WO2010063242A1

WO2010063242A1 - Clock synchronization method, device and network system

Info

Publication number: WO2010063242A1
Application number: PCT/CN2009/075353
Authority: WO
Inventors: 吕欣岩; 聂爽; 何纲
Original assignee: 华为技术有限公司
Priority date: 2008-12-05
Filing date: 2009-12-07
Publication date: 2010-06-10
Also published as: CN101436923B; CN101436923A

Abstract

A clock synchronization method, device and network system are provided. The method includes: a clock server establishes the first path and the second path to the terminal, wherein the first path is a secure connection transmitting data in the secure manner and the second path is a connection transmitting data in the secure manner or the insecure manner; the first path and the second path are associated; the control message is interacted with the terminal through the first path, and the clock synchronization message is transmitted to the terminal through the second path. The invention can improve the security performance of the clock synchronization while implementing clock synchronization.

Description

Method, device and network system for clock synchronization This application claims to Chinese Patent Application No. 200810182902.6, filed on December 5, 2008, entitled "A Method, Device and Network System for Clock Synchronization" Priority is hereby incorporated by reference in its entirety. The present invention relates to the field of communications technologies, and in particular, to a method, device, and network system for clock synchronization. Background technique

The IEEE 1588 protocol is a precision clock synchronization protocol standard for network measurement and control systems. The 1588 protocol packets can be classified into two categories: event messages and general messages. The general message does not need a timestamp, and is used for sending information including clock information and configuration management information; the event message carries a time stamp for transmitting time and frequency information. In addition, the transmission of 1588 protocol packets has two modes: unicast and multicast. Different transmission modes specify different sending addresses and ports.

The 1588 protocol is an adaptive network clock synchronization protocol. It can automatically complete the clock level division and reconstruction of the entire network through the source selection algorithm, and supports time synchronization and frequency synchronization. The link is used in the time synchronization. In the frequency synchronization, the clock server periodically sends clock synchronization packets to the terminal. The terminal calculates the difference between the two clock synchronization messages before and after, and the reference frequency can be obtained. .

In the prior art, the 1588 protocol provides a shared key based security mechanism that provides source authentication, information integrity protection, and anti-replay capabilities. Please refer to Figure 1. Figure 1 is a flow chart of the security mechanism of the shared key provided by the 1588 protocol. The sender indicates that the sender of the message may be a clock server or a terminal; the receiver indicates that the receiver of the message may be a clock server or a terminal; the sender and the receiver each maintain a security association (SA), respectively Called output SA and input SA, each SA includes source port, source address, destination port, destination address, key, random number, and replay counter. The control port of the clock server is visible to all terminals and can receive messages sent by multiple terminals at the same time.

As shown in Figure 1, the security mechanism provided by the 1588 protocol is as follows: (1) The sender sends a 1588 protocol packet carrying the parameter AUTHENTICATION TLV, which is used to indicate the type, length, and value range (including the random number, the replay counter, the key identifier, the algorithm identifier, and the record) of the packet for verification. Summary) .

(2) If the receiver supports the security verification of the packet, it first performs packet integrity check and source verification: Determines the packet verification algorithm according to the algorithm identifier, determines the packet verification key according to the key identifier, and calculates and receives the packet. The summary of the 1588 packet is compared with the summary of the recorded packet. If the packet is the same, the packet is verified and the packet is accepted. Otherwise, the packet fails to pass and the packet is discarded.

(3) The receiving party searches for the local receiving SA list. If the receiving packet can be mapped to an SA, the replay counter performs anti-replay checking by the SA and the random number identifier carried in the packet. ; Otherwise discard 4 艮.

(4) If the message cannot be mapped to an existing SA, a new input SA is created, and then a verification response process is performed to confirm the validity of the parameters in the SA. When the playback counter of the SA record reaches the maximum value, the verification response process is re-executed to confirm the new parameters in the SA.

The inventor found that the security mechanism provided by the above 1588 protocol has at least the following problems: The control port of the clock server is exposed to all terminals and is vulnerable to attacks. SUMMARY OF THE INVENTION The technical problem to be solved by the embodiments of the present invention is to provide a method, a device, and a network system for clock synchronization, which can further improve the security performance of the clock server while realizing clock synchronization.

To achieve the above objective, the embodiment of the present invention provides the following technical solutions:

An embodiment of the present invention provides a method for implementing clock synchronization, including:

The clock server establishes a secure path and a non-secure path with the terminal;

Associating the secure path with the non-secure path;

The control message is exchanged with the terminal through the security path, and the terminal sends a clock synchronization message through the non-secure path.

The terminal establishes a secure path and an unsecure path with the clock server;

Associating the secure path with the non-secure path;

Controlling message interaction with the clock server through the secure path, in the non-an Full path for clock synchronization.

The embodiment of the invention provides a clock server, including:

a first interface module, configured to establish a secure path and a non-secure path with the terminal;

a first association module, configured to associate an address of the security path of the terminal with an address of the non-secure path;

a first control message interaction module, configured to perform control message interaction with the terminal by using the secure path;

The synchronization message sending module is configured to send a clock synchronization message to the terminal by using the non-secure path.

The embodiment of the invention provides a terminal, including:

a second interface module, configured to establish a secure path and a non-secure path with the clock server; and a second association module, configured to associate an address of the secure path of the server with an address of the non-secure path;

a second control message interaction module, configured to perform a control message interaction with the clock server by using the secure path;

And a clock synchronization module, configured to perform clock synchronization with the server by using the non-secure path.

The embodiment of the invention further provides a network system, including:

a clock server, configured to establish a secure path and a non-secure path with the terminal; associate the secure path with the non-secure path; perform control message interaction with the terminal through the secure path, and send clock synchronization to the terminal by using the non-secure path Message

a terminal, configured to establish a secure path and a non-secure path with the clock server; associate the secure path with the non-secure path; perform control message interaction with the clock server through the secure path, and perform clock synchronization on the non-secure path.

The embodiment of the invention further provides another clock server, including:

a first path establishing module, configured to establish a first path with the terminal, where the first path is a secure connection for transmitting data in a secure manner;

a second path establishing module, configured to send, by using the first path, information required for establishing a second path to the terminal, to establish the second path with the terminal;

a clock message module, configured to send a clock synchronization report to the terminal by using the second path Text.

The embodiment of the invention further provides another terminal, including:

a first path establishing module, configured to establish a first path with a clock server, where the first path is a secure connection for transmitting data in a secure manner;

a second path establishing module, configured to acquire, by using the first path, information required for establishing a second path from the clock server, and establish, by the clock server, the second path; a clock message module, configured to: Receiving, by the second path, a clock synchronization message sent by the clock server.

The embodiment of the invention further provides another method, including:

Establishing a first path between the clock server and the terminal, where the first path is a secure connection for transmitting data in a secure manner;

And establishing information about the second path by using the first path, and establishing the second path between the clock server and the terminal according to the information about establishing the second path;

Transmitting a clock message through the second path.

The clock server of the embodiment of the present invention establishes a secure path and a non-secure path between the terminal and the terminal, and sends a clock synchronization message to the terminal on the established non-secure path, so that the terminal can perform clock synchronization according to the clock synchronization message. At the same time, since the control message interacts with the terminal through the secure path, the control message is not easily parsed, so the security performance of the clock server can be further improved. BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a schematic diagram showing a processing flow of a shared key security mechanism provided by the existing 1588 protocol;

FIG. 2 is a schematic flowchart of a method for clock synchronization according to Embodiment 1 of the present invention; FIG. 3 is a schematic flowchart of still another method for clock synchronization according to Embodiment 2 of the present invention; FIG. FIG. 5 is a schematic flowchart of a clock server and a terminal deployment framework; FIG. 5 is a schematic flowchart of a method for transmitting a clock synchronization message through a non-secure path and transmitting a control message through a secure path according to Embodiment 4 of the present invention;

FIG. 6 is a schematic flowchart of a method for implementing clock synchronization according to Embodiment 5 of the present invention; FIG. 7 is a schematic flowchart of a method for implementing clock synchronization according to Embodiment 6 of the present invention; 8 is a schematic flowchart of a method for implementing clock synchronization according to Embodiment 7 of the present invention; FIG. 9 is a schematic structural diagram of a clock server according to Embodiment 8 of the present invention; FIG. 10 is a schematic diagram of a terminal provided by Embodiment 9 of the present invention; Schematic;

11 is a schematic diagram of a network system according to Embodiment 10 of the present invention;

FIG. 12 is a schematic structural diagram of a clock synchronization network according to Embodiment 11 of the present invention; FIG. 13 is a schematic flowchart diagram of a clock synchronization method according to Embodiment 12 of the present invention. The embodiments of the present invention provide a method, a device, and a network system for clock synchronization, which can further improve the security performance of the clock server while implementing clock synchronization.

