WO2011026341A1 - 一种移动ip业务的接入方法和系统 - Google Patents

一种移动ip业务的接入方法和系统 Download PDF

Info

Publication number
WO2011026341A1
WO2011026341A1 PCT/CN2010/072593 CN2010072593W WO2011026341A1 WO 2011026341 A1 WO2011026341 A1 WO 2011026341A1 CN 2010072593 W CN2010072593 W CN 2010072593W WO 2011026341 A1 WO2011026341 A1 WO 2011026341A1
Authority
WO
WIPO (PCT)
Prior art keywords
ipsec
pdsn
parameter
negotiated
aaa
Prior art date
Application number
PCT/CN2010/072593
Other languages
English (en)
French (fr)
Inventor
钮远
金仁康
井惟栋
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to EP10813263.0A priority Critical patent/EP2445146A4/en
Publication of WO2011026341A1 publication Critical patent/WO2011026341A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/16—Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0272—Virtual private networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0892—Network architectures or network communication protocols for network security for authentication of entities by using authentication-authorization-accounting [AAA] servers or protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H04L63/205—Network architectures or network communication protocols for network security for managing network security; network security policies in general involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/061—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key exchange, e.g. in peer-to-peer networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/164—Implementing security features at a particular protocol layer at the network layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W80/00—Wireless network protocols or protocol adaptations to wireless operation
    • H04W80/04—Network layer protocols, e.g. mobile IP [Internet Protocol]

