WO2013071821A1

WO2013071821A1 - Security policy delivery method and network element and system for implementing same

Info

Publication number: WO2013071821A1
Application number: PCT/CN2012/083791
Authority: WO
Inventors: 颜正清; 张世伟; 符涛
Original assignee: 中兴通讯股份有限公司
Priority date: 2011-11-15
Filing date: 2012-10-31
Publication date: 2013-05-23
Also published as: CN103108302B; CN103108302A

Abstract

Disclosed are a security policy delivery method and a network element and a system for implementing same, which can implement a same security policy for a user throughout a network. The method comprises: after receiving a location registration request of a user from an access server (ASR), an identity location register (ILR) sending a message indicating a new location of the user to a policy server (PS); and after receiving the message indicating the new location of the user from the ILR, the PS sending a security policy related to the user to a security execution entity for the current location of the user. The system comprises an ILR and a PS. The ILR comprises a receiving module and a sending module. The PS comprises a receiving module and a sending module.

Description

Security policy delivery method and network element and system for implementing the same

Technical field

The present invention relates to the field of mobile communications and the Internet, and specifically relates to a method for issuing a security policy and a network element and system for implementing the method. Background technique

With the convergence of networks and the development trend of all-IP, security issues are becoming more and more serious. At the same time, the corresponding variety of security devices are also emerging. At present, traditional security devices have been developed in the direction of high capacity and high performance, mainly dealing with security threats at the network layer. A variety of application-level security devices and inspection devices are also deployed on the network to protect against security threats at all levels of the network.

Traditional security devices mainly have basic functions such as packet filtering, network address translation (NAT), anti-DDoS (distributed denial of service) attacks, and anti-aliased packet attacks. They can defend against network layer security. Threat. With the development of the network and the richness of network applications, the attack technology for the application layer has developed rapidly. Security devices that defend against these application layer attacks, such as IDS (Intrusion Detection System), IPS (Intrusion Protection System), and UTM (Unified Threat Management) devices, are also emerging.

As people's awareness of security protection becomes stronger and stronger, security devices are deployed at various nodes of the network, enhancing the protection of the network. At the same time, the security device is deployed in a unified manner as shown in Figure 1. The security policy server can communicate with the security enforcement entity (or the security device) to implement the security policy delivery and reduce the manual maintenance security device. the cost of.

But with the development of mobile networks, more and more users are moving between different networks. In the existing network, due to the ambiguity of the IP address (which represents both the identity of the user and the location of the user), the user accesses at different network nodes, and the obtained IP address is different. The existing policy delivery mechanism can only send security policies to fixed users on a single security device, and cannot deliver the same security policy to multiple security devices for mobile users. That is, the security policy server cannot The security device in the different nodes accessed by the user delivers a security policy based on the user. In summary, due to user mobility, the identity (IP) changes, and the existing security policy delivery mechanism cannot solve the problem of implementing the same security policy for the entire network.

Summary of the invention

The embodiment of the invention provides a security policy delivery method, which can implement the same security policy for the entire network.

The method for issuing the security policy includes:

After receiving the user location registration request sent by the access server (ASR), the identity and location registration register (ILR) sends a message to the policy server (PS) indicating the new location of the user; the PS receives the ILR transmission After the message indicating the new location of the user, the security policy related to the user is sent to the security enforcement entity where the current location of the user is located.

Preferably, after the ILR receives the user location registration request, the method further includes: the ILR updating the mapping relationship between the locally stored access identifier and the location of the user.

Preferably, after the PS receives the message indicating the new location of the user sent by the ILR, the method further includes: the PS recording the current location of the user.

Preferably, the PS sends a security policy related to the user to the security enforcement entity where the current location of the user is located, including: the PS first determines whether the location of the user changes, and if a change occurs, the current location of the user is located. The security enforcement entity sends a security policy associated with the user.

Preferably, the security enforcement entity includes: a security gateway (SG) or an ASR with an SG function.

The embodiment of the invention further provides a security policy delivery system, which can implement the same security policy for the entire network.

The security policy is delivered by the system, including an identity and location registration register (ILR) and a policy server (PS), where:

The ILR is configured to send a message indicating a new location of the user to the PS after receiving the user location registration request sent by the access server (ASR); The PS is configured to, after receiving the message indicating the new location of the user sent by the ILR, send a security policy related to the user to the security enforcement entity where the current location of the user is located.

Preferably, the PS is further configured to record the current location of the user after receiving the message indicating the new location of the user sent by the ILR.

Preferably, the PS is configured to send a security policy related to the user to the security execution entity where the current location of the user is located in the following manner: first, determine whether the user location changes, and if there is a change, then to the user current The security enforcement entity where the location is located sends the security policy associated with the user.

The embodiment of the present invention further provides an identity identification and location registration register (ILR) to enable the security policy server to know when to issue a security policy to the security enforcement entity.

The identity and location registration register (ILR) includes a receiving module and a transmitting module, wherein:

The receiving module is configured to receive a user location registration request sent by an access server (ASR);

The sending module is configured to send a message indicating a new location of the user to the policy server (PS) after the receiving module receives the user location registration request.

Preferably, the ILR further includes a saving module, configured to update a mapping relationship between the locally stored access identifier and the location of the user after the receiving module receives the user location registration request.

The embodiment of the invention further provides a policy server (PS), which implements an security policy delivery system, and can implement the same security policy for the user on the entire network.

The policy server (PS) includes a receiving module and a sending module, where: the receiving module is configured to receive a message sent by an identity identifier and a location registration register (ILR) indicating a new location of the user; The sending module is configured to send, after the receiving module receives the message indicating the new location of the user, a security policy related to the user to the security performing entity where the current location of the user is located.

Preferably, the PS further includes a saving module configured to record the current location of the user after the receiving module receives the message indicating the new location of the user sent by the ILR.

Preferably, the PS further includes a determining module configured to receive the at the receiving module

After the ILR sends a message indicating the new location of the user, it is determined whether the location of the user changes. If the change occurs, the notification sending module sends a security policy related to the user to the security enforcement entity where the current location of the user is located.

The embodiment of the present invention combines the identity identification and the location separation network, and the ILR queries the user location information according to the AID setting. When the user location changes, the ILR can notify the PS to timely deliver the security based on the user AID to the security device at the location of the user. The policy uses the network-wide uniqueness of the user identification identifier (AID) to deliver the user-based network-wide security policy. BRIEF abstract

FIG. 1 is a schematic diagram of a security policy delivery;

Figure 2 shows the system architecture diagram of the SILSN;

FIG. 3 is a flowchart of dynamically transmitting a user-based security policy on the entire network according to an embodiment of the present invention; FIG. 4 is a flowchart of an application example of the present invention;

FIG. 5 is a schematic structural diagram of a system for implementing security policy delivery according to an embodiment of the present invention.

Preferred embodiment of the invention

Considering the user identification identifier (Access Identification, in the identity and location separation network)

AID) has the uniqueness of the whole network, which creates a prerequisite for the dynamic security policy of the whole network. Figure 2 is an architectural diagram of the identity and location separation network, in this figure, the identity and location separation system (Subscriber Identifier & Locator Separation Network, SILSN for short) is accessed by Access Service Router (ASR) and User Equipment (UE), Identity and Location Register (ILR), and Authentication Center (AC) and other components. The access servers ASR1 and ASR2 are respectively used to access the user terminal devices UE1 and UE2, and are responsible for implementing access for the user terminal, and performing functions such as charging, switching, and security. The ILR assumes the user's location registration and identification capabilities. The AC assumes the user access authentication function. UE1 and UE2 have unique identity identifiers AID 1 and AID2, respectively.

The network shown in Figure 2 has the following characteristics: Each user in the network can only access after strict authentication. When sending each data packet, the user carries its own real user access identifier AID. This symbol is only assigned to The user uses and is unique to the entire network. The data packets sent by users in various services always carry this identifier. Each data packet sent by the user must be authenticated by the access server ASR to ensure that the data packets sent by the user are carried. It is its own access identity, it will not impersonate other users' AIDs to access the network, and this identifier will remain unchanged when transmitted within the network. This identifier will not change when the user moves or switches.

In Figure 2, users UE1 and UE2 access the network through ASR1 and ASR2 respectively, and need to perform access authentication through the AC. After the authentication is successful, ASR will report the user's location information to the ILR. The ILR informs the PS (Policy Server) to inform the user of the new location information (for example, the RID of the ASR), and the PS delivers a security policy based on the user to the corresponding security device according to the new location of the user. By observing the location information of the user by the ILR, when the ASR registers with the ILR or updates the location information of the user, the ILR notifies the new location of the PS user, so that the PS sends a security policy based on the user to the security device in the new location where the user is currently located. A user-based security policy delivery mechanism that implements dynamic network dynamics.

Embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be noted that, in the case of no conflict, the features in the embodiments and the embodiments in the present application may be arbitrarily combined with each other.

As shown in Figure 3, the following steps are included:

Step 301: After receiving the user location registration request sent by the ASR, the ILR sends a message indicating the new location of the user to the PS.

Preferably, after receiving the user location registration request, the ILR also updates the mapping relationship between the locally stored access identifier and the location of the user. Step 302: After receiving the message sent by the ILR indicating the new location of the user, the PS sends a security policy related to the user to the security enforcement entity where the current location of the user is located.

Specifically, after receiving the message sent by the ILR indicating the new location of the user, the PS records the current location of the user, and sends a security policy related to the user to the security enforcement entity where the current location of the user is located. The security enforcement entity includes: SG or the ASR with SG function.

Generally, the ILR sends the current location of the user to the PS when the user's location changes. However, for program optimization, preferably, after receiving the message of the ILR, the PS first determines whether the user location changes, and if a change occurs, Send the security policy related to the user to the security enforcement entity where the user's current location is located. If no change occurs, it will not be sent.

Regarding the relationship between SG and ASR, SG can be deployed independently of ASR, and the functions of SG can also be integrated into ASR. If the SG is deployed separately from the ASR, the PS needs to maintain an association table between the SG and the ASR. When the user moves to the location of the ASR, the PS needs to find the SG of the location according to the location of the ASR, and then issue a security policy.

Application example

Figure 4 shows an embodiment of a security policy issued in an identity and location separation network. The user first sends an ASR1 access, and the PS (Policy Server) sends a security policy related to the user to the SG (Security Gateway) 1. After the user moves to the ASR2, the ILR informs the PS that the user has moved to the ASR2, and the PS sends the security policy related to the user to the SG2, and deletes the security policy related to the user on the SG1.

In Figure 4, the security device SG can be a standalone device or integrate the functions of the security device into the ASR.

S400: The user goes online on the ASR1, and the ASR1 sends the location registration request of the user to the ILR.

S404, the ILR receives the location registration request of the user, and sends a location registration request response to the ASR1 after completing the registration;

S408, the ILR notifies the PS, informs the user of the location, and the PS records the location of the user;

S412. The PS sends the user-related security policy to the SG1 where the user is located according to the location of the user. S416: The SGI receives a security policy related to the user, and sends a security policy to send a response message to the PS.

S420, the user moves from ASR1 to ASR2, and ASR2 sends a user location registration request to the ILR;

S424. After receiving the user location registration request sent by the ASR2, updating the user identity and the location mapping relationship, the ILR sends a user location registration request response to the ASR2.

S428. After updating the identity and location mapping relationship of the user, the ILR sends a message of changing the location of the user to the PS, and carries the new location information of the user.

S432, the PS receives the user location change message, and compares with the original location of the user. If the change occurs, the user sends the security policy related to the user to the SG2 where the user is located.

S436. The SG2 sends a security policy response message to the PS.

S440, the PS sends the user-related security policy deletion command to the SG1.

S444, SG1 sends a command response to the PS.

The above process completes the process of releasing the security policy related to the user during the process of the user going online from the ASR1 and then moving to the ASR2.

A system for implementing the foregoing security policy delivery method, as shown in FIG. 5, includes an ILR and a PS, where: the ILR is configured to send a message indicating a new location of the user to the PS after receiving the user location registration request sent by the ASR. ;

The PS is configured to, after receiving the message indicating the new location of the user sent by the ILR, send a security policy related to the user to the security enforcement entity where the current location of the user is located.

Specifically, the foregoing ILR includes a first receiving module and a first sending module, where:

a first receiving module, configured to receive a user location registration request sent by the ASR;

The first sending module is configured to send a message indicating the new location of the user to the PS after the first receiving module receives the user location registration request.

Preferably, the ILR further includes a first saving module, configured to update a mapping relationship between the locally stored access identifier and the location of the user after the first receiving module receives the user location registration request.

Specifically, the foregoing PS includes a second receiving module and a second sending module, where: a second receiving module, configured to receive a message sent by the ILR to indicate a new location of the user; and a second sending module, configured to: after the second receiving module receives the message indicating the new location of the user, the security of the current location of the user The executing entity sends a security policy related to the user.

Preferably, the PS further includes a second saving module configured to record the current location of the user after the second receiving module receives the message sent by the ILR indicating the new location of the user.

Preferably, the PS further includes a determining module, configured to: after the second receiving module receives the message indicating the new location of the user sent by the ILR, determining whether the user location changes, and if the change occurs, notifying the second sending module to the The security enforcement entity where the user's current location is located sends the security policy associated with the user.

The above security enforcement entities include: SG or ASR with SG function.

One of ordinary skill in the art will appreciate that all or a portion of the above steps may be accomplished by a program instructing the associated hardware, such as a read-only memory, a magnetic disk, or an optical disk. Alternatively, all or part of the steps of the above embodiments may also be implemented using one or more integrated circuits. Correspondingly, each module/unit in the above embodiment may be implemented in the form of hardware or in the form of a software function module. The invention is not limited to any specific form of combination of hardware and software.

It is a matter of course that the invention may be embodied in various other forms and modifications without departing from the spirit and scope of the invention.

Industrial Applicability The embodiment of the present invention combines the identity identification and the location separation network, and the ILR queries the user location information according to the AID setting. When the user location changes, the ILR can promptly notify the PS to deliver the security device based on the location to the user. The security policy of the AID is based on the network-wide security policy of the user AID.

Claims

Claim

1. A security policy delivery method, including:

2. The method of claim 1 wherein:

After the ILR receives the user location registration request, the method further includes: the ILR updating a mapping relationship between the locally stored access identifier and the location of the user.

3. The method of claim 1 wherein:

After the PS receives the message indicating the new location of the user that is sent by the ILR, the method further includes:

The PS records the current location of the user.

4. The method of claim 1 or 3, wherein:

The PS sends a security policy related to the user to the security enforcement entity where the current location of the user is located, including:

The PS first determines whether the location of the user changes, and if a change occurs, sends a security policy related to the user to the security enforcement entity where the user is currently located.

5. The method of claim 1 wherein:

The security enforcement entity includes: a security gateway (SG) or an ASR with SG functionality.

6. A security policy delivery system, including an identity and location registration register (ILR) and a policy server (PS), wherein:

The ILR is configured to: after receiving a user location registration request sent by an access server (ASR), send a message to the PS indicating a new location of the user;

The PS is configured to: after receiving the message indicating the new location of the user sent by the ILR, send a security policy related to the user to the security execution entity where the current location of the user is located.

7. The system of claim 6 wherein:

The PS is further configured to: record the current location of the user after receiving the message indicating the new location of the user sent by the ILR.

8. The system of claim 6 or 7, wherein:

The PS is configured to send a security policy related to the user to the security enforcement entity where the current location of the user is located in the following manner: first, determine whether the user location changes, and if there is a change, then the security of the current location of the user The executing entity sends a security policy related to the user.

9. The system of claim 7 or 8, wherein:

10. An identity and location register (ILR), comprising a receiving module and a transmitting module, wherein:

The receiving module is configured to: receive a user location registration request sent by an access server (ASR);

The sending module is configured to: after the receiving module receives the user location registration request, send a message indicating a new location of the user to the policy server (PS).

11. The ILR of claim 10, wherein:

The ILR further includes a saving module configured to update a locally stored mapping relationship between the access identifier of the user and the location after the receiving module receives the user location registration request.

12. A policy server (PS), comprising: a receiving module and a sending module, wherein: the receiving module is configured to: receive a message sent by an identity identifier and a location registration register (IRR) indicating a new location of the user;

The sending module is configured to: after the receiving module receives the message indicating the new location of the user, send a security policy related to the user to the security executing entity where the current location of the user is located.

13. The PS of claim 12, wherein:

The PS further includes a saving module, configured to: after the receiving module receives the message sent by the ILR indicating the new location of the user, record the current location of the user.

14. The PS of claim 12, wherein: The PS further includes a determining module, configured to: after the receiving module receives the message indicating the new location of the user sent by the ILR, determine whether the user location changes, and if the change occurs, notify the sending module to the user The security enforcement entity where the current location is located sends the security policy associated with the user.

15. The PS of claim 14 wherein: