WO2008003208A1

WO2008003208A1 - A method, system for ensuring the security communication of mobile node and a mobile node

Info

Publication number: WO2008003208A1
Application number: PCT/CN2007/001127
Authority: WO
Inventors: Gang Cheng
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2006-06-30
Filing date: 2007-04-09
Publication date: 2008-01-10
Also published as: CN101098228A

Abstract

A method for ensuring security communication of mobile node is disclosed, includes the following steps: MN establishes a security association with the LER/FA and LER/HA to ensure the security communication of the MN. Further, a system for ensuring security communication of MN and a MN are disclosed. The present invention uses the method of establishing security association with the LER/FA and LER/HA; in the present invention, the MN establishes security association with the LER/FA and LER/HA level by level, which makes the MN directly register to the nearby LER/FA after the MN has moved in a new area without registering to the LER/HA again, therefore the message times transmitted to the LER/HA is reduced and the communication delay is lowered.

Description

Method, system and mobile node for guaranteeing secure communication of mobile node

The invention relates to a network security technology, in particular to a method for guaranteeing secure communication of a mobile node. Background of the invention

Next Generation Network (NG) is a converged network that carries a variety of telecommunication services such as voice, image and data through an IP connection between communicating entities. The mobility control and transmission function of the NGN service based on the Multi-Protocol Label Switching (MPLS) network is a hot topic. MPLS provides signaling and transport mechanisms to support quality of service (QoS), traffic engineering, and virtual private network (VPN) capabilities. Currently, most mobile networks have transitioned to use IP technology for transmission, and most IP routers support MPLS.

In the process of implementing the present invention, the inventor found that in a mobile network environment, a mobile node (MN) is often connected to a network through a wireless link, and an LSP (Label Switched Path) connected to these access links is easy. being attacked. In the current technology, the security mechanism based on the MPLS network does not provide a specific implementation method and processing procedure to ensure the security of the MN. Therefore, the prior art cannot guarantee the secure communication of the MN in the MPLS-based network. Summary of the invention

In view of this, the main object of the present invention is to provide a method for securing secure communication of a mobile node, and the method provided by the present invention can ensure secure communication of the MN in an MPLS-based network.

Meanwhile, another main object of the present invention is to provide a secure communication for a mobile node. The system can guarantee the secure communication of the MN in the MPLS-based network.

In addition, another main object of the present invention is to provide a mobile node capable of securing its own secure communication in an MPLS-based network.

In order to achieve the above object, the technical solution of the present invention is achieved as follows:

The present invention provides a method for securing secure communication of a mobile node, performing the following steps: The mobile node MN establishes a security association with the MN secure communication between the label router/foreign agent LER7FA and the label router/home agent LER/HA.

In addition, the present invention further provides a system for ensuring secure communication of a mobile node, the system comprising: MN, LER/FA, and LER/HA;

The MN establishes a security association with LER/FA, and LER/HA to secure communication. Furthermore, the present invention further provides a mobile node, the MN including at least a request unit and a negotiation unit;

The requesting unit is configured to send a security association request to the LER/FA;

The negotiating unit establishes a security association with the LER/FA and the LER/HA to secure communication.

The invention provides a method for guaranteeing secure communication of a mobile node, and the MN establishes

MN security during communication. In the technical solution of the embodiment of the present invention, the MN is used to establish a security association with the LER/FA and the LER/HA step by step, so that the MN can directly register with the adjacent LER/FA after moving to the new area without having to The LER/HA is registered, which reduces the number of times the message is sent to the LER7HA, and reduces the communication delay. In addition, the present invention also provides a system for securing secure communication of a mobile node, and a mobile node. BRIEF DESCRIPTION OF THE DRAWINGS

1 is a structural diagram based on an MPLS network; 1 is a flow chart of a method of a first preferred embodiment of the present invention;

3 is a flowchart of updating a security association according to a first preferred embodiment of the present invention;

4 is a structural diagram of a system according to a first preferred embodiment of the present invention;

Figure 5 is a flow chart of a method of a second preferred embodiment of the present invention;

FIG. 6 is a flowchart of updating a security association according to a second preferred embodiment of the present invention; FIG. 7 is a flowchart of still updating a security association according to a second preferred embodiment of the present invention; FIG. 8 is a second preferred embodiment of the present invention; a structural diagram of the example system;

9 is a flow chart of a method of a third preferred embodiment of the present invention;

FIG. 10 is a flowchart of updating a security association according to a third preferred embodiment of the present invention; FIG.

FIG. 11 is a flowchart of still updating a security association according to a third preferred embodiment of the present invention; FIG. 12 is a flowchart of still updating a security association according to a third preferred embodiment of the present invention; FIG. 13 is a third preferred embodiment of the present invention; a structural diagram of the example system;

Figure 14 is a structural diagram of a mobile node of the present invention. Mode for carrying out the invention

Security Association (SA) is a logical connection established between two entities using IP Security (IPSec), such as a host or router. Security associations define the communication parties' conventions for certain elements of the communication process, such as the security protocol used, the protocol's mode of operation, the cryptographic algorithm, the shared key of the protected data in a particular stream, and the lifetime of the key. Therefore, two IPSec entities can use the established security association for secure communication.