Definitions

  • the present invention relates to the field of communications, and in particular, to a method and system for accessing a Mobile Internet Protocol (IP) service in a CDMA2000 system.
  • IP Mobile Internet Protocol
  • Mobile IP services provide users with a wider range of uninterrupted services than simple IP services. They are widely used in CDMA2000, World Interoperability for Microwave Access (Wimax) and next-generation evolution networks.
  • the main network elements of the mobile IP service on the core network side include a Foreign Agent (FA), a Home Agent (HA), and an Authentication Authorization Accounting (AAA).
  • FA Foreign Agent
  • HA Home Agent
  • AAA Authentication Authorization Accounting
  • Mobile IP accesses the network through the FA and HA, and performs signaling and data service interaction with the network through the FA and the HA to ensure the security of the mobile IP service by ensuring the security of signaling and data services between the FA and the HA.
  • the security of signaling and data services between FA and HA is usually guaranteed by two methods:
  • the first method is to use
  • the authentication extension between the FA and the HA is to configure the HA list and related parameters on the FA, and configure the FA list and related parameters on the HA.
  • the disadvantage of this method is that the list and related parameters need to be manually configured.
  • the operation and maintenance work is not convenient enough.
  • each time the FA is configured it is necessary to understand the configuration of all interworking HAs in the world and add a new FA configuration on the global HA, and the actual operability is poor.
  • the second method uses an Internet Protocol Security (IPSec) tunnel, that is, a pre-shared key required for the Internet Key Exchange (IPSec IKE) negotiation by the AAA.
  • IPSec IKE Internet Key Exchange
  • PDSN Packet Data Service Node
  • the FA can be replaced with a PDSN.
  • the existing mobile IP access method using the IPSec tunnel includes the following steps, as shown in FIG. 1: Step 101: Packet Control Function (Packet Control Function, PCF) establishes an air interface link with the FA or the PDSN; Step 102: The access terminal negotiates PPP with the FA or the PDSN, and the FA or PDSN sends a proxy broadcast to the access terminal. Step 103: The access terminal acquires the mobile IP through the proxy broadcast Information: Step 104: The access terminal initiates a mobile IP registration to the FA or the PDSN.
  • Packet Control Function Packet Control Function
  • Steps 105 to 108 the FA or the PDSN interacts with the AAA, and obtains the authentication information, including the pre-shared password and the Key1D, and delivers the HA address to the FA or the PDSN.
  • the FA or the PDSN reads the other negotiated IPSec parameters of the local configuration, performs the ISAKMP SA negotiation with the HA according to the authentication information sent by the FA, and carries the proposed ISAKMP SA information, the key material, and the Key1D.
  • Step 110 the HA is restored according to the Key1D.
  • the FA address is obtained, and the S Key for generating the IPSec pre-shared key is obtained from the AAA and saved locally;
  • Step 111 112 HA reads the current Pre-configured other negotiated IPSec parameters, negotiate with the FA or PDSN to establish an ISAKMP SA;
  • Step 113 PDSN/FA, HA negotiates to establish an IPSec SA;
  • step 118 the FA notifies the AAA of the charging start.
  • step 119 the mobile IP access is completed, the access terminal starts the data service, and the data between the FA and the HA is carried by the IPSec tunnel.
  • the existing mobile IP access method of the IPSec tunnel has the following problems: 1.
  • the second problem is that the 3gpp2 protocol imposes several constraints on IKE negotiation.
  • ISAKMP Internet Security Association and Key Management Protocol, Internet Security Protocol and Key Management Protocol
  • the main version and the minor version, selectors, etc. unified the standard, but the scalability is not good.
  • the mainstream IKE already has VI.0 and V2.0 versions, and 3gpp2 still stays at version 0.
  • Different systems and different versions have problems in actual docking.
  • the present invention provides a method and system for accessing a mobile IP service, which can improve the availability of the system and meet the requirements of the operator's diverse security policies.
  • a mobile IP access method including: in the process of establishing a Internet Protocol security tunnel, that is, an IPSec tunnel, in a process in which a foreign agent FA or a packet data serving node PDSN negotiates with a home agent HA, an authentication authorization meter
  • the fee server AAA sends the negotiation IPSec parameter or the attribute identifier profile1D corresponding to the IPSec parameter to the FA or the PDSN.
  • the method further includes: in the process of the foreign agent FA or the packet data service node PDSN collaborating with the home agent HA to establish an Internet protocol security tunnel, that is, an IPSec tunnel, the AAA sends an IPSec parameter or negotiates an attribute identifier profile1D corresponding to the IPSec parameter.
  • an Internet protocol security tunnel that is, an IPSec tunnel
  • the AAA sends an IPSec parameter or negotiates an attribute identifier profile1D corresponding to the IPSec parameter.
  • the process in which the FA or the PDSN negotiates with the HA to establish the IPSec tunnel includes:
  • the FA or PDSN sends an authentication request to the AAA.
  • the FA or the PDSN sends a negotiation request according to the authentication response sent by the AAA.
  • the HA To the HA;
  • the HA receives the negotiation request, and obtains the negotiated IPSec parameter or the profile1D corresponding to the IPSec parameter from the local or the AAA, and the FA or the PDSN negotiates with the HA to establish an IPSec tunnel.
  • the authentication response further includes a pre-shared key and the identity information.
  • the negotiation request is a negotiation request established by the FA or the PDSN according to the negotiated IPSec parameter, and the negotiation request established by the ISAKMP SA is established. And carrying the proposed ISAKMP SA information, the key material, and the identity information.
  • the HA after receiving the negotiation request, the HA obtains the negotiated IPSec parameter from the local or the AAA, where the FA Or the step of the PDSN collaborating with the HA to establish an IPSec tunnel includes: after receiving the negotiation request established by the ISAKMP SA, the HA restores the address of the FA or the PDSN according to the identity information therein, and obtains the address locally.
  • the HA generates a pre-shared key of the IPSec according to the identity information and the S Key;
  • the HA interacts with the FA or PDSN to establish an IPSec tunnel between the FA or PDSN and the HA.
  • the authentication response further includes a pre-shared key and identity information.
  • the step A3 further includes: the FA or the PDSN acquiring the negotiated IPSec parameter locally according to the profile1D corresponding to the negotiated IPSec parameter;
  • the negotiation request is a negotiation request established by the FA or the PDSN according to the locally obtained negotiated IPSec parameter, and the negotiation request established by the ISAKMP SA carries the ISAKMP SA information and the secret established by the proposal.
  • step A4 after receiving the negotiation request, the HA obtains profilelD corresponding to the negotiation IPSec parameter from the local or the AAA, the FA or the PDSN and the HA
  • the steps for negotiating an IPSec tunnel include: After receiving the negotiation request established by the ISAKMP SA, the HA restores the address of the FA or the PDSN according to the identity information, and obtains the S Key and the profilelD corresponding to the negotiated IPSec parameter locally, or The AAA obtains the profile 1D corresponding to the S key and the negotiated IPSec parameter; the HA generates a pre-shared key of the IPSec according to the identity information and the S Key; the HA interacts with the FA or the PDSN, thereby establishing the An IPSec tunnel between the FA or PDSN and the HA.
  • the profile1D corresponding to the negotiated IPSec parameter or the negotiated IPSec parameter is the negotiated IPSec parameter corresponding to the security level of the access terminal or the profile1D corresponding to the negotiated IPSec parameter.
  • the security level of the access terminal is preset by an operator or a user.
  • the present invention also provides an authentication and authorization charging server supporting mobile IP access, and the authentication and authorization charging server is configured to negotiate to establish an IPSec tunnel between the foreign agent FA or the packet data serving node PDSN and the home agent HA.
  • the IPSec parameter is negotiated or the attribute identifier profile1D corresponding to the IPSec parameter is negotiated to the FA or the PDSN.
  • the authentication and authorization accounting server is further configured to: in the process of negotiating establishing an IPSec tunnel between the FA or the PDSN and the HA, sending the negotiation IPSec parameter or the negotiation IPSec parameter profilelD to the HA.
  • the authentication and authorization accounting server is configured to: after selecting the corresponding IPSec parameter or the profile1D corresponding to the IPSec parameter, the profile ID corresponding to the negotiation IPSec parameter or the negotiation IPSec parameter is selected according to the security level of the access terminal. .
  • the present invention also provides a foreign agent FA or a packet data serving node PDSN supporting mobile IP access, wherein: the FA or PDSN is set to negotiate with the home HA to establish an IPSec tunnel, from the AAA Obtaining the negotiation IPSec parameter; or obtaining the profile1D corresponding to the negotiation IPSec parameter from the AAA, and obtaining the negotiated IPSec parameter according to the profile1D.
  • the present invention also provides a home agent HA supporting mobile IP access, wherein the HA is set to: in the process of negotiating establishing an IPSec tunnel with the foreign agent FA or the packet data serving node PDSN, from the authentication authorization meter
  • the fee server AAA obtains the attribute identifier profileID corresponding to the negotiation IPSec parameter or the negotiation IPSec parameter.
  • the present invention also provides a mobile IP access system, comprising: a foreign agent FA or a packet data serving node PDSN, and an authentication authorization charging server AAA, wherein the AAA is set to be a foreign agent FA or a packet data serving node
  • the negotiation of the IPSec parameter or the negotiation of the attribute identifier profile1D corresponding to the IPSec parameter to the FA or the PDSN is performed; the FA or the PDSN is set to In the process of establishing an IPSec tunnel with the HA, the negotiation IPSec parameter is obtained from the AAA; or the profile1D corresponding to the negotiation IPSec parameter is obtained from the AAA, and the negotiated IPSec parameter is obtained according to the profile1D.
  • the system further includes a home agent HA, and the AAA is further configured to: during the process of establishing an IPSec tunnel between the FA or the PDSN and the HA, sending an negotiation IPSec parameter or negotiating an IPSec parameter Corresponding attribute identifier profile1D to the HA; the HA is configured to obtain the negotiated IPSec parameter or the negotiated IPSec parameter from the AAA in the process of negotiating establishing an IPSec tunnel with the FA or the PDSN. Corresponding profilelD.
  • the AAA is configured to: send the negotiated IPSec parameter or the profile1D corresponding to the negotiated IPSec parameter after selecting the corresponding negotiated IPSec parameter or the profile1D corresponding to the IPSec parameter according to the security level of the access terminal.
  • the present invention has the beneficial effects that the present invention selects and delivers the negotiated IPSec parameters or negotiates the profile1D corresponding to the IPSec parameters to the FA and the HA, or the PDSN and the HA, thereby avoiding manual configuration on the network element.
  • Negotiating the IPSec parameters simplifies the system configuration and improves the system availability.
  • the negotiation parameters of the FA and the HA, or the PDSN and the HA are uniformly delivered, and the protocol versions are the same, which avoids the difficulty of connecting due to different versions.
  • the security level of the access terminal is also set by the operator in advance, and the access terminals of different security levels correspond to different authentication responses, and different authentication responses correspond to different levels of security policies, which satisfy the security policy of the operator. The needs of the sample.
  • FIG. 1 exemplarily depicts a prior art CDMA2000 system mobile IP access procedure
  • FIG. 2 exemplarily depicts a CDMA2000 system mobile IP access procedure of the present invention
  • FIG. 3 exemplarily depicts the CDMA2000 of the present invention
  • FIG. 4 exemplarily depicts a system structure diagram of the present invention.
