WO2011095097A1 - 安全关联存活检测方法、装置和系统 - Google Patents

安全关联存活检测方法、装置和系统 Download PDF

Info

Publication number
WO2011095097A1
WO2011095097A1 PCT/CN2011/070629 CN2011070629W WO2011095097A1 WO 2011095097 A1 WO2011095097 A1 WO 2011095097A1 CN 2011070629 W CN2011070629 W CN 2011070629W WO 2011095097 A1 WO2011095097 A1 WO 2011095097A1
Authority
WO
WIPO (PCT)
Prior art keywords
peer
ipsec
survival
security association
message
Prior art date
Application number
PCT/CN2011/070629
Other languages
English (en)
French (fr)
Inventor
黄国淋
胡辉
Original Assignee
成都市华为赛门铁克科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 成都市华为赛门铁克科技有限公司 filed Critical 成都市华为赛门铁克科技有限公司
Publication of WO2011095097A1 publication Critical patent/WO2011095097A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/104—Peer-to-peer [P2P] networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/164—Implementing security features at a particular protocol layer at the network layer

Definitions

  • Safety association survival detection method, device and system The present application claims priority to Chinese Patent Application entitled “Safety Associated Survival Detection Method, Apparatus and System” submitted to the Chinese Patent Office on February 4, 2010, application number 201010113705.6 The entire contents of which are incorporated herein by reference.
  • TECHNICAL FIELD The present invention relates to the field of communications technologies, and in particular, to a security association survival detection method, apparatus, and system.
  • IP Security Internet Protocol Security
  • IKE SA Internet Key Exchange Security Association
  • IPSec SA Internet Protocol Security Association
  • the IKE protocol packets are transmitted under the protection of the IKE SA
  • IPSec traffic are transmitted under the protection of the IPSec SA.
  • IKE SA and the IPSec SA of the local end need to be sent by the IKE SA and the IPSec SA of the local end.
  • the data is encrypted and sent to the peer.
  • the peers discard the data because the IKE SA or the IPSec SA does not exist.
  • the service is interrupted. After the IKE SA and the IPSec SA are aged out, the new IKE SA and IPSec SA can be triggered. As a result, the business interruption time is too long.
  • the IKE protocol itself does not provide detection of IKE SA and IPSec SA in the peer.
  • the mechanism of the IKE SA and the IPSec SA in the peer is queried by the IKE notification payload.
  • a typical traffic-based peer-to-peer detection mechanism DPD (Dead Peer Detection), but DPD can only detect the survival status of IKE SA, but cannot detect the survival status of IPSec SA. Therefore, when one of the two peers does not exist, the peer does not know the situation and continues to use the IPSec SA to send data packets, causing data loss and wasting a lot of data.
  • CPU resources and encryption card resources are examples of the IPSec SA to send data packets, causing data loss and wasting a lot of data.
  • Embodiments of the present invention provide a security association survival detection method, apparatus, and system, to implement verification
  • IPSecSA Whether IPSecSA is alive or not, so that it can trigger a new security association in time to ensure normal communication when communication is required.
  • a security association survival detection method includes:
  • the result of the search is fed back to the second peer, so that the second peer determines the survival of the first peer's IPSec SA according to the search result.
  • a security association survival detection method including: transmitting, to a first peer, a security association survival detection DTD message carrying a security protocol index SPI and a protocol number;
  • a security association survival detecting apparatus including: a first receiving unit, configured to receive a security association survival detection DTD that carries a security protocol index SPI and a protocol number sent by a second peer Message
  • a locating unit configured to find an IPSec SA of the first peer corresponding to the iPSec SA of the second peer according to the SPI, the protocol number, and the source IP address of the DTD message;
  • a first sending unit configured to obtain a search result of the searching unit, and feed back to the second peer, so that the second peer determines an IPSec SA of the first peer according to the search result. Survival situation.
  • a security association survival detecting apparatus including:
  • a second sending unit configured to send, to the first peer, a security association survival detection DTD message carrying a security protocol index SPI and a protocol number;
  • a second receiving unit configured to receive, by the first peer, a first peer corresponding to the IPSec SA of the second peer according to the source IP address of the SPI, the protocol number, and the DTD message
  • the result of the IPSec SA feedback is obtained, and the survival of the IPSec SA of the first peer is determined according to the search result.
  • a peer communication system including: a peer communication system, including: a first peer and a second peer, The first peer includes a first security association survival detecting device, and the second peer includes a second security association survival detecting device, where:
  • the second security association survival detecting apparatus is configured to: send a security association survival detection DTD message carrying a security protocol index SPI and a protocol number, and receive the first peer according to the SPI, the protocol number, and the The search result of the post-search feedback of the IPSec SA of the first peer corresponding to the IPSec SA of the second peer, and the first peer is determined according to the search result.
  • the first security association survival detecting apparatus is configured to receive the DTD message, and according to the SPI, the protocol number, and the source IP address of the DTD message, the first corresponding to the IPSecSA of the second peer
  • the IPSecSA of the peer searches for the result and feeds back the search result to the second peer.
  • the solution disclosed in the embodiment of the present invention can uniquely determine the characteristics of the IPSec SA of the first peer by using the destination IP, the protocol number, and the SPI, and send the DTD message carrying the protocol number and the SPI to the first a pair of peers, and based on the protocol number and the SPI and the source IP address of the DTD message, the feedback result of the IPSec SA of the first peer corresponding to the IPSec SA of the second peer is searched according to the The result of the search determines the IPSec SA survival of the first peer and improves the accuracy of the peer security association detection.
  • Figure 1 is a schematic diagram of a format of a DPD message
  • FIG. 2 is a schematic structural diagram of a DTD message according to an embodiment of the present invention.
  • Figure 3 is a schematic diagram of a communication process between peers
  • FIG. 4 is a flowchart of a method for detecting a security association survival according to Embodiment 1 of the present invention
  • FIG. 5 is a schematic diagram of the IPSec of the same IPSec SA as that of the target IPSec SA.
  • FIG. 6 is a schematic diagram of feedback to Peer2 when Peer1 does not find the same IPSec SA as the target IPSec SA according to the first embodiment of the present invention
  • FIG. 7 is a flowchart of a method for detecting a security association survival according to Embodiment 2 of the present invention
  • 8 is a flowchart of a security association survival detection method according to Embodiment 3 of the present invention
  • FIG. 9 is a flowchart of a security association survival detection method according to Embodiment 4 of the present invention
  • FIG. 10 is a security association according to Embodiment 5 of the present invention
  • FIG. 11 is a flowchart of an implementation of a security association survival detecting method according to Embodiment 6 of the present invention
  • FIG. 12 is a schematic structural diagram of a security association survival detecting apparatus according to Embodiment 7 of the present invention
  • FIG. 14 is a schematic structural diagram of a security association survival detecting apparatus according to Embodiment 9 of the present invention
  • FIG. 15 is a schematic diagram of a security association survival detecting apparatus according to Embodiment 10 of the present invention
  • FIG. 16 is a schematic structural diagram of a security association survival detecting apparatus according to Embodiment 11 of the present invention
  • FIG. 17 is a schematic structural diagram of a peer communication network system according to Embodiment 12 of the present invention
  • SPI Security Parameter Index, security parameter index
  • AH/ESP Authentication Header/Encapsulating Security Payload, that is, the authentication header/encapsulation security payload; collectively referred to herein as a protocol number, the protocol number may include AH or ESP, or both.
  • NAC Not ACKnowledge Character, negative confirmation character
  • DOI Domain of interpretation, interpretation domain
  • DTD Dead Tunnel Detection, which is called security association survival detection. It can also be called tunnel survival. Detection, a new technical concept presented in this paper, will be highlighted below.
  • the embodiment of the present invention provides a new technical concept, a DTD, that is, a security association survival detection, which is generally used in a peer-to-peer architecture system. Therefore, it can also be called a peer security association survival detection.
  • a DTD that is, a security association survival detection
  • a security association survival detection which is generally used in a peer-to-peer architecture system. Therefore, it can also be called a peer security association survival detection.
  • the following describes the improvement reason and process. :
  • DPD Interval is to send a DPD message to detect when no IPSec traffic occurs within a preset time. Whether the terminal is alive or not; another method is called DPD On Demand. That is, when no IPSec traffic occurs within a preset time and a data packet needs to be sent through a security association, the detection is performed.
  • the format of the DPD message is as shown in Figure 1. It includes the protocol identifier Protocol-ID field, the cookie field, the notification message type Notify Message Type field, and the notification data Notification Data field.
  • Protocol ID Protocol ID of the Internet Security Association and Key Management Protocol (ISAKMP);
  • Cookies Size The length of the ISAKMP cookies, usually 16bit; the notification message type Notify Message Type: is set to -U-THERE/R-U-THERE-ACK;
  • Cookies the cookies of the initiator and responder
  • Notification Data A randomly generated sequence number used to prevent replay attacks and prevent forged keep-alive messages.
  • the DPD message may further include: a next payload Next Payload field, a reserved item RESERVED, payload length Payload Length field, interpretation domain DOI.
  • the DPD detection mode can only detect the IKE SA survival status and cannot detect the survival of the IPSec SA. Therefore, when one of the two peers ( ⁇ is ⁇ ), an IPSec SA does not exist. , because another peer (the branch is set to B) can not understand this situation and continue to use the IPSec SA to send data packets, resulting in data loss (if this situation continues for a period of time to produce a "data black hole"), The communication service is affected, and a large amount of CPU resources and encryption card resources are wasted.
  • the IPSec protocol stipulates that each IPSec SA has its own validity period (lifetime), and each IPSec SA is terminated at the end of the validity period (also called For natural aging, that is, peer B needs to wait for the IPSec SA to age naturally before renegotiating a new IPSec SA with peer A. Therefore, the embodiment of the present invention proposes a new security association survival detection method.
  • the security association survival detection message carrying the protocol number and the SPI is hereinafter referred to as a DTD message, and the DTD message may be in the form of an IKE message (hereinafter collectively referred to as an IKE notification payload), and the structure is as shown in FIG. 2, including the protocol.
  • Protocol ID Protocol-ID The protocol number (protocol ID) set to IPSec, for example, AH or ESP;
  • SPI Size refers to the length of the SPI of the IPSec SA.
  • Notification message type Notify Message Type is set to R-U-THERE/R-U-THE E-ACK/ R-U-THERE-NAC;
  • SPI Security Parameter Index
  • Inbound SPI and outbound security parameter index Outbound SPI is set to the inbound direction of the IPSec SA.
  • Notification Data A randomly generated sequence number used to prevent replay attacks and prevent forged keep-alive messages.
  • the DTD message may further include: a next payload Next Payload field, a reserved item
