WO2006128384A1

WO2006128384A1 - A method for creating a ipsec security association

Info

Publication number: WO2006128384A1
Application number: PCT/CN2006/001186
Authority: WO
Inventors: Hui Wang; Zhengbin Tang; Jian Xu
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2005-06-03
Filing date: 2006-06-02
Publication date: 2006-12-07
Also published as: CN1874343B; CN1874343A

Abstract

A method for creating a IPSec security association includes providing a more robust security association by creating a security association whose destination address is an unspecified address and updating a address when determining the address. Thereby the method reduces the amount of the created security association when a destination address is uncertain and improves the maintainability of the security association, so it is a flexible and convenient method for creating the security association.

Description

How to create an IPSec security association

Technical field

The present invention relates to the field of network communication security technologies, and in particular, to a method for creating an IPSec security association. Background technique

IP Security Protocol (IPSec) is a security protocol widely used in network communication. In the application of the protocol, a security association (SA) needs to be established for the encryption and decryption process of information to ensure the secure transmission of information. According to the IPSec protocol definition, a security association is uniquely determined by a triplet consisting of a destination address, a Security Parameter Index (SPI), and a security protocol.

Generally, in mobile communication, a home agent is deployed and maintained by an operator, and a mobile node is also a controllable user of the operator (the identity can be verified and controlled by means of a mobile subscriber identity code or a CA certificate) Therefore, in the security mechanism of the mobile IP signaling security, a security association may be established in advance for the mobile node and the home agent to ensure security between the mobile node and the home agent. After the communication node confirms that the home address and the care-of address claimed by the mobile node are reachable, the peer communication node (Correspondent Node) accepts the binding update message from the mobile node, and establishes a corresponding binding relationship, and then the subsequent The traffic is forwarded to the new care-of address of the mobile node to ensure security between the mobile node and the communication node. In the process of applying IPSec to mobile IP, according to RPC3776, after the mobile node moves to the foreign network, IPSec can be used to establish a security association between the home agent and the mobile node to protect the transport mode. The control message between the mobile node and the home agent protects the control or payload message between the mobile node and the communication node in a tunnel mode. In the home agent, the security association pair created by the IPSec protection for the control packet between the mobile node and the home agent, the destination address of the inbound security association is the home agent address (Home Agent Address); The destination address of the alliance is the home address of the mobile node.

According to the implementation principle of the mobile IPv6 protocol, there may be multiple Home Agent Addresses provided by the home agent to the mobile node, and which home agent address is specifically used by the mobile node, depending on the mobile node selection. For this situation, the current implementation is to establish a pair of security associations between each home agent proxy address and the mobile node home address between the home agent and the mobile node. For example, the home agent has three home agent addresses (HAAddrl, HAAddr2, HAAddr3); the mobile node's home address is HomeAddr; IPSec uses the ESP security protocol; the security protocol encapsulation mode is the transport mode; then the home agent will establish 3 For security alliances.

However, a pair of security associations is established between each of the different home agent addresses and the home address of the mobile node, resulting in a large number of security associations, especially in the case of manual configuration. Summary of the invention

In view of the above problems in the prior art, an object of the present invention is to provide a method for creating an IPSec security association, which can perform simple and flexible processing and facilitate maintenance management when the destination address is indefinite or multiple.

The method for creating an IPSec security association is provided by the present invention. The security association created by the method is uniquely determined by a triplet composed of a destination address, a security parameter index, and a security protocol, and includes the following steps:

Create a security association whose destination address is an unspecified address.

When the security association is able to determine the destination address it uses, it updates the unspecified address in the security association as the destination address with the determined destination address information.

Assign a unique security parameter index to the created security association.

The created security association compares the unspecified address with any address in the triple comparison of conflict detection.

When the created SA is in conflict detection, the result of comparing the unspecified address with the address within the limited range that may be valued is the same.

When the created destination address is an SA with no specified address, the destination address is ignored when the decryption match is performed.

The created security association is an inbound security association created by the home agent in the mobile IPv6 to establish a secure connection with the mobile node and whose destination address is an unspecified address.

The home agent determines the destination address of the inbound security association according to the binding update BU message sent by the mobile node after being moved to the foreign network.

The home agent updates the destination address of the inbound security association according to the address information in the received binding update BU message. After the mobile node returns to the home network, the home agent sets the address of the corresponding inbound security association PI to an unspecified address.

It can be seen from the technical solution provided by the present invention that the present invention provides a destination address by creating a security association whose destination address is an unspecified address and performing address refresh when the address can be determined to provide a more complete security association. A method for creating an IPSec SA that is simple, flexible, and easy to maintain when there are multiple or multiple destination addresses.

The result of assigning a unique security parameter index to the security association, or comparing the unspecified address with any address in the triple comparison at the time of the security association conflict detection is considered to be the same (ie, the conflict in the security association and its subsequent security association) In the detection, the purpose of ignoring the destination address and using only the other parts of the triplet as the index for collision detection can prevent some conflicts that may occur during the creation or refreshing of the security association.

The present invention can be applied not only to the creation of an IPSec SA in Mobile IPv6, but also to a routing protocol such as OSPFv3 (the destination address of the routing message may be a different multicast address or a unicast address) or other destination addresses may be indefinite or The creation of an IPSec security association. DRAWINGS

FIG. 1 is a flowchart of a process when the present invention is applied in IPv6. detailed description

The core idea of the present invention is to provide a flexible and simple method for creating a security association by creating a security association whose destination address is an unspecified address and performing address refresh when the address can be determined to provide a more robust security association.

In order to make the principles, features and advantages of the present invention more apparent, the invention will be further described in conjunction with the accompanying drawings.

There may be multiple home agent addresses provided by the home agent to the mobile node when using IPSec, and which home agent address is used by the mobile node, depending on the mobile node selection; the application of the present invention in IPv6 may be as follows: The process flow shown in Figure 1.

> Step 11: Assign a unique security parameter index to the created SA. That is, the security parameter index is unique to the inbound SA or the outbound SA. The security parameter index cannot be compared with the existing security parameter index. The same, the future assigned security parameter index is also Cannot be the same as this security parameter index. Of course, it is not necessary to adopt a method of assigning a unique security parameter index, and other methods for preventing conflicts may be adopted to prevent security alliance conflicts. For example, the created security association can compare the unspecified address with any address in the triple comparison of conflict detection, that is, the destination address is ignored when comparing, and only the other parts of the triple are used as indexes. Collision detection, that is, regardless of the destination address, only consider SPI and security protocol, as long as any one of the SPI and the security protocol is different (such as the same SPI, but the security protocol is not the same), that is, no conflict, not once the SPI is the same It is also a conflict; the created security association can also compare the unspecified address with the address within the limited range when the conflict detection is performed, that is, the range of possible values except the unspecified address when comparing In addition to the security alliances that may constitute conflicts, other security associations use triples as an index for collision detection.

Step 12: After obtaining the unique security parameter index, use the security parameter index and combine the other configuration conditions to create an SA with the destination address as an unspecified address. As shown in Table 1, the home agent creates a pair of security associations for the mobile node. The situation here is that the home agent has three home agent addresses (HAAddrl, HAAddr2, HAAddr3) for the mobile node to select, the mobile node home address is HomeAddr; IPSec uses the Encapsulating Security Payload (ESP) security protocol. IPsec Encapsulating Security Payload ESP is a major protocol in the IPsec architecture designed primarily for hybrid applications that provide security services in both IPv4 and IPv6. ESP provides confidentiality and integrity by encrypting the data that needs to be protected and by placing these encrypted data in the data portion of the ESP. The encapsulation mode of the ESP security protocol is the transmission mode. The destination address of the inbound SA is the unspecified address 0::0. The only security parameter is SPI-11 and the security protocol is ESP (Encapsulated Security Payload).

Table 1. A pair of security associations created by the home agent in IPv6 for the mobile node.

Step 13, waiting or performing other corresponding processing; the destination address is the security of the unspecified address Once the alliance is created, it can be used.

Step 14. Receive a message;

Step 15: Determine whether the destination address of the created security association is determined.

If the destination address is undefined, perform step 16, if the destination address is determined, go to step 17;

Step 16. Ignore the destination address when decrypting the message.

Step 17, performing a complete triple match when the message is decrypted;

Step 18: Determine whether the message decryption is successful by using the check value or the parameter, that is, whether the message decryption is successfully performed, and if not, return to step 13 to perform corresponding error processing or wait for receiving the message again; Yes, it means that the correct message was received.

Step 19: After receiving the correct packet, further determine whether the received packet advertises the information of the change of the destination address of the security association. If yes, go to step 20; otherwise, return to step 13 to continue with other subsequent processing.

Step 20: Refresh the destination address of the security association, and then proceed to step 13 for other processing. As shown in Table 2, the status of the home agent to the security association after the refresh. This refresh is performed by the home agent security association after the mobile node moves to the foreign network and sends a Binding Update (BU) message to the home node to announce that the home agent address selected by the mobile node is HAAddrl.

Table 2. The status of the home agent to the security alliance after the refresh

Certainly, in step 19, the address change may be an address that is changed from an unspecified address to a certain address (away from the home network), or may be changed from a determined address to an unspecified address (back to the home network), or may be Change from one determined address to another (from one foreign network to another). Correspondingly, similar to step 20 above, the security association destination address refresh is required. It can be seen from the foregoing specific embodiments that the present invention assigns a unique security parameter index to the security association, or ignores the destination address and the triplet only in the triple comparison in the security association conflict detection. Other measures, such as index detection for conflict detection, can prevent some conflicts that may occur during the creation or refresh of the security association. It can be applied to the creation of IPSec SAs in Mobile IPv6, OSPFv3 and other routing protocols, or the creation of IPSec SAs in other occasions where the destination address is uncertain or multiple.

The above is only a preferred embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or within the technical scope of the present disclosure. Alternatives are intended to be covered by the scope of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

Rights request

A method for creating an IPSec security association. The security association created by the method is uniquely determined by a triplet composed of a destination address, a security parameter index, and a security protocol, and is characterized by the following steps:

2. The method for creating an IPSec security association according to claim 1, further comprising assigning a unique security parameter index to the created security association.

3. The method for creating an IPSec security association according to claim 1, wherein the created security association compares the unspecified address with any address in a triplet comparison of collision detection.

The method for creating an IPSec security association according to claim 1, wherein the created security association compares the unspecified address with an address within a limited range that may be valued during collision detection. For the same.

The method for creating an IPSec security association according to any one of claims 2 to 4, wherein when the created destination address is a security association with no specified address, the destination address is ignored when the decryption match is performed.

The method for creating an IPSec security association according to claim 5, wherein the created security association is created by the home agent in the mobile IPv6 to establish a secure connection with the mobile node, and the destination address is an unspecified address. Inbound security alliance.

The method for creating an IPSec security association according to claim 6, further comprising: determining, by the home agent, the inbound security association according to the binding update BU message sent by the mobile node after being moved to the foreign network. Destination address.

The method for creating an IPSec security association according to claim 6, further comprising: the home agent updating the destination address of the inbound security association according to the received address information in the binding update BUf message. .

The method for creating an IPSec security association according to claim 7, further comprising: after the mobile node returns to the home network, the home agent sets the corresponding inbound security association destination address to an unspecified address. .