  • the mobile IP access system of the CDMA2000 system of this example includes the following processing steps: Step 201, PCF (Packet Control Function, Packet Control Function Subsystem) Establishing an air interface link with the FA; Step 202: The access terminal negotiates a PPP (Point to Point Protocol) with the FA, and the FA sending proxy broadcasts to the access terminal. Step 203: The access terminal acquires the mobile by proxy broadcast IP related information; Step 204: The access terminal initiates a mobile IP registration to the FA; Step 205: The FA sends an authentication request to the FAAA, and requests a pre-shared password;
  • PCF Packet Control Function, Packet Control Function Subsystem
  • the AAA includes the HAAA (Home Authentication Authorization Accounting) and the FAAA (Foreign Authentication Authorization Accounting), where the HAAA is used to select and deliver the negotiated IPSec parameters.
  • FAAA is used to relay authentication requests and responses between FA and HAAA.
  • Step 206 The FAAA forwards the authentication request to the HAAA.
  • Step 207 The HAAA selects and sends a different authentication response to the FAAA according to the security level of the access terminal, where the authentication response includes the negotiation IPSec parameter, the pre-shared key, the identity information, and the like;
  • the security level of the terminal is preset by the user or the operator.
  • the access terminals of different security levels can respond to different authentication responses. Different authentication responses correspond to different levels of security policies.
  • IPSec parameters include IKE version number, IKE negotiation identity type, IKE negotiation exchange type, IPSec mode, encryption algorithm, authentication algorithm, IPSec tunnel address, selector, ISAKMP SA lifetime, DH exchange group, key The length and parameters of the IPSec protocol are subsequently introduced. Step 208, FAAA forwards the authentication response to the FA;
  • the AAA sends the negotiation IPSec parameters to the FA, which avoids manually configuring various parameters on the FA, simplifies the system configuration, and improves the system availability.
  • Step 209 The FA sends the negotiation request established by the ISAKMP SA to the HA according to the negotiated IPSec parameter sent by the AAA, and the ISAKMP SA establishes the negotiation request to establish the ISAKMP SA information, the key material, and the identity information.
  • Step 210 After receiving the negotiation request established by the ISAKMP SA, the FA address is restored according to the identity information, and the S Key and the negotiated IPSec request are sent to the AAA, and the AAA issues the S Key and the negotiated IPSec parameter to the HA, and the HA according to the identity information and The S key generates a pre-shared key of the IPSec, and saves the information locally. If the S Key and the negotiated IPSec parameter are saved locally, the locally saved information is directly read, and step 210 is skipped.
  • Pre-shared passwords on HA and FA to encrypt data and signaling transmitted within the IPSec tunnel.
  • the AAA sends the negotiation IPSec parameters to the HA to avoid manually configuring various parameters on the HA, which simplifies the system configuration and improves the system availability.
  • the negotiated IPSec parameters are uniformly configured in the AAA and then delivered to the FA and the HA.
  • the negotiated IPsec parameters are consistent with the HA and FA versions and are consistent with the support capabilities of the FA and HA, improving the system's extended performance.
  • Step 213 After the ISAKMP SA is established, the FA establishes an IPSec SA with the HA.
  • an IPSec tunnel is established between the FA and the HA.
  • the access terminal completes the mobile IP registration, and the signaling between the FA and the HA is carried by the IPSec tunnel.
  • the FA notifies the AAA charging start;
  • Step 219 the mobile IP access is completed, and the access terminal starts the data service.
  • the data between the FA and the HA is carried by the IPSec tunnel.
  • the existing technology has a single security policy and cannot meet the requirements of the operator's customized security policy.
  • the operator may propose a number of customized requirements when constructing a mobile IP network, such as distinguishing the account from the implementation of IPSec between the HA and the HA, and distinguishing the operations.
  • the internal network and other carrier networks implement different IPSec policies, etc.
  • the current architecture cannot meet the needs of operators.
  • the security level of the access terminal is preset by the operator, and the access terminals of different security levels correspond to different authentication responses, and different authentication responses correspond to different levels of security policies, satisfying the diversified requirements of the operator security policy.
  • the IPSec parameters are negotiated and delivered to the FA and the HA. This prevents the IPSec parameters from being manually configured on the NEs. This simplifies the system configuration and improves the system availability.
  • the negotiation parameters are unified on the FA and HA.
  • the protocol version is the same, which avoids the connection difficulties caused by different versions.
  • different negotiation security IPSec parameters are provided for different security levels, that is, different security policies are provided to meet the diversified security policy requirements of operators.
  • Embodiment 2 As shown in FIG. 3, in the second embodiment of the mobile IP access method of the CDMA2000 system of the present invention, the diversified security policy includes the following steps: Step 301: The access terminal accesses the CDMA2000 system, and the PCF establishes with the FA. An air interface link; the access terminal negotiates a PPP with the FA, and the FA sends a proxy broadcast to the access terminal; the access terminal acquires mobile IP related information through a proxy broadcast; the access terminal initiates a mobile IP registration; The AAA sends an authentication request and requests a pre-shared password.
  • Step 302 The AAA provides different negotiation IPSec parameters according to the security level of the access terminal, that is, provides different levels of security policies and delivers them to the FA.
  • the security policy is implemented in different negotiation IPSec.
  • the negotiated IPSec parameter has the address of both ends of the IPSec tunnel
  • the high-level security policy provides the special HA address and other negotiated IPSec parameters of the confidential level
  • the low-level security policy selects the HA address according to a general algorithm, such as a round robin algorithm. Only negotiate other IPSec parameters for the authentication service.
  • Step 303 The FA and the HA establish an IPSec tunnel with different security levels according to different negotiated IPSec parameters.
  • Step 304: The signaling and data of the access terminal are transmitted by the IPSec tunnel between the FA and the HA. High-security access terminals and low-security access terminals transmit signaling and data on IPSec tunnels of different security levels to meet different security levels.
  • Embodiment 3 In this embodiment, to reduce the information between the FA/PDSN and the AAA, and the interaction between the HA and the PDSN, the AAA only issues the attribute identifier ( rofilelD ) corresponding to the negotiated IPSec parameter, and the FA/PDSN and the HA are negotiated.
  • the profile1D corresponding to the IPSec parameter obtains the negotiated IPSec parameter, and the corresponding relationship between the profilelD and the negotiated IPSec parameter is saved locally in the FA/PDSN, and the difference between the first embodiment and the first embodiment is that the 207 to the step 210 have another implementation method.
  • Step 207a The HAAA selects and sends an authentication response to the FAAA according to the security level of the access terminal.
  • the authentication response includes profilelD, pre-shared key, identity information, and the like corresponding to the negotiation IPSec parameter.
  • Step 208a FAAA forwards the authentication response to FA;
  • Step 209a the FA obtains the negotiated IPSec parameter locally according to the profile1D corresponding to the negotiated IPSec parameter, and the FA sends the negotiation request established by the ISAKMP SA to the HA according to the negotiated IPSec parameter information, and the negotiation request established by the ISAKMP SA carries the proposal to be established.
  • Step 210a After receiving the negotiation request established by the ISAKMP SA, the HA restores the FA address according to the identity information, and sends the S Key and the profiledD corresponding to the IPSec to obtain the request to the AAA, and the AAA sends the S Key and the profile1D that negotiates the IPSec parameter.
  • HA generates an IPSec pre-shared key based on the identity information and the S Key, and saves the information (including the S Key and the negotiated IPSec parameters) locally; during subsequent access, the saved information can be used. If the SKey and the profile1D corresponding to the negotiation IPSec parameter are saved locally, the locally saved information is directly read, and step 210a is skipped.
  • the AAA delivers profilelD to FA and HA.
  • the FA and HA obtain the negotiated IPSec parameters locally based on rofilelD, which avoids manually configuring parameters on the FA and HA, and also saves traffic between HA and FA.
  • Embodiment 4 As shown in FIG. 4, an embodiment of a mobile IP access system of a CDMA2000 system of the present invention includes a home agent, a foreign agent, and an authentication and authorization accounting server, which are used to negotiate to establish bearer signaling and The IPSec tunnel of the data, in the process of establishing an IPSec tunnel between the home agent and the foreign agent, the authentication and authorization charging server selects and delivers the negotiated IPSec parameter or negotiates the profile1D corresponding to the IPSec parameter to the foreign agent and the home agent.
  • the present invention provides an authentication authorization charging server supporting mobile IP access, and the authentication authorization charging server is configured to negotiate to establish an IPSec tunnel between a foreign agent FA or a packet data serving node PDSN and a home agent HA.
  • the IPSec parameter is negotiated or the attribute identifier profile1D corresponding to the IPSec parameter is negotiated to the FA or the PDSN.
  • the authentication and authorization accounting server is further configured to: in the process of negotiating establishing an IPSec tunnel between the FA or the PDSN and the HA, sending the negotiation IPSec parameter or the negotiation IPSec parameter The attribute identifies profilelD to the HA.
  • the authentication and authorization accounting server is configured to: deliver the corresponding negotiation IPSec parameter or the profilelD corresponding to the IPSec parameter according to the security level of the access terminal, and then deliver the association The IPSec parameter or the profileID corresponding to the IPSec parameter.
  • the present invention also provides a foreign agent FA or a packet data serving node PDSN supporting mobile IP access, wherein: the FA or PDSN is set to negotiate with the home HA to establish an IPSec tunnel, from the AAA Obtaining the negotiation IPSec parameter; or obtaining the profile1D corresponding to the negotiation IPSec parameter from the AAA, and obtaining the negotiated IPSec parameter according to the profile1D.
  • the present invention also provides a home agent HA supporting mobile IP access, wherein the HA is set to: in the process of negotiating establishing an IPSec tunnel with the foreign agent FA or the packet data serving node PDSN, from the authentication authorization meter
  • the fee server AAA obtains the attribute identifier profileID corresponding to the negotiation IPSec parameter or the negotiation IPSec parameter.
  • the present invention also provides a mobile IP access system including the above-mentioned foreign agent FA or packet data serving node PDSN, authentication and authorization charging server AAA, and home agent HA.
  • the invention is not limited to CDMA2000 systems.
  • the PDSN Packet Data Service Node
  • the FA can be replaced with the PDSN.
  • the present invention selects and delivers the negotiated IPSec parameters or the profile1D corresponding to the IPSec parameters to the FA and the HA, or the PDSN and the HA, thereby avoiding the manual configuration of the negotiated IPSec parameters on the network element, which simplifies the system configuration and improves the system configuration.
  • the availability of the system at the same time, because the negotiation parameters of the FA and the HA, or the PDSN and the HA are uniformly delivered, the protocol versions are the same, which avoids the difficulty of docking caused by different versions.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明提供了一种移动IP接入方法，包括，在外地代理FA或分组数据服务节点PDSN与家乡代理HA协商建立Internet协议安全隧道即IPSec隧道的过程中，鉴权授权计费服务器AAA下发协商IPSec参数或协商IPSec参数所对应的属性标识profile ID至所述FA或所述PDSN。本发明还提供一种移动IP接入系统。