  • the embodiment of the present invention provides a security association survival detection method: As shown in FIG. 3, the first peer Peer1 and the second peer Peer2 are two peers in the network, which can be used as senders and receivers of the DTD message.
  • Peerl is used as the peer.
  • the receiver of the DTD message, peer2 as the sender of the DTD message is described as an example.
  • the security association survival detection process is as shown in FIG. 4, and includes the following steps:
  • Step S41 Receive a DTD message that carries the SPI and the protocol number sent by Peer2.
  • Step S42 Search for the Peerl IPSec SA corresponding to the IPSec SA of the Peer2 according to the SPI of the DTD message, the protocol number, and the source IP address.
  • the IPSec SA of the Peer2 may be determined by using the SPI of the DTD message, the protocol number, and the source IP address triplet. Then look for the IPSec SA corresponding to Peer2's IPSec SA in all Peerl IPSec SAs.
  • Step S43 The search result is fed back to Peer2.
  • step S43 when an IPSec SA corresponding to the IPSec SA of the Peerl is queried, the A-U_THERE-ACK message is sent as a search result to Peer2, as shown in FIG. 5; otherwise, A-U_THERE-NACK is used.
  • the message is sent to Peer2 as a result of the search, as shown in Figure 6.
  • Peer2 determines the IPSec SA survival status on the Peerl end according to the A-U THERE-ACK/A-U-THERE-NACK message.
  • A-U-THERE-ACK/A-U-THERE-NACK message indicates that the search result is only an implementation manner, and there are other implementation manners, as long as the two results can be distinguished, which is not limited herein.
  • Peerl searches for the IPSec SA of the Peerl corresponding to the IPSec SA of the Peer2 by using the DFD message carrying the protocol number and the SPI sent by the Peer2, and tells the Peer2 to find the result, so that the Peer2 knows the IPSec SA survival of both parties. Therefore, it is convenient for Peer2 to perform the corresponding operations based on the IPSec SAs of both parties. For example, the IPSec SA of the Peer2 is deleted in time to trigger the negotiation of a new security association without waiting for the natural aging time of the security association to speed up the recovery of the communication services. Speed, and because there is no need to wait for the natural aging time of the security association, there is no CPU and encryption card resources saved.
  • Embodiment 2
  • Step S71 Receive the IKE notification payload sent by Peer2.
  • the IKE notification payload is a specific form of the foregoing DTD message. If the IP address is changed by the NAT without the address translation protocol, the source IP address of the IKE notification payload is the destination IP address of the IPSec SA of the Peerl, and the IKE notification payload. It can only include SPI and protocol numbers.
  • the DTD message may also be another form of message, and the specific form of the DTD message is not limited herein.
  • Step S72 Search for a corresponding IKE SA according to the header information of the IKE notification payload.
  • the IKE SA information is included in the cookie in the header information of the IKE notification payload. Therefore, the Peer1 IKE SA corresponding to the IKE SA of the Peer2 can be searched according to the cookies of the IKE header information.
  • Step S73 Determine, according to the result of the searching, whether to find the IKE SA of Peer1 corresponding to the IKE SA of Peer2, and if yes, go to step S74; otherwise, go to step S75.
  • Step S74 Decrypt the IKE notification payload by using the IKE SA of the discovered Peer1, obtain the SPI and the protocol number, and proceed to step S76.
  • step S74 the IKE SA can be decrypted by using the IKE SA, and the related data content, such as the Inbound SPI and the Outbound SPI of the IPSec SA, and the protocol number, etc., are obtained, and the process proceeds to step S76.
  • the related data content such as the Inbound SPI and the Outbound SPI of the IPSec SA, and the protocol number, etc.
  • Step S75 Discard the IKE notification payload.
  • Step S76 Search for the Peerl IPSec SA corresponding to the IPSec SA of the Peer2 according to the source IP address, the SPI, and the protocol number of the IKE notification payload (constituting a triplet for determining a unique IPSec SA).
  • Step S77 Determine, according to the result of the searching, whether the IPSec SA of the Peer1 is found, and if yes, go to step S78; otherwise, go to step S79.
  • Step S78 responding to the AU-THERE-ACK message.
  • This message can be set according to the notification type specified in the Notify Message Type field in the above IKE notification payload.
  • Step S79 Responding to the A-U-THERE-NACK message.
  • This message can also be set according to the notification type specified in the Notify Message Type field in the above IKE notification payload.
  • Peer1 searches for the IPSec SA of the Peer1 corresponding to the IPSec SA of the Peer2 by using the carrying protocol number and the SPI DTD message sent by the Peer2, and informs the Peer2 to find the result, so that Peer2 knows the IPSec SA survival status of both parties. Therefore, the consistency of the peer-to-peer security association (SA) detection is improved, so that the Peer2 can perform the corresponding operations based on the IPSec SAs of the two parties. For example, the IPSec SA of the Peer2 is deleted in time to trigger the negotiation of a new security association.
  • SA peer-to-peer security association
  • the Peer 2 is the sender of the DTD message.
  • the embodiment provides a method for the security association survival detection. The process of the method is as shown in FIG. 8 and includes the following steps:
  • Step S81 Send a DTD message carrying the SPI and the protocol number to the Peer1.
  • Step S82 The receiving Peer1 searches for the search result of the IPSec SA of the Peer1 corresponding to the IPSec SA of the Peer2 according to the SPI, the protocol number, and the source IP address of the DTD message.
  • the search result of the post-find feedback may be a search result of Peerl's search for the security security association according to the SPI, the protocol number, and the source IP address of the DTD message. Specifically, Peerl determines an IPSec SA of Peer 1 based on the source IP address of the SPI, the protocol number, and the DTD message, searches for all IPSec SAs in the local end, and feeds back the search result.
  • Step S83 Determine, according to the search result, a survival status of the IPSec SA of the Peerl.
  • step S83 when the AU-THERE-ACK message is received, it is determined that the IPSec SA of the Peerl exists, and when the AU-THERE-NACK message is received, it is determined that the IPSec SA of the Peerl does not exist.
  • the Peer2 sends a DTD message carrying the protocol number and the SPI to the Peerl, and the Peerl receives the IPSec SA of the Peerl corresponding to the IPSec SA of the Peer2 according to the SPI, the protocol number, and the source IP address of the DTD message.
  • the search result of the feedback determines, according to the search result, the survival of the IPSecSA of the first peer according to the search result.
  • the accuracy of the peer security management detection is improved, and the subsequent control operations are also provided. For example, when the IPSec SA of the Peer1 does not exist, the IPSec SA of the Peer2 can be deleted in time to trigger a new security negotiation.
  • the Peer2 Since the Peer2 sends the DTD message to the Peerl (that is, the DTD detection is started), it may be performed periodically, or may be triggered in some cases. Therefore, in this embodiment, the DTD message is sent by triggering as an example.
  • the method of survival detection is described. As shown in FIG. 9, the method may include the following steps:
  • Step S91 Calculate the duration of no traffic in the Peer2IPSec SA.
  • the IPSec SA records the forwarding time of the last data packet every time the data packet is forwarded. Therefore, the method for calculating the duration of the traffic in the IPSec SA is: Check whether the IPSec SA has inbound traffic for a period of time. The current time is subtracted from the last time the IPSec SA is used. The result is the duration of no traffic in the IPSec SA.
  • An implementation manner of calculating the duration of the traffic in the IPSec SA may be: setting a timer for each IPSec SA, and starting timing when the corresponding IPSec SA is used (that is, forwarding data packets). The calculated time is the duration of no traffic in the IPSec SA. Therefore, the DTD detection is started when the timing exceeds the preset threshold.
  • Step S92 Extract the SPI of the IPSec SA of the Peer2 (including the Inbound SPI and the Outbound SPI) and the protocol number to construct a DTD message.
  • Step S93 The DTD message is transmitted to the peer end under the protection of the corresponding IKE SA.
  • the specific implementation manner of transmitting the DTD message under the protection of the corresponding IKE SA may be: transmitting the DTD message in the form of an IKE notification payload.
  • Step S94-Step S95 is basically the same as step S82-step S83, and details are not described herein again.
  • the DTD message when the duration of the traffic in the IPSec SA is less than the predetermined threshold, the DTD message is sent to perform the security association survival detection. In other embodiments, the duration of the traffic in the IPSec SA does not exceed the predetermined threshold and is located at the end.
  • the DTD message is triggered to perform security association survival detection. Obviously, the latter saves resources, but it takes some time to perform security association survival detection. Normal data transmission can only wait after this time has elapsed. In comparison, the former has better timeliness.
  • Steps S101-S103 are substantially the same as the above steps S91-S93, and are not described herein again;
  • Step S104 determining whether the feedback result of the peer end is received within the preset time, if yes, proceeding to step S105; otherwise, proceeding to step S107;
  • Step S105 The receiving Peer1 performs a search result feedback after the IPSec SA of the Peer1 corresponding to the IPSec SA of the Peer2 according to the SPI, the protocol number, and the source IP address of the DTD message.
  • Step S106 Determine, according to the search result, the PeerllPSec SA survival status.
  • Step S107 Retransmit the DTD message and record the number of retransmissions.
  • Step S108 When the number of retransmissions exceeds a preset threshold, determine that the Peer1 IPSec SA does not exist.
  • the security association between Peerl and Peer2 is considered invalid.
  • the preset threshold may be set and adjusted according to actual network conditions or user requirements. It can be seen that the retransmission mode is used to improve the communication reliability, and further, it is further determined that the IPSec SA of the Peerl does not exist when the number of retransmissions exceeds a predetermined threshold, so that a new security association can be triggered in time to Ensure the normal operation of the communication service without waiting for the normal aging of the security association, thereby improving the security of communication between the peers.
  • the specific value of the preset time and the number of retransmissions of the DTD message is not limited. In this paper, it is recommended that the preset time is at least a few minutes, and the number of retransmissions is at least 7 or 8 times. Only consider removing IPSecSA from Peer2. Moreover, different environments may set different rules. In addition, in order to avoid more serious network congestion, it may be specified that the length of the preset time after each retransmission may be increased exponentially.
  • This embodiment discloses a security association survival detection method according to the foregoing embodiments 3, 4, and 5.
  • the method flow is as shown in FIG. 11 and includes the following steps:
  • Step SI 11 Send a DTD message carrying the SPI and the protocol number to Peerl.
  • Step S112 The receiving Peer1 performs a search and search result of the IPSec SA of the Peer1 corresponding to the IPSec SA of the Peer2 according to the SPI, the protocol number, and the source IP address of the DTD message.
  • Peerl determines Peerl's IPSec SAIPec SA based on the source IP address of the SPI, protocol number, and DTD message, searches for it in all IPSec SAs with Peerl, and feeds back the search result.
  • Step S113 Determine, according to the search result, the IPSec SA survival status of the Peer1.
  • the search result of the Peerl feedback is an AU-THERE-ACK message
  • Step S114 When it is determined that the IPSec SA of the Peer1 does not exist, the IPSec SA of the Peer2 is deleted.
  • Deleting the IPSec SA of the Peer2 includes: deleting information about the IPSec SA, such as the destination IP, SPI, protocol number, and other related information.