For a better understanding of the embodiments of the present invention, the embodiments of the present invention are described in detail below with reference to the accompanying drawings.

Example 1

Referring to FIG. 2, FIG. 2 is a schematic flowchart of a method for clock synchronization according to an embodiment of the present invention. As shown in Figure 2, the method can include:

Step 201: The clock server establishes a secure path and a non-secure path with the terminal.

The clock server can establish a secure path with the terminal by adding a logical interface, such as an IPSec tunnel, or establish a secure path with the terminal by adding a physical link, such as a dedicated signaling link. .

The clock server can establish a non-secure path with the terminal by accessing the public communication network, such as accessing the Internet.

Step 202: Associate the secure path with the non-secure path.

Generally, there is a globally unique identifier in each clock. This identifier is associated with the address of all interactions and the address of the non-secure path, and the association between the secure path and the non-secure path is implemented.

Step 203: Perform a control message exchange with the terminal through the secure path, and send a clock synchronization packet to the terminal through the non-secure path.

The interaction between the control message and the terminal through the security path may be: The clock server receives the unicast request of the notification message sent by the terminal; Returning an announcement message unicast request authorization to the terminal;

Periodically sending an announcement unicast message for selecting a source to the terminal;

The control message interaction with the terminal through the secure path may also be:

The clock server receives the security mechanism negotiation request sent by the terminal, where the security mechanism negotiation request carries the security mechanism negotiation parameter;

Returning a security mechanism negotiation request response to the terminal, indicating the security mechanism used and the corresponding negotiation parameters; or

The clock server sends a security mechanism negotiation request to the terminal, where the security mechanism negotiation request carries a security mechanism negotiation parameter;

The security mechanism returned by the receiving terminal negotiates a request response, indicating the security mechanism used and the corresponding negotiation parameters.

The clock server receives the point-to-point delay negotiation request sent by the terminal through the secure path; returns a point-to-point delay negotiation request authorization to the terminal, and the delay negotiation request authorization indicates the delay mechanism used;

Or, receiving an end-to-end delay negotiation request sent by the terminal through the secure path;

The end-to-end delay negotiation request authorization returned to the terminal, the delay negotiation request authorization indicates the delay mechanism used.

The sending of the line clock synchronization packet on the non-secure path is specifically as follows:

The clock server sends a clock synchronization packet to the terminal in a unicast mode on the non-secure path. Alternatively, the clock synchronization packet is sent to the terminal in a multicast manner on the non-secure path.

Delay the negotiation request to the end;

Further, the method for implementing the clock synchronization security provided by the embodiment of the present invention may also perform network address translation negotiation on the non-secure path, which may be:

The clock server receives the handshake request initiated by the terminal through the non-secure path to traverse the network address translation;

A handshake request response returned to the terminal, the handshake request response carrying the non-secure path address and the corresponding port after the network address translation.

Further, the method for implementing clock synchronization security provided by the embodiment of the present invention may further be that the clock server periodically sends an advertisement for the source selection to the terminal through the non-secure path. And periodically transmitting a clock synchronization message to the terminal by using a non-secure path in a multicast manner.

The method for clock synchronization provided by the embodiment of the present invention is described. The clock server in the embodiment of the present invention establishes a secure path and a non-secure path between the terminal, and the clock server sends a clock to the terminal by establishing an unsecured path. Synchronizing the message, so that the terminal can perform clock synchronization according to the clock synchronization message. At the same time, because the clock server interacts with the terminal through the control path on the secure path, the control message is not easily attacked, and the security performance of the clock server can be further improved.

Example 2

Referring to FIG. 3, FIG. 3 is a flow chart of still another method for clock synchronization according to an embodiment of the present invention. As shown in FIG. 3, the method may include:

Step 301: The terminal establishes two bearer paths connected to the clock server, which are a secure path and a non-secure path, respectively.

The terminal can establish a secure path with the clock server by adding a logical interface, such as an IPSec tunnel, or establish a secure path with the terminal by adding a physical link, such as a dedicated signaling link. .

The terminal can establish a non-secure path with the clock server by accessing the public communication network, such as accessing the Internet.

Step 302: Associate the secure path with the non-secure path.

The terminal can associate the secure path address of the clock server with the address of the non-secure path through the clock identifier sent by the clock server to implement association between the secure path and the non-secure path.

Step 303: Perform control message interaction with the clock server through the secure path, and perform clock synchronization on the non-secure path.

The control message interaction between the security path and the clock server may be: The terminal sends an advertisement message unicast request to the clock server;

Receiving the notification message unicast request authorization returned by the clock server;

Periodically, the receiving unicast message sent by the clock server for selecting the source is received.

The control message interaction between the security path and the clock server may be: The terminal sends a security mechanism negotiation request to the clock server, where the security mechanism negotiation request carries the security mechanism negotiation parameter; Receiving a security mechanism negotiation request response returned by the clock server, indicating the security mechanism used and the corresponding negotiation parameters; or

The terminal accepts a security mechanism negotiation request sent by the clock server, where the security mechanism negotiation request carries a security mechanism negotiation parameter;

Returns a security mechanism negotiation request response to the clock server, indicating the security mechanism used and the corresponding negotiation parameters.

The control message interaction between the security path and the clock server may also be: The terminal sends a point-to-point delay negotiation request to the clock server through the secure path; and receives the point-to-point delay negotiation request authorization returned by the clock server, and the delayed negotiation request authorization indication is used. Delay mechanism

Or, sending an end-to-end delay negotiation request to the clock server through the secure path; receiving an end-to-end delay negotiation request authorization returned by the clock server, the delay negotiation requesting the delay mechanism used by the authorization indication.

The clock synchronization on the non-secure path can be:

The terminal sends a clock synchronization packet through the non-secure path receiving clock server, or sends the clock synchronization packet through the non-secure path receiving clock server. The clock synchronization packet is processed according to the negotiated security mechanism.

Further, the method for implementing clock synchronization provided by the embodiment of the present invention may also perform network address translation negotiation on an unsecure path, which may be:

The terminal initiates a handshake request to traverse the network address translation to the clock server through the non-secure path;

Receiving a handshake request response returned by the clock server, the handshake request response carries the non-secure path address and the corresponding port after the network address translation.

Further, the method for implementing clock synchronization security provided by the embodiment of the present invention may further be that the terminal periodically broadcasts an announcement multicast message for selecting a source through a non-secure path, and periodically transmits the non-secure path. The clock synchronization message sent by the receiving clock server in multicast mode.

The foregoing describes a method for clock synchronization provided by the embodiment of the present invention. The terminal establishes a secure path and a non-secure path that are connected to the clock server, and can receive the clock synchronization message sent by the clock server on the established non-secure path. According to the clock synchronization message Clock synchronization. At the same time, because the control message interacts with the server through the secure path, the control message is not easily attacked, and the security performance of the clock server can be further improved.

Example 3

In the following, before describing a specific embodiment of implementing the method provided by the embodiment of the present invention, the network architecture discussed in the embodiment of the present invention is first introduced. From a security perspective, networks can be divided into trusted networks and non-trusted networks. Different network elements are secure in communication within a trusted network. Conversely, when a network element is placed on a non-trusted network, communication between other network elements and it is not secure. The trusted network mainly has the operator's core network or other private networks; the non-trusted networks mainly have public communication networks, such as the Internet.