Description

一种移动 IP业务的接入方法和系统
技术领域 本发明涉及通信领域， 尤其涉及 CDMA2000 系统中移动网络互连协议 ( Internet Protocol, IP ) 业务接入时方法和系统。
背景技术
移动 IP业务相较简单 IP业务为用户提供了更大范围的不间断业务， 在 CDMA2000 , 全球微波接入互通技术（World Interoperability for Microwave Access , Wimax ) 以及下一代演进网络中都得到了广泛的应用。 移动 IP业务在核心网侧主要网元包括外地代理（ Foreign Agent , FA ) 、 归属代理 （Home Agent , HA ) 和鉴权授权计费服务器 （Authentication Authorization Accounting, AAA ) 。 移动 IP通过 FA和 HA接入网络， 并通 过 FA和 HA与网络进行信令和数据业务的交互， 保证移动 IP业务的安全性 通过保证 FA和 HA之间信令和数据业务的安全性来实现。 在第三代合作伙伴计划 2 (3rd Generation Partnership Project 2 , 3gpp2)协 议中， FA与 HA之间的信令和数据业务的安全性通常釆用两种方法来保证： 第一种方法是釆用 FA与 HA之间的认证扩展，即在 FA上配置 HA列表 及相关参数， 在 HA上配置 FA列表及相关参数。 此方法的缺点是列表及相 关参数需要手工配置， 对于复杂的组网环境， 操作维护工作不够方便。 特别 是移动 IP业务国际漫游的场景， 每次配置 FA时需要了解全球所有互通 HA 的配置并且在全球的 HA上增加新增 FA的配置， 实际可操作性较差。 第二种方法釆用 Internet协议安全 ( Internet Protocol Security, IPSec )隧 道， 即由 AAA下发因特网密钥交换协议（ Internet Key Exchange, IPSec IKE ) 协商需要的预共享密钥。 在某些 CDMA2000 系统中， 分组数据服务节点 （Packet Data Service Node, PDSN)在移动 IP用户接入时具有 FA同样的功能， 在第二种方法中， FA可以用 PDSN替换。
和第一种方法相比， 第二种釆用 IPSec隧道的安全性更高， 现有的釆用 IPSec隧道的移动 IP接入方法包括以下步骤， 如图 1所示： 步骤 101、分组控制功能（ Packet Control Function, PCF )与 FA或 PDSN 建立空口链路； 步骤 102、 访问终端与 FA或 PDSN协商 PPP , FA或 PDSN发送代理 广播至访问终端； 步骤 103、 访问终端通过代理广播获取移动 IP相关信息； 步骤 104、 访问终端向 FA或 PDSN发起移动 IP注册； 步骤 105至 108, FA或 PDSN与 AAA交互， 获取认证信息， 包括预共 享密码和 KeylD , 同时下发 HA地址给 FA或 PDSN; 步骤 109 , FA或 PDSN读取本地配置的其他协商 IPSec参数， 根据 FA 下发的认证信息， 向 HA进行 ISAKMP SA协商， 携带提议的 ISAKMP SA 信息、 密匙材料以及 KeylD; 步骤 110, HA根据 KeylD还原出 FA地址， 向 AAA获取生成 IPSec预 共享密钥的 S Key并保存在本地； 步骤 111 112, HA读取本地预先配置的其他协商 IPSec参数， 与 FA或 PDSN协商建立 ISAKMP SA; 步骤 113 , PDSN/FA, HA协商建立 IPSec SA; 步骤 114~117 , 完成 MIP注册， PDSN/FA与 HA之间信令由 IPSec隧道 承载；
步骤 118, FA通知 AAA计费开始； 步骤 119, 移动 IP接入完成， 访问终端开始数据业务， FA与 HA之间 数据由 IPSec隧道承载。 现有的釆用 IPSec隧道的移动 IP接入方法有以下问题： 问题一， IKE协商两端的 IPSec安全关联， 除了预共享密钥还需要配置 若干协商参数， 如 FA与 HA之间 IPSec的传输模式、 隧道模式下隧道两端 的地址、安全类型、具体的加密认证算法等， 这些参数仍需要手工配置在 FA 和 HA上， 可操作性较差； 问题二， 3gpp2协议对 IKE协商作了若干约束， 如 ISAKMP ( Internet Security Association and Key Management Protocol, 因特网安全协定和密钥管 理协议） 的主版本和副版本、 选择符等， 统一了标准， 但是扩展性不好。 如 目前主流 IKE已经有 VI .0和 V2.0的版本， 而 3gpp2还是停留在 0版本， 不 同的系统、 不同的版本在实际对接存在问题。
发明内容 本发明提供了一种移动 IP业务的接入方法及系统，可以提高系统的可用 性， 同时满足运营商多样化安全策略需求。 为解决上述问题， 本发明提供了一种移动 IP接入方法， 包括， 在外地代 理 FA或分组数据服务节点 PDSN与家乡代理 HA协商建立 Internet协议安全 隧道即 IPSec隧道的过程中，鉴权授权计费服务器 AAA下发协商 IPSec参数 或协商 IPSec参数所对应的属性标识 profilelD至所述 FA或所述 PDSN。 上述方法还包括， 在外地代理 FA或分组数据服务节点 PDSN与家乡代 理 HA协商建立 Internet协议安全隧道即 IPSec隧道的过程中 , 所述 AAA下 发协商 IPSec参数或协商 IPSec参数所对应的属性标识 profilelD至所述 HA。 其中， 所述 FA或 PDSN与所述 HA协商建立所述 IPSec隧道的过程包 含：
A1、 所述 FA或 PDSN向所述 AAA发送认证请求；
含所述协商 IPSec参数或所述协商 IPSec参数所对应的 profilelD;
A3、 所述 FA或 PDSN根据所述 AAA下发的认证应答， 发送协商请求 至所述 HA;
A4、 所述 HA接收所述协商请求， 从本地或者从所述 AAA获取所述协 商 IPSec参数或协商 IPSec参数所对应的 profilelD,所述 FA或所述 PDSN与 所述 HA协商建立 IPSec隧道。 其中， 所述认证应答中还包括预共享密匙和身份信息； 所述协商请求为所述 FA 或 PDSN根据所述协商 IPSec 参数发起的 ISAKMP SA建立的协商请求，所述 ISAKMP SA建立的协商请求中携带提议 建立的 ISAKMP SA信息、 密钥材料以及身份信息； 所述步骤 A4中， 所述 HA收到所述协商请求后， 从本地或从所述 AAA 获取所述协商 IPSec参数， 所述 FA或所述 PDSN与所述 HA协商建立 IPSec 隧道的步骤包括： 所述 HA收到所述 ISAKMP SA建立的协商请求后， 根据其中的所述身 份信息还原所述 FA或 PDSN的地址， 从本地获取 S Key和所述协商 IPSec 参数， 或者， 从所述 AAA获取所述 S Key和所述协商 IPSec参数； 所述 HA根据所述身份信息以及所述 S Key, 生成 IPSec的预共享密匙； 所述 HA与所述 FA或 PDSN交互， 从而建立所述 FA或 PDSN与所述 HA之间的 IPSec隧道。 其中， 所述认证应答中还包括预共享密匙和身份信息； 所述步骤 A3中还包括，所述 FA或 PDSN根据所述协商 IPSec参数所对 应 profilelD在本地获取所述协商 IPSec参数； 所述步骤 A3中： 所述协商请求为所述 FA或 PDSN根据所述本地获取 的协商 IPSec参数发起的 ISAKMP SA建立的协商请求，所述 ISAKMP SA建 立的协商请求中携带提议建立的 ISAKMP SA信息、密钥材料以及身份信息； 所述步骤 A4中 ,所述 HA收到所述协商请求后 ,从本地或者从所述 AAA 获取协商 IPSec参数所对应的 profilelD, 所述 FA或所述 PDSN与所述 HA 协商建立 IPSec隧道的步骤包括： 所述 HA收到所述 ISAKMP SA建立的协商请求后， 根据其中的所述身 份信息还原所述 FA或 PDSN的地址， 从本地获取 S Key和所述协商 IPSec 参数对应的 profilelD,或者，从所述 AAA获取所述 S Key和协商 IPSec参数 对应的 profilelD; 所述 HA根据所述身份信息以及 S Key, 生成 IPSec的预共享密匙； 所述 HA与所述 FA或 PDSN交互， 从而建立所述 FA或 PDSN与所述 HA之间的 IPSec隧道。 其中， 所述协商 IPSec参数或协商 IPSec参数所对应的 profilelD是与访 问终端的安全等级对应的协商 IPSec 参数或协商 IPSec 参数所对应的 profilelD。 其中， 所述访问终端的安全等级由运营商或用户预先设定。
本发明还提供一种支持移动 IP接入的鉴权授权计费服务器，所述鉴权授 权计费服务器设置为， 在外地代理 FA或分组数据服务节点 PDSN和家乡代 理 HA之间协商建立 IPSec隧道的过程中， 下发协商 IPSec参数或协商 IPSec 参数所对应的属性标识 profilelD至所述 FA或者所述 PDSN。 其中， 所述鉴权授权计费服务器还设置为， 在所述 FA或所述 PDSN和 所述 HA之间协商建立 IPSec隧道的过程中， 下发所述协商 IPSec参数或协 商 IPSec参数所对应的 profilelD至所述 HA。 其中， 所述鉴权授权计费服务器是设置为： 根据访问终端的安全等级选 择对应的协商 IPSec参数或协商 IPSec参数所对应的 profilelD后下发所述协 商 IPSec参数或协商 IPSec参数所对应的 profileID。 本发明还提供一种支持移动 IP接入的外地代理 FA或分组数据服务节点 PDSN, 其中： 所述 FA或 PDSN设置为， 在和家乡 HA之间协商建立 IPSec隧道的过 程中，从所述 AAA获取协商 IPSec参数； 或者，从所述 AAA获取协商 IPSec 参数所对应的 profilelD, 根据所述 profilelD得到协商 IPSec参数。 本发明还提供一种支持移动 IP接入的家乡代理 HA, 其中， 所述 HA设置为： 在和外地代理 FA或分组数据服务节点 PDSN之间协 商建立 IPSec隧道的过程中，从鉴权授权计费服务器 AAA获取协商 IPSec参 数或协商 IPSec参数所对应的属性标识 profileID。 本发明还提供一种移动 IP接入系统， 包括： 外地代理 FA或分组数据服 务节点 PDSN、 以及鉴权授权计费服务器 AAA, 其中， 所述 AAA设置为，在外地代理 FA或分组数据服务节点 PDSN和家乡代 理 HA之间协商建立 IPSec隧道的过程中， 下发所述协商 IPSec参数或协商 IPSec参数所对应的属性标识 profilelD至所述 FA或者所述 PDSN; 所述 FA或 PDSN设置为， 在和所述 HA之间协商建立 IPSec隧道的过 程中，从所述 AAA获取协商 IPSec参数； 或者，从所述 AAA获取协商 IPSec 参数所对应的 profilelD, 根据所述 profilelD得到协商 IPSec参数。 其中， 所述系统还包括家乡代理 HA, 所述 AAA还设置为， 在所述 FA 或所述 PDSN和所述 HA之间协商建立 IPSec隧道的过程中，下发协商 IPSec 参数或协商 IPSec参数所对应的属性标识 profilelD至所述 HA; 所述 HA设置为， 在和所述 FA或所述 PDSN之间协商建立 IPSec隧道 的过程中，从所述 AAA获取所述协商 IPSec参数或协商 IPSec参数所对应的 profilelD。 其中， 所述 AAA是设置为： 根据访问终端的安全等级选择对应的协商 IPSec参数或协商 IPSec参数所对应的 profilelD后下发所述协商 IPSec参数或 协商 IPSec参数所对应的 profilelD。 与现有技术相比，本发明的有益效果在于：本发明选择并下发协商 IPSec 参数或协商 IPSec参数所对应的 profilelD至 FA和 HA, 或 PDSN和 HA, 避 免了在上述网元上手工配置协商 IPSec参数， 简化了系统配置， 提高了系统 的可用性， 同时， 由于 FA和 HA, 或 PDSN和 HA上的协商参数统一下发， 协议版本相同， 避免了不同版本造成的对接困难。 而且， 本发明还可由运营 商预先设定访问终端的安全级别， 不同安全级别的访问终端对应不同的认证 应答， 不同的认证应答对应不同级别的安全策略， 满足了运营商安全策略多 样化的需求。
附图概述 图 1示例性地描述了现有的 CDMA2000系统移动 IP接入流程； 图 2示例性地描述了本发明的 CDMA2000系统移动 IP接入流程； 图 3示例性地描述了本发明的 CDMA2000系统移动 IP接入方法多样化 安全策略的一种实施例； 图 4示例性地描述了本发明的系统结构图。
本发明的较佳实施方式
下面对照附图并结合具体实施方式对本发明进行进一步详细说明。 实施例一： 如图 2所示，本例的 CDMA2000系统移动 IP的接入系统，其 CDMA2000 系统移动 IP接入方法， 包括以下处理步骤： 步骤 201 , PCF ( Packet Control Function, 分组控制功能子系统）与 FA 建立空口链路； 步骤 202 , 访问终端与所述 FA协商 PPP ( Point to Point Protocol, 点对 点联机协议） ， FA发送代理广播至所述访问终端； 步骤 203 , 访问终端通过代理广播获取移动 IP相关信息； 步骤 204 , 访问终端向 FA发起移动 IP注册； 步骤 205 , FA向 FAAA发送认证请求， 同时请求预共享密码；
AAA包括 HAAA ( Home Authentication Authorization Accounting归属婆 权 4受权计费月良务器 )和 FAAA( Foreign Authentication Authorization Accounting 外地鉴权授权计费服务器） ， 其中， HAAA为用于选择和下发协商 IPSec参 数； FAAA用于中转 FA与 HAAA之间的认证请求和应答。 步骤 206, FAAA将认证请求转至 HAAA; 步骤 207 , HAAA根据访问终端的安全级别， 选择并下发不同的认证应 答至 FAAA, 认证应答包含协商 IPSec参数、 预共享密匙、 身份信息等； 访问终端的安全级别由用户或运营商预先设定， 不同安全级别的访问终 端可对应不同的认证应答， 不同的认证应答对应不同级别的安全策略。 协商 IPSec参数包括 IKE版本号、 IKE协商的身份类型、 IKE协商的交 换类型、 IPSec模式、 加密算法、 认证算法、 IPSec隧道两端地址、 选择符、 ISAKMP SA的生命期、 DH交换群、 密钥长度、 IPSec协议发展后续引入的 参数。 步骤 208, FAAA将认证应答转发至 FA;
AAA下发协商 IPSec参数等至 FA, 避免了在 FA上手工配置各种参数， 简化了系统配置， 提高了系统的可用性。 步骤 209, FA根据 AAA下发的协商 IPSec参数， 发送 ISAKMP SA建 立的协商请求至 HA , ISAKMP SA 建立的协商请求中携带提议建立的 ISAKMP SA信息、 密钥材料以及身份信息； 步骤 210, HA根据收到 ISAKMP SA建立的协商请求后， 根据其中的 身份信息还原 FA地址，并发送 S Key和协商 IPSec获取请求至 AAA, AAA 下发 S Key和所述协商 IPSec参数至 HA, HA根据身份信息以及 S Key生 成 IPSec的预共享密匙， 并将信息保存在本地； 若本地已保存 S Key和所述 协商 IPSec参数， 则直接读取本地保存的信息， 跳过步骤 210。
HA与 FA上的预共享密码，用来加密在 IPSec隧道内传输的数据和信令。
AAA下发协商 IPSec参数等至 HA,避免了在 HA上手工配置各种参数， 简化了系统配置， 提高了系统的可用性。 协商 IPSec参数在 AAA统一配置， 然后下发到 FA与 HA, 可以保证下发的协商 IPsec参数与 HA、 FA的版本一 致且与 FA、 HA的支持能力相符， 提高了系统的扩展性能。 步骤 211 , HA发送 ISAKMP SA协商请求响应至所述 FA; 步骤 212 , FA收到 ISAKMP SA协商请求响应后， 发送已接收响应至 所述 HA, ISAKMP SA建立； 步骤 213 , ISAKMP SA建立后 , FA与 HA建立 IPSec SA; IPSec SA 建立后 , FA与 HA之间建立 IPSec隧道。 步骤 214〜步骤 217 ,访问终端完成移动 IP注册， FA与 HA之间的信令 由 IPSec隧道承载； 步骤 218, FA通知 AAA计费开始； 步骤 219, 移动 IP接入完成， 访问终端开始数据业务， FA与 HA之间 数据由所述 IPSec隧道承载。 现有技术存在安全策略单一， 无法满足运营商订制安全策略的需求， 运 营商在建设移动 IP网络时可能会提出若干的订制要求， 如区分帐号实施 FA 与 HA之间的 IPSec、 区分运营商内部网络和其他运营商网络实施不同的 IPSec策略等， 目前的架构无法满足运营商的需求。 本发明中， 访问终端的安全级别由运营商预先设定， 不同安全级别的访 问终端对应不同的认证应答， 不同的认证应答对应不同级别的安全策略， 满 足了运营商安全策略多样化的需求。 本实施例选择并下发协商 IPSec参数至 FA和 HA,避免了在上述网元上 手工配置协商 IPSec参数， 简化了系统配置， 提高了系统的可用性； 同时， 由于 FA和 HA上的协商参数统一下发， 协议版本相同， 避免了不同版本造 成的对接困难； 另一方面， 对不同安全等级提供不同的协商 IPSec参数， 即 提供了不同的安全策略， 可以满足运营商多样化安全策略需求。
实施例二： 如图 3所示，本发明的 CDMA2000系统移动 IP接入方法的实施例二中， 多样化安全策略包含以下步骤： 步骤 301 , 访问终端接入 CDMA2000系统， PCF与所述 FA建立空口链 路； 访问终端与所述 FA协商 PPP, FA发送代理广播至访问终端； 访问终 端通过代理广播获取移动 IP相关信息； 访问终端发起移动 IP注册； FA向 AAA发送认证请求， 同时请求预共享密码； 步骤 302, AAA根据访问终端的安全级别，提供不同的协商 IPSec参数， 即提供不同等级的安全策略， 下发至 FA; 安全策略体现在不同的协商 IPSec参数中， 例如， 协商 IPSec参数中有 IPSec隧道两端地址， 高级别安全策略提供特殊 HA地址以及机密级别的其 他协商 IPSec参数， 低级别安全策略则按通用算法， 如轮循算法选择 HA地 址以及仅提供认证服务的其他协商 IPSec参数。 步骤 303 , FA与 HA按照不同的协商 IPSec参数， 建立不同安全级别的 IPSec隧道； 步骤 304 , 访问终端的信令和数据在 FA与 HA之间的 IPSec隧道传输。 高安全级别的访问终端和低安全级别的访问终端， 在不同安全级别的 IPSec隧道上传输信令和数据， 达到不同安全级别的保障。
实施例三： 本实施例中， 为减少 FA/PDSN与 AAA, 以及 HA和 PDSN之间交互的 信息， AAA只下发协商 IPSec参数所对应的属性标识（ rofilelD ) , FA/PDSN, HA根据协商 IPSec参数所对应的 profilelD获取协商 IPSec参数，在 FA/PDSN, HA本地保存 profilelD与协商 IPSec参数的对应关系， 与实施例一的不同之 处主要在于， 步骤 207〜步骤 210有另一种实施方法： 步骤 207a, HAAA根据访问终端安全级别， 选择并下发认证应答至 FAAA, 认证应答中包含协商 IPSec参数所对应的 profilelD, 预共享密匙、 身份信息等； 步骤 208a, FAAA将认证应答转发至 FA; 步骤 209a, FA根据协商 IPSec参数所对应的 profilelD在本地获取协商 IPSec参数， FA根据协商 IPSec参数信息， 发送 ISAKMP SA建立的协商请 求至所述 HA, ISAKMP SA建立的协商请求中携带提议建立的 ISAKMP SA 信息、 密钥材料以及身份信息； 步骤 210a, HA根据收到 ISAKMP SA建立的协商请求后， 根据其中的 身份信息还原 FA地址， 并发送 S Key和协商 IPSec所对应 profilelD获取请 求至 AAA, AAA下发 S Key和协商 IPSec参数的 profilelD至 HA, HA根 据身份信息以及 S Key生成 IPSec的预共享密匙， 并将信息 （包括 S Key和 协商 IPSec参数）保存在本地； 在后续接入时， 可以使用已保存的信息。 若本地已保存所述 S Key和所述协商 IPSec参数所对应的 profilelD, 则 直接读取本地保存的信息， 跳过步骤 210a。
AAA下发 profilelD至 FA和 HA, 由 FA和 HA根据 rofilelD在本地获 取协商 IPSec参数， 避免了在 FA和 HA上手动配置参数， 同时也节约了 HA 和 FA之间的通信量。
实施例四： 如图 4所示， 本发明的一种 CDMA2000系统移动 IP的接入系统地实施 例中， 包括归属代理、 外地代理和鉴权授权计费服务器， 用于协商建立承载 信令和数据的 IPSec隧道， 在归属代理和外地代理之间协商建立 IPSec隧道 的过程中， 鉴权授权计费服务器选择并下发协商 IPSec参数或协商 IPSec参 数所对应的 profilelD至外地代理和归属代理。
本发明提供一种支持移动 IP接入的鉴权授权计费服务器，所述鉴权授权 计费服务器设置为， 在外地代理 FA或分组数据服务节点 PDSN和家乡代理 HA之间协商建立 IPSec隧道的过程中， 下发协商 IPSec参数或协商 IPSec参 数所对应的属性标识 profilelD至所述 FA或者所述 PDSN。 其中， 所述鉴权授权计费服务器还设置为， 在所述 FA或所述 PDSN和 所述 HA之间协商建立 IPSec隧道的过程中， 下发所述协商 IPSec参数或协 商 IPSec参数所对应的属性标识 profilelD至所述 HA。 其中， 所述鉴权授权计费服务器是设置为： 根据访问终端的安全等级选 择对应的协商 IPSec参数或协商 IPSec参数所对应的 profilelD后下发所述协 商 IPSec参数或协商 IPSec参数所对应的 profileID。 本发明还提供一种支持移动 IP接入的外地代理 FA或分组数据服务节点 PDSN, 其中： 所述 FA或 PDSN设置为， 在和家乡 HA之间协商建立 IPSec隧道的过 程中，从所述 AAA获取协商 IPSec参数； 或者，从所述 AAA获取协商 IPSec 参数所对应的 profilelD, 根据所述 profilelD得到协商 IPSec参数。 本发明还提供一种支持移动 IP接入的家乡代理 HA, 其中， 所述 HA设置为： 在和外地代理 FA或分组数据服务节点 PDSN之间协 商建立 IPSec隧道的过程中，从鉴权授权计费服务器 AAA获取协商 IPSec参 数或协商 IPSec参数所对应的属性标识 profileID。 本发明还提供一种移动 IP接入系统， 包括上述提到的外地代理 FA或分 组数据服务节点 PDSN, 鉴权授权计费服务器 AAA, 和家乡代理 HA。 本发明不限于 CDMA2000系统。 以上内容是结合具体的优选实施方式对本发明所作的进一步详细说明， 但这只是为便于理解而举的实例， 不应认为本发明的具体实施只局限于这些 说明。 对于本发明所属技术领域的普通技术人员来说， 在不脱离本发明构思 的前提下， 可以做出各种可能的等同改变或替换， 这些改变或替换都应属于 本发明的保护范围。例如，某些 CDMA2000系统中， PDSN (Packet Data Service Node 分组数据服务节点)在移动 IP用户接入时具有 FA同样的功能， 所以在 上述各实施例中， FA可以用 PDSN替换。
工业实用性 本发明选择并下发协商 IPSec参数或协商 IPSec参数所对应的 profilelD 至 FA和 HA, 或 PDSN和 HA, 避免了在上述网元上手工配置协商 IPSec参 数， 简化了系统配置，提高了系统的可用性， 同时， 由于 FA和 HA,或 PDSN 和 HA上的协商参数统一下发， 协议版本相同， 避免了不同版本造成的对接 困难。