  • the IPSec SA of the Peer2 If the IPSec SA of the Peer2 exists, the IPSec SA of the Peer2 is kept valid. Otherwise, the IPSec SA of the Peer2 is deleted to trigger the negotiation of a new security association to ensure normal communication between the two parties.
  • step S114 may also be combined with the other security association survival detection methods in the foregoing fourth and fifth embodiments, and details are not described herein again.
  • the IPSec SA of the Peer2 is deleted according to the IPSec SA of the Peer2 corresponding to the IPSec SA of the Peer2, and the IPSec SA of the Peer2 is deleted in time when the IPSec SA of the Peerl is not available.
  • Peer2 continuously sends data and causes data loss, which reduces the working time and number of times of CPU and encryption card, thus saving CPU and encryption card resources.
  • Example 7
  • This embodiment provides a security association survival detecting apparatus for the foregoing embodiment 1 and the second embodiment.
  • the structure is as shown in FIG. 12, and includes a first receiving unit 121, a searching unit 122, and a second sending unit 123, where:
  • the first receiving unit 121 is configured to receive a security association DTD message that carries the SPI and the protocol number sent by the second peer.
  • the searching unit 122 is configured to search, according to the SPI, the protocol number, and the source IP address of the DTD message, the IPSec SA of the first peer corresponding to the IPSec SA of the second peer.
  • the first sending unit 123 is configured to obtain a search result of the searching unit, and feed back the second peer to the second peer, so that the second peer determines the IPSec of the first peer according to the search result.
  • the survival of the SA For the specific working process of the device, reference may be made to the content of the first embodiment and the second embodiment, and details are not described herein again.
  • the device disclosed in the embodiment of the present invention uses the carrying protocol number and SPI sent by the second peer.
  • the DTD message searches for the IPSec SA of the first peer corresponding to the IPSec SA of the second peer, and informs the second peer of the search result, so that the second peer knows the first peer.
  • IPSec SA survival The accuracy of the peer security association detection is improved, so that the second peer can perform corresponding operations according to the IPSec SA survival of the first peer, for example: timely deleting the corresponding IPSec of the second peer.
  • the SA triggers the negotiation of a new security association without waiting for the natural aging time of the security association to speed up the recovery of the communication service between the two parties. Since there is no need to wait for the natural aging time of the security association, there is no natural aging time process waiting for the security association.
  • the problem of constantly sending data and causing data loss saves CPU and encryption card resources.
  • the embodiment corresponds to the three-phase of the foregoing embodiment, and provides another security association survival detecting device.
  • the structure is as shown in FIG. 13 , and includes: a second sending unit 131 and a second receiving unit 132, where: the second sending unit The sending, by the first peer, the security association DTD message carrying the SPI and the protocol number.
  • the second receiving unit 132 is configured to receive, by the first peer, the first peer corresponding to the IPSec SA of the second peer according to the SPI, the protocol number, and the source IP address of the DTD message.
  • the search result of the IPSec SA is forwarded, and the survival of the IPSec SA of the first peer is determined according to the search result. .
  • the embodiment of the present invention may exist in a peer that needs to initiate a security association survival detection end, and the terminal sends a DTD message carrying the protocol number and the SPI to the first peer, and obtains the first peer according to the DTD message.
  • the IPSec SA of the second peer performs the search result of the post-search and the IPSec SA of the first peer. For the subsequent control operations, for example, when the IPSec SA of the first peer does not exist, the corresponding IPSec SA of the second peer is deleted in time to trigger negotiation of a new security association without waiting.
  • the natural aging time of the security association is to speed up the recovery of the communication services of both parties, and since there is no need to wait for the natural aging time of the security association, there is no problem of data loss caused by continuously sending data while waiting for the natural aging time of the security association, saving CPU and encryption card resources.
  • This embodiment provides another security association survival detecting apparatus, which is configured as shown in FIG. 14 and includes a second sending unit 131, a second receiving unit 132, a timing unit 143, and a trigger indicating unit 144. among them:
  • the timing unit 143 is configured to calculate the duration of the Internet Protocol security IPSec traffic that does not receive the first peer.
  • the triggering indicating unit 144 is configured to trigger the second sending unit 131 to send the current when the duration exceeds the preset threshold, or when the duration exceeds the preset threshold and the data packet needs to be sent at the end of the device. DTD message.
  • the cornerstone of the foregoing embodiment 8 further discloses that the security association survival detection is performed.
  • the DTD message is sent to perform security association detection, and the time is good. .
  • the DTD message is triggered to perform the security association detection. Obviously, it is more resource-saving than the above-described embodiment 9.
  • the present embodiment provides another security association survival detecting apparatus, including a second sending unit 131, a second receiving unit 132, a timing unit 143, a trigger indication unit 144, and a retransmission indication unit, in the foregoing Embodiment 4 and Embodiment 5. 155, where:
  • the retransmission indication unit 155 is configured to: after the second sending unit does not receive the response information of the peer end, after the second sending unit sends the DTD message, instruct the second sending unit 131 to retransmit the DTD message.
  • the method may further include: a counting unit 156 and a deletion instructing unit 157, wherein: the counting unit 156 is configured to calculate a number of retransmissions of the second sending unit, and the deletion instructing unit 157 is configured to: when the number of retransmissions exceeds a pre When the threshold is set, the IKE that deletes the first peer is issued.
  • the IKE SA of the corresponding second peer of the SA, and the IPSec SA indication of the second peer corresponding to the IPSec SA of the first peer is improved on the basis of the foregoing embodiment IX, and uses retransmission to improve communication reliability, and further specifies that the first peer IPSec SA does not exist when the number of retransmissions exceeds a predetermined threshold.
  • a new security association can be triggered in time to ensure that the communication service is performed normally without waiting for the normal aging of the security association.
  • the embodiment of the present invention further provides a security association survival detecting apparatus, including: a security association survival state determining unit 161 and a management unit 162, where:
  • the security association survival determining unit 161 is configured to send, to the first peer, a DTD message carrying the SPI and the protocol number, and receive, by the first peer, the SPI, the protocol number, and the source of the DTD message.
  • the IP looks up the search result of the IPSec SA of the first peer corresponding to the IPSecSA of the second peer, and determines the survival status of the IPSec SA of the first peer according to the search result.
  • the management unit 162 is configured to acquire, by the security association survival determining unit, the survival status of the IPSec SA of the first peer, when determining the first peer corresponding to the IPSecSA of the second peer If the IPSec SA of the IPSecSA does not exist, the IPSec SA of the second peer is deleted. In addition, when the first peer is invalid, the IKE SA of the second peer corresponding to the IKE SA of the first peer and the second peer corresponding to the IPSec SA of the first peer are deleted. IPSec SA.
  • the structure of the security association survival confirmation unit 161 may be any one of the security association survival detection apparatuses provided in the above-mentioned Embodiments 8, 9 and 10.
  • the specific structure may refer to FIGS. 13, 14, and 15.
  • the DTD message described in Embodiments 7 to 11 of the present invention may include various forms such as an IKE message.
  • the security association survival detecting apparatus disclosed in this embodiment may be configured in any one of the two peers, and the IPSec of the first peer corresponding to the IPSec SA of the second peer is confirmed by the security association survival confirmation unit.
  • SA survival And performing the corresponding control operation according to the IPSec SA survival of the first peer, and deleting the IPSec SA of the second peer in time when the IPSec SA of the first peer does not exist Triggering to negotiate a new security association without waiting for the natural aging time of the security association to speed up the recovery of both communication services, and without waiting
  • the natural aging time of the security association does not exist in the process of waiting for the natural aging time of the security association.
  • the local end continuously sends data and causes data loss, which saves CPU and encryption card resources.
  • the embodiment of the present invention also provides a peer communication system, and the structure thereof is as shown in FIG. 17.
  • the first peer 171 and the second peer 172 are included, and the first peer 171 includes the first security association to survive.
  • the first security association survival detecting apparatus 173 is configured to: receive the DTD message, and according to the SPI, the protocol number, and the source IP address of the DTD message, the first pair corresponding to the IPSecSA of the second peer.
  • the IPSecSA of the body performs a lookup and feeds back the search result to the second peer.
  • the first security association survival detecting device 173 may be any one of the security association survival detecting devices provided in the above embodiments 8 and 9 and the tenth embodiment.
  • the specific structure may refer to FIG. 13, 14, and 15.
  • the second security association survival detecting device 174 may be the security association survival detecting device provided in the above seventh embodiment. The specific structure is shown in FIG.
  • the peers in the system disclosed in this embodiment can initiate the security association survival detection of the peer peers, so as to know the survival of the peer IPSec SA and improve the accuracy of the security association survival detection.
  • the embodiment of the present invention also provides another peer communication system.
  • the structure is as shown in FIG. 18, and includes a first peer 181 and a second peer 182.
  • the first peer 181 includes the first security.
  • the associated survival detecting device 183 and the management device 185, the second peer 182 includes a second security associated survival detecting device 184, wherein: the second security associated survival detecting device 184 is the same as in the above-described embodiment
  • the functions of the devices are basically the same, and the security association management device is the same as the security association management device disclosed in the above eleventh embodiment.
  • the DTD message described in Embodiments 12 to 13 of the present invention may include various forms such as an IKE message.
  • the system disclosed in this embodiment further adds the security association management function on the basis of the foregoing embodiment, and when the IPSec SA of the first peer corresponding to the IPSec SA of the second peer does not exist, The IPSec SA of the second peer is deleted in time to trigger the negotiation of a new security association without waiting for the natural aging time of the security association to speed up the recovery of the communication service between the two parties, and since there is no need to wait for the natural aging time of the security association, There is no problem that the local end continuously sends data and waits for data loss while waiting for the natural aging time of the security association, which saves CPU and encryption card resources.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Description