Referring to FIG. 4, FIG. 4 is a schematic diagram of a deployment architecture of a clock server and a terminal according to an embodiment of the present invention. As shown in Figure 4, the clock server is deployed in a trusted network, and the terminal is deployed in an untrusted network. Among them, the communication of the clock server in the trusted network is secure, and the communication between the clock server and the terminal is relatively unsecured. Two communication paths are established between the clock server and the terminal, which are a secure path and an unsecure path. The clock synchronization packets transmitted on the non-secure path need to be filtered by the security gateway, and the control message security gateway transmits the two-way transparent transmission on the secure path. The security path can be established in various ways, such as an IPSec tunnel established by adding a logical interface or a dedicated signaling link established by adding a physical link. The non-secure path can be accessed through the existing public. The communication network is established.

Example 4:

In this embodiment, when the clock server is deployed on the trusted network, and the home gateway is in the routing mode, the terminal and the clock server transmit the clock synchronization message through the non-secure path, and the control message is transmitted through the secure path. Referring to FIG. 5, FIG. 5 is a schematic flowchart of a method for transmitting a clock synchronization message through a non-secure path and transmitting a control message through a secure path between a terminal and a clock server according to Embodiment 1 of the present invention. As shown in Figure 5, the dotted line indicates the change of the service packet address when the terminal and the clock server transmit the clock synchronization packet through the non-secure path. The solid line indicates the service packet address when the terminal and the clock server pass the security path control message. Changes. SIP indicates the source IP, DIP indicates the target IP, SPort indicates the source port, and DPort indicates the destination port. The terminal has two addresses: 10.10.2.20 is used for the secure path communication address, for example, the clock server is deployed on the core network, and the terminal allocates the address when accessing the core network through the secure path IPSec tunnel; 192.168.0.2 is used for non-secure path communication. Address, such as the address used by public network communications; the clock server also has two addresses: 10.10.2.2 is used for secure path communication address; 210.45.38.2 is used for non-secure path communication address, such as address used by public network communication.

To facilitate the subsequent description of the embodiments of the present invention, the network addresses in the embodiments of the present invention are first agreed as follows:

(1) S-S-IP: The IP communication address assigned by the terminal when accessing the reliability network through the secure path, as shown in Figure 10.10.20.

(2) S-U-IP: The IP address assigned by the terminal when accessing the reliability network through the non-secure path, as shown in Figure 5, 192.168.0.2;

(3) S-NAT-U-IP: The IP communication address of the non-secure path of the terminal traversing the network address translation, as shown in Figure 5, 202.38.120.4; when there is no traversal network address translation, this address is the same as SU-IP ;

(4) M-A-IP: access IP address of the clock server, as shown in Figure 5, 210.45.38.2; (5) M-I-IP: IP address of the intranet of the clock server, as shown in Figure 10.10.2.2. In the flowchart shown in FIG. 5, the clock client sends a message to the clock server, and the second path (non-secure path) indicated by the dotted line, the source address in the message is SIP 192.168.0.2, the source port number. Sport: 319, destination address DIP is 210.45.38.2, destination port DPort is 319; After arriving at the home gateway, the home gateway replaces SIP with the external network address of the clock client (ie, the address of the home gateway) 202.30.120.4, SPort is 2345; After the security gateway is reached, the security gateway replaces the DIP in the packet with the intranet address 10.10.2.2 of the clock server. The DPort remains unchanged and then sends the packet to the clock server.

When the clock server sends a packet to the clock client, the SIP in the packet is the intranet address 10.10.2.2 and the Sport is 319. The DIP in the packet is the external address 202.38.120.4 of the clock client. The DPort is 2345; After reaching the security gateway, the security gateway replaces the SIP in the packet with the external network address 210.45.38.2 of the clock server, and the DPort remains unchanged. After reaching the home gateway, the home gateway replaces the DIP with the intranet address of the clock client 192.168.0.2 and the DPort with the 319.

In the solid line, the first path (secure path) is established, and the clock client and the security gateway establish a secure connection, such as an IP Sec tunnel, in which the clock server and the local area network are in the same virtual local area network; or, through a dedicated physical link, Enables the clock client to establish a direct connection to the security gateway so that the clock server and clock client can be on the same local area network. At first In the path, the IP address of the clock client is 10.10.2.2. In the packet sent to the clock server, SIP is 10.10.2.20, Sport 320, DIP is the intranet address 10.10.2.2 of the clock server, and DPort is 320. A path is sent to the clock server, and the SIP or DIP of the message is not changed during the transmission. If the clock server sends a clock packet to the clock client, SIP is the clock server address 10.10.2.2, SPort is 320, DIP is the clock client address 10.10.2.20, DPort is 320, and the packet is sent to the clock through the first path. On the client side, SIP, DIP, and the corresponding port number will not change during the delivery process.

It can be seen from FIG. 5 that when the control message is transmitted through the secure path in the embodiment of the present invention, the home gateway and the security gateway are regarded as two-way transparent transmission, so that the control message is not easily parsed, and the security performance of the clock server can be further improved. At the same time, the terminal can receive clock synchronization messages sent by the clock server on the established non-secure path, so that clock synchronization can be performed. In addition, when the clock synchronization message is transmitted on the non-secure path, the network address can be flexibly converted, so that the network address translation can be realized.

Example 5

Referring to FIG. 6, FIG. 6 is a schematic flowchart of a method for implementing a clock synchronization security according to Embodiment 2 of the present invention. As shown in FIG. 6, this embodiment performs clock synchronization message transmission in a unicast manner, a broken line indicates a flow performed on an unsecured path, and a solid line indicates a flow performed on a secure path. The process of this embodiment may include:

(1) The terminal establishes a secure path with the security gateway to establish a secure path between the terminal and the clock server.

The security path between the clock server and the terminal may be established by adding a logical interface, such as an IPSec tunnel, or by adding a physical link, such as a dedicated signaling link. In this embodiment, an IPSec tunnel is used as an example to establish a secure path between the terminal and the clock server.

(2) The terminal initiates a handshake request Handshake_Req for traversing the network address translation to the clock server through the non-secure path, and the handshake request carries an identifier (such as a random number) for message matching.

The address and port information carried in the handshake request are: SIP: S-S-IP; SPort: 319; DIP: M-A-IP; DPort: 319.

For the different sending methods of clock packets, the 1588 protocol specifies different sending addresses and ends. mouth. Table 1 shows the mapping between the sending mode of a clock packet and the port.

(3) The clock server responds to the handshake request, and responds according to the random number of the handshake request, the source IP, and the handshake request returned by the port Handshake_Resp; the handshake request response carries the non-secure path address and the corresponding port after the network address translation. If the clock server does not support the handshake request, no handshake request response is sent.

The address and port information carried in the handshake request response are: SIP: M-I-IP; SPort: 319; DIP: S-NAT-U-IP; DPort: Source port of the handshake request.

(4) The terminal sends a Announce message unicast request to the clock server.

The address and port information carried in the Announce message unicast request sent by the terminal is:

SIP: S-S-IP; SPort: 320; DIP: M-I-IP; DPort: 320.

(5) The clock server advertises the unicast authorization of the Announce message.

The address and port information carried by the unicast authorization of the Announce message sent by the clock server are:

SIP: M-I-IP; SPort: 320; DIP: S-S-IP; DPort: 320.

(6) The Announce unicast message sent by the clock server to the terminal periodically for selecting the source of the clock server.

The address and port information carried by the Announce unicast message periodically sent by the clock server are:

SIP: M-I-IP; SPort: 320; DIP: S-S-IP; DPort: 320.

(7) The terminal sends a unicast request for the clock synchronization message to the selected clock server, carries the converted network address S-NAT-U-IP and the corresponding port, and can carry the terminal branch Security mechanism parameters.

The address and port information carried by the unicast request for sending the clock synchronization packet to the selected clock server is:

SIP: S-S-IP; SPort: 320; DIP: M-I-IP; DPort: 320.

(8) The clock server initiates a unicast authorization message to the terminal, and if the security mechanism is supported, the specified security mechanism parameters.

The address and port information carried by the clock server to the terminal to initiate the unicast authorization message are: SIP: M-I-IP; SPort: 320; DIP: S-S-IP; DPort: 320.

(9) If the terminal is required to perform an independent security negotiation process, the terminal sends a clock signal to the clock server, which carries the security mechanism negotiation parameters.