Claims

权 利 要 求 书
1、 一种移动 IP接入方法， 包括， 在外地代理 FA或分组数据服务节点 PDSN与家乡代理 HA协商建立 Internet协议安全隧道即 IPSec隧道的过程中 , 鉴权授权计费服务器 AAA下发协商 IPSec参数或协商 IPSec参数所对应的属 性标识 profilelD至所述 FA或所述 PDSN。
2、 如权利要求 1所述的接入方法， 其特征在于， 所述方法还包括， 在外 地代理 FA或分组数据服务节点 PDSN与家乡代理 HA协商建立 Internet协议 安全隧道即 IPSec隧道的过程中 ,所述 AAA下发协商 IPSec参数或协商 IPSec 参数所对应的属性标识 profilelD至所述 HA。
3、 如权利要求 1所述的接入方法， 其中， 所述 FA或 PDSN与所述 HA 协商建立所述 IPSec隧道的过程包含：
A1、 所述 FA或 PDSN向所述 AAA发送认证请求；
含所述协商 IPSec参数或所述协商 IPSec参数所对应的 profilelD;
A3、 所述 FA或 PDSN根据所述 AAA下发的认证应答， 发送协商请求 至所述 HA;
A4、 所述 HA接收所述协商请求， 从本地或者从所述 AAA获取所述协 商 IPSec参数或协商 IPSec参数所对应的 profilelD,所述 FA或所述 PDSN与 所述 HA协商建立 IPSec隧道。
4、 如权利要求 3所述的接入方法， 其中， 所述认证应答中还包括预共享密匙和身份信息； 所述协商请求为所述 FA 或 PDSN根据所述协商 IPSec 参数发起的 ISAKMP SA建立的协商请求，所述 ISAKMP SA建立的协商请求中携带提议 建立的 ISAKMP SA信息、 密钥材料以及身份信息； 所述步骤 A4中， 所述 HA收到所述协商请求后， 从本地或从所述 AAA 获取所述协商 IPSec参数， 所述 FA或所述 PDSN与所述 HA协商建立 IPSec 隧道的步骤包括： 所述 HA收到所述 ISAKMP SA建立的协商请求后， 根据其中的所述身 份信息还原所述 FA或 PDSN的地址， 从本地获取 S Key和所述协商 IPSec 参数， 或者， 从所述 AAA获取所述 S Key和所述协商 IPSec参数； 所述 HA根据所述身份信息以及所述 S Key, 生成 IPSec的预共享密匙； 所述 HA与所述 FA或 PDSN交互， 从而建立所述 FA或 PDSN与所述 HA之间的 IPSec隧道。
5、 如权利要求 3所述的接入方法， 其中， 所述认证应答中还包括预共享密匙和身份信息； 所述步骤 A3中还包括，所述 FA或 PDSN根据所述协商 IPSec参数所对 应 profilelD在本地获取所述协商 IPSec参数； 所述步骤 A3中： 所述协商请求为所述 FA或 PDSN根据所述本地获取 的协商 IPSec参数发起的 ISAKMP SA建立的协商请求，所述 ISAKMP SA建 立的协商请求中携带提议建立的 ISAKMP SA信息、密钥材料以及身份信息； 所述步骤 A4中 ,所述 HA收到所述协商请求后 ,从本地或者从所述 AAA 获取协商 IPSec参数所对应的 profilelD, 所述 FA或所述 PDSN与所述 HA 协商建立 IPSec隧道的步骤包括： 所述 HA收到所述 ISAKMP SA建立的协商请求后， 根据其中的所述身 份信息还原所述 FA或 PDSN的地址， 从本地获取 S Key和所述协商 IPSec 参数对应的 profilelD,或者，从所述 AAA获取所述 S Key和协商 IPSec参数 对应的 profilelD; 所述 HA根据所述身份信息以及 S Key, 生成 IPSec的预共享密匙； 所述 HA与所述 FA或 PDSN交互， 从而建立所述 FA或 PDSN与所述 HA之间的 IPSec隧道。
6、 如权利要求 1至 5任一所述的接入方法， 其中， 所述协商 IPSec参数 或协商 IPSec参数所对应的 profilelD是与访问终端的安全等级对应的协商 IPSec参数或协商 IPSec参数所对应的 profileID。
7、如权利要求 6所述的接入方法， 其中， 所述访问终端的安全等级由运 营商或用户预先设定。
8、 一种支持移动 IP接入的鉴权授权计费服务器， 所述鉴权授权计费服 务器设置为， 在外地代理 FA或分组数据服务节点 PDSN和家乡代理 HA之 间协商建立 IPSec隧道的过程中，下发协商 IPSec参数或协商 IPSec参数所对 应的属性标识 profilelD至所述 FA或者所述 PDSN。
9、如权利要求 8所述的鉴权授权计费服务器， 其中， 所述鉴权授权计费 服务器还设置为， 在所述 FA或所述 PDSN和所述 HA之间协商建立 IPSec 隧道的过程中，下发所述协商 IPSec参数或协商 IPSec参数所对应的 profilelD 至所述 HA。
10、 如权利要求 8或 9所述的鉴权授权计费服务器， 其中， 所述鉴权授 权计费服务器是设置为： 根据访问终端的安全等级选择对应的协商 IPSec参 数或协商 IPSec参数所对应的 profilelD后下发所述协商 IPSec参数或协商 IPSec参数所对应的 profilelD。
11、 一种支持移动 IP接入的外地代理 FA或分组数据服务节点 PDSN, 其中：
所述 FA或 PDSN设置为， 在和家乡 HA之间协商建立 IPSec隧道的过 程中，从所述 AAA获取协商 IPSec参数； 或者，从所述 AAA获取协商 IPSec 参数所对应的 profilelD, 根据所述 profilelD得到协商 IPSec参数。
12、 一种支持移动 IP接入的家乡代理 HA, 其中， 所述 HA设置为： 在和外地代理 FA或分组数据服务节点 PDSN之间协 商建立 IPSec隧道的过程中，从鉴权授权计费服务器 AAA获取协商 IPSec参 数或协商 IPSec参数所对应的属性标识 profileID。
13、 一种移动 IP接入系统， 包括： 外地代理 FA或分组数据服务节点 PDSN, 以及鉴权授权计费服务器 AAA, 其中， 所述 AAA设置为，在外地代理 FA或分组数据服务节点 PDSN和家乡代 理 HA之间协商建立 IPSec隧道的过程中， 下发所述协商 IPSec参数或协商 IPSec参数所对应的属性标识 profilelD至所述 FA或者所述 PDSN; 所述 FA或 PDSN设置为， 在和所述 HA之间协商建立 IPSec隧道的过 程中，从所述 AAA获取协商 IPSec参数； 或者，从所述 AAA获取协商 IPSec 参数所对应的 profilelD, 根据所述 profilelD得到协商 IPSec参数。
14、 如权利要求 13 所述的接入系统， 其中， 所述系统还包括家乡代理 HA, 其中： 所述 AAA还设置为，在所述 FA或所述 PDSN和所述 HA之间协商建立 IPSec隧道的过程中，下发协商 IPSec参数或协商 IPSec参数所对应的属性标 识 profilelD至所述 HA; 所述 HA设置为， 在和所述 FA或所述 PDSN之间协商建立 IPSec隧道 的过程中，从所述 AAA获取所述协商 IPSec参数或协商 IPSec参数所对应的 profilelD。
15、 如权利要求 13或 14所述的接入系统， 其中， 所述 AAA是设置为： 根据访问终端的安全等级选择对应的协商 IPSec 参数或协商 IPSec参数所对应的 profilelD后下发所述协商 IPSec参数或协商 IPSec参数所对应的 profilelD。
PCT/CN2010/072593 2009-09-01 2010-05-11 一种移动ip业务的接入方法和系统 WO2011026341A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP10813263.0A EP2445146A4 (en) 2009-09-01 2010-05-11 Mobile ip service access method and system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN2009101899288A CN101656961B (zh) 2009-09-01 2009-09-01 一种cdma2000系统移动ip业务的接入方法和系统
CN200910189928.8 2009-09-01