安全关联存活检测方法、 装置和系统 本申请要求于 2010年 2月 4日提交中国专利局，申请号为 201010113705.6， 发明名称为"安全关联存活检测方法、 装置和系统"的中国专利申请的优先 权， 其全部内容通过引用结合在本申请中。 技术领域 本发明涉及通信技术领域，更具体地说，涉及一种安全关联存活检测方法、 装置和系统。
背景技术
互联网协议安全性（IPSec， IP Security )是一种开放标准的框架结构， 通 过使用加密的安全服务以确保在互联网协议（ IP , Internnet Protocol )基础上 进行保密而安全的通讯。
在 IPSec框架下， 两个对等体（peer )之间存在两类安全关联。 分别是互联 网密钥交换安全关联 ( IKE SA, Internet Key Exchange Security Association )和 互联网协议安全性安全关联 (IPSec SA, Internnet Protocol Security Association)。 IKE协议报文在 IKE SA的保护下进行传输，而数据报文（ IPSec流量）则在 IPSec SA的保护下进行传输。 这就意味着， 两个对等体只有在两边的 IKE SA和 IPSec SA均存活时才能进行安全的通信。 然而， 由于路由切换或者对等体重启等原 因， 对等体中的一端在正常情况下无法得知对端的 IKE SA和 IPSec SA是否存 活,则仍然会利用本端的 IKE SA和 IPSec S A对需要发送的数据进行加密并发送 给对端， 而对端由于 IKE SA或 IPSec SA不存在而丢弃数据， 造成业务中断， 需 要等到 IKE SA和 IPSec SA自然老化后才能触发协商新的 IKE SA和 IPSec SA,从 而使得业务中断时间过长。
现有技术中， IKE协议本身没有提供检测对等体中 IKE SA和 IPSec SA的 存活状态的机制， 而仅是釆用 IKE通知载荷来查询对等体中 IKE SA和 IPSec SA的存活状态。 比较典型的是一种基于流量的对等体存活检验机制： 对等体 存活检测（ DPD, Dead Peer Detection )， 但是 DPD只能够检测 IKE SA的存活 状态， 而无法检测出 IPSec SA的存活状态， 因此在两个对等体中的一个对等 体 IPSec SA不存在时， 由于另一个对等体并不能了解到这种情况而会继续利 用 IPSec SA发送数据报文， 造成数据丢失， 并浪费大量的 CPU资源和加密卡 资源。
发明内容
本发明实施例提供一种安全关联存活检测方法、装置和系统， 以实现检验
IPSecSA是否存活的功能， 从而能够在需要通信时能够及时触发协商新安全关 联以保证正常通信。
一种安全关联存活检测方法， 包括：
接收第二对等体发送的携带安全协议索引 SPI和协议号的安全关联存活 检测 DTD消息；
依据所述 SPI、 所述协议号和所述 DTD消息的源互联网协议 IP地址查找 与第二对等体中的互联网协议安全关联 IPSec SA相应的第一对等体的 IPSec SA;
将所述查找的结果反馈给第二对等体，以便第二对等体依据所述查找结果 确定所述第一对等体的 IPSec SA的存活情况。
根据本发明实施例的另一个方面，提供一种安全关联存活检测方法，包括： 向第一对等体发送携带安全协议索引 SPI和协议号的安全关联存活检测 DTD消息；
接收所述第一对等体依据所述 SPI、 所述协议号和所述 DTD消息的源 IP 查找与第二对等体的 IPSec SA相应的第一对等体的 IPSec SA后反馈的查找结 果；
依据所述查找结果确定所述第一对等体的 IPSecSA的存活情况。
根据本发明实施例的又一个方面，提供一种安全关联存活检测装置，包括： 第一接收单元，用于接收第二对等体发送的携带安全协议索引 SPI和协议 号的安全关联存活检测 DTD消息；
查找单元， 用于侬据所述 SPI、 所述协议号和所述 DTD消息的源 IP地址 查找与第二对等体的 iPSec SA相应的第一对等体的 IPSec SA;
第一发送单元，用于获取所述查找单元的查找结果并反馈给所述第二对等 体， 以便所述第二对等体依据所述查找结果确定所述第一对等体的 IPSec SA 的存活情况。
根据本发明实施例的另外一个方面，提供一种安全关联存活检测装置， 包 括：
第二发送单元，用于向第一对等体发送携带安全协议索引 SPI和协议号的 安全关联存活检测 DTD消息；
第二接收单元， 用于接收所述第一对等体依据所述 SPI、 所述协议号和所 述 DTD消息的源 IP地址查找与第二对等体的 IPSec SA相应的第一对等体的 IPSec SA后反馈的查找结果，并依据查找结果确定所述第一对等体的 IPSec SA 的存活情况。
才艮据本发明实施例的又一个方面， 提供一种对等体通信系统， 包括： 一种 对等体通信系统， 其特征在于， 包括第一对等体和第二对等体， 所述第一对等 体包括第一安全关联存活检测装置，所述第二对等体包括第二安全关联存活检 测装置， 其中：
所述第二安全关联存活检测装置用于：发送携带安全协议索引 SPI和协议 号的安全关联存活检测 DTD消息， 以及接收所述第一对等体依据所述 SPI、 所述协议号和所述 DTD消息的源 IP地址对与所述第二对等体的 IPSec SA相 应的第一对等体的 IPSec SA进行的查找后反馈的查找结果， 并依据所述查找 结果确定所述第一对等体的 IPSec SA的存活情况； 所述第一安全关联存活检测装置用于：接收所述 DTD消息，依据所述 SPI、 所述协议号和所述 DTD消息的源 IP对与所述第二对等体的 IPSecSA相应的第 一对等体的 IPSecSA进行查找， 并将所迷查找结果反馈给所述第二对等体。
从上述的技术方案可以看出， 本发明实施例公开的方案利用目的 IP、协议 号和 SPI可唯一确定第一对等体的 IPSec SA的特点，将携带协议号和 SPI的 DTD 消息发送给第一对等体， 并依据所述协议号和 SPI和所述 DTD消息的源 IP对与 第二对等体的 IPSec SA相应的第一对等体的 IPSec SA进行查找后的反馈结果， 依据该查找结果即可确定第一对等体的 IPSec SA存活情况，提高了对等体安全 关联存活检测的准确性。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施 例或现有技术描述中所需要使用的附图作一简单地介绍，显而易见地， 下面描 述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不 付出创造性劳动性的前提下， 还可以根据这些附图获得其他的附图。
图 1为 DPD消息的格式示意图；
图 2为本发明实施例提出 DTD消息的一种具体结构示意图；
图 3为对等体之间的通信过程示意图；
图 4为本发明实施例一提出的安全关联存活检测方法的流程图； 图 5为本发明实施例一中， Peerl查到与所述目标 IPSec SA相同的 IPSec
SA时， 向 Peer2反馈查找结果的示意图；
图 6为本发明实施例一中， Peerl没有查到与所述目标 IPSec SA相同的 IPSec SA时， 向 Peer2反馈查找结果的示意图；
图 7为本发明实施例二提出的安全关联存活检测方法的流程图； 图 8为本发明实施例三提出的安全关联存活检测方法的流程图； 图 9为本发明实施例四提出的安全关联存活检测方法的流程图； 图 10为本发明实施例五提出的安全关联存活检测方法的流程图； 图 11为本发明实施例六提出的安全关联存活检测方法的实现流程图； 图 12为本发明实施例七提出的安全关联存活检测装置的结构示意图； 图 13为本发明实施例八提出的安全关联存活检测装置的结构示意图； 图 14为本发明实施例九提出的安全关联存活检测装置的结构示意图； 图 15为本发明实施例十提出的安全关联存活检测装置的结构示意图； 图 16为本发明实施例十一提出的安全关联存活检测装置的结构示意图； 图 17为本发明实施例十二提出的对等体通信网络系统的结构示意图； 图 18为本发明实施例十三提出的对等体通信网络系统的结构示意图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清 楚、 完整地描述， 显然， 所描述的实施例仅仅是本发明一部分实施例， 而不是 全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有作出创造 性劳动前提下所获得的所有其他实施例， 都属于本发明保护的范围。
为了引用和清楚起见，先将本文中使用的技术名词、简写或缩写总结如下： SPI: Security Parameter Index, 安全参数索引；
AH/ESP: Authentication Header/ Encapsulating Security Payload, 即认证头 /封装安全载荷； 在本文中又统称为协议号， 所述协议号可包括 AH或 ESP, 或者同时包括两者。
AC : ACKnowledge Character, 确认字符；
NAC : Not ACKnowledge Character, 否定确认字符；
DOI: Domain of interpretation, 解释域；
DTD: Dead Tunnel Detection, 即安全关联存活检测， 也可称为隧道存活 检测， 为本文提出的一种新的技术概念， 下文将重点介绍。
实施例一
本发明实施例提出一种新的技术概念一 DTD , 即安全关联存活检测，一般 用于对等体架构的系统， 因此也可以称为对等体安全关联存活检测， 下面先介 绍改进缘由及过程：
当两个对等体之间有 IPSec流量的时候， 没有必要发送额外的消息来证明 对方 IPSec SA是否存活， 因为 IPSec流量本身就能证明对等体 IPSec SA是存 活的。 但是， 在预设时间（时间长度可以根据实际要求进行设置和调整） 内没 有 IPSec流量发生 (即没有数据交换)时， 对等体安全关联的存活状态是不确定 的， 因此可以发送 DPD消息来检测对端安全关联是否存活。通过发送 DPD消 息检测对端安全关联是否存活的方法存在两种方式，其中一种方式被称为间隔 式 DPD ( DPD Interval ), 即在预设时间内没有 IPSec流量发生时发送 DPD消 息来检测对端是否存活；另外一种方式被称为请求式 DPD ( DPD Ondemand ), 即在预设时间内没有 IPSec 流量发生且存在数据报文需要通过安全关联发送 时， 才进行检测。
DPD消息的格式如图 1 所示， 包括协议标识 Protocol-ID字段、 Cookies 字段、 通知消息类型 Notify Message Type字段和通知数据 Notification Data字 段； 其中：
协议标识 Protocol-ID: 互联网安全关联和密钥管理协议 ( Internet Security Association and Key Management Protocol, ISAKMP)的协议标识；
Cookies尺寸 Cookies Size: 指 ISAKMP cookies的长度， 一般是 16bit; 通 知 消 息 类 型 Notify Message Type ： 被 设 置 成 -U-THERE/R-U-THERE-ACK;
Cookies:发起者和响应者的 cookies;
通知数据 Notification Data: 随机产生的序列号， 用于防重放攻击和防止 伪造保活报文。
所述 DPD 消息还可以包括： 下一载荷 Next Payload 字段， 保留项 RESERVED, 载荷长度 Payload Length字段、 解释域 DOI。
由于采用 DPD检测方式只能够检测 IKE SA存活情况， 而无法检测出 IPSec SA的存活情况， 因此在两个对等体中的其中一个对等体（^ϋ殳为 Α )某 IPSec SA不存在时， 由于另一个对等体（ 支设为 B )并不能了解到这种情况而 继续利用该 IPSec SA发送数据报文， 造成数据丢失（如果这种情况持续一段 时间即产生"数据黑洞"）， 导致通信业务受影响， 且浪费大量的 CPU资源和加 密卡资源， 而 IPSec协议规定， 每条 IPSec SA都有自己的有效期 （生存期）， 各奈 IPSec SA在有效期结束时即被终止（也称为自然老化）， 也就是说， 对等 体 B需要等待该 IPSec SA自然老化后才能与对等体 A重新协商新的 IPSec SA。 因此， 本发明实施例提出了一种新的安全关联存活检测方法。 为了方便描述， 下文将携带协议号和 SPI的安全关联存活检测消息称之为 DTD消息， DTD消 息的形式可以是 IKE报文（下文统称为 IKE通知载荷）， 结构如图 2所示， 包 括协议标识 Protocol-ID字段、 Cookies字段、通知消息类型 Notify Message Type 字段、安全参数索引 SPI(Security Parameter Index)字段、安全参数索引尺寸 SPI Size字段和通知数据 Notification Data字段， 其中：
协议标识 Protocol-ID:被设置成 IPSec的协议号（协议 ID ), 比如， AH或 者 ESP;
安全参数索引尺寸 SPI Size: 是指 IPSec SA的 SPI的长度。
通 知 消 息 类 型 Notify Message Type ： 被 设 置 成 R-U-THERE/R-U-THE E-ACK/ R-U-THERE-NAC ;
安全参数索引 SPI(Security Parameter Index):被设置成 IPSec SA的入方向 安全参数索引 Inbound SPI和出方向安全参数索引 Outbound SPI;
通知数据 Notification Data: 随机产生的序列号， 用于防重放攻击和防止 伪造保活报文。
所述 DTD 消息还可以包括： 下一载荷 Next Payload 字段， 保留项
RESERVED, 载荷长度 Payload Length字段、 解释域 DOI。
以提出 DTD为基 ， 本发明实施例提供了一种安全关联存活检测方法： 如图 3所示， 第一对等体 Peerl和第二对等体 Peer2为网络中的两个对等 体， 均可以作为 DTD消息的发送者和接收者， 在本实施例中， 以 Peerl作为 DTD消息的接收者， peer2作为 DTD消息的发送者为例进行描述， 站在 Peerl 的角度， 安全关联存活检测流程如图 4所示， 包括以下步骤：
步骤 S41、 接收 Peer2发送的携带 SPI和协议号的 DTD消息。
步驟 S42、根据所述 DTD消息的 SPI、所述协议号和源 IP地址查找与 Peer2 的 IPSec SA相应的 Peerl的 IPSec SA。
在步骤 S42中， 可以利用所述 DTD消息的 SPI、 所迷协议号和源 IP地址 三元组确定 Peer2 的 IPSec SA。 然后在 Peerl的所有 IPSec SA中查找与 Peer2 的 IPSec SA相对应的 IPSec SA。
步骤 S43、 将查找结果反馈给 Peer2。
在步驟 S43中，当查询到与所述 Peerl 的 IPSec SA相对应的 IPSec SA时， 以 A-U_THERE-ACK消息作为查找结果发送给 Peer2, 如图 5所示； 否则， 以 A-U_THERE-NACK消息作为查找结果发送给 Peer2,如图 6所示。 Peer2依据 A-U THERE-ACK/ A-U— THERE-NACK消息确定 Peerl端的 IPSec SA存活情 况。
需要说明的是， 以 A-U— THERE- ACK/ A-U— THERE-NACK消息指示查找 结果只是一种实现方式而已，还有其他实现方式，只要能够区分两种结果即可， 本文对此不做限定。
上述实施例中， Peerl利用 Peer2发送的携带协议号和 SPI的 DTD消息对 与 Peer2的 IPSec SA相应的 Peerl的 IPSec SA进行查找，并告知 Peer2查找结 果， 以便 Peer2知悉双方的 IPSec SA存活情况。 从而方便 Peer2根据双方的 IPSec SA存活情况进行相应操作， 例如： 及时删除其所述 Peer2的 IPSec SA 以触发协商新的安全关联， 而无需等待安全关联的自然老化时间， 以加快双方 通信业务的恢复速度， 并且由于无需等待安全关联的自然老化时间， 不存在在 省了 CPU和加密卡资源。 实施例二
本实施例是在上述实施例一的基础上， 更详细地描述接收到 DTD消息后 如何操作并以什么样的形式将查找结杲反馈，流程如图 7所示，包括以下步骤： 步骤 S71、 接收 Peer2发送的 IKE通知载荷。
所述 IKE通知载荷是上述 DTD消息的一种具体形式， 若未经地址转换协 议 NAT变更 IP地址， 则该 IKE通知载荷的源 IP地址就是 Peerl的 IPSec SA 的目的 IP地址， 所述 IKE通知载荷可以仅包括 SPI和协议号。
当然，所述 DTD消息还可以是另外形式的报文，本文对所述 DTD消息的 具体形式不做限定。
步骤 S72、 根据所述 IKE通知载荷的头部信息查找相应的 IKE SA。
具体的，参考上述图 2， IKE通知载荷的头部信息中的 Cookies中包含 IKE SA信息， 因此，可根据所述 IKE头部信息的 cookies查找与 Peer2的 IKE SA 相应的 Peerl的 IKE SA。
步骤 S73、 根据所述查找的结果判断是否查找到与 Peer2的 IKE SA相应 的 Peerl的 IKE SA, 若是， 进入步骤 S74; 否则， 进入步骤 S75。
步骤 S74、利用查找到的 Peerl的 IKE SA对所述 IKE通知载荷进行解密， 获取 SPI和协议号， 进入步骤 S76。
在步骤 S74中， 可以利用 IKE SA对 IKE通知载荷进行解密， 获取相关数 据内容，如 IPSec SA的 Inbound SPI和 Outbound SPI以及协议号等， 然进入步 骤 S76。
步骤 S75、 丢弃所述 IKE通知载荷。
步骤 S76、根据所述 IKE通知载荷的源 IP地址、 SPI和协议号（组成了三 元组，用于确定唯一的 IPSec SA )查找与 Peer2的 IPSec SA相应的 Peerl的 IPSec SA。
步驟 S77、 根据所述查找的结果判断是否查找到所述 Peerl的 IPSec SA, 若是， 进入步骤 S78; 否则， 进入步驟 S79。
步骤 S78、 回应 A-U-THERE-ACK消息。 此消息可以按照上述 IKE通知载荷中的 Notify Message Type字段规定的 通知类型进行设置。
步骤 S79、 回应 A-U-THERE-NACK消息。
此消息也同样可以按照上述 IKE通知载荷中的 Notify Message Type字段 规定的通知类型进行设置。
需要说明的是， 本实施例中， 仅在 Inbound SPI和 Outbound SPI两者都被 查到时， 才确定所述 Peer 1的 IPSec SA被查到。 而如果仅是其中一个查到或 者两个都没查到时， 则确定所述 Peerl的 IPSec SA没有被查到。
本实施例中 Peerl利用 Peer2发送的携带协议号和 SPI的 DTD消息对与 Peer2的 IPSec SA相应的 Peerl的 IPSec SA进行查找，并告知 Peer2查找结果， 以便 Peer2知悉双方的 IPSec SA存活情况。从而提高了对等体安全关联（ SA ) 存活状态检测的一致性， 从而方便 Peer2根据双方的 IPSec SA存活情况进行 相应操作， 例如： 及时删除 Peer2的 IPSec SA以触发协商新的安全关联， 而 无需等待安全关联的自然老化时间， 以加快双方通信业务的恢复速度， 并且由 于无需等待安全关联的自然老化时间，不存在在等待安全关联的自然老化时间 过程中不断发送数据而导致数据丢失的问题， 节省了 CPU和加密卡资源。
实施例三
站在 Peer2的角度（ Peer2为 DTD消息的发送者）， 本实施例提供一种安 全关联存活检测的方法， 所述方法的流程如图 8所示， 包括以下步骤：
步骤 S81、 向 Peerl发送携带 SPI、 协议号的 DTD消息。
步骤 S82、接收 Peerl依据所述 SPI、所述协议号和所述 DTD消息的源 IP 对与 Peer2的 IPSec SA相应的 Peerl的 IPSec SA进行查找后反馈的查找结果。
在步骤 S82中， 所述查找后反馈的查找结果可以是 Peerl依据所述 SPI、 所述协议号和该 DTD消息的源 IP对安全安全关联进行查找后反馈的查找结 果。具体的， Peerl会依据 SPI、协议号和 DTD消息的源 IP确定一个 Peer 1 的 IPSec SA, 在其本端中的所有 IPSec SA中进行查找， 并反馈查找结果。
步骤 S83、 依据所述查找结果确定所述 Peerl的 IPSec SA的存活情况。 在步骤 S83中， 当接收到 A-U-THERE-ACK消息时， 确定存在所述 Peerl 的 IPSec SA， 当接收到 A-U-THERE-NACK消息时， 确定不存在所述 Peerl的 IPSec SA。
本实施例中的 Peer2发送携带协议号和 SPI的 DTD消息给 Peerl,接收 Peerl依据所述 SPI、所述协议号和所述 DTD消息的源 IP查找与 Peer2的 IPSec SA相应的 Peerl的 IPSec SA后反馈的查找结果， 依据所迷查找结果确定所述 依据所迷查找结果确定所述第一对等体的 IPSecSA的存活情况。提高了对等体 安全管理检测的准确性， 也为后续控制操作提供了方便， 例如： 在获知所述 Peerl的 IPSec SA不存在时，可以及时删除所述 Peer2的 IPSec SA以触发协商 新的安全关联， 而无需等待安全关联的自然老化时间， 以加快双方通信业务的 恢复速度， 并且由于无需等待安全关联的自然老化时间， 不存在在等待安全关 联的自然老化时间过程中不断发送数据而导致数据丟失的问题， 节省了 CPU 和加密卡资源。
实施例四
由于 Peer2向 Peerl发送 DTD消息（即启动 DTD检测）可以是定时进行 的， 也可以是在某种情况被触发而进行的， 因此， 本实施例将以通过触发发送 DTD消息来为例对安全关联存活检测的方法进行描述， 如图 9所示， 该方法 可以包括以下步骤：
步骤 S91、 计算 Peer2IPSec SA中没有流量的持续时间。
IPSec SA每次有数据报文转发时， 都会记录最后一次数据报文的转发时 间，因此，计算 IPSec SA中没有流量的持续时间的方式可以是：定时检查 IPSec SA在一段时间内是否有入流量，利用当前时间减去 IPSec SA最后一次使用时 间， 得到的结果就是 IPSec SA中没有流量的持续时间。
计算 IPSec SA中没有流量的持续时间的一种实现方式还可以是： 为每条 IPSec SA分别设置一个计时器， 在对应的 IPSec SA被使用 （即进行数据报文 的转发）时开始计时（其计算的时间为 IPSec SA中没有流量的持续时间）， 于 是， 当计时超过预设门限时启动 DTD检测。 步驟 S92、提取 Peer2的 IPSec SA的 SPI(包括 Inbound SPI和 Outbound SPI ) 以及协议号， 构造 DTD消息。
步骤 S93、 将所述 DTD消息在相应的 IKE SA保护下传输给对端。
将所述 DTD消息在相应的 IKE SA保护下传输的具体实现方式可以是： 将 DTD消息以 IKE通知载荷的形式传输。
步驟 S94-步骤 S95与上述步骤 S82-步驟 S83基本相同， 在此不再赘述。 本实施例在 IPSec SA 中没有流量的持续时间超过预定门限时马上发送 DTD消息以进行安全关联存活检测， 在其他实施例中， 可以是在 IPSec SA中 没有流量的持续时间超过预定门限且所在端存在需要通过 IPSec SA发送的数 据报文时， 才触发发送 DTD消息以进行安全关联存活检测。 显然， 后者更节 省资源，但是在进行安全关联存活检测需要花费一些时间，正常的数据发送只 能等待这段时间过后才能进行， 相比而言， 前者的及时性较优。
实施例五
本实施例在上述实施例四的基 上进行改进，
具体流程如图 10所示， 包括以下步骤：
步骤 S101- S103与上述步骤 S91- S93基本相同， 在此不再赘述； 步骤 S104、 判断预设时间内是否收到对端的反馈结果， 若是， 进入步驟 S105; 否则， 进入步骤 S107;
步骤 S105、 接收 Peerl依据所述 SPI、 所述协议号和所述 DTD消息的源 IP对与 Peer2的 IPSec SA相应的 Peerl的 IPSec SA进行查找后反馈的查找结 果。
步骤 S106、 依据查找结果确定所述 PeerllPSec SA存活情况。
步骤 S 107、 重传所述 DTD消息并记录重传次数。
步骤 S108、当所述重传次数超过预设门限时，确定所述 Peerl的 IPSec SA 不存在。
如果重传次数超过预设门限， 即可认为 Peerl与 Peer2之间的安全关联失 效。 所述预设门限可以根据网络实际情况或者用户需求进行设置和调整。 可以看出，本实施例使用重传的方式来提高通信可靠性， 并且进一步规定 在重传次数超过预定门限时确定所述 Peerl的 IPSec SA不存在， 如此可以及 时触发协商新的安全关联， 以保证通信业务的正常进行， 而无需等待安全关联 的正常老化， 从而提高对等体之间通信的安全性。
需要说明的是， 本文对所述预设时间和 DTD消息的重传次数的具体数值 不做限定， 本文建议在所述预设时间至少是几分钟， 重传次数最少 7、 8次的 情况下才考虑删除 Peer2的 IPSecSA。 并且， 不同的环境可以设定不同规则， 另外， 为了避免网络拥塞更加严重， 可以规定所述各次重传后所述预设时间的 时间长度可以以指数形式增加。 实施例六
本实施例公开了一种依据上述实施例三、四和五的基础上提出一种安全关 联存活检测方法， 所述方法流程如图 11所示， 包括以下步骤：
步骤 SI 11、 向 Peerl发送携带 SPI和协议号的 DTD消息。
步骤 S112、 接收 Peerl依据所述 SPI、 所述协议号和所述 DTD消息的源 IP地址对与 Peer2的 IPSec SA相应的 Peerl的 IPSec SA进行查找后反馈的查 找结果。
具体的， Peerl会依据 SPI、协议号和 DTD消息的源 IP地址确定 Peerl的 IPSec SAIPec SA, 在其与 Peerl的所有 IPSec SA中进行查找， 并反馈查找结 果。
步骤 S113、 依据所述查找结果确定所述 Peerl的 IPSec SA存活情况。 当接收到 Peerl反馈的查找结果是 A-U-THERE-ACK消息时，即可以确定 存在所述 Peerl 的 IPSec SA , 当接收到 Peerl 反馈的查找结果是 A-U-THE E-NACK时， 即可以确定不存在所述 Peerl的 IPSec SA。
步骤 S114、 当确定不存在所述 Peerl的 IPSec SA时， 删除所述 Peer2的 IPSec SA。
删除所述 Peer2的 IPSec SA包括： 删除确定 IPSec SA的相关信息， 如目 的 IP、 SPI、 协议号及其他相关信息。
如果存在所述 Peerl的 IPSec SA时， 则保持所述 Peer2的 IPSec SA有效， 否则， 删除所述 Peer2的 IPSec SA, 以触发协商新的安全关联， 保证双方通信 业务的正常进行。
需要说明的是上述步骤 S114也可以结合在上述实施例四、 五中形成其他 安全关联存活检测方法， 在此不再赘述。
另外， 当确定 Peerl无效（即： 重传 DTD消息次数超过预设门限） 时， 删除本端相应的 IKE SA和 IPSec SA。
根据本发明实施例的方法，依据与 Peer2的 IPSec SA相应的 Peerl的 IPSec SA存活情况进行相应的控制操作， 能够在获知所述 Peerl的的 IPSec SA不存 在时， 及时删除所述 Peer2的 IPSec SA以触发协商新的安全关联， 而无需等 待安全关联的自然老化时间， 以加快双方通信业务的恢复速度， 并且由于无需 等待安全关联的自然老化时间，不存在在等待安全关联的自然老化时间过程中
Peer2不断发送数据而导致数据丢失的问题，減少了 CPU和加密卡的工作时间 和工作次数， 从而节省了 CPU和加密卡资源。 实施例七
本实施例针对上述实施例一和实施例二，提供了一种安全关联存活检测装 置， 其结构如图 12所示， 包括第一接收单元 121、 查找单元 122和第二发送 单元 123 , 其中：
第一接收单元 121 , 用于接收第二对等体发送的携带 SPI和协议号的安全 关联 DTD消息。
查找单元 122, 用于依据所述 DTD消息中的 SPI、 协议号和该 DTD消息 的源 IP查找与第二对等体的 IPSec SA相应的第一对等体的 IPSec SA。
第一发送单元 123， 用于获取所述查找单元的查找结果并反馈给所述第二 对等体， 以便所述第二对等体依据所述查找结果确定所述第一对等体的 IPSec SA的存活情况。 本装置的具体工作流程可参照前文实施例一和实施例二的内 容， 在此不再赘述。