The terminal sends a clock signal to the clock server. The address and port information carried by the Signalin port is:

SIP: S-S-IP; SPort: 320; DIP: M-I-IP; DPort: 320.

(10) If the clock server supports the security mechanism, it returns a clock signal to the terminal. The Signaling indication packet indicates the security mechanism used and the corresponding negotiation parameters.

The clock server returns a clock signal to the terminal. Signaling indicates that the address and port information carried in the packet are:

SIP: M-I-IP; SPort: 320; DIP: S-S-IP; DPort: 320.

It should be noted that if the terminal and/or the clock server do not implement security, there is no process (9) and process (10).

(11) If time synchronization is performed, the terminal sends a point-to-point delay negotiation request Delay_Req to the clock server.

The address and port information carried by the terminal to send a point-to-point delay negotiation request to the clock server is:

SIP: S-S-IP; SPort: 320; DIP: M-I-IP; DPort: 320.

(12) The point-to-point delay negotiation request authorization Delay_Resp returned by the clock server to the terminal, the delay negotiation request authorization indication uses a delay mechanism.

The address and port information carried by the point-to-point delay negotiation request authorization returned by the clock server to the terminal is:

SIP: MI-IP; SPort: 320; DIP: SS-IP; DPort: 320. (13) If time synchronization is performed, the terminal may also send an end-to-end delay negotiation request PDelay_Req to the clock server.

The address and port information carried by the terminal to send the end-to-end delay negotiation request to the clock server is:

SIP: S-S-IP; SPort: 320; DIP: M-I-IP; DPort: 320.

( 14 ) End-to-end delay negotiation request authorization returned by the clock server to the terminal

PDelay_Resp, the delay negotiation request authorization indicates the delay mechanism used.

The address and port information carried in the end-to-end delay negotiation request authorization returned by the clock server to the terminal is:

SIP: M-I-IP; SPort: 320; DIP: S-S-IP; DPort: 320.

It should be noted that the processes (11), (12), (13) and (14) are used for the negotiation of the delay mechanism in time synchronization. If it is frequency synchronization, there is no process (11), (12), (13). ) and (14).

(15) The clock server periodically sends clock synchronization packets to the terminal in unicast mode for frequency or time synchronization. After receiving the packet, the terminal needs to perform the verification according to the previously negotiated security mechanism. Message.

The clock server periodically sends clock synchronization to the terminal in the unicast mode. The address and port information carried in the file are:

SIP: MI-IP; SPort: 319; DIP: If the IP address is indicated in the unicast negotiation, the indicated IP address is used, otherwise the source IP of the unicast request is used; DPort: If the port is indicated in the unicast negotiation, the indication is used. Port, otherwise use 319.

(16) If it is time synchronization, the terminal may send a point-to-point delay request Delay_Req to the clock server according to the negotiated delay mechanism of processes (11) and (12).

The address and port information carried by the terminal to the clock server to send the point-to-point delay request are: SIP: S-U-IP; SPort: 319; DIP: M-A-IP; DPort: 319.

(17) The clock server performs verification according to the negotiated security mechanism, processes the packet that passes the verification, and delays the request to the terminal to delay the request to delay_Resp.

The address and port information carried by the point-to-point delay request authorization returned by the clock server to the terminal is:

SIP: MI-IP; SPort: 320; DIP: SS-IP; DPort: 320. (18) If it is time synchronization, the terminal may send an end-to-end delay request PDelay_Req to the clock server according to the negotiated delay mechanism of processes (13) and (14).

The address and port information carried by the terminal to send the end-to-end delay request to the clock server are: SIP: S-U-IP; SPort: 319; DIP: M-A-IP; DPort: 319.

(19) The clock server performs verification according to the negotiated security mechanism, processes the packet that passes the verification, and delays the end-to-end delay request request to the terminal to PDelay_Resp.

The address and port information carried by the clock server to the terminal end-to-end request authorization is:

SIP: M-I-IP; SPort: 319; DIP: S-NAT-U-IP; DPort: PDelay—Req port SPort.

It should be noted that when time synchronization is performed, the processes (16), (17), (18) and (19) are used for the negotiated delay according to the processes (11), (12), (13) and (14). The mechanism performs time synchronization; if it is frequency synchronization, there are no processes (11), (12), (13), (14), (16), (17), (18) and (19).

It can be understood that, in this embodiment, the terminal is a clock client Slave. The secure path is a path established between the terminal and the clock server to transfer data in a secure manner (referred to as a first path in this embodiment), and the non-secure path is established between the terminal and the clock server after the first path is established. The second path (referred to as the second path in this embodiment).

Process 2 and Process 3 are used to negotiate some parameters of the terminal NAT traversal, such as the traversed address and the port number. These two processes need to be completed before the second path is established. The second path is either a secure method or a connection that transfers data in a non-secure manner.

In the process 4, 5, and 6, the Announce message is used in the IP Sec tunnel to transmit information for establishing the second path, where the information includes, for example, the address of the clock server and the port used by the clock server, and the terminal can establish the information according to the information. A second path. Because the IP Sec tunnel delivers relevant information in a secure manner, critical information (such as the port of the clock server) is not easily accessed, improving security.

In processes 9 and 10 (optional process), the security policy used by the second path is negotiated through the first path, thereby effectively simplifying the security negotiation process. If the two processes negotiate security parameters, the second path can pass the data using the negotiated security policy.

The method provided in this embodiment can be applied to transmit a clock report specified by the IEEE 1588 protocol. Text.

The method for implementing clock synchronization provided by the second embodiment of the present invention is described in detail above. The clock server establishes a secure path and a non-secure path between the terminal and the terminal, and sends a clock synchronization message to the terminal on the established non-secure path, so that the terminal can perform clock synchronization according to the clock synchronization message. At the same time, because the clock server interacts with the terminal through the security path, the control message is not easily attacked, and the security performance of the clock server can be further improved.

Example 6:

Referring to FIG. 7, FIG. 7 is a flow chart of a method for implementing clock synchronization according to Embodiment 3 of the present invention. As shown in FIG. 7, in this embodiment, a clock synchronization message is sent in a multicast manner, a broken line indicates a flow performed on an unsecured path, and a solid line indicates a flow performed on a secure path. The flow of this embodiment may include:

The security path between the clock server and the terminal may be established by adding a logical interface, such as an IP Sec tunnel, or by adding a physical link, such as a dedicated signaling link. In this embodiment, an IP Sec tunnel is taken as an example to establish a secure path between the terminal and the clock server.

(2) The terminal sends a Announce message unicast request to the clock server.

SIP: S-S-IP; SPort: 320; DIP: M-I-IP; DPort: 320.

(3) The clock server advertises the unicast authorization of the Announce message.

The address and port information carried by the unicast authorization of the Announce message sent by the clock server is:

SIP: M-I-IP; SPort: 320; DIP: S-S-IP; DPort: 320.

(4) The Announce unicast message sent by the clock server to the terminal periodically for the source of the clock server.

The address and port information carried in the Announce unicast message periodically sent by the clock server is: SIP: MI-IP; SPort: 320; DIP: SS-IP; DPort: 320.

(5) If the terminal is required to perform security negotiation, the terminal sends a clock signal to the clock server, and carries the security mechanism negotiation parameters.

The terminal sends a clock signal to the clock server. The address and port information carried by the Signaling^ message is:

SIP: S-S-IP; SPort: 320; DIP: M-I-IP; DPort: 320.

(6) If the clock server supports the security mechanism, it returns a clock signal Signaling indication message to the terminal, indicating the security mechanism used and the corresponding negotiation parameters.

SIP: M-I-IP; SPort: 320; DIP: S-S-IP; DPort: 320.

It should be noted that if the terminal and/or the clock server do not implement security, there is no process (5) and process (6).

(7) If time synchronization is performed, the terminal sends a point-to-point delay negotiation request Delay_Req to the clock server.

SIP: S-S-IP; SPort: 320; DIP: M-I-IP; DPort: 320.

(8) The point-to-point delay negotiation request authorization Delay_Resp returned by the clock server to the terminal, the delay negotiation request authorization indication uses a delay mechanism.

The address and port information carried by the clock server master to the point-to-point delay negotiation request returned by the terminal Slave is:

SIP: M-I-IP; SPort: 320; DIP: S-S-IP; DPort: 320.

