds an authentication option field capable of setting 16 characters in an original RIP message, and supports two modes of plaintext authentication and MD5 encryption authentication, wherein the field values are 16-character plaintext password strings or MD5 signatures respectively.
However, the RIPv2 protocol only provides an authentication mechanism for the identity of the sender of the message, and the way of verifying the signature through a plaintext or a certificate is not secure, so that an attacker can steal key information through brute force attack or counterfeiting the identities of both parties by a man-in-the-middle, and further perform attack behaviors such as interception, counterfeiting and the like of routing information in real time. In addition, the routing protocol of the version only provides one-way authentication service, that is, if the identity authentication of the sender is successful, the receiver does not return a service for realizing the identity authentication of the receiver to the sender after updating the local routing table, so that the broadcasted routing table may be known by an untrusted node, and potential safety hazards are brought.
For the above security problem, the existing security policy mainly relies on a security mechanism established on a network layer to provide security service for data packets, for example, a security tunnel (VPN) provided by an IPsec protocol is used to implement authentication and encryption of the packets. However, this protocol encapsulates the entire data packet by using a negotiation policy, and since it is not designed for an independent transmission item, it does not provide a separate protection measure for the payload such as the transmitted routing table, and therefore there is still a safety risk in protecting the routing information transmitted in the internal gateway by relying on this method completely.
Disclosure of Invention
In view of the above-mentioned practical needs and the deficiencies in the prior art, the present invention provides a security management method for an interior gateway routing link, which specifically comprises the following steps:
step 1) selecting a router on a bus of an internal gateway as a security negotiation node of the autonomous system, wherein all security associations based on an IKE protocol are stored in the security negotiation node;
step 2) utilizing the security negotiation node to complete the security association negotiation used in the transmission process of the routing data with the router node to be registered, and connecting the router to the internal gateway routing link after the negotiation is passed;
and 3) broadcasting the locally updated routing table to the adjacent router nodes by adopting a RIP2 protocol for the registered router nodes, and performing encryption and authentication on the message carrying the routing table transmitted between the router nodes by using the negotiated security association.
Further preferably, the security association negotiation process is:
step 201) using a router node to be registered as an initiator, sending a plurality of IKE security policy proposals to a security negotiation node, wherein the IKE security policy proposals comprise: the router node authentication strategy, the encryption strategy of the routing table and the authentication strategy of the routing table;
step 202) using the security negotiation node as a responder, checking the received IKE security policy, trying to find a security policy matched with the IKE security policy locally, and returning the matched security policy serving as a response message to the router node to be registered;
step 203) both parties exchange key information and authenticate identity through the security policy negotiated in step 202), and register the router node is completed.
Further preferably, the authentication policy of the router node and the routing table includes:
the security negotiation node establishes a routing coefficient a0,a1,a2Formed linear equation f (x)i):
From the linear equation f (x)i) Generating a shared key pair (x)i,yi) Distributing two unique shared key pairs and a linear routine f (x) to each router nodei) And the method is used for realizing the authentication of the router node and the routing table.
Further preferably, the encryption policy of the routing table includes:
the security negotiation node establishes an m-sequence generating function:
wherein, cjRepresenting feedback coefficients, x representing state variables in the m-sequence;
Sharing m-sequence generating function and initial state δ (0) ═ a for all router nodes0,a1,…an-1) And the router node constructs an m sequence in any state by using the m sequence generating function, and the m sequence is used as an encryption key of the routing table in the current state.
Further preferably, the execution process of the encryption policy of the routing table is as follows:
the sender of the routing table generates a random number, and calculates the state key of the current routing table item by using the distance field value recorded in the routing table item and the initial state of the m-sequence generating function, wherein the calculation formula is represented as:
wherein, δ (r)d) Representing the state key, T representing the state transition matrix, d representing the distance of the destination IP address to the sender of the routing table, rSA random number representing a sender of the routing table;
using state key to encrypt the destination IP address, subnet mask, IP address of sender in routing list and last hop IP address field by symmetric encryption algorithm, and generating cipher text data and random number rSBroadcasting the RIP message to adjacent router nodes in a multicast mode together with the distance field value;
after receiving RIP message, the receiving party of the routing list is according to the distance field value and random number r in the routing listSAnd regenerating the state key, and decrypting the ciphertext data by using the state key to obtain plaintext data.
Further preferably, the authentication process of the router node and the routing table is as follows:
in the initial state established by the routing table item, the distance field value in the sent routing table item is one hop, and the sender of the routing table item distributes the first shared key pair (x)S_1,ys_1) Encrypting through the state key, and broadcasting the ciphertext data and the encrypted routing table together;
routing table receiver utilizing state keysDecrypting the received ciphertext data to obtain a shared key pair (x)S_1′,yS_1') a first shared key pair (x) to which the routing table receiver is assignedR_1,yR_1) Second shared key pair (x)R_2,yR_2) And a shared key pair (x)S_1′,yS_1') introduce the linear equation f (x)i) Calculating to obtain a coefficient a0', coefficient of a0' with locally stored coefficients a0Comparing, if different, indicating that the route table item authentication fails, terminating the authentication, otherwise generating a random number rRUsing a shared key pair (x)S_1′,yS_1') hash with the routing table sender IP address:
wherein, IPSIndicating the routing table sender IP address, HRRepresenting a hash value;
by a hash value HRAs the first authentication key, the IP address of the receiving party of the routing table, the IP address of the sending party of the routing table and the random number r are comparedRThe formed route backtracking table is encrypted by adopting a symmetric encryption algorithm, and the encrypted route backtracking table is sent to a route table sender;
after receiving the encrypted route backtracking table, the routing table sender utilizes a first shared key pair (x)S_1,yS_1) Carrying out Hash operation with local IP address to generate authentication key HR' and decrypt the encrypted route trace back table, compare the IP address of the sender with the local IP address of the route table obtained by decryption, if different, indicate that the identity authentication of the receiver of the route table fails, terminate the authentication, otherwise utilize the first shared key pair (x)S_1,yS_1) And carrying out hash operation on the decrypted IP address of the routing table receiver:
wherein, IPRIndicating the routing table receiver IP address, HSRepresenting a hash value;
by a hash value HSAs a second authentication key, the routing backtracking table is encrypted again by adopting a symmetric encryption algorithm, and the encrypted routing backtracking table is transmitted back to a routing table receiver;
after receiving the encrypted route backtracking table, the route table receiver utilizes the locally stored shared secret key pair (x)S_1′,yS_1') generating an authentication key H by hashing with the local IP addressS', decrypting the encrypted route backtracking table, comparing the decrypted route backtracking table receiver IP address with the local IP address, if different, indicating that the route backtracking table sender identity authentication fails, terminating authentication, otherwise updating the successfully authenticated route table item to the local route table by the distance vector routing algorithm, and simultaneously, updating the shared key pair (x) to the local route tableS_1′,yS_1′)、(xR_2,yR_2) And a random number rRAfter being encrypted by the state key, the routing table updated locally continues to broadcast to the next hop router node;
the next-hop router node decrypts the received ciphertext data by using the state key to obtain a shared key pair (x)S_1″,yS_1") and (x)R_2′,yR_2'), a first shared key pair (x) to be assigned to a next hop router nodenext_1,ynext_1) Shared key pair (x)S_1″,yS_1") and (x)R_2′,yR_2') introduce the linear equation f (x)i) Calculating to obtain a coefficient a0", the coefficient a0"coefficient a with local storage0Comparing, if different, indicating that the route table item authentication fails, terminating the authentication, otherwise generating a random number rnext=rR+1, with shared key pair (x)S_1″,yS_1"), random number rnextAnd carrying out Hash operation with the IP address of the sender of the routing table:
using a shared key pair (x)R_2′,yR_2'), random number rnextAnd carrying out hash operation with the IP address of the routing table receiver:
wherein Hnext_SAnd Hnext_RRepresenting a hash value;
by a hash value Hnext_SAs the first authentication key of the next hop router node and the routing table sender, the IP address of the next hop router node, the IP address of the routing table sender and the random number r are comparednextThe formed route backtracking table is encrypted by adopting a symmetric encryption algorithm, and the encrypted route backtracking table is sent to a route table sender;
by a hash value Hnext_RAs the first authentication key of the next hop router node and the routing table receiver, the IP address of the next hop router node, the IP address of the routing table receiver and the random number r are comparednextThe formed route backtracking table is encrypted by adopting a symmetric encryption algorithm, and the encrypted route backtracking table is sent to a route table receiver;
after receiving the encrypted route backtracking table, the routing table sender utilizes the local first shared key pair (x)S_1,yS_1) And local IP address, random number rR+1 Hash operation to generate certification key Hnext_S' and decrypt the encrypted route backtracking list, compare the sender IP address of the route backtracking list with the local IP address, if different, indicate that the next hop router node identity authentication fails, terminate the authentication, otherwise utilize the local first shared key pair (x)S_1,yS_1) A random number rR-1, performing hash operation with the decrypted next-hop router node IP address:
by a hash value HS_nextAs a second authentication key of the next hop router node and the routing table sender, re-encrypting the routing backtracking table by adopting a symmetric encryption algorithm, and returning the encrypted routing backtracking table to the next hop router node;
after receiving the encrypted route backtracking table, the route table receiver utilizes a local second shared secret key pair (x)R_2,yR_2) And local IP address, random number rR+1 Hash operation to generate certification key Hnext_R' and decrypt the encrypted route trace back table, compare the decrypted route table receiver IP address with the local IP address, if different, indicate that the next hop router node identity authentication fails, terminate the authentication, otherwise utilize the local second shared secret key pair (x)R_2,yR_2) A random number rRAnd carrying out hash operation on the node IP address of the next-hop router obtained by decryption:
by a hash value HR_nextAs a second authentication key of the next hop router node and the routing table receiver, re-encrypting the routing backtracking table by adopting a symmetric encryption algorithm, and returning the encrypted routing backtracking table to the next hop router node;
after the next-hop router node respectively receives the routing backtracking tables encrypted by the sender and the receiver of the routing table, the next-hop router node utilizes the locally stored shared key pair (x)S_1″,yS_1"), random number rnext-2 generating an authentication key H by hashing with the local IP addressS_next', using a locally stored shared key pair (x)R_2′,yR_2'), random number rnext-1 generating an authentication key H by hashing with the local IP addressR_next', to authenticate the secret key HS_next' and HR_nextRespectively decrypting ciphertext data from a sending party and a receiving party of a routing table, respectively comparing IP addresses of next-hop router nodes recorded in two routing backtracking tables obtained by decryption with local IP addresses, and if the two comparisons are finishedIf there is difference, it indicates that the identity authentication of the sender or receiver of the routing list fails, and terminates the authentication, if the two comparison results are the same, it indicates that the identity authentication of the sender and receiver of the routing list succeeds, and updates the successfully authenticated routing list item to the local routing list by the distance vector routing algorithm, and at the same time, updates the shared key pair (x)R_2′,yR_2'), second shared key pair (x) assigned by next hop router nodenext_2,ynext_2) And a random number rnextAnd after the state key is encrypted, continuously broadcasting to the two-hop router nodes along with the locally updated routing table, continuously finishing the authentication of the routing table received by the two-hop router nodes until the distance field value recorded in the updated routing table entry reaches sixteen hops, and terminating the broadcasting of the routing table entry.
In order to implement the method, the invention also provides an interior gateway routing link security management system, which specifically comprises: the system comprises a security negotiation node arranged on an internal gateway bus and a plurality of router sub-nodes deployed in a distributed manner;
the security negotiation node comprises: an IKE security association negotiation module, an IKE security association database and an IKE security policy database;
IKE security association negotiation module: receiving an IKE security policy proposal from a router child node, trying to search a security policy matched with the IKE security policy proposal in a local security policy database, returning the matched security policy serving as a response message to the router child node, and simultaneously constructing a corresponding security association according to the successfully matched security policy;
IKE security association database: the security association used for storing the security parameter index SPI negotiated with the router child node;
IKE security policy database: for storing all IKE security policies indexed by source/destination IP addresses;
the router child node includes: the routing system comprises a random number generator, a routing security association negotiation module, a routing security association database, a routing security policy database, a routing backtracking table generation module, a routing encryption module, a routing authentication module and a routing update module;
a random number generator: for generating random numbers used in the encryption and authentication processes;
the routing security association negotiation module: searching an IKE security policy applicable to a routing protocol of a local internal gateway in a routing security policy database, sending an IKE security policy proposal to a security negotiation node, and constructing a corresponding security association according to the security policy returned by the security negotiation node;
routing security association database: the security association used for storing the security parameter index SPI which is negotiated through with the security negotiation node;
routing security policy database: for storing all IKE security policies indexed by source/destination IP addresses;
the route backtracking table generation module: generating a routing backtracking table which is composed of the IP address of the receiving party of the routing table, the IP address of the sending party of the routing table and the random number which is increased along with the hop number of the routing path;
a routing table generation module: generating a routing table consisting of a destination IP address, a subnet mask, a sender IP address of the routing table and a previous hop IP address field;
the route encryption module: generating an encryption algorithm and a key according to an encryption strategy of the routing table, encrypting the routing table and the routing backtracking table by adopting a symmetric encryption algorithm, and reversely decrypting the received ciphertext data;
the route authentication module: generating an authentication algorithm and an authentication message according to the authentication strategy of the routing table to realize the authentication of the routing table; generating an authentication algorithm and an authentication message according to an authentication strategy of the router node, and realizing the authentication of the router node through the verification of the routing backtracking table;
a route updating module: and updating each routing table entry successfully authenticated by the routing information to a local routing table by using a distance vector routing algorithm.
By combining the technical scheme, the invention has the beneficial effects that:
providing a safe route authentication and encryption strategy: the method has the advantages that a uniform security association and key negotiation system is established between all router nodes and security negotiation nodes which are deployed in a distributed mode by utilizing a security association negotiation mechanism provided by an IKE protocol, authentication and encryption services are provided for routing information broadcast when the routing protocol is executed by using a policy which is consistent with the negotiation, an insecure authentication mechanism used in the original RIP2 protocol is abandoned, and meanwhile, on the premise that the used RIP2 protocol is not adjusted greatly, a security policy which is completely suitable for the RIP2 protocol is established through the IKE protocol, a security channel between the routing protocols is established, the method is different from the potential safety hazard brought by the conventional method of directly applying the IKE protocol, and the method has higher security performance.
Different authentication and encryption objects: the authentication method of data integrity of the tail authentication data field of the traditional RIP2 protocol message is not adopted, but the authentication process of the router node and the routing table is directly mapped into each routing table item, the effective load in the RIP message is directly encrypted, the concealment of routing information is improved, the attack behaviors of identity forgery, path tampering and the like are avoided after an attacker steals the IP address of the routing table recorded in the original RIP message in a clear text, the encryption and authentication processes of different table items in the same routing table are respectively and independently executed, the whole routing table is not encapsulated, and the difficulty of cracking the routing information is greatly improved;
a route combination authentication mechanism that provides multi-party forwarding: by constructing a polynomial equation, deriving a plurality of shared key pairs from a linear equation and distributing the shared key pairs to the router nodes, obtaining a shared secret coefficient by using a limited shared key pair combination so as to judge the authenticity of the identities of all parties participating in authentication, converting the authentication process of a continuously forwarded routing table into a joint authentication process of the shared key pairs transmitted between adjacent router nodes, and compared with a one-to-one unidirectional authentication mode, the authentication process of all parties participating in has higher reliability;
providing a route backtracking authentication mechanism: the route backtracking table opposite to the route of the route table is established, the route table receiver can establish a bidirectional authentication process with the sender according to the hop address of the backtracking path, a reverse authentication mechanism is realized through an authentication message returned by the receiver under the condition of determining the authenticity of the sender identity, the update of the route table is executed only after the bidirectional authentication is successful, and the safety authentication strength is far higher than that of any existing route protocol.
Drawings
FIG. 1 is a flowchart of a security management method for an interior gateway routing link according to the present invention;
FIG. 2 is a schematic diagram of an n-stage linear feedback shift register;
FIG. 3 is a diagram of the RIP message format designed in the present invention;
FIG. 4 is a diagram of an alternative field format for an IP header designed in the present invention;
FIG. 5 is a format diagram of a routing trace back table message designed in the present invention;
fig. 6 is an architecture diagram of an interior gateway routing link security management system provided by the present invention.
Detailed Description
In order to make the objects, technical solutions and advantages of the present invention more apparent, embodiments of the present invention will be described in detail with reference to the accompanying drawings.
The Internet Key exchange protocol (IKE) is one of the important protocols of the IPsec protocol family, responsible for dynamically negotiating and managing IPsec SAs. The IKE protocol uses the ISAKMP foundation, the OAKLEY mode and the SKEME sharing and key updating technology, and defines a unique authentication encryption material generation technology and a sharing security policy negotiation technology. The IPsec VPN is a VPN built based on a tunnel technology and an encryption module technology, data can be safely transmitted between two different geographic positions, the key for realizing the technology is an IKE protocol, authentication and key exchange of two communication parties are completed in a negotiation mode, and a generated virtual private network has high safety performance.
The IKE protocol is implanted into a security management system of a routing link, so that two technical bottlenecks to be solved exist; firstly, the IKE protocol completes negotiation between two peers, namely the IKE protocol is only suitable for a unicast mode, and the routing protocol adopts a multicast mode to broadcast routing information; the IKE protocol is based on the network layer framework to safely encapsulate the whole message, and then transmit the message through a tunnel, and does not execute a security policy aiming at any specific entity load data, namely, does not directly execute encryption or authentication on the routing information.
Aiming at the problems, the invention designs a brand-new internal gateway routing link management mechanism fusing an IKE protocol and a RIP2 protocol.
To address the first issue, a particular router is selected among the router nodes of the interior gateway as an IKE negotiation center mechanism, which is located on the trunk line in the interior network so that it can satisfy the bandwidth requirement for completing negotiation work simultaneously with the router sub-nodes on multiple links, while being deployable with a relatively short distance between the sub-nodes with respect to the vast majority of routers in terms of location. After deployment is completed, an SA negotiation in a unicast mode is established between an IKE negotiation central mechanism (security negotiation node) and router sub-nodes according to an IKE protocol, the SA which is passed through the negotiation is adaptive to an RIP2 protocol, namely, a security authentication and encryption strategy which is customized according to a routing table updating rule and an RIP message format of the RIP2 protocol, because the same routing protocol is used by the whole internal gateway, the SA negotiated by each router node and related parameters are also consistent, then the routing table is encrypted by using the commonly negotiated security strategy, authentication messages are mutually transmitted along with the routing table, and the security authentication and encryption operation in a multicast mode between the router nodes is realized.
Aiming at the second problem, the routing information in the message is used as an encapsulation object, the risk of exposing a routing table is reduced, the source/destination IP address in the route is hidden by carrying out encryption processing on the routing information, and the disastrous result caused by the fact that an attacker acts as a middle man to impersonate the identity of a legal user, steal the routing information and even maliciously tamper the path is avoided.
As shown in fig. 1, the method for managing the security of the internal gateway routing link provided by the present invention specifically includes the following steps:
step 1) selecting a router on a bus of an internal gateway as a security negotiation node of the autonomous system, wherein all security associations based on an IKE protocol are stored in the security negotiation node;
step 2) utilizing the security negotiation node to complete the security association negotiation used in the transmission process of the routing data with the router node to be registered, and connecting the router to the internal gateway routing link after the negotiation is passed;
and 3) broadcasting the locally updated routing table to the adjacent router nodes by adopting a RIP2 protocol for the registered router nodes, and performing encryption and authentication on the message carrying the routing table transmitted between the router nodes by using the negotiated security association.
The following embodiment specifically illustrates the implementation process of the present invention, which mainly includes three stages: security Association (SA) establishment, route encryption and authentication, and route updating.
First, security association establishment
This stage is a process of performing security association negotiation for the non-uplink router node, and the router node is registered by negotiating with the security negotiation node. The security association negotiation process specifically includes:
firstly, a router node to be registered is used as an initiator, and a plurality of IKE security policy proposals are sent to a security negotiation node, wherein the IKE security policy proposals comprise: router node authentication policy, encryption policy of routing table, authentication policy of routing table.
And then, taking the security negotiation node as a responder, checking the received IKE security policy, trying to locally find a security policy matched with the IKE security policy, and returning the matched security policy serving as a response message to the router node to be registered.
And finally, the two parties exchange key information and authenticate identities by the security policy passed by negotiation, and the registration of the router nodes is completed.
Aiming at the authentication strategy of the routing table, in the embodiment, a polynomial equation is constructed, a plurality of shared key pairs are derived by the security negotiation node according to the equation and are distributed to each router node, and the shared secret coefficient can be obtained by limited shared key pair combination, so that the authenticity of the identities of all parties authenticated on the routing path is judged.
Suppose there is a router node T1,T2…TmSet A of constituents, wantSelecting t nodes from the data to determine secret Ka0Value of a0For the recognized secret coefficients in the encryption system, which are kept secret only from the outside, a security negotiation node establishes a polynomial:
wherein, a0,a1,…at-1Representing coefficients, t can be obtained as0,a1,…at-1A linear equation of unknowns. If the equations are linearly independent, then there is a unique solution, solving for a0The value of' and the original value a0And comparing, if the identity is the same, indicating that the t nodes pass the cooperative authentication process, and if the identity is different, inevitably having false identity on one or more nodes.
Based on the secret coefficient reconstruction principle, the method establishes a trinomial form in this embodiment, that is, the method performs association authentication on the router nodes of three continuous hops at most, and establishes a linear equation f (x) by the security negotiation nodei):
The security negotiation node uses a linear equation f (x)i) Generating a plurality of shared key pairs (x) in advancei,yi) And distributing two unique shared key pairs and a linear routine f (x) for each routing node to be registered in the negotiation processi) And the authentication module is used for realizing the subsequent authentication of the router node and the routing table.
When an attacker wants to forge the node identity of the previous hop and send an attack to a target, since the attacker does not know the shared key pair value of the two previous hop nodes, authentication will inevitably fail when all the next hop nodes receive forged routing table entries, and the routing path in the table entry is judged to be a false path.
As for the encryption policy of the routing table, m-sequence is adopted as the data encryption key in the present embodiment. m sequences being formed by multiple linesA Linear Feedback Shift Register (LFSR) generates the longest code sequence by Linear Feedback. In a binary shift register, if n is the number of shift register stages, the n-stage shift register has 2nOne state, except all 0 states, remaining 2n1 state, so that it can produce a maximum length code sequence of 2n1 bit, that is, the longest period of the n-stage linear feedback shift register sequence is 2n-1。
As shown in FIG. 2, ak+n-1,ak+n-2,…akFor the state (0 or 1) of the n-stage shift register, the connection state of the feedback is controlled by the switch ciIs represented by ci0 denotes feedback off, c i1 denotes that the feedback is on, and cn-1=c 01. Each stage of output of the shift register is used as the input a of the highest bit after linear feedbackk+nIs provided withBeing an nth order polynomial on the sequence polynomial g (x) of the shift register, the n stages of shift register can be represented by an nxn order matrix:
any sequence α ═ (a) in the sequence polynomial gf (x) determined by f (x)k) A vector δ (k) formed by arbitrary consecutive n symbols is (a)kak+1ak+2Lak+n-1) Is a state at time k, so the state transition from δ (k) to δ (k +1) is a linear transformation with a linear recurrence relation:
the state transition transitions to:
δ(k+1)=δ(k)·W=δ(k-1)·W2=L=δ(0)·Wk+1
wherein δ (k +1) ═ ak+1ak+2Lak+n),δ(k)=(ak+1ak+2Lak+n-1) Thus, the state transition matrix W can be expressed as:
for this purpose, an m-sequence generating function is established at the security negotiation node:
sharing m-sequence generating function and initial state δ (0) ═ a for all router nodes0,a1,…an-1) And the router node constructs an m sequence in any state by using the m sequence generating function, and the m sequence is used as an encryption key of the routing table in the current state.
The invention is designed aiming at the routing protocol, and does not contain the strategy negotiation of the IPsec protocol, so that the negotiation task of the first stage is only completed in the main IKE mode in the negotiation process, namely, a safety channel used by the IKE protocol is established between the safety negotiation node and the router sub-node, and the negotiation is completed at the stage by the router node authentication strategy, the encryption strategy of the routing table, the authentication strategy of the routing table and related safety parameters.
The main mode negotiation involves three bi-directional exchanges, using six ISAKMP messages. The specific process for realizing the IKE SA negotiation by adopting the main mode interactive mode of the IKE protocol comprises the following steps:
the first message is: the initiator sends a plurality of IKE security policy proposals to the responder, wherein the IKE security policy proposals comprise: an encryption algorithm, an authentication algorithm, a Diffie-Hellmman group and an authentication method;
four mandatory parameter values are mainly negotiated: 1) and (3) encryption algorithm: such as DES or 3DES, 2) authentication algorithm: selecting MD5 or SHA, etc., 3) authentication method: selection of certificate authentication, preset shared key authentication, or Kerberos v5 authentication, 4) selection of Diffie-Hellman groups.
Initiator I responder R
----------- ------------
1 HDR,SAi1 ——>
HDR contains Security Parameter Index (SPI), version number and different kinds of flags, which are the headers of ISAKMP messages. When denoted HDR, the traffic is encrypted. The SAi1 payload declares that the encryption algorithm of the initiator IKE SA is a payload with one or more proposals. While only one message is replied to for multiple proposed responders.
The second message is: the responder checks the received IKE security policy, tries to find a security policy matched with the IKE security policy locally, and returns the matched security policy serving as a response message to the initiator;
initiator I responder R
----------- ------------
2 <—— HDR,SAr1
The responder looks up the first matching IKE security offer and replies this IKE security offer to the initiator with a SAr1 payload. The matching principle is that the two parties have the same encryption algorithm, authentication method and Diffie-Hellman group identification.
The third message: the initiator generates RDI carrying the routing domain identifieriDiffie-Hellmman exchange value DHiAnd a random number NiAnd sending the message to a responder through a local router, wherein the exchange value DH isiDetermined by the Diffie-Hellmman algorithm negotiated by both parties;
initiator I responder R
----------- ------------
3 HDR,KE,Ni ——>
The initiator sends the key exchange value DH through KE loadiAnd transmits the random number through Ni.
A fourth message: responder generates RDI carrying routing domain identifierrDiffie-Hellmman exchange value DHrAnd a random number NrAnd returning the message to the initiator through the local router, wherein the exchange value DHrDetermined by the Diffie-Hellmman algorithm negotiated by both parties;
initiator I responder R
----------- ------------
4 <—— HDR,KE,Nr
The responder sends a key exchange value DH via the IKE payloadrAnd transmits the random number through Nr.
Fifth message: performing HASH operation on all security parameters of the negotiated IKE security policy and the sender IP address to obtain a HASH value HASH _ I, performing digital signature by using a temporary private key to generate a message carrying the sender IP address and a HASH value HASH _ I ciphertext, and sending the message to a responder through a local router;
initiator I responder R
----------- ------------
5 HDR*,IDi,HASH_I ——>
Sixth message: after the initiator passes the authentication, the responder performs HASH operation on all security parameters and the responder IP address to obtain a HASH value HASH _ R, performs digital signature on the HASH value HASH _ R by using a temporary private key to generate a message carrying the responder IP address and a HASH value HASH _ R ciphertext, and sends the message to the initiator through a local router;
initiator I responder R
----------- ------------
6 <—— HDR*,IDr,HASH_R
The IP address of the responder is carried by IDr payload.
After the responder passes the authentication, the IKE SA negotiation is completed, thereby establishing all security associations used by the routing protocol for implementing the authentication and encryption of the subsequent routing identity.
Second, route encryption and authentication
For a newly registered and uplink router, firstly, a connection relation with each neighbor node is required to be established, distance field values in a routing table entry using the neighbor nodes as destination addresses are all one hop, and after the routing table entry is updated to the local, the local updated routing table entry can be continuously forwarded to the neighbor nodes of the next hop, so that a routing encryption and authentication process between a routing table sender (a routing creator) and a receiver (a neighbor node of the next hop) is started.
Firstly, a router sender firstly encrypts a routing table entry to be broadcasted. The routing table sender S generates a random number rSCalculating the state key of the current routing table entry by using the distance field value d recorded in the routing table entry and the initial state of the m sequence generating functionThe state key is a random number rsThe d-power value is used as a state sequence generated by the current state of the routing table entry, and different distance values can be generated after different routing table entries are jumped for multiple times, so that the keys of all routing table entries in the routing table are different, and calculation is needed one by one, and the encryption strength is improved.
As shown in fig. 3, the difference from the conventional RIP message format is that the present invention adds the local and previous hop IP addresses in the sent routing table entry at the same time for performing the subsequent joint multi-hop node authentication. Using the calculated state key delta (r)S d) The destination IP address, subnet mask, the IP address of the sender (local) and the last hop IP address field in the routing table item are encrypted by adopting a symmetric encryption algorithm, and the generated ciphertext data and the random number r are encryptedSAnd broadcasting the RIP message to adjacent router nodes in a multicast mode together with the distance field value. The last hop of the routing table entry in the initial state is the destination address, so that the next IP address field is left empty, and the corresponding address needs to be added to the next IP address field after two hops.
After the routing table encryption processing, an authentication message needs to be added to the header of the IP packet. The routing table sender isA security association establishment phase, which has been allocated by the security negotiation node to two shared key pairs (x)S_1,ys_1) And (x)S_2,yS_2) First shared key pair (x) to be assignedS_1,yS_1) Also encrypted by the state key generated as described above, and then the random number, encrypted local shared key pair, are copied together in an optional field of the IP header (as shown in fig. 4). For the routing table entry in the initial state, since there is no shared key pair of the previous hop, this field is still left empty. The invention considers that the change of the original RIP message format is reduced as much as possible, so the random number and the authentication message are written into the IP header, but not into the RIP message.
After the above operation is completed, the ciphertext data with the authentication message is packaged with the encrypted routing table and then broadcasted.
After receiving the encrypted data message, the routing table receiver R extracts a random number from the IP header, extracts a distance field value from each routing table item, reconstructs a state key according to an encryption algorithm consistent with negotiation, decrypts the received ciphertext data by using the state key, and obtains a shared key pair (x) of a sender recorded in the IP headerS_1′,yS_1') and a first shared key pair (x) to which the receiver of the routing table is assigned by requiring the two shared key pairs of the receiver to participate in the authentication operationR_1,yR_1) Second shared key pair (x)R_2,yR_2) And a shared key pair (x)S_1′,yS_1') introduce the linear equation f (x)i) The following system of linear equations is obtained:
can calculate and obtain the coefficient a0', coefficient of a0' with locally stored coefficients a0Comparing, if different, indicating that the route table item authentication fails, terminating the authentication, otherwise generating a random number rRUsing a shared key pair (x)S_1′,yS_1') hashing with the routing table sender IP address:
Wherein, IPSIndicating the routing table sender IP address, HRRepresenting a hash value;
by a hash value HRAs the first authentication key, it is used for encryption of the route trace back table. The route backtracking table and the route table are in reverse path, a corresponding route backtracking table item is established according to the received or updated route table item, and the route table receiver can return the authentication message to the node of the previous hop or two hops according to the path in the backtracking table to complete the bidirectional backtracking authentication process. As shown in fig. 5, the entry in the routing trace-back table is composed of an IP address of a sender in the routing table, an IP address of a receiver in the routing table, and a random number, and the random number is locally generated by the receiver in the routing table.
The routing table receiver utilizes the first authentication key HRAnd encrypting the corresponding routing backtracking list item, wherein the encryption algorithm still adopts a symmetric algorithm, and the encrypted routing backtracking list item is sent to the corresponding routing list sender. As shown in fig. 5, the data carrying the route trace table is a route trace packet, the format of the packet is redesigned based on the RIP packet format framework, and the route tag field is replaced with the route trace tag field, which is convenient for the route trace and identification of the route trace table.
After receiving the encrypted route backtracking table, the routing table sender utilizes a first shared key pair (x)S_1,yS_1) Carrying out Hash operation with local IP address to generate authentication key HR' and decrypt the encrypted route trace back table, compare the IP address of the sender with the local IP address of the route table obtained by decryption, if different, indicate that the identity authentication of the receiver of the route table fails, terminate the authentication, otherwise utilize the first shared key pair (x)S_1,yS_1) And carrying out hash operation on the decrypted IP address of the routing table receiver:
wherein, IPRIndicating the routing table receiver IP address, HSRepresenting a hash value;
by a hash value HSAnd as a second authentication key, re-encrypting the routing backtracking table by adopting a symmetric encryption algorithm, and returning the encrypted routing backtracking table to a routing table receiver.
After receiving the encrypted route backtracking table, the route table receiver utilizes the locally stored shared secret key pair (x)S_1′,yS_1') generating an authentication key H by hashing with the local IP addressaAnd decrypting the encrypted routing backtracking table again, comparing the decrypted IP address of the receiver of the routing table with the local IP address, if the IP addresses are different, indicating that the identity authentication of the sender of the routing table fails, terminating the authentication, otherwise indicating that the authentication succeeds.
After finishing updating the local routing information, the routing table receiver continues to broadcast the locally updated routing table to the next-hop router node, and the difference of the forwarding mode with the previous-hop router node is as follows: the next hop router node needs to execute a joint authentication mechanism on the received routing table, that is, the original routing table sender, receiver and next hop router node participate in the authentication process together. To implement this authentication approach, the routing table receiver will send a shared key pair (x) for the senderS_1′,yS_1'), a local second shared key pair (x)R_2,yR_2) And a locally generated random number rRAfter the state key is used for encryption, the routing table updated locally continues to be broadcasted to the next hop router node, and the routing encryption method and the message format for executing the process are consistent with the method for forwarding the routing table by the sender stated above.
The next-hop router node decrypts the received ciphertext data by using the state key to obtain a shared key pair (x)S_1″,yS_1") and (x)R_2′,yR_2'), a first shared key pair (x) to be assigned to a next hop router nodenext_1,ynext_1) Shared key pair (x)S_1″,yS_1") and (x)R_2′,yR_2') introduce the linear equation f (x)i) Calculating to obtain a coefficient a0", the coefficient a0"coefficient a with local storage0Comparing, if different, indicating that the route table item authentication fails, terminating the authentication, otherwise generating a random number rnext=rR+1, with shared key pair (x)S_1″,yS_1"), random number rnextAnd carrying out Hash operation with the IP address of the sender of the routing table:
using a shared key pair (x)R_2′,yR_2'), random number rnextAnd carrying out hash operation with the IP address of the routing table receiver:
wherein Hnext_SAnd Hnext_RRepresenting a hash value;
by a hash value Hnext_SAs the first authentication key of the next hop router node and the routing table sender, the IP address of the next hop router node, the IP address of the routing table sender and the random number r are comparednextThe formed route backtracking table is encrypted by adopting a symmetric encryption algorithm, and the encrypted route backtracking table is sent to a route table sender;
by a hash value Hnext_RAs the first authentication key of the next hop router node and the routing table receiver, the IP address of the next hop router node, the IP address of the routing table receiver and the random number r are comparednextThe formed route backtracking table is encrypted by adopting a symmetric encryption algorithm, and the encrypted route backtracking table is sent to a route table receiver;
after receiving the encrypted route backtracking table, the routing table sender utilizes the local first shared key pair (x)s_1,yS_1) And local IP address, random number rR+1 Hash Generation authenticationCertificate key Hnext_S' and decrypt the encrypted route backtracking list, compare the sender IP address of the route backtracking list with the local IP address, if different, indicate that the next hop router node identity authentication fails, terminate the authentication, otherwise utilize the local first shared key pair (x)S_1,yS_1) A random number rR-1, performing hash operation with the decrypted next-hop router node IP address:
by a hash value HS_nextAs a second authentication key of the next hop router node and the routing table sender, re-encrypting the routing backtracking table by adopting a symmetric encryption algorithm, and returning the encrypted routing backtracking table to the next hop router node;
after receiving the encrypted route backtracking table, the route table receiver utilizes a local second shared secret key pair (x)R_2,yR_2) And local IP address, random number rR+1 Hash operation to generate certification key Hnext_R' and decrypt the encrypted route trace back table, compare the decrypted route table receiver IP address with the local IP address, if different, indicate that the next hop router node identity authentication fails, terminate the authentication, otherwise utilize the local second shared secret key pair (x)R_2,yR_2) A random number rRAnd carrying out hash operation on the node IP address of the next-hop router obtained by decryption:
by a hash value HR_nextAs a second authentication key of the next hop router node and the routing table receiver, re-encrypting the routing backtracking table by adopting a symmetric encryption algorithm, and returning the encrypted routing backtracking table to the next hop router node;
the next-hop router node receives the encrypted routing table respectively from the sender and the receiverAfter routing the trace-back table, the same locally stored shared key pair (x) is utilizedS_1″,yS_1"), random number rnext-2 generating an authentication key H by hashing with the local IP addresss_next', using a locally stored shared key pair (x)R_2′,yR_2'), random number rnext-1 generating an authentication key H by hashing with the local IP addressR_next', to authenticate the secret key HS_next' and HR_nextRespectively decrypting ciphertext data from a routing table sender and a routing table receiver, respectively comparing next hop router node IP addresses recorded in two routing backtracking tables obtained through decryption with local IP addresses, if certain comparison result is different in two comparison results, indicating that authentication of a returned data party corresponding to the comparison result fails, if the two comparison results are different, indicating that authentication of the router nodes of the first two hops fails, and indicating that authentication of the routing table sender and the routing table receiver succeeds only if the two comparison results are the same.