本发明实施例公开的装置利用第二对等体发送的携带协议号和 SPI 的 DTD消息对与第二对等体的 IPSec SA相应的第一对等体的 IPSec SA进行查 找，并告知地二对等体查找结果，以便第二对等体知悉所述第一对等体的 IPSec SA存活情况。 提高了对等体安全关联检测的准确度， 从而方便第二对等体后 续根据所述第一对等体的 IPSec SA存活情况进行相应操作， 例如： 及时删除 其第二对等体相应的 IPSec SA以触发协商新的安全关联， 而无需等待安全关 联的自然老化时间， 以加快双方通信业务的恢复速度， 并且由于无需等待安全 关联的自然老化时间，不存在在等待安全关联的自然老化时间过程中不断发送 数据而导致数据丟失的问题， 节省了 CPU和加密卡资源。
实施例八
本实施例与上述实施例三相对应， 提供了另一种安全关联存活检测装置， 其结构如图 13所示， 包括： 第二发送单元 131和第二接收单元 132， 其中： 第二发送单元 131， 用于向第一对等体发送携带 SPI、 协议号的安全关联 DTD消息。
第二接收单元 132， 用于接收所述第一对等体依据所述 SPI、 所述协议号 和该 DTD消息的源 IP查找与第二对等体的 IPSec SA相应的第一对等体的 IPSec SA后反馈的查找结果，并依据查找结果确定所述第一对等体的 IPSec SA 的存活情况。。
具体工作过程请参照实施例三。
本发明实施例可以存在于对等体中的需要发起安全关联存活检测一端，该 端向第一对等体发送携带协议号和 SPI 的 DTD 消息， 获取第一对等体依据 DTD消息对其第二对等体的 IPSec SA进行查找后反馈的查找结果， 即可获知 该所述第一对等体的 IPSec SA存活情况。 为后续控制操作提供了方便， 例如： 在获知所述第一对等体的 IPSec SA不存在时， 及时删除所述第二对等体相应 的 IPSec SA以触发协商新的安全关联， 而无需等待安全关联的自然老化时间， 以加快双方通信业务的恢复速度， 并且由于无需等待安全关联的自然老化时 间，不存在在等待安全关联的自然老化时间过程中不断发送数据而导致数据丟 失的问题， 节省了 CPU和加密卡资源。 实施例九
本实施例针对上述实施例三，提供了另一种安全关联存活检测装置，其结 构如图 14所示， 包括第二发送单元 131、 第二接收单元 132、 计时单元 143 和触发指示单元 144, 其中：
计时单元 143 , 用于计算没有收到第一对等体的互联网协议安全性 IPSec 流量的持续时间。
触发指示单元 144， 用于当所迷持续时间超过预设门限时， 或者当所述持 续时间超过预设门限且所述装置所在端存在数据报文需要发送时，触发第二发 送单元 131发送所述 DTD消息。
本实施例上述实施例八的基石出上，进一步公开了进行安全关联存活检测的 时机，在 IPSec SA中没有流量的持续时间超过预定门限时马上发送 DTD消息 以进行安全关联检测， 及时性较好。
在其他实施例中， 还可以是在 IPSec SA中没有流量的持续时间超过预定 门限且第二对等体存在需要通过 IPSec SA发送的数据报文时， 才触发发送 DTD消息以进行安全关联检测。 显然， 与上述实施例九相比要更节省资源。
实施例十
本实施例针对上述实施例四和实施例五，提供了另一种安全关联存活检测 装置， 包括第二发送单元 131、 第二接收单元 132、 计时单元 143、 触发指示 单元 144和重发指示单元 155, 其中：
重发指示单元 155用于： 在所述第二发送单元发出 DTD消息后， 所述第 二接收单元没有收到所述对端的响应信息时，指示第二发送单元 131重传所述 DTD消息。
此外， 还可以包括： 计数单元 156和删除指示单元 157， 其中： 计数单元 156, 用于计算所述第二发送单元的重传次数； 删除指示单元 157, 用于在所述重传次数超过预设门限时， 发出删除本与第一对等体的 IKE
SA相应的第二对等体的 IKE SA、 与第一对等体的 IPSec SA相应的第二对等 体的 IPSec SA指示。 本实施例在上述实施例九的基础上进行改进，使用重传的方式来提高通信 可靠性， 并且进一步规定在重传次数超过预定门限时确定所述第一对等体 IPSec SA不存在，如此可以及时触发协商新的安全关联， 以保证通信业务的正 常进行， 而无需等待安全关联的正常老化。
实施例十一
本发明实施例还提供一种安全关联存活检测装置， 包括： 安全关联存活状 态确定单元 161和管理单元 162， 其中：
安全关联存活确定单元 161， 用于向第一对等体发送携带 SPI和协议号的 DTD消息， 以及， 接收所述第一对等体利用所述 SPI、 所述协议号和该 DTD 消息的源 IP与第二对等体的 IPSecSA相应的第一对等体的 IPSecSA进行查找 的查找结果， 并根据查找结果确定所述第一对等体的 IPSec SA的存活状态。
管理单元 162， 用于获取所述安全关联存活确定单元确定的所述第一对等 体的 IPSec SA的存活状态， 当确定与所述第二对等体的 IPSecSA相应的第一 对等体的 IPSecSA相应的 IPSec SA不存在时， 删除所述第二对等体的 IPSec SA。 另外， 还可以确定第一对等体无效时， 删除与第一对等体的 IKE SA相应 的第二对等体的 IKE SA、与第一对等体的 IPSec SA相应的第二对等体的 IPSec SA。
需要说明的是， 安全关联存活确认单元 161的结构可以是上述实施例八、 九和实施例十所提供的安全关联存活检测装置中的任意一个，其具体结构可以 参照图 13、 14和 15。 此外， 本发明实施例七至十一中所述的 DTD消息可以 包括 IKE报文等多种形式。
本实施例公开的安全关联存活检测装置可以设置于两个对等体中的任意 一端， 通过安全关联存活确认单元确认与所述第二对等体的 IPSec SA相应的 第一对等体的 IPSec SA存活情况。 并依据所述第一对等体的 IPSec SA存活情 况进行相应的控制操作， 能够在获知所述第一对等体的 IPSec SA不存在时， 及时删除所述第二对等体的 IPSec SA以触发协商新的安全关联， 而无需等待 安全关联的自然老化时间， 以加快双方通信业务的恢复速度， 并且由于无需等 待安全关联的自然老化时间，不存在在等待安全关联的自然老化时间过程中本 端不断发送数据而导致数据丟失的问题， 节省了 CPU和加密卡资源。
实施例十二
本发明实施例同时还提供一种对等体通信系统， 其结构如图 17所示， 包 括第一对等体 171和第二对等体 172, 第一对等体 171包括第一安全关联存活 检测装置 173， 第二对等体 172包括第二安全关联存活检测装置 174， 其中： 第二安全关联存活检测装置 174用于：发送携带安全协议索引 SPI和协议 号的安全关联存活检测 DTD消息， 以及接收所述第一对等体依据所述 SPI、 所述协议号和所述 DTD消息的源 IP地址对与所述第二对等体的 IPSec SA相 应的第一对等体的 IPSec SA进行的查找后反馈的查找结果， 并依据所述查找 结果确定所述第一对等体的 IPSec SA的存活情况；
第一安全关联存活检测装置 173用于：接收所述 DTD消息，依据所迷 SPI、 所述协议号和所述 DTD消息的源 IP对与所述第二对等体的 IPSecSA相应的第 一对等体的 IPSecSA进行查找， 并将所述查找结果反馈给所述第二对等体。 需要说明的是， 第一安全关联存活检测装置 173可以是上述实施例八、九 和实施例十所提供的安全关联存活检测装置中的任意一个，其具体结构可以参 照图 13、 14和 15。 第二安全关联存活检测装置 174可以是上述实施例七所提 供的安全关联存活检测装置， 具体结构参照图 12。
本实施例公开的系统中的对等体能够发起对对端对等体的安全关联存活 检测， 从而能够获知对端 IPSec SA的存活情况， 提高安全关联存活检测的准 确性。
实施例十三
本发明实施例同时还提供另一种对等体通信系统， 其结构如图 18所示， 包括第一对等体 181和第二对等体 182, 第一对等体 181包括由第一安全关联 存活检测装置 183和管理装置 185 , 第二对等体 182包括第二安全关联存活检 测装置 184, 其中： 第二安全关联存活检测装置 184与上述实施例十二中的同 名装置的功能基本相同，所述安全关联管理装置与上述实施例十一中公开的安 全关联管理装置相同。 此外， 本发明实施例十二至十三中所述的 DTD消息可 以包括 IKE报文等多种形式。
本实施例公开的系统在上述实施例的基础上，进一步增加了安全关联管理 功能， 在获知与所述第二对等体的 IPSec SA相应的第一对等体的的 IPSec SA 不存在时， 及时删除所述第二对等体的 IPSec SA以触发协商新的安全关联， 而无需等待安全关联的自然老化时间， 以加快双方通信业务的恢复速度， 并且 由于无需等待安全关联的自然老化时间，不存在在等待安全关联的自然老化时 间过程中本端不断发送数据而导致数据丟失的问题， 节省了 CPU和加密卡资 源。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到本发明 可借助软件加必需的硬件平台的方式来实现， 当然也可以全部通过硬件来实 施， 但很多情况下前者是更佳的实施方式。基于这样的理解， 本发明的技术方 案对背景技术做出贡献的全部或者部分可以以软件产品的形式体现出来，该计 算机软件产品可以存储在存储介质中， 如 R0M/RAM、 磁碟、 光盘等， 包括若干 指令用以使得一台计算机设备（可以是个人计算机，服务器，或者网络设备等） 执行本发明各个实施例或者实施例的某些部分所述的方法。
最后应说明的是：以上实施例仅用以说明本发明的技术方案而非对其进行 限制，尽管参照较佳实施例对本发明进行了详细的说明， 本领域的普通技术人 员应当理解： 其依然可以对本发明的技术方案进行修改或者等同替换， 而这些 修改或者等同替换亦不能使修改后的技术方案脱离本发明技术方案的精神和 范围。