(9) If time synchronization is performed, the terminal may also send an end-to-end delay negotiation request PDelay_Req to the clock server.

SIP: S-S-IP; SPort: 320; DIP: M-I-IP; DPort: 320.

(10) End-to-end delay negotiation request authorization returned by the clock server to the terminal

PDelay—Resp, the delay negotiation request authorization indicates the delay mechanism used. The address and port information carried in the end-to-end delay negotiation request authorization returned by the clock server to the terminal is:

SIP: M-I-IP; SPort: 320; DIP: S-S-IP; DPort: 320.

It should be noted that the processes (7), (8), (9) and (10) are used for the negotiation of the delay mechanism for time synchronization. If the frequency is synchronized, there are no processes (7), (8), (9). ) and (10).

(11) The clock server periodically sends a clock synchronization message to the terminal for frequency or time synchronization. After receiving the message, the terminal needs to perform the verification according to the previously negotiated security mechanism. Message.

The clock server periodically sends clock synchronization to the terminal in a multicast manner. The address and port information carried in the message are:

SIP: M-I-IP; SPort: 319; DIP: 224.0.1.129; DPort: 319.

(12) If it is time synchronization, the terminal may send a point-to-point delay request Delay_Req to the clock server according to the delay mechanism negotiated by processes (7) and (8).

The address and port information carried by the terminal to the point-to-point delay sent to the clock server is:

SIP: S-U-IP; SPort: 319; DIP: M-A-IP; DPort: 319.

(13) The clock server performs verification according to the negotiated security mechanism, processes the packet that passes the verification, and delays the request to the terminal to delay the request to delay_Resp.

SIP: M-I-IP; SPort: 320; DIP: S-S-IP; DPort: 320.

(14) If it is time synchronization, the terminal may send an end-to-end delay request PDelay_Req to the clock server according to the negotiated delay mechanism of processes (9) and (10).

(15) The clock server performs verification according to the negotiated security mechanism, processes the packets that pass the verification, and delays the end-to-end delay request request to the terminal to PDelay_Resp.

The address and port information carried by the end-to-end delay request authorization returned by the clock server to the terminal is:

SIP: MI-IP; SPort: 319; DIP: S-NAT-U-IP; DPort: PDelay—the end of Req Port SPort.

It should be noted that when time synchronization is performed, processes (12), (13), (14), and (15) are used to negotiate delays according to processes (7), (8), (9), and (10). The mechanism performs time delay; if it is frequency synchronization, there are no processes (7), (8), (9), (10), (12), (13), (14) and (15).

In this embodiment, the clock synchronization message is sent in the multicast mode, and the home gateway is required to be supported. Therefore, the process in this embodiment is different from the unicast process in the first embodiment in that: The handshake process, the clock synchronization message is sent by multicast; the other process is the same as the unicast process of the first embodiment.

The flow of implementing the clock synchronization security method provided in the third embodiment of the present invention is described in detail above. The clock server establishes a secure path and a non-secure path between the terminal and the terminal, and sends a clock synchronization message to the terminal on the established non-secure path, so that the terminal can perform clock synchronization according to the clock synchronization message. At the same time, because the clock server interacts with the terminal through the security path, the control message is not easily attacked, and the security performance of the clock server can be further improved.

Example 5

Referring to FIG. 8, FIG. 8 is a flow chart of a method for implementing clock synchronization security according to Embodiment 4 of the present invention. As shown in FIG. 8, in this embodiment, the Announce message and the clock synchronization message are sent in a multicast manner, the dotted line indicates the flow on the non-secure path, and the solid line indicates the flow in the secure path. The process of this embodiment may include:

(2) Announcement Announce Multicast message sent by the clock server to the terminal periodically for the source of the clock server.

The address and port information carried by the Announce multicast message sent by the clock server to the terminal periodically is: SIP: MI-IP; SPort: 320; DIP: 224.0.1.129; DPort: 320.

(3) If the terminal is required to perform security negotiation, the terminal sends a clock signal to the clock server, and carries the security mechanism negotiation parameters.

SIP: S-S-IP; SPort: 320; DIP: M-I-IP; DPort: 320.

(4) If the clock server supports the security mechanism, it returns a clock signal Signaling indication packet to the terminal, indicating the security mechanism used and the corresponding negotiation parameters.

SIP: M-I-IP; SPort: 320; DIP: S-S-IP; DPort: 320.

It should be noted that if the terminal and/or the clock server do not implement security, there is no process (3) and process (4).

(5) If time synchronization is performed, the terminal sends a point-to-point delay negotiation request Delay_Req to the clock server.

SIP: S-S-IP; SPort: 320; DIP: M-I-IP; DPort: 320.

(6) The point-to-point delay negotiation request authorization Delay_Resp returned by the clock server to the terminal, the delay negotiation request authorization indication uses a delay mechanism.

SIP: M-I-IP; SPort: 320; DIP: S-S-IP; DPort: 320.

(7) If time synchronization is performed, the terminal may also send an end-to-end delay negotiation request PDelay_Req to the clock server.

SIP: S-S-IP; SPort: 320; DIP: M-I-IP; DPort: 320.

(8) End-to-end delay negotiation request authorization returned by the clock server to the terminal

SIP: M-I-IP; SPort: 320; DIP: S-S-IP; DPort: 320.

It should be noted that the processes (5), (6), (7) and (8) are used for the negotiation of the delay mechanism for time synchronization. If it is frequency synchronization, there are no processes (5), (6), (7). ) and (8).

(9) The clock server periodically sends a clock synchronization message to the terminal in a multicast manner for frequency or time synchronization. After receiving the message, the terminal needs to perform verification according to the previously negotiated security mechanism; Message.

SIP: M-I-IP; SPort: 319; DIP: 224.0.1.129; DPort: 319.

(10) If it is time synchronization, the terminal may send a point-to-point delay request Delay_Req to the clock server according to the delay mechanism negotiated by processes (5) and (6).

The address and port information carried by the terminal to the clock server to send the point-to-point delay request is:

SIP: S-U-IP; SPort: 319; DIP: M-A-IP; DPort: 319.

(11) The clock server performs verification according to the negotiated security mechanism, processes the packet that passes the verification, and delays the request to the terminal to delay the request to delay_Resp.

SIP: M-I-IP; SPort: 320; DIP: S-S-IP; DPort: 320.

(12) If it is time synchronization, the terminal may send an end-to-end delay request PDelay_Req to the clock server according to the delay mechanism negotiated by processes (7) and (8).

(13) The clock server performs verification according to the negotiated security mechanism, processes the packet that passes the verification, and delays the end-to-end delay request request to the terminal to PDelay_Resp.

It should be noted that when time synchronization is performed, the processes (10), (11), (12) and (13) are used for the negotiated delay according to the processes (5), (6), (7) and (8). The mechanism performs time delay; if it is frequency synchronization, there are no processes (5), (6), (7), (8), (10), (11), (12) and (13).

The process of this embodiment is different from the multicast process of the third embodiment in that: the terminal directly receives the advertisement multicast message sent by the clock server periodically, and is used for selecting the source of the clock server; The broadcast process is the same.

The method for implementing clock synchronization provided by Embodiment 4 of the present invention is described in detail above. The clock server establishes a secure path and a non-secure path between the terminal and the terminal, and sends a clock synchronization message to the terminal on the established non-secure path, so that the terminal can perform clock synchronization according to the clock synchronization message. At the same time, because the clock server interacts with the terminal through the security path, the control message is not easily attacked, and the security performance of the clock server can be further improved.

The method and the embodiment of the clock synchronization provided by the embodiment of the present invention are described in detail with reference to the accompanying drawings, and the device provided by the embodiment of the present invention is described below with reference to the accompanying drawings.

Example 6:

Referring to FIG. 9, FIG. 9 is a schematic structural diagram of a clock server according to Embodiment 5 of the present invention. As shown in FIG. 9, the clock server provided by the embodiment of the present invention may include:

The first interface module 901 is configured to establish a secure path and a non-secure path with the terminal; the first association module 902 is configured to associate the address of the secure path and the non-secure path;

The first control message interaction module 903 is configured to perform control message interaction with the terminal through the secure path;

The synchronization message sending module 904 is configured to send a clock synchronization message to the terminal through the non-secure path.

The first control message interaction module 903 is further configured to receive, by using a secure path, a security mechanism negotiation request sent by the terminal, where the security mechanism negotiation request carries a security mechanism negotiation parameter; The security mechanism returned to the terminal negotiates a request response, the request response indicating the security mechanism used and the corresponding negotiation parameters.

The first control message interaction module 903 is further configured to receive, by using a secure path, a point-to-point delay negotiation request sent by the terminal;

Returning a point-to-point delay negotiation request authorization to the terminal, the negotiation request authorization indicating a delay mechanism used;

An end-to-end delay negotiation request authorization is returned to the terminal, the negotiation request authorization indicating a delay mechanism used.

The first control message interaction module 903 is further configured to receive, by using an unsecure path, a handshake request initiated by the terminal to traverse the network address translation;

And returning a handshake request response to the terminal, where the handshake request response carries the non-secure path address and the corresponding port after the network address translation.

The first control message interaction module 903 can also periodically send an announcement multicast message for selecting a source to the terminal through a non-secure path.

The synchronization message sending module 904 is configured to use a non-secure path to periodically transmit a clock synchronization message to the terminal in a multicast manner.

Further, if the clock server does not implement security, the first control message interaction module 903 does not negotiate with the terminal for security mechanism; if the terminal line is time synchronized, the first control message interaction module 903 does not communicate with the terminal. The deferred mechanism negotiation is performed. If the clock server sends the advertisement message for selecting the source to the terminal in a multicast manner, the first control message interaction module 903 may directly send the advertisement message for the clock source to the terminal.

The clock server provided in the fifth embodiment of the present invention is described in detail. The control message interaction is performed on the secure path established by the first interface module 901, so that the control message is not easily attacked, thereby further improving the security performance of the clock server. In addition, the clock synchronization message is sent to the terminal through the non-secure path established by the first interface module 901, so that the terminal can perform clock synchronization according to the clock synchronization.

Example 7

Referring to FIG. 10, FIG. 10 is a schematic structural diagram of a terminal according to Embodiment 6 of the present invention. As shown in FIG. 10, the terminal provided by the embodiment of the present invention may include: The second interface module 1001 is configured to establish a secure path and a non-secure path with the clock server. The second association module 1002 is configured to associate the secure path address with the address of the non-secure path.

The second control message interaction module 1003 is configured to perform control message interaction with the clock server through the secure path.

The clock synchronization module 1004 is configured to perform clock synchronization through the non-secure path.

The second control message interaction module 1003 is further configured to send a security mechanism negotiation request to the clock server through the security path, where the security mechanism negotiation request carries the security mechanism negotiation parameter;

Receiving a security mechanism negotiation request response returned by the clock server, the request response indicating a security mechanism used and a corresponding negotiation parameter.

The second control message interaction module 1003 is further configured to send a point-to-point delay negotiation request to the clock server through the secure path;

Receiving a point-to-point delay negotiation request authorization returned by the clock server, the negotiation request authorization indicating a delay mechanism used;

Or, sending an end-to-end delay negotiation request to the clock server through the secure path; receiving an end-to-end delay negotiation request authorization returned by the clock server, where the negotiation request authorization indicates a delay mechanism used.

The second control message interaction module 1003 is further configured to initiate a handshake request to traverse the network address translation to the clock server through the non-secure path;

The receiving clock server returns a handshake request response, and the handshake request response carries the non-secure path address and the corresponding port after the network address translation.

The second control message interaction module 1003 may further receive, by using an unsecured path, an advertisement multicast message for selecting a source that is periodically sent by the clock server;

The clock synchronization module 1004 is configured to receive, by using an unsecured path, a clock synchronization packet periodically sent by the clock server in a multicast manner; and processing the clock synchronization packet according to the negotiated security mechanism.

Further, if the terminal does not implement security, the second control message interaction module 1003 does not perform security negotiation with the clock server; if time synchronization is performed with the clock server, the second control message interaction module 1003 does not. Will negotiate with the clock server for the delay mechanism; if the clock The server sends the advertisement message for selecting the source to the terminal in a multicast manner, and the second control message interaction module 1003 can directly perform the source selection of the clock server according to the advertisement message.

The terminal provided in the sixth embodiment of the present invention is described in detail. The control message interaction is performed on the secure path established by the second interface module 1001, so that the control message is not easily attacked, thereby further improving the security performance of the clock server. In addition, the clock synchronization message sent by the clock server is received by the non-secure path established by the second interface module 1001, so that clock synchronization can be performed according to the clock synchronization message.

Example 8

Referring to FIG. 11, FIG. 11 is a schematic diagram of a network system according to Embodiment 7 of the present invention. As shown in FIG. 11, the network system provided by the embodiment of the present invention may include:

The clock server 1101 is configured to establish a secure path and a non-secure path with the terminal 1102; associate the secure path with the non-secure path; perform control message interaction with the terminal through the secure path, and use the non-secure path to the terminal 1102. Send a clock synchronization packet.

The terminal 1102 is configured to establish a secure path and a non-secure path with the clock server 1101; associate the secure path with the non-secure path; perform control message interaction with the clock server 1101 through the secure path, and perform the control message on the non-secure path. Clock synchronization.

The terminal 1102 may also send a security mechanism negotiation request to the clock server 1101 through a secure path, where the security mechanism negotiation request carries a security mechanism negotiation parameter;

The security mechanism returned by the receiving clock server 1101 negotiates a request response, the request response indicating the security mechanism used and the corresponding negotiation parameters.

The clock server 1101 is further configured to receive, by using the secure path, a security mechanism negotiation request sent by the terminal, where the security mechanism negotiation request carries a security mechanism negotiation parameter;

The security mechanism returned to the terminal 1102 negotiates a request response, the request response indicating the security mechanism used and the corresponding negotiation parameters.

The terminal 1102 may also send a point-to-point delay negotiation request to the clock server 1101 through the secure path; receive the point-to-point delay negotiation request authorization returned by the clock server 1101, and the delay negotiation request authorization indicates the delay mechanism used;

Or, sending an end-to-end delay negotiation request to the clock server 1101 through the secure path; receiving an end-to-end delay negotiation request authorization returned by the clock server, the delay negotiation request authorization indicating a delay mechanism used. The clock server 1101 is further configured to send a point-to-point delay negotiation request by the secure path receiving terminal, and return a point-to-point delay negotiation request authorization to the terminal, where the delayed negotiation request authorization indicates a delay mechanism used;

Or, receiving an end-to-end delay negotiation request sent by the terminal through the secure path; returning an end-to-end delay negotiation request authorization to the terminal, where the delayed negotiation request authorization indicates a delay mechanism used.

The terminal 1102 may also initiate a handshake request to traverse the network address translation to the clock server 1101 through the non-secure path.

The receiving clock server 1101 returns a handshake request response, and the handshake request response carries the non-secure path address and the corresponding port after the network address translation.

The clock server 1101 is further configured to receive, by using an unsecure path, a handshake request initiated by the terminal to traverse the network address;

A handshake request response is returned to the terminal 1102, and the handshake request response carries the non-secure path address and the corresponding port after the network address translation.

The clock server 1101 is further configured to periodically send an announcement multicast message for selecting a source to the terminal 1102 by using the non-secure path;

The clock synchronization message periodically sent by the multicast mode is used to the terminal 1102 through the non-secure path.

The terminal 1102 may also receive, by the non-secure path, the advertisement multicast message periodically sent by the clock server 1101 for selecting a source;

The clock server 1101 receives the clock synchronization packet periodically sent by the multicast mode; and processes the clock synchronization packet according to the negotiated security mechanism.

Example 9

Referring to FIG. 12, the embodiment of FIG. 12 provides a clock server 121 and a terminal 123. The terminal 123 can access the clock server 121 through the security gateway 122.

The clock server 121 provided in this embodiment includes the following modules:

The first path establishing module 1211, the second path establishing module 1212, and the clock message module 1213. among them,

The first path establishing module 1211 is configured to establish a first path with the terminal 123, where the first path is a secure connection for transmitting data in a secure manner.

For example, the first path here can be a secure IP Sec tunnel, or a security special. Link, etc.

The first path establishing module 1211 can establish a secure connection with the terminal 123 through the security gateway 122.

The second path establishing module 1212 is configured to send, by using the first path, information for establishing the second path to the terminal 123, to establish the second path with the terminal.

For example, after receiving the Announce message unicast request of the terminal 123 through the first path, the terminal 123 may return an authorization for the Announce message unicast request, where the authorization carries the corresponding information for establishing the second path. .

As an example, the address and port information carried by the Announce message sent by the terminal 123 is: SIP: SS-IP; SPort: 320; DIP: MI-IP; DPort: 320; sent by the second path establishing module 1212. The address and port information carried in the unicast authorization of the Announce message is: SIP: MI-IP; SPort: 320; DIP: SS-IP; DPort: 320.

For details, refer to the description of the foregoing embodiments, and details are not described herein.

The clock message sending module 1213 is configured to send a clock synchronization message to the terminal 123 by using the second path.

The clock message can be sent in multicast mode or in unicast mode.

Optionally, the clock server 121 may further include a first signaling module 1214, configured to send, by using the first path, a control message to the terminal 123, where the control message includes any one of the following messages or a combination thereof, and is used for selecting a source. Announcement message, end-to-end delay negotiation request authorization, security mechanism negotiation request response.

The second signaling module 1215 is configured to send, by using the second path, a control message to the terminal 123, where the control information includes any one of the following messages or a combination thereof, a point-to-point delay negotiation request, and an end-to-end delay negotiation request authorization. , an advertisement multicast message for selecting a source.

The terminal 123 includes the following modules:

The first path establishing module 1231 is configured to establish a first path with the clock server 121, where the first path is a secure connection for transmitting data in a secure manner;

The second path establishing module 1232 is configured to obtain information for establishing the second path from the clock server 121 by using the first path, and establish the second path by the clock server 121.

The clock message receiving module 1233 is configured to receive, by using the second path, a clock synchronization message sent by the clock server 121. Optionally, the clock server may further include the following modules:

The third signaling module 1234 is configured to send, by using the first path, a control message to the clock server 121, where the control information includes a security mechanism negotiation request.

The fourth signaling module 1235 is configured to send, by using the second path, a control message to the clock server 121, where the control information includes any one of the following messages or a combination thereof, a point-to-point delay negotiation request, and an end-to-end delay negotiation request. Wait.

For the flow of the control information between the clock server 121 and the terminal 123, reference may be made to the description of the above embodiment.

It can be seen from the above description that the method provided in this embodiment can use the first path to transmit some key information, such as a port of the clock server, so that the information required to establish the second path is hidden and is not disclosed to all terminals. The security of the clock server is improved. Further, the first path can also be used to transmit some key information, such as some important control messages, so that key information is not easily intercepted, and the security of the clock synchronization process is improved; further, A path can also be used to negotiate the security mechanism used by the second path, simplifying the negotiation process of the security mechanism adopted by the second path.

Example 10

The method provided in this embodiment includes the following steps

Step 1301 establishes a first path between the clock server and the terminal.

For example, through an IP Sec tunnel or a new physical link.

Illustratively, a secure connection can be established through a security gateway. The connection may be initiated by the terminal, initiated by the security gateway, or initiated by the clock server.

Step 1302 establishes a second path by using the first path.

And transmitting, by the first path, information required to establish the second path, and establishing the second path between the clock server and the terminal according to the information required to establish the second path. The information required to establish the second path, such as the address of the clock server, the port, and the like.

As an example, the clock server receives the advertisement message unicast request sent by the terminal by using the first path,

The clock server returns an advertised message unicast request authorization to the terminal by using the first path, so that the terminal establishes the second path according to the unicast request authorization information carried by the terminal; or Sending, by the terminal, an announcement message unicast request to the clock server by using the first path,

Receiving, by the terminal, the notification message unicast request authorization returned by the clock server by using the first path,

And the terminal establishes a second path with the clock server according to the advertisement message unicast requesting authorization to carry the information.

Since the first path transmits the information required to establish the second path in a secure manner, for example, the port of the server, the information can be made difficult to be intercepted, so that the information required to establish the second path is not disclosed to all terminals, thereby improving The security of the clock server.

Step 1303: The clock message is transmitted through the second path.

For example, the clock server transmits the clock synchronization message in a unicast manner on the second path; or the clock server transmits the clock synchronization message in the second path in a multicast manner.

After the step 1303, before the step 1303, the method may further include the following steps: The security mechanism used by the second path is negotiated between the clock server and the terminal through the first path. Since the first path uses a secure way to pass security mechanisms, it is possible to centralize the negotiation process of the security mechanism.

As an example, the clock server receives the security mechanism negotiation request sent by the terminal by using the first path, where the security mechanism negotiation request carries the security mechanism negotiation parameter;

And returning the security mechanism negotiation request response to the terminal by using the security path, and indicating the security mechanism used by the second path to send the clock message in step 1303 and the corresponding negotiation parameter. In addition, before step 1303, the following steps may also be included:

The clock server receives the point-to-point delay negotiation request sent by the terminal by using the second path, and returns a point-to-point delay negotiation request authorization to the terminal by using the second path, where the second path is used in the delay negotiation request authorization indication step 1303. Delay mechanism

Or receiving an end-to-end delay negotiation request sent by the terminal by using the second path, and returning an end-to-end delay negotiation request authorization to the terminal by using the first path, where the delay negotiation request authorization indicates the delay of the second path used in step 1303. mechanism. In addition, before step 1302, after the NAT traversal can be negotiated for the second path to be established, The address and port of the terminal on the second path.

As an example, the clock server receives a handshake request initiated by the terminal to traverse the network address translation;

The clock server returns a handshake request response to the terminal, and the handshake request response carries the address and the corresponding port on the second path after the terminal traverses the network address translation.

It can be understood that the method provided by this embodiment can use the first path to transmit some key information, such as a server port, or some important control messages, to improve the security of the clock synchronization process.

The network system provided in the seventh embodiment of the present invention is described in detail, and the control message is exchanged on the established security path, so that the control message is not easily attacked, thereby further improving the security performance of the clock server. In addition, the clock can be transmitted through the established non-secure path. It can be understood by those skilled in the art that all or part of the steps of implementing the foregoing method embodiments may be performed by hardware related to the program instructions, and the foregoing program may be stored in a computer readable storage. In the medium, when the program is executed, the steps including the foregoing method embodiments are performed; and the foregoing storage medium includes: a medium that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.

The foregoing describes a method, device, and network system for clock synchronization provided by the embodiments of the present invention. The description of the above embodiments is only for helping to understand the method and core idea of the present invention. Meanwhile, the general technology in the field In the following, the description of the present invention is not limited to the scope of the present invention.

Claims

Rights request

A method for implementing clock synchronization, comprising:

Associating the secure path with the non-secure path;

The method according to claim 1, wherein the establishing a secure path and a non-secure path of the clock server and the terminal include:

The clock server establishes a secure path with the terminal by adding a logical interface or adding a physical link.

An unsecure path with the terminal is established by accessing a public communication network.

3. The method according to claim 1, wherein the associating the secure path with the non-secure path comprises:

The clock server associates the address of the secure path of the terminal with the address of the non-secure path by using a clock identifier sent by the terminal.

The method according to claim 1, wherein the performing control message interaction with the terminal by using the secure path includes:

Receiving, by the clock server, the advertisement message unicast request sent by the terminal by using the secure path;

And returning, by using the security path, an advertisement message unicast request authorization to the terminal; and periodically sending, by the security path, the advertisement unicast message for selecting a source to the terminal.

The method according to claim 1, wherein the performing the control message interaction with the terminal by using the secure path further includes:

Receiving, by the clock server, the security mechanism negotiation request sent by the terminal by using the security path, where the security mechanism negotiation request carries a security mechanism negotiation parameter;

Returning, by the secure path, a security mechanism negotiation request response to the terminal, indicating a security mechanism used and corresponding negotiation parameters.

The method according to claim 1, wherein the performing control message interaction with the terminal by using the secure path includes: Receiving, by the non-secure path, an end-to-end delay negotiation request sent by the terminal; returning an end-to-end delay negotiation request authorization to the terminal by using the security path, where the delayed negotiation request authorization indicates a delay mechanism used.

The method according to any one of claims 1 to 6, wherein the sending the line clock synchronization message through the non-secure path comprises:

The clock server periodically sends a clock synchronization message to the terminal in a unicast manner on the non-secure path; or

The clock server periodically sends a clock synchronization message to the terminal in a multicast manner on the non-secure path.

The method according to claim 1, 2, 3, 5 or 6, further comprising: the clock server periodically transmitting the source for selecting the source to the terminal on the non-secure path Advertise multicast messages;

The method according to any one of claims 1 to 6, wherein the performing the control message interaction with the terminal by using the secure path further comprises:

The clock server receives, by using the non-secure path, a handshake request initiated by the terminal to traverse a network address translation;

The clock server returns a handshake request response to the terminal by using the non-secure path, and the handshake request response carries the IP address of the non-secure path and the corresponding port of the terminal traversing the network address translation.

10. A method for implementing clock synchronization, comprising:

Associating the secure path with the non-secure path;

Controlling message interaction with the clock server through the secure path, and clock synchronization is performed on the non-secure path.

The method according to claim 10, wherein the associating the secure path with the non-secure path comprises: associating an address of a full path with an address of a non-secure path

The method according to claim 10, wherein the performing control message interaction with the clock server through the secure path comprises:

Sending, by the terminal, a notification message unicast request to the clock server by using the secure path;

Receiving, by the clock server, the unicast request authorization by the advertisement message returned by the security path;

Periodically, the advertisement unicast message sent by the clock server for selecting a source is received through the secure path.

The method according to any one of claims 10 to 12, wherein the clock synchronization on the non-secure path comprises:

Receiving, by the non-secure path, the clock synchronization message periodically sent by the clock server in a unicast manner, or

Receiving, by the non-secure path, the clock synchronization message periodically sent by the clock server by using the multicast mode;

The clock synchronization message is processed according to the negotiated security mechanism.

14. A clock server, comprising:

The clock server according to claim 14, wherein the first control message interaction module is further configured to receive, by using a secure path, a security mechanism negotiation request sent by the terminal, where the security mechanism negotiation request carries a security mechanism. Negotiate parameters,

A security mechanism negotiation request response is returned to the terminal, the request response indicating a security mechanism used and corresponding negotiation parameters.

The clock server according to claim 14 or 15, wherein the first control message interaction module is further configured to receive, by using the non-secure path, a point sent by the terminal to Point delay negotiation request, returning a point-to-point delay negotiation request authorization to the terminal, where the negotiation request authorization indicates a delay mechanism used;

Or, the end-to-end delay negotiation request sent by the terminal is received by the non-secure path, and the end-to-end delay negotiation request authorization is returned to the terminal by the security path, where the negotiation request authorization indicates a delay mechanism used.

The clock server according to claim 14 or 15, wherein the first control message interaction module is further configured to receive, by using the non-secure path, a handshake request initiated by the terminal to traverse a network address translation, The terminal returns a handshake request response, and the handshake request response carries the address of the non-secure path and the corresponding port of the terminal traversing the network address translation.

The clock server according to claim 14 or 15, wherein the first control message interaction module is further configured to periodically send, by using the non-secure path, the notification for selecting a source to the terminal. Broadcast message

The synchronization packet sending module is further configured to periodically send a clock synchronization packet to the terminal in a multicast manner by using the non-secure path.

19. A terminal, comprising:

The terminal according to claim 19, wherein the second control message interaction module is further configured to send a security mechanism negotiation request to the clock server by using the security path, where the security mechanism negotiation request carries security The mechanism negotiation parameter receives a security mechanism negotiation request response returned by the clock server, where the request response indicates a security mechanism used and a corresponding negotiation parameter.

The terminal according to claim 19 or 20, wherein the second control message interaction module is further configured to send a point-to-point delay to the clock server by using the secure path. Receiving, by the negotiation request, a point-to-point delay negotiation request authorization returned by the clock server, where the negotiation request authorization indicates a delay mechanism used;

Or, sending, by the non-secure path, an end-to-end delay negotiation request to the clock server, and receiving, by the secure path, an end-to-end delay negotiation request authorization returned by the clock server, where the negotiation request authorization indicates a delay mechanism used.

The terminal according to claim 19 or 20, wherein the second control message interaction module is further configured to initiate, by the non-secure path, a handshake request to traverse the network address translation to the clock server, and receive the location The clock server returns a handshake request response, and the handshake request response carries the address of the non-secure path and the corresponding port of the terminal traversing the network address translation.

The terminal according to claim 19 or 20, wherein the second control message interaction module is further configured to receive, by using the non-secure path, an advertisement that is periodically sent by the clock server for selecting a source. Broadcast message

The clock synchronization module is further configured to receive, by using the non-secure path, a clock synchronization packet periodically sent by the clock server in a multicast manner, and process the clock synchronization packet according to the negotiated security mechanism.

24. A network system, comprising:

25. A clock server, comprising:

The clock message sending module is configured to send a clock synchronization message to the terminal by using the second path.

The clock server according to claim 25, further comprising: a first signaling module, configured to send, by using the first path, a control message to the terminal, where the control message includes any one of the following The message or a combination thereof, the advertisement message for selecting the source, the end-to-end delay negotiation request authorization, and the security mechanism negotiation request response.

The clock server according to claim 26, further comprising: a second signaling module, configured to send, by using the second path, a control message to the terminal, where the control information includes any one of the following The message or a combination thereof, a point-to-point delay negotiation request, an end-to-end delay negotiation request authorization, an announcement multicast message for selecting a source.

28. A terminal, comprising:

a second path establishing module, configured to acquire, by using the first path, information required for establishing a second path from the clock server, and establish, by the clock server, the second path; a clock message receiving module, Receiving, by using the second path, a clock synchronization message sent by the clock server.

The terminal according to claim 28, further comprising:

And a third signaling module, configured to send, by using the first path, a control message to the clock server, where the control information includes a security mechanism negotiation request.

The terminal according to claim 28, further comprising:

a fourth signaling module, configured to send, by using the second path, a control message to the clock server, where the control information includes any one of the following messages or a combination thereof, a point-to-point delay negotiation request, and an end-to-end delay negotiation request .

31. A method for implementing clock synchronization, comprising:

Transmitting, by the first path, information required to establish a second path, establishing, according to the information required to establish the second path, the second path between the clock server and the terminal; The second path transmits clock packets.

The method according to claim 31, wherein the establishing a first path between the clock server and the terminal comprises: The clock server establishes the first path by using a home gateway and the terminal; or the terminal establishes a first path by using a home gateway and the clock server.

The method according to any one of claims 31 to 32, wherein the information required to establish the second path by the first path is transmitted according to the information required to establish the second path, Establishing the second path between the clock server and the terminal, the method includes: receiving, by the clock server, the unicast request of the advertisement message sent by the terminal by using the first path,

The clock server returns an advertised message unicast request authorization to the terminal by using the first path, so that the terminal establishes the second path according to the unicast request authorization information carried by the terminal; or

Sending, by the terminal, a notification message unicast request to the clock server by using the first path,

The method according to claim 31, wherein before the establishing the second path between the clock server and the terminal, the method further includes:

And the security mechanism used by the second path to send a clock message is negotiated between the clock server and the terminal by using the first path.

The method according to claim 31, wherein the method further comprises: transmitting control information by using the first path, where the control information includes any one of the following messages or a combination thereof, and is used for selecting a source. Announcement message, end-to-end delay negotiation request authorization;

Or, transmitting, by using the second path, a point-to-point delay negotiation request and a point-to-point delay negotiation request authorization, where the point-to-point delay negotiation request is used to indicate a delay mechanism used when the second path transmits a clock message;

Or transmitting an end-to-end delay negotiation request by using the first path, and transmitting an end-to-end delay negotiation request authorization by using the second path, where the end-to-end delay negotiation request authorization indicates that the second path transmits a clock message The delay mechanism used when.

36. The method according to any one of claims 31 to 35, characterized in that The second path transmission clock message includes:

The second path transmits a clock synchronization message in a unicast manner; or the second path transmits a clock synchronization message in a multicast manner.