Similarly, the next hop router node continues to share the key pair (x)R_2′,yR_2'), second shared key pair (x) assigned by next hop router nodenext_2,ynext_2) And a random number rnestAfter the state key is used for encryption, the broadcast is continuously carried out to the next two-hop router nodes along with the locally updated routing table, the authentication process is continuously carried out on the routing table received by the next two-hop router nodes until the distance field value recorded in the updated routing table entry reaches the peak value (sixteen hops), and the broadcast of the routing table entry is terminated.
Third, route updating
After the router node and the corresponding routing table entry are successfully authenticated, each routing table entry is updated to the local routing table by using a distance vector routing algorithm, which is a basic routing algorithm under the RIP2 protocol framework and is not described herein again.
In addition, in order to ensure that the IKE security associations used between the router nodes are always consistent, it is necessary that each router node synchronizes clocks with the security negotiation node, and a set system clock deadline is used as a life cycle of the IKE security association, the security negotiation node and all router nodes complete a new negotiation before expiration, and start a newly established security association mechanism when the current life cycle expires.
In order to implement the method, the invention also provides an interior gateway routing link security management system, which comprises: the system comprises a security negotiation node arranged on an internal gateway bus and a plurality of router sub-nodes deployed in a distributed manner;
as shown in fig. 6, the security negotiation node specifically includes: an IKE security association negotiation module, an IKE Security Association Database (SAD), an IKE Security Policy Database (SPD);
IKE security association negotiation module: receiving an IKE security policy proposal from a router child node, trying to search a security policy matched with the IKE security policy proposal in a local security policy database, returning the matched security policy serving as a response message to the router child node, and simultaneously constructing a corresponding security association according to the successfully matched security policy;
IKE security association database: the security association used for storing the security parameter index SPI negotiated with the router child node;
IKE security policy database: for storing all IKE security policies indexed by source/destination IP addresses;
as shown in fig. 6, the router child node specifically includes: the routing system comprises a random number generator, a routing security association negotiation module, a Routing Security Association Database (RSAD), a Routing Security Policy Database (RSPD), a routing backtracking table generation module, a routing encryption module, a routing authentication module and a routing update module;
a random number generator: for generating random numbers used in the encryption and authentication processes;
the routing security association negotiation module: searching an IKE security policy applicable to a routing protocol of a local internal gateway in a routing security policy database, sending an IKE security policy proposal to a security negotiation node, and constructing a corresponding security association according to the security policy returned by the security negotiation node;
routing security association database: the security association used for storing the security parameter index SPI which is negotiated through with the security negotiation node;
routing security policy database: for storing all IKE security policies indexed by source/destination IP addresses;
the route backtracking table generation module: generating a routing backtracking table which is composed of the IP address of the receiving party of the routing table, the IP address of the sending party of the routing table and the random number which is increased along with the hop number of the routing path;
a routing table generation module: generating a routing table consisting of a destination IP address, a subnet mask, a sender IP address of the routing table and a previous hop IP address field;
the route encryption module: generating an encryption algorithm and a key according to an encryption strategy of the routing table, encrypting the routing table and the routing backtracking table by adopting a symmetric encryption algorithm, and reversely decrypting the received ciphertext data;
the route authentication module: generating an authentication algorithm and an authentication message according to the authentication strategy of the routing table to realize the authentication of the routing table; generating an authentication algorithm and an authentication message according to an authentication strategy of the router node, and realizing the authentication of the router node through the verification of the routing backtracking table;
a route updating module: and updating each routing table entry successfully authenticated by the routing information to a local routing table by using a distance vector routing algorithm.
It will be evident to those skilled in the art that the invention is not limited to the details of the foregoing illustrative embodiments, and that the present invention may be embodied in other specific forms without departing from the spirit or essential attributes thereof. The present embodiments are therefore to be considered in all respects as illustrative and not restrictive, the scope of the invention being indicated by the appended claims rather than by the foregoing description, and all changes which come within the meaning and range of equivalency of the claims are therefore intended to be embraced therein. Any reference sign in a claim should not be construed as limiting the claim concerned.
Claims (7)
1. A security management method for an interior gateway routing link, the method comprising:
step 1) selecting a router on a bus of an internal gateway as a security negotiation node of the autonomous system, wherein all security associations based on an IKE protocol are stored in the security negotiation node;
step 2) utilizing the security negotiation node to complete the security association negotiation used in the transmission process of the routing data with the router node to be registered, and connecting the router to the internal gateway routing link after the negotiation is passed;
and 3) broadcasting the locally updated routing table to the adjacent router nodes by adopting a RIP2 protocol for the registered router nodes, and performing encryption and authentication on the message carrying the routing table transmitted between the router nodes by using the negotiated security association.
2. The security management method for interior gateway routing link according to claim 1, wherein the security association negotiation process is:
step 201) using a router node to be registered as an initiator, sending a plurality of IKE security policy proposals to a security negotiation node, wherein the IKE security policy proposals comprise: the router node authentication strategy, the encryption strategy of the routing table and the authentication strategy of the routing table;
step 202) using the security negotiation node as a responder, checking the received IKE security policy, trying to find a security policy matched with the IKE security policy locally, and returning the matched security policy serving as a response message to the router node to be registered;
step 203) both parties exchange key information and authenticate identity through the security policy negotiated in step 202), and register the router node is completed.
3. The interior gateway routing link security management method of claim 2, wherein the authentication policies of the router nodes and routing tables include:
the security negotiation node establishes a routing coefficient a0,a1,a2Formed linear equation f (x)i):
From the linear equation f (x)i) Generating a shared key pair (x)i,yi) Distributing two unique shared key pairs and a linear routine f (x) to each router nodei) And the method is used for realizing the authentication of the router node and the routing table.
4. The interior gateway routing link security management method of claim 2, wherein the encryption policy of the routing table comprises:
the security negotiation node establishes an m-sequence generating function:
wherein, cjRepresenting the feedback coefficient, x representing the state variable in the m-sequence;
sharing m-sequence generating function and initial state δ (0) ═ a for all router nodes0,a1,...an-1) And the router node constructs an m sequence in any state by using the m sequence generating function, and the m sequence is used as an encryption key of the routing table in the current state.
5. The interior gateway routing link security management method of claim 4, wherein the encryption policy of the routing table is executed by:
the sender of the routing table generates a random number, and calculates the state key of the current routing table item by using the distance field value recorded in the routing table item and the initial state of the m-sequence generating function, wherein the calculation formula is represented as:
wherein, δ (r)d) Representing the state key, T representing the state transition matrix, d representing the distance of the destination IP address to the sender of the routing table, rSA random number representing a sender of the routing table;
using state key to encrypt the destination IP address, subnet mask, IP address of sender in routing list and last hop IP address field by symmetric encryption algorithm, and generating cipher text data and random number rSBroadcasting the RIP message to adjacent router nodes in a multicast mode together with the distance field value;
after receiving RIP message, the receiving party of the routing list is according to the distance field value and random number r in the routing listSAnd regenerating the state key, and decrypting the ciphertext data by using the state key to obtain plaintext data.
6. The interior gateway routing link security management method of claim 2, wherein the router node and routing table authentication process is:
in the initial state established by the routing table item, the distance field value in the sent routing table item is one hop, and the sender of the routing table item distributes the first shared key pair (x)S_1,yS_1) Encrypting through the state key, and broadcasting the ciphertext data and the encrypted routing table together;
the receiving party of the routing table decrypts the received ciphertext data by using the state key to obtain a shared key pair (x)S_1′,yS_1') a first shared key pair (x) to which the routing table receiver is assignedR_1,yR_1) Second shared key pair (x)R_2,yR_2) And a shared key pair (x)S_1′,yS_1') introduce the linear equation f (x)i) Calculating to obtain a coefficient a0', coefficient of a0' with locally stored coefficients a0Comparing, if different, indicating that the route table item authentication fails, terminating the authentication, otherwise generating a random number rRUsing a shared key pair (x)S_1′,yS_1') hash with the routing table sender IP address:
wherein, IPSIndicating the routing table sender IP address, HRRepresenting a hash value;
by a hash value HRAs the first authentication key, the IP address of the receiving party of the routing table, the IP address of the sending party of the routing table and the random number r are comparedRThe formed route backtracking table is encrypted by adopting a symmetric encryption algorithm, and the encrypted route backtracking table is sent to a route table sender;
after receiving the encrypted route backtracking table, the routing table sender utilizes a first shared key pair (x)S_1,yS_1) Carrying out Hash operation with local IP address to generate authentication key HR' and decrypt the encrypted route trace back table, compare the IP address of the sender with the local IP address of the route table obtained by decryption, if different, indicate that the identity authentication of the receiver of the route table fails, terminate the authentication, otherwise utilize the first shared key pair (x)S_1,yS_1) And carrying out hash operation on the decrypted IP address of the routing table receiver:
wherein, IPRIndicating the routing table receiver IP address, HSRepresenting a hash value;
by a hash value HSAs a second authentication key, the routing backtracking table is encrypted again by adopting a symmetric encryption algorithm, and the encrypted routing backtracking table is transmitted back to a routing table receiver;
after receiving the encrypted route backtracking table, the route table receiver utilizes the locally stored shared secret key pair (x)S_1′,yS_1') generating an authentication key H by hashing with the local IP addressS' and decrypt the encrypted routing backtracking list, compare the decrypted IP address of the receiving party of the routing list with the local IP address, if different, indicate that the identity authentication of the sending party of the routing list fails, terminate the authentication, if not, indicate that the sending party of the routing list fails to authenticateUpdating the successfully authenticated routing table entry into the local routing table by using the distance vector routing algorithm, and simultaneously updating the shared key pair (x)S_1′,yS_1′)、(xR_2,yR_2) And a random number rRAfter being encrypted by the state key, the routing table updated locally continues to broadcast to the next hop router node;
the next-hop router node decrypts the received ciphertext data by using the state key to obtain a shared key pair (x)S_1″,yS_1") and (x)R_2′,yR_2'), a first shared key pair (x) to be assigned to a next hop router nodenext_1,ynext_1) Shared key pair (x)S_1″,yS_1") and (x)R_2′,yR_2') introduce the linear equation f (x)i) Calculating to obtain a coefficient a0", the coefficient a0"coefficient a with local storage0Comparing, if different, indicating that the route table item authentication fails, terminating the authentication, otherwise generating a random number rnext=rR+1, with shared key pair (x)S_1″,yS_1"), random number rnextAnd carrying out Hash operation with the IP address of the sender of the routing table:
using a shared key pair (x)R_2′,yR_2'), random number rnextAnd carrying out hash operation with the IP address of the routing table receiver:
wherein Hnext_SAnd Hnext_RRepresenting a hash value;
by a hash value Hnext_SAs the first authentication key of the next hop router node and the routing table sender, the IP address of the next hop router node and the IP address of the routing table sender are verifiedA random number rnextThe formed route backtracking table is encrypted by adopting a symmetric encryption algorithm, and the encrypted route backtracking table is sent to a route table sender;
by a hash value Hnext_RAs the first authentication key of the next hop router node and the routing table receiver, the IP address of the next hop router node, the IP address of the routing table receiver and the random number r are comparednextThe formed route backtracking table is encrypted by adopting a symmetric encryption algorithm, and the encrypted route backtracking table is sent to a route table receiver;
after receiving the encrypted route backtracking table, the routing table sender utilizes the local first shared key pair (x)S_1,yS_1) And local IP address, random number rR+1 Hash operation to generate certification key Hnext_S' and decrypt the encrypted route backtracking list, compare the sender IP address of the route backtracking list with the local IP address, if different, indicate that the next hop router node identity authentication fails, terminate the authentication, otherwise utilize the local first shared key pair (x)S_1,yS_1) A random number rR-1, performing hash operation with the decrypted next-hop router node IP address:
by a hash value HS_nextAs a second authentication key of the next hop router node and the routing table sender, re-encrypting the routing backtracking table by adopting a symmetric encryption algorithm, and returning the encrypted routing backtracking table to the next hop router node;
after receiving the encrypted route backtracking table, the route table receiver utilizes a local second shared secret key pair (x)R_2,yR_2) And local IP address, random number rR+1 Hash operation to generate certification key Hnext_R' and decrypt the encrypted route backtracking list, compare the decrypted route backtracking list receiver IP address with the local IP address, if different, indicate that the next hop router node identity authentication fails, terminateAuthentication, otherwise using a local second shared key pair (x)R_2,yR_2) A random number rRAnd carrying out hash operation on the node IP address of the next-hop router obtained by decryption:
by a hash value HR_nextAs a second authentication key of the next hop router node and the routing table receiver, re-encrypting the routing backtracking table by adopting a symmetric encryption algorithm, and returning the encrypted routing backtracking table to the next hop router node;
after the next-hop router node respectively receives the routing backtracking tables encrypted by the sender and the receiver of the routing table, the next-hop router node utilizes the locally stored shared key pair (x)S_1″,yS_1"), random number rnext-2 generating an authentication key H by hashing with the local IP addressS_next', using a locally stored shared key pair (x)R_2′,yR_2'), random number rnext-1 generating an authentication key H by hashing with the local IP addressR_next', to authenticate the secret key HS_next' and HR_nextRespectively decrypting ciphertext data from a routing table sender and a routing table receiver, respectively comparing next hop router node IP addresses recorded in two routing backtracking tables obtained by decryption with a local IP address, if the two comparison results are different, indicating that the routing table sender or receiver identity authentication fails, terminating the authentication, if the two comparison results are the same, indicating that the routing table sender and receiver identity authentication succeeds, updating a routing table item successfully authenticated into the local routing table by using a distance vector routing algorithm, and simultaneously sharing a secret key pair (x)R_2′,yR_2'), second shared key pair (x) assigned by next hop router nodenext_2,ynext_2) And a random number rnextAfter the state key is encrypted, the routing table which is updated locally continues to broadcast to the two-hop router nodes, and the routing table identification received by the two-hop router nodes is continuously completedAnd finally, terminating the broadcast of the routing table entry until the distance field value recorded in the updated routing table entry reaches sixteen hops.
7. An interior gateway routing link security management system, the system comprising: the system comprises a security negotiation node arranged on an internal gateway bus and a plurality of router sub-nodes deployed in a distributed manner;
the security negotiation node comprises: an IKE security association negotiation module, an IKE security association database and an IKE security policy database;
IKE security association negotiation module: receiving an IKE security policy proposal from a router child node, trying to search a security policy matched with the IKE security policy proposal in a local security policy database, returning the matched security policy serving as a response message to the router child node, and simultaneously constructing a corresponding security association according to the successfully matched security policy;
IKE security association database: the security association used for storing the security parameter index SPI negotiated with the router child node;
IKE security policy database: for storing all IKE security policies indexed by source/destination IP addresses;
the router child node includes: the routing system comprises a random number generator, a routing security association negotiation module, a routing security association database, a routing security policy database, a routing backtracking table generation module, a routing encryption module, a routing authentication module and a routing update module;
a random number generator: for generating random numbers used in the encryption and authentication processes;
the routing security association negotiation module: searching an IKE security policy applicable to a routing protocol of a local internal gateway in a routing security policy database, sending an IKE security policy proposal to a security negotiation node, and constructing a corresponding security association according to the security policy returned by the security negotiation node;
routing security association database: the security association used for storing the security parameter index SPI which is negotiated through with the security negotiation node;
routing security policy database: for storing all IKE security policies indexed by source/destination IP addresses;
the route backtracking table generation module: generating a routing backtracking table which is composed of the IP address of the receiving party of the routing table, the IP address of the sending party of the routing table and the random number which is increased along with the hop number of the routing path;
a routing table generation module: generating a routing table consisting of a destination IP address, a subnet mask, a sender IP address of the routing table and a previous hop IP address field;
the route encryption module: generating an encryption algorithm and a key according to an encryption strategy of the routing table, encrypting the routing table and the routing backtracking table by adopting a symmetric encryption algorithm, and reversely decrypting the received ciphertext data;
the route authentication module: generating an authentication algorithm and an authentication message according to the authentication strategy of the routing table to realize the authentication of the routing table; generating an authentication algorithm and an authentication message according to an authentication strategy of the router node, and realizing the authentication of the router node through the verification of the routing backtracking table;
a route updating module: and updating each routing table entry successfully authenticated by the routing information to a local routing table by using a distance vector routing algorithm.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202210069334.9A CN114374564B (en) | 2022-01-21 | 2022-01-21 | Internal gateway routing link security management system and method |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202210069334.9A CN114374564B (en) | 2022-01-21 | 2022-01-21 | Internal gateway routing link security management system and method |
Publications (2)
Publication Number | Publication Date |
---|---|
CN114374564A true CN114374564A (en) | 2022-04-19 |
CN114374564B CN114374564B (en) | 2024-03-15 |
Family
ID=81145659
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CN202210069334.9A Active CN114374564B (en) | 2022-01-21 | 2022-01-21 | Internal gateway routing link security management system and method |
Country Status (1)
Country | Link |
---|---|
CN (1) | CN114374564B (en) |
Citations (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN2068254U (en) * | 1990-05-28 | 1990-12-26 | 中国人民解放军57351部队 | Information leakage prevention related interference unit |
US20030093691A1 (en) * | 2001-11-13 | 2003-05-15 | Reefedge, Inc., A Delaware Corporation | Enabling secure communication in a clustered or distributed architecture |
KR20040028329A (en) * | 2002-09-30 | 2004-04-03 | 주식회사 케이티 | Method for supplying discriminative services in VPN |
US20060105741A1 (en) * | 2004-11-18 | 2006-05-18 | Samsung Electronics Co., Ltd. | Method and apparatus for security of IP security tunnel using public key infrastructure in mobile communication network |
US20080187137A1 (en) * | 2005-02-11 | 2008-08-07 | Pekka Nikander | Method and Apparatus for Ensuring Privacy in Communications Between Parties |
US7562384B1 (en) * | 2003-03-07 | 2009-07-14 | Cisco Technology, Inc. | Method and apparatus for providing a secure name resolution service for network devices |
US8954601B1 (en) * | 2007-06-15 | 2015-02-10 | Juniper Networks, Inc. | Authentication and encryption of routing protocol traffic |
CN113364811A (en) * | 2021-07-05 | 2021-09-07 | 北京慧橙信息科技有限公司 | Network layer safety protection system and method based on IKE protocol |
-
2022
- 2022-01-21 CN CN202210069334.9A patent/CN114374564B/en active Active
Patent Citations (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN2068254U (en) * | 1990-05-28 | 1990-12-26 | 中国人民解放军57351部队 | Information leakage prevention related interference unit |
US20030093691A1 (en) * | 2001-11-13 | 2003-05-15 | Reefedge, Inc., A Delaware Corporation | Enabling secure communication in a clustered or distributed architecture |
KR20040028329A (en) * | 2002-09-30 | 2004-04-03 | 주식회사 케이티 | Method for supplying discriminative services in VPN |
US7562384B1 (en) * | 2003-03-07 | 2009-07-14 | Cisco Technology, Inc. | Method and apparatus for providing a secure name resolution service for network devices |
US20060105741A1 (en) * | 2004-11-18 | 2006-05-18 | Samsung Electronics Co., Ltd. | Method and apparatus for security of IP security tunnel using public key infrastructure in mobile communication network |
US20080187137A1 (en) * | 2005-02-11 | 2008-08-07 | Pekka Nikander | Method and Apparatus for Ensuring Privacy in Communications Between Parties |
US8954601B1 (en) * | 2007-06-15 | 2015-02-10 | Juniper Networks, Inc. | Authentication and encryption of routing protocol traffic |
CN113364811A (en) * | 2021-07-05 | 2021-09-07 | 北京慧橙信息科技有限公司 | Network layer safety protection system and method based on IKE protocol |
Also Published As
Publication number | Publication date |
---|---|
CN114374564B (en) | 2024-03-15 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
Xue et al. | A lightweight and secure group key based handover authentication protocol for the software-defined space information network | |
US8245028B2 (en) | Method and apparatus for dynamic, seamless security in communication protocols | |
CN110581763A (en) | Quantum key service block chain network system | |
CN113364811B (en) | Network layer safety protection system and method based on IKE protocol | |
US8345878B2 (en) | Method for distributing cryptographic keys in a communication network | |
Khan et al. | Energy efficient partial permutation encryption on network coded MANETs | |
CN114095423B (en) | MPLS-based power communication backbone network data security protection method and system | |
Cho et al. | Using QKD in MACsec for secure Ethernet networks | |
Li et al. | A new scheme for key management in ad hoc networks | |
Ye et al. | A safe proactive routing protocol SDSDV for ad hoc network | |
CN115733683A (en) | Method for realizing Ethernet link self-organizing encryption tunnel by adopting quantum key distribution | |
CN102448062B (en) | Method for establishing 6LoWPAN (6 Local Wireless Personal Area Network) key | |
CN114374564B (en) | Internal gateway routing link security management system and method | |
Chakrabarty et al. | Black routing and node obscuring in IoT | |
CN108768661B (en) | Improved AKA identity authentication system and method based on symmetric key pool and cross-relay | |
Raheem et al. | A secure authentication protocol for IP-based wireless sensor communications using the Location/ID Split Protocol (LISP) | |
Erritali et al. | A Contribution to Secure the Routing Protocol" Greedy Perimeter Stateless Routing" Using a Symmetric Signature-Based AES and MD5 Hash | |
Rajendran et al. | Secure anonymous routing in ad hoc networks | |
Gahlin | Secure ad hoc networking | |
Johnson et al. | Providing authentication in delay/disruption tolerant networking (dtn) environment | |
CN115695030B (en) | Information theory security group authentication method based on quantum key distribution network | |
Agarwal et al. | OLWS: optimized light weight secure clustering protocol for wireless sensor networks | |
Bhutta et al. | A framework for key management architecture for DTN (KMAD): requirements and design | |
Khan | An identity based routing path verification scheme for wireless sensor networks | |
Wang et al. | A pair-wise key establishment scheme without predistributing keys for ad-hoc networks |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PB01 | Publication | ||
PB01 | Publication | ||
SE01 | Entry into force of request for substantive examination | ||
SE01 | Entry into force of request for substantive examination | ||
TA01 | Transfer of patent application right | ||
TA01 | Transfer of patent application right |
Effective date of registration: 20240202 Address after: Chinatelecom tower, No. 19, Chaoyangmen North Street, Dongcheng District, Beijing 100010 Applicant after: Tianyi Safety Technology Co.,Ltd. Country or region after: China Address before: 210046 computer system engineering test center of Jiangsu Institute of metrology, No. 95 Wenlan Road, Qixia District, Nanjing, Jiangsu Province Applicant before: Huang Xing Country or region before: China |
|
GR01 | Patent grant | ||
GR01 | Patent grant |