Claims

权 利 要 求
1、 一种安全关联存活检测方法， 其特征在于， 包括：
接收第二对等体发送的携带安全协议索引 SPI和协议号的安全关联存活 检测 DTD消息；
依据所述 SPI、 所述协议号和所述 DTD消息的源互联网协议 IP地址查找 与第二对等体中的互联网协议安全关联 IPSec SA相应的第一对等体的 IPSec SA;
将所述查找的结果反馈给第二对等体，以便第二对等体依据所述查找结果 确定所迷第一对等体的 IPSec SA的存活情况。
2、 如权利要求 1所述的方法， 其特征在于， 所述 DTD消息包括互联网密 钥协议 IKE报文。
3、 一种安全关联存活检测方法， 其特征在于， 包括：
向第一对等体发送携带安全协议索引 SPI和协议号的安全关联存活检测 DTD消息；
接收所述第一对等体依据所述 SPI、 所述协议号和所述 DTD消息的源 IP 查找与第二对等体的 IPSec SA相应的第一对等体的 IPSec SA后反馈的查找结 果；
依据所述查找结果确定所述第一对等体的 IPSecSA的存活情况。
4、 如权利要求 3所述的方法， 其特征在于， 还包括：
当确定所述第一对等体的 IPSec SA不存在时， 删除所述第二对等体中与 第一对等体的 IPSec SA相应的 IPSec SA。
5、 如权利要求 3所述的方法， 其特征在于， 所述向第一对等体发送携带 安全协议索引 SPI和协议号的安全关联存活检测 DTD消息包括：
当没有收到第一对等体的 IPSec流量的持续时间超过预设门限时， 向所述 第一对等体发送携带安全协议索引 SPI和协议号的安全关联存活检测 DTD消 息。
6、 如权利要求 3所述的方法， 其特征在于， 所述向第一对等体发送携带 安全协议索引 SPI和协议号的安全关联存活检测 DTD消息包括：
当没有收到第一对等体的 IPSec流量的持续时间超过预设门限，且存在数 据报文需要发送时，向所述第一对等体发送所述携带安全协议索引 SPI和协议 号的安全关联存活检测 DTD消息。
7、 如权利要求 3-6任意一项所述的方法， 其特征在于， 所述 DTD消息包 括 IKE报文。
8、 一种安全关联存活检测装置， 其特征在于， 包括：
第一接收单元，用于接收第二对等体发送的携带安全协议索引 SPI和协议 号的安全关联存活检测 DTD消息；
查找单元， 用于侬据所述 SPI、 所述协议号和所述 DTD消息的源 IP地址 查找与第二对等体的 IPSec SA相应的第一对等体的 IPSec SA;
第一发送单元，用于获取所述查找单元的查找结果并反馈给所述第二对等 体， 以便所述第二对等体依据所述查找结果确定所述第一对等体的 IPSec SA 的存活情况。
9、 如权利要求 8所述的装置， 其特征在于， 所述 DTD消息包括 IKE报 文。
10、 一种安全关联存活检测装置， 其特征在于， 包括：
第二发送单元，用于向第一对等体发送携带安全协议索引 SPI和协议号的 安全关联存活检测 DTD消息；
第二接收单元， 用于接收所述第一对等体依据所述 SPI、 所述协议号和所 述 DTD消息的源 IP地址查找与第二对等体的 IPSec SA相应的第一对等体的 IPSec SA后反馈的查找结果，并依据查找结果确定所述第一对等体的 IPSec SA 的存活情况。
11、 如权利要求 10所述的装置， 其特征在于， 还包括：
管理单元， 用于当所述第二接收单元确定所述第一对等体的 IPSec SA不 存在时， 删除所述第二对等体中与第一对等体的 IPSec SA相应的 IPSec SA。
12、 如权利要求 10所述的装置， 其特征在于， 还包括： 计时单元， 用于计算没有收到所述第一对等体的 IPSec流量的持续时间； 触发指示单元， 用于当所述持续时间超过预设门限时，或者当所述持续时 间超过预设门限且第二对等体存在数据报文需要发送时，触发所述第二发送单 元发送所述 DTD消息。
13、 如权利要求 10-12任意一项所述的装置， 其特征在于， 所述 DTD消 息包括 IKE报文。
14、 一种对等体通信系统， 其特征在于， 包括第一对等体和第二对等体， 所述第一对等体包括第一安全关联存活检测装置，所述第二对等体包括第二安 全关联存活检测装置， 其中：
所述第二安全关联存活检测装置用于：发送携带安全协议索引 SPI和协议 号的安全关联存活检测 DTD消息， 以及接收所述第一对等体依据所述 SPI、 所述协议号和所述 DTD消息的源 IP地址对与所述第二对等体的 IPSec SA相 应的第一对等体的 IPSec SA进行的查找后反馈的查找结果， 并依据所述查找 结果确定所述第一对等体的 IPSec SA的存活情况；
所述第一安全关联存活检测装置用于：接收所述 DTD消息，依据所述 SPI、 所述协议号和所述 DTD消息的源 IP对与所述第二对等体的 IPSecSA相应的第 一对等体的 IPSecSA进行查找， 并将所述查找结果反馈给所述第二对等体。
15、 如权利要求 16所述的系统， 其特征在于， 所述第二对等体还包括： 管理装置，用于获取所述第二安全关联存活检测装置的检测结果， 当确定 与所述第二对等体的 IPSec SA相应的第一对等体的 IPSec SA不存在时， 删除 所述第二对等体中与第一对等体的 IPSec SA相应的 IPSec SA。
16、 如权利要求 14或 15所述的系统， 其特征在于， 所述 DTD消息包括 IKE 报文。
PCT/CN2011/070629 2010-02-04 2011-01-26 安全关联存活检测方法、装置和系统 WO2011095097A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201010113705.6 2010-02-04
CN201010113705.6A CN102148810B (zh) 2010-02-04 2010-02-04 安全关联存活检测方法、装置和系统

Publications (1)

Publication Number Publication Date
WO2011095097A1 true WO2011095097A1 (zh) 2011-08-11

Family

ID=44354963

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2011/070629 WO2011095097A1 (zh) 2010-02-04 2011-01-26 安全关联存活检测方法、装置和系统

Country Status (2)

Country Link
CN (1) CN102148810B (zh)
WO (1) WO2011095097A1 (zh)

Families Citing this family (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102571497B (zh) * 2012-01-29 2016-03-30 华为技术有限公司 一种IPSec隧道故障检测的方法、装置及系统
CN103716196B (zh) * 2012-09-28 2018-10-09 新华三技术有限公司 一种网络设备及探测方法
CN102904901B (zh) * 2012-10-29 2015-07-29 杭州华三通信技术有限公司 同步IPsec SA的方法、组成员及组密钥服务器
CN102946333B (zh) * 2012-10-31 2015-12-02 杭州华三通信技术有限公司 一种基于IPsec的DPD探测方法和设备
CN103179225B (zh) * 2013-03-18 2016-12-28 杭州华三通信技术有限公司 一种基于IPsec的NAT表项保活方法和设备
CN103237028B (zh) * 2013-04-22 2016-06-29 杭州华三通信技术有限公司 一种删除Child SA的方法和设备
CN104023022B (zh) * 2014-06-13 2017-08-08 新华三技术有限公司 一种IPSec SA的获取方法和装置
CN104125151A (zh) * 2014-08-06 2014-10-29 汉柏科技有限公司 一种IPSec报文转发的方法及系统
CN106034014B (zh) * 2015-03-19 2020-09-15 中兴通讯股份有限公司 一种实现丢包请求重传的方法、接收装置和发送装置
CN106487802B (zh) * 2016-11-07 2019-09-17 杭州迪普科技股份有限公司 基于DPD协议的IPSec SA的异常探测方法及装置
CN106685701B (zh) * 2016-12-06 2019-12-06 杭州迪普科技股份有限公司 断开IPSec VPN连接方法及装置
CN107682284B (zh) * 2017-08-02 2021-06-01 华为技术有限公司 发送报文的方法和网络设备
CN109547487A (zh) * 2018-12-28 2019-03-29 北京奇安信科技有限公司 消息处理方法、装置及系统
CN109802954A (zh) * 2018-12-29 2019-05-24 北京奇安信科技有限公司 一种用于数据传输中对IPSec SA进行删除的方法及装置
CN110061965B (zh) * 2019-03-13 2022-08-26 北京华为数字技术有限公司 更新安全联盟的方法、装置、设备及可读存储介质
CN111711636A (zh) * 2020-06-28 2020-09-25 杭州安恒信息技术股份有限公司 一种主机存活检测的方法、系统、设备及可读存储介质

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060248583A1 (en) * 2005-04-27 2006-11-02 Atsushi Inoue Communication apparatus and communication method and computer readable medium
CN101521602A (zh) * 2008-02-29 2009-09-02 上海博达数据通信有限公司 利用IKE监测IPSec VPN中通信节点状态的实现方法

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1764970A1 (en) * 2005-09-19 2007-03-21 Matsushita Electric Industrial Co., Ltd. Multiple interface mobile node with simultaneous home- and foreign network connection

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060248583A1 (en) * 2005-04-27 2006-11-02 Atsushi Inoue Communication apparatus and communication method and computer readable medium
CN101521602A (zh) * 2008-02-29 2009-09-02 上海博达数据通信有限公司 利用IKE监测IPSec VPN中通信节点状态的实现方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
WANG ZHIMIN: "Study and Implementation of IPSec", CHINESE DOCTOR DISSERTATIONS & MASTER'S THESES FULL-TEXT DATABASE (MASTER) INFORMATION SCIENCE TECHNOLOGY, 15 June 2005 (2005-06-15), pages I139 - I220 *

Also Published As

Publication number Publication date
CN102148810B (zh) 2014-03-12
CN102148810A (zh) 2011-08-10

Similar Documents

Publication Publication Date Title
WO2011095097A1 (zh) 安全关联存活检测方法、装置和系统
US10616379B2 (en) Seamless mobility and session continuity with TCP mobility option
US11570098B2 (en) Systems, apparatuses and methods for cooperating routers
CA2611776C (en) Method and communication unit for communicating between communication apparatuses
US10530644B2 (en) Techniques for establishing a communication connection between two network entities via different network flows
Thornburgh Adobe's Secure Real-Time Media Flow Protocol
US20140095862A1 (en) Security association detection for internet protocol security
WO2009082889A1 (fr) Procédé de négociation pour échange de clés internet et dispositif et système associés
CN104184646A (zh) Vpn网络数据交互方法和系统及其网络数据交互设备
TWM315862U (en) Wireless transmit/receive unit
WO2005112349A1 (en) A method for redialing quickly to the broad band network of users
US20230171191A1 (en) Systems, Apparatuses and Methods for Cooperating Routers
WO2006097031A1 (fr) Procede de transmission de message dans le reseau du protocole internet mobile
JP2006352500A (ja) 自動鍵交換処理装置および自動鍵交換処理方法
WO2011127761A1 (zh) 主机标识协议安全通道复用方法及装置
CN102025742A (zh) 一种ike报文的协商方法和设备
EP3539235B1 (en) Systems, apparatuses and methods for cooperating routers
WO2018120799A1 (zh) 一种慢协议报文处理方法及相关装置
WO2007118381A1 (fr) Procédé, système et appareil de transfert de message syslog
WO2011044810A1 (zh) 实现多方通信的方法、装置及系统
JPWO2019145379A5 (zh)
JP4013920B2 (ja) 通信システム、通信装置及びその動作制御方法並びにプログラム
JP4805185B2 (ja) ゲートウェイ装置およびセッション管理方法
Thornburgh RFC 7016: Adobe's Secure Real-Time Media Flow Protocol
CN106685701B (zh) 断开IPSec VPN连接方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 11739376

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 11739376

Country of ref document: EP

Kind code of ref document: A1