The Label Edge Router/Foreign Agent and the Label Router/Home Agent (LER/HA, Label Edge Router/Home Agent) establish security associations to ensure that the MN can communicate securely.

Referring to Figure 1, Figure 1 is a structural diagram based on an MPLS network. Where LER/FA is here The three levels of foreign agents are: Label Router / Local Edge Agent (LER/LFA, Label Edge Router/Local Foreign Agent) is the first level foreign agent, label router / regional foreign agent (LER / RFA, Label Edge Router / The Regional Foreign Agent is a third-level foreign agent, and the Label Router/Gateway Foreign Agent (LER/GFA, Label Edge Router/Gateway Foreign Agent) is the third-level agent.

Here, LER/HA, LER/LFA, LER/RFA, and LER/GFA support devices in MPLS. LER/HA is an MPLS router with home agent function; LER/LFA is an MPLS router with foreign agent function; LER/RFA is an MPLS router with regional foreign agent function; LER/GFA is one with The MPLS router functioning as a gateway foreign agent is responsible for the jurisdiction of an autonomous domain.

Based on the specific application of the MPLS network, the LER/FA may include only the first-level foreign agent, and when only the first-level foreign agent is included, it may be LER/LFA, or LER/RFA, or LER/GFA. The LER/FA may also include a secondary foreign agent, which may be: the first level LER/FA is LER/LFA, the second level LER/FA is LER/RFA; or the first level LER/FA is LER/LFA, The second stage LER/FA is LER/GFA; or, the first stage LER/FA is KER/RFA, and the second level LER/FA is LER/GFA.

In addition, FIG. 1 also describes four models in which the MN moves in the MPLS network when the LER/FA includes a tertiary foreign agent, and the MN communicates with the communication node user (CN, Correspondence Nod), including: intra-subnet access , refers to the movement of the MN in the same LER/LFA jurisdiction; inter-subnet access refers to the movement of the MN under different LER/LFA jurisdictions but within the same LER/RFA jurisdiction; inter-network access, Refers to the movement of the MN in different LER/LFA jurisdictions, but in the same LER/GFA jurisdiction; inter-autonomous network access refers to the MN in different autonomous domains under the LER/GFA jurisdiction. mobile.

The preferred embodiments are now listed for each of the three cases included in the LER/FA. In the MPLS network, hierarchical mobile management is implemented for both mobile IPv4 services and mobile IPv6 services. In hierarchical mobile management, LER/LFA, LER/RFA and LER/GFA support local registration. The local registration function allows M to register directly with the adjacent LER/LFA, LER/RFA or LER/GFA after moving to the new area without having to register with the HA.

Therefore, in this embodiment, the MN establishes a security association with the LER/HA step by step. In this way, the MN can directly establish a security association with the foreign agent corresponding to the new area after moving to the new area, without having to re-negotiate with the LER/HA to establish a security association, thereby reducing the security association with the LER/HA. The number of process interactions reduces the switching delay.

In the embodiment of the present invention, the security association may be performed while the MN requests registration from the LER/HA. Here, the purpose of the MN registration with the LER/HA is to inform the LER/HA of its current Care-of Address (COA) so that the LER/HA knows its current area. Among them, the COA is used to provide the current location information of the MN.

Referring to Figure 2, Figure 2 is a flow chart of a method in accordance with a first preferred embodiment of the present invention. Since the description describes the process of establishing a security association with the LER/HA when the MN initially accesses the MPLS network, the LER/FA described here is the home LER/FA, that is, the LER/FA corresponding to the MN home address. In this embodiment, the LER/FA includes only the primary foreign agent, and the LER/FA may be LER/LFA, LER/RFA > or LER/GFA. The specific process is as follows:

Step 201: The MN sends a registration request message to the LER/HA through the LER/FA of the current area, and the registration request message carries the mobile node information such as the COA of the MN and the home address of the MN.

The home address is a permanent address assigned to the MN by the network side, and belongs to the home link of the mobile node. Through the MN's home address, the routing mechanism sends the packet addressed to the MN to its home link. The home address is used to identify the security association established by the MN. The COA is used to provide current location information of the MN to establish a security association. Step 202: After receiving the registration request message sent by the MN, the LER/FA registers the MN currently requesting registration, and saves the mobile node information of the MN, including the home address and the COA address, in its mobile node information table, and A security association is established in association with the MN. After the LER/FA and the MN successfully establish a security association, the LER7FA establishes a security association entry for the MN in its own mobile node information table, and is used to save the established security association.

Here, the LER/FA saves the security association between itself and the MN in order to be used by the MN in future communication processes to ensure the security of the MN in the communication process.

Here, the LER/FA negotiates with the MN to establish a security association, which needs to be based on the home address and COA carried in the registration request message.

Step 203: The LER/FA sends a registration request message of the MN to the LER/HA.

Step 204: After receiving the registration request message for the MN sent by the LER/FA, the LER/HA registers the MN on the LER/HA, and saves the mobile node information of the MN, including the home address and the COA address, in its own mobile node. In the information table, and establishing a security association with the MN; after the LER/HA and the MN successfully establish a security association, the LER/HA establishes a security association entry for the MN in its mobile node information table, and is used to save the established relationship with the MN. Security association.

Here, the LER/HA negotiates with the MN to establish a security association, which needs to be based on the home address and COA carried in the registration request message.

Steps 205 - 206: The LER/HA returns a registration response message to the MN through the LER/FA. In the process shown in FIG. 2, the method for establishing a security association between the MN and the LER/FA and the LER/HA may be: The MN further carries the information used by the MN to establish a security association in the sent registration request message, for example, the MN can support The type of security protocol, information such as the type of authentication method that the MN can use. When LER/LFA and LER/HA need to establish a security association with the MN, then LER/FA and LER/HA are based on the security association information in the MN registration request message. The MN returns an acknowledgment message to establish a security association between itself and the MN. The method for establishing a security association between the MN and the LER/FA and the LER/HA may be: after receiving the registration request message sent by the MN by the LER/FA and the LER/HA, triggering the interaction between the MN and the MN to establish the security of the MN and the MN. Association. Here, in the preferred embodiment of the invention, the described LER/FA is LER/LFA, or LER/RPA, or LER/GFA. The method of establishing a security association as described herein is equally applicable to the preferred embodiment described later in the present invention.

In the technical solution provided by the preferred embodiment, since the security association is established step by step, when the M moves to move from one LER/FA to another LER/FA, the MN does not need to cooperate with the LER/HA. To establish a security association, you only need to establish a security association with the LER/FA that you are moving to, and only update the security association with LER/HA.

Referring to FIG. 3, FIG. 3 is a flow chart of updating the MN security association of the MN moving from one LER/FA to another LER/FA. Specific steps are as follows:

Step 301: The MN sends a registration request message to the new LER/FA corresponding to the current new area to which the MN is located, and the registration request message carries the mobile node information such as the COA of the MN and the home address of the MN.

Step 302: After receiving the registration request message sent by the MN, the new LER/FA registers the MN currently requesting registration, and saves the mobile node information of the MN, including the home address and the COA address, in its mobile node information table. And establishing a security association with the MN. After the LER/FA and the MN successfully establish a security association, the new LER/FA establishes a security association entry for the MN in its mobile node information table, and is used to save the security association established between itself and the MN.

Step 303: The new LER/FA sends a registration request message of the MN to the original LER/FA where the MN moved before. Step 304: The original LER/FA performs registration update on the MN that is currently requesting registration according to the mobile node information in the registration request message, that is, updates the mobile node information of the MN recorded in the mobile node information table, including the COA; and searches for itself. The mobile node information table obtains the security association entry of the MN, and updates the COA information corresponding to the security association of the current MN in the security association entry.

Steps 305 ~ 306: The original LER/FA returns a registration response to the MN through the new LER/FA. Further, referring to FIG. 4, FIG. 4 is a system structure diagram corresponding to the preferred embodiment. The system for secure communication of a mobile node, the system comprising: MN41, LER/FA42 and LER/HA43. The MN 41 is mainly used to send a registration request message to the LER/FA 42. The LER/FA 42 is mainly used to receive the registration request message, establish a security association with the MN 41, and send a registration request message for the MN 41 to the LER/HA 43; LER/HA43, for receiving The registration request message establishes a security association with the MN 41. Here, the actual networking conditions of the described LER/FA 42 may be: LER/LFA, or LER/RFA, or LER/GFA. In addition, the process of establishing an updated security association between the MN 401 and the LER/FA 402, and the LER/HA 403 can be referred to the related description in the preferred embodiment.

Referring to Figure 5, Figure 5 is a flow chart of a method in accordance with a second preferred embodiment of the present invention. Figure 5 depicts the case where the LER/FA includes a secondary foreign agent, the first level LER/FA and the second level LER/FA. As with the first preferred embodiment, since the process described herein is to establish a security association with the LER/HA when the MN initially accesses the MPLS network, the first-level LER/FA and the second-level LER/ described herein are FA, both are foreign agents corresponding to the MN's home location. The specific process of the preferred embodiment is as follows:

Step 501: The MN sends a registration request message to the LER/HA through the first-level LER/FA of the current area, and the registration request message carries the mobile node information such as the MN's COA and the MN's home address. Step 502: After receiving the registration request message sent by the MN, the first-level LER/FA registers the MN currently requesting registration, and saves the mobile node information of the MN, including the home address and the COA address, in its own mobile node information table. And establishing a security association with the MN; after the first-level LER/FA and the MN successfully establish a security association, the first-level LER/FA establishes a security association entry for the MN in its mobile node information table, which is used for saving establishment. Security association.

Step 503: The first level LER/FA sends a registration request message of the MN to the second level LER/FA.

Step 504: The second level LER/FA performs the same operation as the first stage LER/FA of step 502, and details are not described in detail herein.

Step 505: The second-level LER/FA sends a registration request for the MN to the LER/HA. Step 506: After the LER/HA receives the registration request message sent by the second-level LER7FA, the LER/HA performs the operation performed by the LER/HA in step 204. The details will not be described in detail here.

Steps 507 - 509: The LER/HA returns a registration reply message to the MN through the second level LER/FA and the first LER/FA.

In the preferred embodiment, how the first level LER/FA and the second level LER/FA can be respectively: first level LER/FA is LER/LFA, second level LER/FA is LER/RFA Or, the first stage LER/FA is LER/LFA, and the second stage LER/FA is LER/GFA; or, the first stage LER/FA is LER/RFA, and the second stage LER/FA is LER/GFA.

In addition, in the preferred embodiment, when the MN moves from one first level LER/FA to another first level LER/FA, the flow chart of the MN updating the security association is as shown in FIG. 6. When the MN moves from one second-level LER/FA to another second-level LER/FA, the flow chart of the MN updating the security association is as shown in FIG. 7. These two processes are introduced separately.

Referring to Figure 6, the specific flow of Figure 6 is as follows: Step 601: The MN sends a registration request message to the new first-level LER/FA corresponding to the current new area, and the registration request message carries the mobile node information such as the MN's COA and the MN's home address.

Step 602: After receiving the registration request message sent by the MN, the new first-level LER/FA performs the operation performed by the new LER/FA in step 302.

Step 603: The new first-level LER/FA sends a registration request message of the MN to the second-level LER/FA where the current MN is located.

Since the current MN is within the jurisdiction of the same second-level LER/FA, moving from one first-level LER/FA to another first-level LER/FA, the second-level LER/FA where the MN is currently located is also The second-level LER/FA to which the original first-level LER/FA belongs.

Step 604: The second-level LER/FA performs registration update on the MN that is currently requesting registration according to the mobile node information in the registration request message, that is, updates the mobile node information of the MN recorded in the mobile node information table, including the COA. In addition, since the second-level LER/FA has established a security association with the MN at this time, the second-level LER/FA does not need to re-establish a security association with the MN, but needs to update related information of the security association. The specific update of the LER/RFA is to update the COA information corresponding to the security association of the current MN in the security association entry.

Steps 605 ~ 606: The second level LER/FA returns a registration response message to the MN through the new first level LER/FA.

See Figure 7, Figure 7 for the specific process as follows:

Steps 701 ~ 702: The same operations as steps 601 - 602 are performed, and will not be described in detail herein. Step 703: The new first level LER/FA sends a registration request message of the MN to the new second level LER/FA where the current MN is located.

Step 704: After receiving the registration request message sent by the MN, the new second-level LER7FA performs the operation performed by the new LER/FA in step 302. Step 705: The new second-level LER/FA sends a registration request message of the MN to the original second-level LER/FA.

Step 706: The original second-level LER/FA performs registration update on the MN that is currently requesting registration according to the mobile node information in the registration request message, that is, updates the mobile node information of the MN recorded in the mobile node information table, including the COA; And searching for the mobile node information table of the MN, obtaining the security association entry of the MN, and updating the COA information of the security association corresponding to the current MN in the security association entry.

Steps 707 ~ 709: The original second-level LER/FA returns a registration response message to the MN through the new second-level LER/FA and the new first-level LER/FA.

In addition, referring to FIG. 8, FIG. 8 is a structural diagram of a system corresponding to the second preferred embodiment of the present invention. The system includes: MN81, LER/FA82 and LER/HA83. Among them, LER/FA82 includes: first level LER/FA821 and second level LER/FA822. The first level LER/FA821 is connected to MN81 and the second level LER/FA822; the second level LER/FA822, and the first level LER/FA821 and LER/HA83.

Specifically, the MN 81 is mainly used to send a registration request message to the first-level LER7FA; the first-level LER/FA 821 is configured to receive the registration request message, establish a security association with the MN 81, and send a registration for the MN81 to the second-level LER/FA 822. a request message; a second level LER/FA822, configured to receive a registration request message, establish a security association with the MN 81, and send a registration request message for the MN 81 to the LER/HA 83; LER/HA83, for receiving the registration request message, and the MN 81 Establish a security association. In addition, the process of establishing an updated security association between the MN 81 and the first level LER/FA 821, the second level LER/FA 822, and the LER/HA 83 can be referred to the related description in the preferred embodiment.

Wherein, the first level LER/FA is LER/LFA, and the second level LER/FA is LER/RFA; or, the first level LER/FA is LER/LFA, and the second level LER/FA is LER/GFA; or The first level LER/FA is LER/RFA, and the second level LER/FA is LER/GFA. Referring to Figure 9, Figure 9 is a flow chart of a method in accordance with a third preferred embodiment of the present invention. Figure 9 depicts the case where LER/FA includes only three levels of foreign agents. LER/FA can be LER/LFA, LER/RFA, LE /GFAo. The specific process is as follows:

Step 901: The MN sends a registration request message to the LER/HA through the LER/LFA of the current area, and the registration request message carries the mobile node information such as the COA of the MN and the home address of the MN.

Step 902: After receiving the registration request message sent by the MN, the LER/LFA registers the MN currently requesting registration, and saves the mobile node information of the MN, including the home address and the COA address, in its mobile node information table, and A security association is established in association with the MN. After the LER/LFA and the MN successfully establish a security association, the LER/LFA establishes a security association entry for the MN in its mobile node information table, and is used to save the established security association.

Here, the purpose of the LER/LFA to save the security association between itself and the MN is to be used by the MN in future communication processes to ensure the security of the MN in the communication process.

Here, the LER/LFA negotiates with the MN to establish a security association, which needs to be based on the home address and COA carried in the registration request message.

Step 903: The LER/LFA sends a registration request message of the MN to the LER/RJFA.

Step 904: After receiving the registration request message of the MN sent by the LER/LFA, the LER/RFA registers the MN currently requesting registration, and saves the mobile node information of the MN, including the home address and the COA address, in its own mobile node information table. And establishing a security association with the MN; after the LER/RFA and the MN successfully establish a security association, the LER/RFA establishes a security association entry for the MN in its mobile node information table, and is used to save the security association established between itself and the MN. .

Here, the LER/RFA negotiates with the MN to establish a security association, which needs to be based on the home address and COA carried in the registration request message.

Step 905. LER/RFA sends a registration request message of the MN to the LER/GFA. Step 906: After receiving the registration request message of the MN sent by the LER/RFA, the LER/GFA registers the MN currently requesting registration, and saves the mobile node information of the MN, including the home address and the COA address, in its mobile node information table. And establishing a security association with the MN. After the LER/GFA and the MN successfully establish a security association, the LER/GFA establishes a security association entry for the MN in its mobile node information table, and is used to save the security association established between itself and the MN. .

Here, the LER7GFA negotiates with the MN to establish a security association, which needs to be based on the home address and COA carried in the registration request message.

Step 907: The LER/GFA sends a registration request message of the MN to the LER/HA.

Step 908: After receiving the registration request message of the MN sent by the LER/GFA, the LER/HA registers the MN on the LER/HA, and saves the mobile node information of the MN, including the home address and the COA address, in its own mobile node information. In the table, the security association is established with the MN. After the LER/GFA and the MN successfully establish a security association, the LER7HA establishes a security association entry for the MN in its own mobile node information table, and is used to save the security association established between itself and the MN.

Steps 909 ~ 912: LER/HA returns a registration response message to the MN through LER/GFA, LER/RFA, and LER/LFA.

In the above process, the LER/GFA is the home LER/GFA, the LER/RFA is the home LER/RFA, and the LER/LFA is the home LER/LFA, that is, the LER/GFA, LER/RFA and the MN home address are corresponding. LER/LFA.

As shown in Figure 1, the four models of MN movement in the MPLS network include: intra-subnet access, which refers to the MN moving in the same LER/LFA jurisdiction; inter-subnet access, refers to the MN in different LERs. /LFA jurisdiction, but in the same LER/RPA jurisdiction Movement within the network; inter-network access refers to the movement of the MN in different LER/LFA jurisdictions, but in the same LER/GFA jurisdiction; inter-autonomous network access refers to the MN in different Movements made in the autonomous domain under the jurisdiction of LER/GFA.

The following describes the methods for MN to update security associations for these four network-level mobility models. - When the MN's mobility is limited to intra-subnet access, since the MN moves within the same LER/LFA jurisdiction, it is not necessary to establish a new LSP path after the MN moves. Therefore, it is not necessary to update the established security association between the MN and the LER/HA, and the communication between the MN and the CN can be safely continued.

Referring to Figure 10, Figure 10 shows the process of updating its own security association when the MN moves from one LER/LFA jurisdiction to another within the LER/LFA jurisdiction within the same LER/RJFA jurisdiction. Since the MN does not exceed the jurisdiction of the same LER/RFA at this time, the MN only needs to regenerate its own security association with the new LER/LFA and update its security with the original LER/RFA when updating the security association. Just connect. The process shown in Figure 10 can be performed simultaneously with the MN registering with LER/HA. Since the MPLS network implements hierarchical management, the registration process of the MN at this time only needs to be registered by the new LER/LFA, and then the new LER/FA can register with the original LER/RJFA. The specific process is as follows:

Step 1001: The MN sends a registration request message to the new LER7LFA corresponding to the new area in which the MN is located. The registration request message carries the mobile node information such as the COA of the MN and the home address of the MN.

Step 1002: After receiving the registration request message sent by the MN, the new LER/LFA registers the MN currently requesting registration, and saves the mobile node information of the MN, including the home address and the COA address, in its mobile node information table. And establishing a security association with the MN; after the LER/LFA and the MN successfully establish a security association, the new LER/LFA establishes a security association entry for the MN in its mobile node information table, and is used to save itself and establish with the MN. Security association.

Step 1003: The new LER/LFA sends a registration request message of the MN to the LER/RFA of the current area of the MN.

Step 1004: The LER/RFA performs registration update on the MN that is currently requesting registration according to the mobile node information in the registration request message, that is, updates the mobile node information of the MN recorded in the mobile node information table, including the COA.

At the same time, since the MN is moving from one LER/LFA jurisdiction to another LER/LFA jurisdiction within the same LER/RFA jurisdiction, the LER/RFA of the MN's jurisdiction does not change before and after the MN moves. . Since the LER/RFA has established a security association with the MN at this time, the LER/RPA does not need to re-establish a security association with the MN, but needs to update the relevant information of the security association. The specific content of the LER/RFA update is: Update the COA information of the security association associated with the current MN in the security association entry.

Steps 1005 ~ 1006: The LER/RFA returns a registration response message to the MN through the new LER/LFA.

Referring to FIG. 11, FIG. 11 shows a process in which the MN updates the security association when the MN moves from one LER/RFA jurisdiction to another within the LER/RJFA jurisdiction within the same LER/GFA jurisdiction. At this time, since the MN does not exceed the jurisdiction of the same LER/GFA, when the MN updates the security association, it only needs to regenerate its own security association with the new LER/LFA and LER/RFA, and update itself and the original. The security association between LER/GFA is sufficient. Here, the process of updating the security association by the MN can also be performed simultaneously in the process of registering the MN with the LER/HA. Since the MPLS network implements hierarchical management, the MN only needs to register with the new LER/LFA and the new LER/RFA, and then the new LER/RFA can register with the original LER/GFA. The specific process is as follows: Step 1101: The MN sends a registration request message to the new LER/LFA corresponding to the new area in which the MN is located. The registration request message carries the mobile node information such as the COA of the MN and the home address of the MN.

Step 1102: After receiving the registration request message sent by the MN, the new LER/LFA registers the MN currently requesting registration, and saves the mobile node information of the MN, including the home address and the COA address, in its mobile node information table. And establishing a security association with the MN. After the new LER/LFA and the MN successfully establish a security association, the new LER/LFA establishes a security association entry for the MN in its own mobile node information table, and is used to save the security association established between itself and the MN. .

Here, the purpose of the new LER/LFA to secure its own association with the MN is that it can be used by the MN in future communication processes to ensure the security of the MN in the communication process.

Step 1103: The new LER/LFA sends a registration request message of the MN to the new LER/RFA corresponding to the current area of the MN.

Step 1104: After receiving the registration request message of the MN sent by the new LER/LFA, the new LER/RFA registers the MN that is currently requesting registration, and saves the mobile node information of the MN, including the home address and the COA address, in its own mobile node. In the information table, and establish a security association with the fixed negotiation; after the new LER/RFA and the MN successfully establish a security association, the new LER/RFA establishes a security association entry for the MN in its own mobile node information table, and is used to save itself and the MN. Established security associations.

Step 1105: The new LER/RFA sends a registration request message of the MN to the LER/GFA of the current area of the MN.

Step 1106: The LER/GFA performs registration update on the currently requested MN according to the mobile node information in the registration request message, that is, updates the mobile node information of the MN recorded in the mobile node information table, including the COA.

At the same time, since the MN is in the same LER/GFA jurisdiction, from a LER/RFA The jurisdiction moved to another LER/RFA jurisdiction, so the LER/GFA in the jurisdiction of the MN did not change before and after the MN moved. Since the LER/GFA at this time has established a security association with the MN, the LER/GFA does not need to re-establish a security association with the MN, but needs to update the related information of the security association. The LER/GFA searches its own mobile node information table, obtains the security association entry of the MN, and updates the COA information corresponding to the security association of the current MN in the security association entry.

Steps 1107 to 1109: The LER/GFA returns a registration response message to the MN through the new LER/RFA, and the new LER/LFA.

Referring to Figure 12, Figure 12 shows the case when the MN moves from one LER/GFA jurisdiction to another within the LER/GFA jurisdiction in two different LER/GFA jurisdictions, i.e., across inter-AS networks. In this case, after the MN moves into the new LER/GFA jurisdiction, the security association is re-established to the new LER/GFA, and the new LER/GFA updates the security association information to the home LER/GFA. Here, the process of updating the security association by the MN can be performed simultaneously with the process of registering the MN with the LER/HA. Since the MPLS network implements hierarchical management, the MN only needs to register with the new LER/GFA first, and then register with the new LER/GFA to the home LER/GFA. The specific process is as follows:

Step 1201: The MN sends a registration request message to the new LER/LFA corresponding to the new area in which the MN is currently located. The registration request message carries the mobile node information such as the COA of the MN and the home address of the MN.

Step 1202: After receiving the registration request message sent by the MN, the new LER/LFA registers the MN currently requesting registration, and saves the mobile node information of the MN, including the home address and the COA address, in its mobile node information table. And establishing a security association with the MN. After the LER/LFA and the MN successfully establish a security association, the LER/LFA establishes a security association entry for the MN in its mobile node information table, and is used to save the security association established between itself and the MN. Here, the LER/LFA saves the security association between itself and the MN in order to be used by the MN in future communication processes to ensure the security of the MN in the communication process.

Step 1203: The new LER/LFA sends a registration request message of the MN to the new LER/RFA corresponding to the current area of the MN.

Step 1204: After receiving the registration request message of the MN sent by the new LER/LFA, the new LER7RFA registers the MN currently requesting registration, and saves the mobile node information of the MN, including the home address and the COA address, in its own mobile node information table. And establishing a security association with the MN; after the new LER/RFA and the MN successfully establish a security association, the new LER/RFA establishes a security association entry for the MN in its own mobile node information table, and is used to save the established relationship with the MN. Security association.

Step 1205: The new LER/RFA sends a registration request message of the MN to the new LER/GFA. Step 1206: After receiving the registration request message of the MN sent by the new LER/RFA, the new LER/GFA registers the MN that is currently requesting registration, and saves the mobile node information of the MN, including the home address and the COA address, in its own mobile node. In the information table, and establish a security association with the MN; after the new LER/GFA and the MN successfully establish a security association, the new LER/GFA establishes a security association entry for the MN in its mobile node information table, and is used to save itself and the MN. Established security associations.

Step 1207: The new LER/GFA sends a registration request message of the MN to the home LER/GFA. When the MN moves within the jurisdiction of two different LER/GFAs, regardless of whether the pre-mobile area is under the jurisdiction of the home LER/GFA, after the move, the LER/GFA currently in the MN must be directed to the MN's home LER/ GFA performs security associations and updates to residence information.

Step 1208: The home LER/GFA performs registration update on the MN that is currently requesting registration according to the mobile node information in the registration request message, that is, updates the mobile node information of the MN recorded in the mobile node information table, including the COA; and searches for itself. Mobile node information The table obtains the security association entry of the MN, and updates the COA information corresponding to the security association of the current MN in the security association entry.

Steps 1209 ~ 1212: The home LER/GFA returns a registration response message to the MN via the new LER/GFA, the new LER/RFA, and the new LER/LFA.

In addition, referring to FIG. 13, FIG. 13 is a structural diagram of a system corresponding to the third preferred embodiment of the present invention. The system includes: MN1301, LER/FA1302 and LER/HA1303. The LER/FA1302 includes: LER/LFA13021, LER/RPA13022, and LER/GFA13023. LER/LFA13021, connected to MN1301 and LER/RFA13022; LER/RFA13022, connected to LER/LFA13021 and LER/GFA13023; LER/GFA13023, connected to LER/RFA13022 and LER/HA1303.

MN1301, configured to send a registration request message to the LER/LFA 13021; LER/LFA 13021, configured to receive a registration request message of the MN 1301, establish a security association with the MN 1301, and send a registration request message for the MN 1301 to the LER/RFA 13022; LER/RFA13022, Receiving a registration request message, establishing a security association with the MN 1301, and sending a registration request message to the LER/GFA 13023 for the MN 1301; LER/GFA 13023, for receiving the registration request message, establishing a security association with the MN 1301, and transmitting to the LER/HA 1303 for the MN 1301 The registration request message; LER/HA1303, is configured to receive a registration request message, and establish a security association with the MN1301. In addition, the process of establishing an update security association between the MN1301 and the LER/LFA13021 LER/RFA13022, LER/GFA13023, and LER/HA1303 can be referred to the related description in the preferred embodiment.

In addition, the present invention also provides an MN, the MN including at least a request unit and a negotiating unit. The requesting unit 1401 is configured to send a registration request message to the LER7FA. The negotiating unit 1402 establishes a security association with the LER FA and the LER/HA to secure communication. Here, the negotiation unit 1402 specifically establishes a process of security association, which can be referred to in the three preferred embodiments of the present invention, and will not be described in detail herein. In the embodiment of the present invention, the process of establishing and updating the security association may be performed along with the registration of the MN; or the process of establishing the security association with the LER/FA and the LER/HA by the MN when the MN needs it. . Since the security association is established along with the MN registration, the home address and the COA carried in the registration request message are mainly utilized. Therefore, when the security association is established by the MN, the security association request is sent to the LER/FA. The security association request carries at least the home address and the COA, and then establishes the MN with the MN in the LER/FA. After the security association between the LER/FA, the MN's security association request is sent to the LER/HA, and then the security association with the MN is established in the same way.

When the MN establishes a security association by sending a security association request, the MN may establish a security association with the LER/FA or the LER/HA. The security association request sent by the MN further carries the authentication mode and/or security that the MN can support. The protocol, LER/FA or LER/HA determines the authentication mode and/or security protocol used by the MN according to the security association request sent by the MN, and returns an acknowledgement message to the MN to establish a security association between itself and the MN. Thus, the registration request described in the flowchart of the method of the present invention is actually a specific implementation of the security association request.

The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention. Any modifications, equivalents, improvements, etc., which are made within the spirit and principles of the present invention, should be included in the present invention. Within the scope of protection.

Claims

Claim

A method for securing secure communication of a mobile node, characterized in that

The mobile node MN establishes a security association with the label router/foreign agent LER/FA, and the label router/home agent LER/HA to secure the MN secure communication.

2. The method according to claim 1, wherein the LER/FA is: a label router/local foreign agent LER/LFA, or a label router/area foreign agent LER/RFA> or a label router/gateway foreign hometown Agent LER/GFA.

The method according to claim 2, wherein the MN establishes a security association with the LER/FA and the LER/HA, including the following steps:

Al, the MN sends a security association request to the LER/FA;

After the LER/FA receives the security association request of the MN, establish a security association with the MN, and send a security association request for the MN to the LER/HA; Cl, the LER/HA After receiving the security association request, a security association is established with the MN.

4. The method according to claim 1, wherein the LER/FA comprises: a first level LER/FA and a second level LER/FA.

5. The method according to claim 4, wherein the MN establishes a security association with the LER/FA and the LER/HA, and the following steps are included:

A2. The MN sends a security association request to the first level LER/FA.

B2, after the first-level LER/FA receives the security association request of the MN,

The MN establishes a security association and sends a security association request for the MN to the second level LER/FA;

After receiving the security association request, the second-level LER/FA establishes a security association with the MN, and sends a security association request for the MN to the LER/HA; D2: After receiving the security association request, the LER/HA establishes a security association with the MN.

6. A method according to claim 4 or 5, characterized in that

The first stage LER7FA is LER/LFA, and the second level LER/FA is LER/RFA; or, the first stage LER/FA is LER/LFA, and the second level LER/FA is LER/ GFA;

Or the first stage LER/FA is LER/RFA, and the second level LER/FA is

7. The method according to claim 1, wherein the LER/FA comprises: LER/LFA, LER/RFA, and LER/GFA.

The method according to claim 7, wherein the MN establishes a security association with the LER/FA and the LER/HA, including the following steps:

A3. The MN sends a security association request to the LER/LFA.

B3. After receiving the security association request of the MN, the LER/LFA establishes a security association with the MN, and sends a security association request for the MN to the LER/RFA.

C3. After receiving the security association request, the LER/RFA establishes a security association with the MN, and sends a security association request for the MN to the LER/GFA.

D3. After receiving the security association request, the LER/GFA establishes a security association with the MN, and sends a security association request for the MN to the LER/HA.

E3. After receiving the security association request, the LER/HA establishes a security association with the MN.

The method according to claim 1, 2, 3, 4, 5, 7 or 8, wherein the security association request includes at least: a MN home address, a care-of address, and a security address that the MN can use. Discussion and / or certification method;

The establishing the security association is: establishing a security with the MN according to the care-of address carried in the security association request, the home address of the MN, the security protocol and/or the authentication mode that the MN can use, Association.

The method of claim 9, wherein the updating the security association is: updating the care-of address in the MN security association according to the current care-of address of the MN carried in the security association request.

11. The method of claim 1, 2, 3, 4, 5, 7 or 8, wherein the security association request is a registration request sent by the MN.

12. A system for securing secure communication of a mobile node, the system comprising: solid, LER/FA, and LER/HA;

The MN is connected to the LER/FA and the LER/HA for establishing a security association with the LER/FA and the LER/HA to secure communication.

13. The system according to claim 12, wherein the LER/FA is: LER/LFA, or LER/RPA, or LER/GFA.

14. The system of claim 13 wherein:

The MN is configured to send a security association request;

And the LER/FA is configured to receive a security association request sent by the MN, establish a security association with the MN, and send a security association request for the MN;

And the LER/HA is configured to receive a security association request sent by the LER/FA, and establish a security association with the MN.

The system of claim 12, wherein the LER/FA comprises: a first level LER/FA and a second level LER7FA;

The first stage LER/FA is connected to the MN and the second level LER/FA;

The second stage LER/FA is connected to the first stage LER/FA and LER7HA.

16. The system of claim 15 wherein:

The MN is configured to send a security association request;

The first level LER/FA is configured to receive a security association request sent by the MN, and The MN establishes a security association and sends a security association request for the MN;

The second level LER7FA is configured to receive a security association request sent by the first level LER/FA, establish a security association with the MN, and send a security association request for the MN;

The LER/HA is configured to receive a security association request sent by the second-level LER/FA, and establish a security association with the MN.

17. A system according to claim 15 or claim 16 wherein:

The first stage LER/FA is LER/LFA, and the second level LER7FA is LER7RFA; or, the first stage LER/FA is LER/LFA, and the second level LER/FA is LER/GFA;

Or the first stage LER/FA is LER/RFA, and the second level LER7FA is

The system according to claim 12, wherein the LER/FA comprises: LER/LFA, LER/RFA and LER/GFA;

The LER/LFA is connected to the MN and the LER/RFA;

The LER/RFA is connected to LER/LFA and LER/GFA;

The LER/GFA is connected to LER/RFA and LER/HA.

19. The system of claim 18, wherein:

The MN is configured to send a security association request;

And the LER/LFA is configured to receive a security association request sent by the MN, establish a security association with the MN, and send a security association request for the MN;

And the LER/RFA is configured to receive a security association request sent by the LER/LFA, establish a security association with the MN, and send a security association request for the MN;

And the LER/GFA is configured to receive a security association request sent by the LER/RFA, establish a security association with the MN, and send a security association request for the MN;

The LER/HA, configured to receive a security association request sent by the LER/GFA, and The MN establishes a security association.

An MN, the MN includes at least a requesting unit and a negotiating unit, and the requesting unit is configured to send a security association request to the LER/FA;