Publications (1)

Publication Number Publication Date
WO2011026341A1 true WO2011026341A1 (zh) 2011-03-10

Family

ID=41710990

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2010/072593 WO2011026341A1 (zh) 2009-09-01 2010-05-11 一种移动ip业务的接入方法和系统

Country Status (3)

Country Link
EP (1) EP2445146A4 (zh)
CN (1) CN101656961B (zh)
WO (1) WO2011026341A1 (zh)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101656961B (zh) * 2009-09-01 2012-07-18 中兴通讯股份有限公司 一种cdma2000系统移动ip业务的接入方法和系统
CN101815295B (zh) * 2010-03-16 2013-02-27 东南大学 一种pmip6中LMA和MAG之间的密钥分发方法
CN102223618A (zh) * 2010-04-15 2011-10-19 中兴通讯股份有限公司 终端接入方法及系统
CN103686704B (zh) * 2012-09-19 2017-02-15 华为技术有限公司 终端与网络侧通信方法和设备
CN103220818B (zh) * 2013-01-30 2015-12-23 中兴通讯股份有限公司 一种建立X2口IPSec隧道的方法和装置

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1905452A (zh) * 2006-08-15 2007-01-31 中国电信股份有限公司 家庭网关中IPSec安全策略的自动配置系统和方法
US20070136590A1 (en) * 2005-12-10 2007-06-14 Nah Jae H Network system and communication methods for securely bootstraping mobile IPv6 mobile node using pre-shared key
CN101656961A (zh) * 2009-09-01 2010-02-24 中兴通讯股份有限公司 一种cdma2000系统移动ip业务的接入方法和系统

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6839338B1 (en) * 2002-03-20 2005-01-04 Utstarcom Incorporated Method to provide dynamic internet protocol security policy service
US20050102514A1 (en) * 2003-11-10 2005-05-12 Telefonaktiebolaget Lm Ericsson (Publ) Method, apparatus and system for pre-establishing secure communication channels
CN101128022B (zh) * 2006-08-18 2011-02-02 华为技术有限公司 终端切换方法及装置、源接入网关地址获取方法及装置

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070136590A1 (en) * 2005-12-10 2007-06-14 Nah Jae H Network system and communication methods for securely bootstraping mobile IPv6 mobile node using pre-shared key
CN1905452A (zh) * 2006-08-15 2007-01-31 中国电信股份有限公司 家庭网关中IPSec安全策略的自动配置系统和方法
CN101656961A (zh) * 2009-09-01 2010-02-24 中兴通讯股份有限公司 一种cdma2000系统移动ip业务的接入方法和系统

Also Published As

Publication number Publication date
EP2445146A4 (en) 2017-09-06
CN101656961B (zh) 2012-07-18
CN101656961A (zh) 2010-02-24
EP2445146A1 (en) 2012-04-25

Similar Documents

Publication Publication Date Title
KR100759489B1 (ko) 이동통신망에서 공개키 기반구조를 이용한 아이피보안터널의 보안 방법 및 장치
KR100420265B1 (ko) 무선 인터넷 망간 접속 방법
EP1465385B1 (en) Method for common authentication and authorization across disparate networks
US7389412B2 (en) System and method for secure network roaming
KR101140497B1 (ko) 이종 무선 애드혹 네트워크
JP4034729B2 (ja) モバイルインターネット通信装置及び方法
JP5204219B2 (ja) 無線通信ネットワークにおけるプロキシモバイルキー階層構造を提供するための方法および装置
JP4723158B2 (ja) パケット・データ・ネットワークにおける認証方法
JP4299102B2 (ja) 無線ネットワークのハンドオフ暗号鍵
WO2019137030A1 (zh) 安全认证方法、相关设备及系统
WO2006010648A2 (en) Methods, apparatuses and computer-readable media for secure communication by establishing multiple secure connections
WO2005096644A1 (fr) Procede d'etablissement d'une association de securite entre l'abonne itinerant et le serveur du reseau visite
WO2009012675A1 (fr) Passerelle de réseau d'accès, terminal, procédé et système pour établir une connexion de données
WO2014176964A1 (zh) 一种通信管理方法及通信系统
WO2007137516A1 (fr) Procédé, équipement et réseau de communication pour la négociation de la capacité de mobile ip
EP2317694B1 (en) Method and system and user equipment for protocol configuration option transmission
JP5044690B2 (ja) Ｉｐモビリティシステムのための動的な外部エージェント−ホーム・エージェント・セキュリティ・アソシエーション割当て
WO2010069202A1 (zh) 认证协商方法及系统、安全网关、家庭无线接入点
WO2011026341A1 (zh) 一种移动ip业务的接入方法和系统
WO2009097798A1 (zh) 策略控制方法、设备及策略控制网络系统
WO2010118570A1 (zh) 一种WiMAX和WiFi网络融合的系统和装置
JP4584776B2 (ja) ゲートウェイ装置およびプログラム
WO2012022212A1 (zh) 用户设备接入方法、装置及系统
WO2008086747A1 (en) Mobile ip system and method for updating home agent root key
WO2006080079A1 (ja) 無線ネットワークシステムおよびそのユーザ認証方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 10813263

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2010813263

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE