WO2015131609A1 - 一种实现L2TP over IPsec接入的方法 - Google Patents

一种实现L2TP over IPsec接入的方法 Download PDF

Info

Publication number
WO2015131609A1
WO2015131609A1 PCT/CN2014/094002 CN2014094002W WO2015131609A1 WO 2015131609 A1 WO2015131609 A1 WO 2015131609A1 CN 2014094002 W CN2014094002 W CN 2014094002W WO 2015131609 A1 WO2015131609 A1 WO 2015131609A1
Authority
WO
WIPO (PCT)
Prior art keywords
l2tp
address
user
ipsec
packet
Prior art date
Application number
PCT/CN2014/094002
Other languages
English (en)
French (fr)
Inventor
臧亮
唐骁琨
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2015131609A1 publication Critical patent/WO2015131609A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/164—Implementing security features at a particular protocol layer at the network layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general

Definitions

  • the present invention relates to the field of communications technologies, and in particular, to a method for implementing L2TP over IPsec access and an L2TP network server (LNS).
  • LNS L2TP network server
  • IPsec Internet Protocol Security
  • IPsec Internet Protocol Security
  • IETF Internet Engineering Task Force
  • L2TP Layer 2 Tunneling Protocol
  • IPsec IP Security
  • NAT Network Address Translation
  • IPsec IP Security
  • the IETF defines a UDP encapsulation method for IPsec packets. The main design idea is to encapsulate the UDP header with port number 4500 before the IPsec header to help IPsec packets traverse the NAT device.
  • IPsec encapsulates packets in two modes, tunnel mode and transport mode.
  • the tunnel mode encrypts the IP header and payload and adds a new IP header encapsulation.
  • the transport mode retains the original IP header and only encrypts the payload portion.
  • L2TP over IPsec uses the transmission mode.
  • an L2TP network server establishes an L2TP over IPsec connection with a UE under a plurality of CPEs (Customer Premise Equipment), and different CPEs may have the same private network address space.
  • CPEs Customer Premise Equipment
  • NAT on the CPE device Processing, converting the private network IP into a public network IP.
  • IP4 destination IP address
  • IP4 source IP address
  • IP header 1 of UE2 includes: IP1 (destination IP address) and IP5 (source IP address); after IPsec processing, the IP header remains unchanged, and the IP headers of UE1 and UE2 after NAT conversion (IP Head1) becomes the new IP header (IP Head2), in which the destination IP address remains unchanged (or IP1), and the source IP address becomes the public IP address (IP2). Therefore, the LNS cannot distinguish between different user terminals under the same CPE.
  • the embodiment of the present invention provides a method for implementing L2TP over IPsec access and an L2TP network server, which can implement differentiating L2TP over IPsec access users by L2TP network server (LNS) in a network where a NAT device exists.
  • LNS L2TP network server
  • a method for implementing L2TP over IPsec access is applied to an L2TP network server, and the method includes:
  • NAT network address translation
  • IKE Internet Key Exchange
  • the private IP address of the user is found, the private IP address of the user and the destination IP address of the L2TP packet are used as an index to match the IPsec security policy database. .
  • the L2TP network server includes an IPsec module and an L2TP module;
  • the IP address of the private network of the user is saved when the packet is an L2TP packet and the NAT device is received, including:
  • the IPsec module receives and encrypts the encrypted packet into the IPsec, and determines that the packet is an L2TP packet and the private network IP address of the user who sent the packet is read from the IPsec security association.
  • the private IP address of the user is sent to the L2TP module together with the decrypted packet;
  • the L2TP module After receiving the private network IP address and the decrypted packet sent by the IPsec module, the L2TP module saves the private network IP address of the user.
  • the IPsec module sends the private IP address of the user and the decrypted packet to the L2TP module, including:
  • the IPsec module sends the private IP address of the user as a cookie and the decrypted message to the L2TP module.
  • the L2TP module saves the private network IP address of the user, and the L2TP module saves the private network IP address of the user in the L2TP session table.
  • Security policy library including:
  • the L2TP module reads the private IP address of the user from the L2TP session table before sending the L2TP packet to the L2TP over IPsec access user. If the IP address is successfully read, the private IP address of the user is used as the cookie. And sent to the IPsec module together with the L2TP packet;
  • the IPsec module After receiving the cookie and the L2TP packet sent by the L2TP module and including the private IP address of the user, the IPsec module uses the private IP address of the user and the destination IP address of the L2TP packet as an index. Match the IPsec security policy library.
  • An L2TP network server including:
  • a negotiating device configured to determine that a network address translation (NAT) device exists on the user side during an Internet Key Exchange (IKE) negotiation process with a network protocol security-based Layer 2 Tunneling Protocol (L2TP over IPsec) access user
  • IKE Internet Key Exchange
  • L2TP over IPsec Layer 2 Tunneling Protocol
  • the inbound packet processing device is configured to: receive and encrypt the encrypted packet into the IPsec, and save the private network IP address of the user when the packet is determined to be an L2TP packet and passes through the NAT device. ;
  • the outgoing message processing device is configured to: before the L2TP message is sent to the user, if the private network IP address of the user is found, the private network IP address of the user and the destination of the L2TP message are used.
  • the IP address is used as an index to match the IPsec security policy library.
  • the inbound message processing device and the outgoing message processing device both include an IPsec module and an L2TP module;
  • the IPsec module is configured to: receive and decrypt the IPsec encrypted message, and determine that the packet is an L2TP packet and the private network IP address of the user who sent the packet is read from the IPsec security association. Sending the private network IP address of the user to the L2TP module together with the decrypted message;
  • the L2TP module is configured to save the private network IP address of the user after receiving the private network IP address and the decrypted message sent by the IPsec module.
  • the cookie is sent to the L2TP module along with the decrypted message.
  • the L2TP module is configured to save the private network IP address of the user in an L2TP session table.
  • the L2TP module is configured to read the private network IP address of the user from the L2TP session table before sending the L2TP packet to the L2TP over IPsec access user, and if the packet is successfully read, the private network IP of the user is obtained.
  • the address is sent to the IPsec module as a cookie and the L2TP message;
  • the IPsec module is configured to use the private IP address of the user and the destination IP address of the L2TP packet as an index after receiving the cookie and the L2TP packet sent by the L2TP module, including the private IP address of the user. Go to match the IPsec security policy library.
  • Embodiments of the present invention also provide a computer program, including program instructions, that when executed by an L2TP network server, cause the L2TP network server to perform the method described above.
  • An embodiment of the invention is a computer readable storage medium storing the computer program.
  • the embodiment of the present invention can implement the distinction between the L2TP network server (LNS) and the L2TP over IPsec access users in the networking where the NAT device exists.
  • LNS L2TP network server
  • FIG. 1 is a typical networking diagram of L2TP over IPsec in the related art.
  • IP packet format of an L2TP packet before and after IPsec and NAT conversion in the related art is an IP packet format of an L2TP packet before and after IPsec and NAT conversion in the related art.
  • FIG. 3 is a flowchart of a method for implementing L2TP over IPsec access according to an embodiment of the present invention.
  • FIG. 4 is a schematic structural diagram of an LNS according to an embodiment of the present invention.
  • Figure 5 shows the IKE negotiation process for L2TP over IPsec user access.
  • Figure 6 is a flow chart of the LNS processing the incoming message.
  • FIG. 7 is a flow chart when the LNS sends a message to the packet.
  • the embodiment of the present invention provides a method for implementing L2TP over IPsec access, which is applied to a Layer 2 tunneling protocol L2TP network server, and the method includes:
  • S20 Receive and encrypt the packet to the IPsec and decrypt the packet. After determining that the packet is an L2TP packet and passes through the NAT device, save the private network IP address of the user.
  • the IPsec security policy library is a data structure for indicating which security service the IP data message should be applied to and how to obtain the service.
  • An IPsec security association is a secure connection created for security purposes. All data flows that pass the same secure connection receive the same security services.
  • the IPsec security association is generated through IKE negotiation. After the generation, a certain record of the IPsec security policy database points to the IPsec security association.
  • the step S10 may further include:
  • the public network IP address of the user and the public IP address of the L2TP network server are used as IPsec security.
  • the inbound and outbound packets are encrypted and decrypted.
  • the packet is determined to be an L2TP packet and the NAT device is passed, the private network IP address of the user is saved, which may include:
  • the IPsec module receives and encrypts the encrypted packet into the IPsec.
  • the packet is determined to be an L2TP packet and the private network IP address of the user who sends the packet is read from the IPsec security association, the user's The private network IP address is sent to the L2TP module together with the decrypted packet.
  • the L2TP module After receiving the private IP address and the decrypted packet sent by the IPsec module, the L2TP module saves the private IP address of the user.
  • the L2TP network server may include an IPsec module and an L2TP module.
  • the IPsec module sends the private IP address of the user and the decrypted packet to the L2TP module, including:
  • the IPsec module sends the private IP address of the user as a cookie and the decrypted message to the L2TP module.
  • the user's private network IP is passed as a cookie, and the L2TP module does not perceive the format and content.
  • the L2TP module saves the private IP address of the user, and the L2TP module saves the private IP address of the user in the L2TP session table.
  • the IPsec module needs to pass the user's private IP address as a cookie to the L2TP module because the L2TP over IPsec user in the NAT traversal scenario uses the private IP address of the user and the public IP address of the CPE.
  • the public network IP address is used as an index of the IPsec security policy library.
  • the private network IP address of the user is found, the private network IP address of the user and the destination IP address of the L2TP packet are used as the destination IP address of the L2TP packet.
  • the index matches the IPsec security policy library and can include:
  • the L2TP module reads the private IP address of the user from the L2TP session table before sending the L2TP packet to the L2TP over IPsec access user. If the L2TP packet is successfully read, the private IP address of the user and the L2TP are obtained. The message is sent to the IPsec module together;
  • the IPsec module After receiving the private network IP address and the L2TP packet sent by the L2TP module, the IPsec module uses the private IP address of the user and the destination IP address of the L2TP packet as an index to match the IPsec security policy database.
  • the L2TP module sends the private IP address of the user and the L2TP packet to the IPsec module, which may include:
  • the L2TP module sends the private IP address of the user as a cookie, and sends the L2TP packet to the IPsec module.
  • the step S30 may further include: sending an L2TP report to the L2TP over IPsec access user. If the private IP address of the user is not found, the source IP address and the destination IP address of the L2TP packet are used as indexes to match the IPsec security policy database.
  • the step S30 may further include: after determining that the matching is successful, encrypting and sending the L2TP packet according to the matched IPsec security association.
  • an embodiment of the present invention provides an L2TP network server, including:
  • the negotiation device is configured to determine that the private network IP address of the user and the NAT device are converted after the network address translation NAT device exists on the user side during the IKE negotiation process of the Internet key exchange with the L2TP over IPsec access user.
  • the public IP address is used as the index of the IPsec security policy library;
  • the inbound packet processing device is configured to receive and decrypt the IPsec encrypted packet, and save the private network IP address of the user when the packet is an L2TP packet and passes through the NAT device;
  • the outgoing packet processing device is configured to send the L2TP packet to the L2TP over IPsec access user, and if the private network IP address of the user is found, the private network IP address of the user and the L2TP packet are used.
  • the destination IP address is used as an index to match the IPsec security policy library.
  • the negotiating device is further configured to determine, when the user does not have a network address translation NAT device in the process of performing an Internet key exchange IKE negotiation with the L2TP over IPsec access user, the public network IP address and the L2TP of the user.
  • the public IP address of the network server is used as the index of the IPsec security policy library.
  • the inbound packet processing device and the outgoing packet processing device may both include an IPsec module and an L2TP module.
  • the IPsec module receives and encrypts the encrypted packet into the IPsec.
  • the packet is determined to be an L2TP packet and the private network IP address of the user who sends the packet is read from the IPsec security association, the user's The private network IP address is sent to the L2TP module together with the decrypted packet.
  • the L2TP module After receiving the private IP address and the decrypted packet sent by the IPsec module, the L2TP module saves the private IP address of the user.
  • the IPsec module sends the private IP address of the user as a cookie and the decrypted message to the L2TP module.
  • the L2TP module saves the private IP address of the user, and the L2TP module saves the private IP address of the user in the L2TP session table.
  • the L2TP module reads the private IP address of the user from the L2TP session table before sending the L2TP packet to the L2TP over IPsec access user. If the L2TP packet is successfully read, the private IP address and location of the user are obtained. The L2TP packet is sent to the IPsec module together;
  • the IPsec module After receiving the private network IP address and the L2TP packet sent by the L2TP module, the IPsec module uses the private IP address of the user and the destination IP address of the L2TP packet as an index to match the IPsec security policy database.
  • the L2TP module sends the private IP address of the user and the L2TP packet to the IPsec module, which may include:
  • the L2TP module sends the private IP address of the user as a cookie, and sends the L2TP packet to the IPsec module.
  • the outgoing packet processing device may be configured to send the L2TP packet to the L2TP over IPsec access user. If the private IP address of the user is not found, the source IP address of the L2TP packet is used. The destination IP address is used as an index to match the IPsec security policy library.
  • the outbound packet processing device may be configured to match the private network IP address of the user and the destination IP address of the L2TP packet as an index to match the IPsec security policy database, and after determining that the matching is successful, according to the matching
  • the IPsec security association encrypts and sends the L2TP packet.
  • FIG. 5 is a schematic flowchart of IKE negotiation in the embodiment of the present invention, including the following steps:
  • the LNS determines whether a NAT device exists in the network, and obtains a private network address of the user;
  • the IPSEC starts to protect the L2TP negotiation and data packets.
  • the processing flow of the incoming traffic of the LNS device is described in conjunction with Figure 6.
  • the LNS device receives the IPSEC encrypted message, and the IPSEC module searches for the IPSEC security association according to the SPI (Security Parameters Index) field of the IPSEC header;
  • SPI Security Parameters Index
  • the negotiated parties perform HASH (hash) processing on their own source address and port and destination address and port respectively, and send them to the other party through the NAT-D payload. If there is a NAT device, the private network address passes the NAT-OA payload. Send to the opposite end;
  • the NAT-OA source address needs to be removed from the IPSEC security association.
  • This address is the private network address of the user, and this address is sent to the L2TP module as a cookie and a message;
  • the L2TP module After receiving the message and the cookie, the L2TP module stores the cookie in the L2TP session table.
  • the packet is sent to the IPSEC module for processing. If the cookie exists in the session table, the cookie is sent to the IPSEC module together;
  • the IPSEC module generates a traffic selector based on the quintuple of the message
  • all or part of the steps of the above embodiments may also be implemented by using an integrated circuit. These steps may be separately fabricated into individual integrated circuit modules, or multiple modules or steps may be fabricated into a single integrated circuit module. achieve. Thus, the invention is not limited to any specific combination of hardware and software.
  • the devices/function modules/functional units in the above embodiments may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices.
  • each device/function module/functional unit in the above embodiment When each device/function module/functional unit in the above embodiment is implemented in the form of a software function module and sold or used as a stand-alone product, it can be stored in a computer readable storage medium.
  • the above mentioned computer readable storage medium may be a read only memory, a magnetic disk or an optical disk or the like.
  • the embodiment of the present invention can implement the distinction between the LNS and the different L2TP over IPsec access users in the networking where the NAT device exists.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

一种实现L2TP over IPsec接入的方法，应用于LNS，包括：在与L2TP over IPsec用户进行IKE协商过程中确定存在NAT设备时，将用户的私网IP地址和经过NAT转换后的公网IP地址作为安全策略库的索引；接收入向IPsec加密报文并进行解密，在确定报文为L2TP报文且经过了NAT设备时，对用户的私网IP地址进行保存；向L2TP over IPsec接入用户发送L2TP报文前，如查找到用户的私网IP地址，则用用户的私网IP地址和报文的目的IP地址作为索引去匹配安全策略库。

Description

一种实现L2TP over IPsec接入的方法 技术领域
本发明涉及通信技术领域，尤其涉及的是一种实现L2TP over IPsec接入的方法和L2TP网络服务器(L2TP Network Server，LNS)。
背景技术
IPsec(Internet协议安全性)是IETF(Internet Engineering Task Force，Internet工程任务组)的IPsec小组建立的一组IP安全协议集。IPsec定义了在网络层使用的安全服务，其功能包括数据加密、对网络单元的访问控制、数据源地址验证、数据完整性检查和防止重放攻击。
L2TP(二层隧道协议)作为一种移动用户接入企业内部网络的方法被广泛应用。但L2TP本身不提供对数据的加密保护，报文在网络的传递过程中容易被窃取和篡改。所以在实际的应用中，通常用IPsec来保护L2TP的协商和用户数据。
在实际的网络环境中，会存在NAT(Network Address Translation，网络地址转换)设备，NAT与IPsec存在兼容性问题。在穿越NAT时，NAT设备需要修改报文的传输层端口号来复用公网IP地址。当报文被IPsec保护时，该操作无法进行。IETF定义了一种IPsec报文的UDP封装方式，其主要设计思想是在IPsec头部之前封装端口号为4500的UDP包头，用于帮助IPsec报文穿越NAT设备。
IPsec对报文的封装有两种模式，隧道模式和传输模式。隧道模式对IP头部和有效负载进行加密，并在之前新增一个IP头部的封装。传输模式保留原有的IP头部，只对有效负载部分进行加密。L2TP over IPsec使用的是传输模式。
如图1所示，L2TP网络服务器(L2TP Network Server，LNS)与多个CPE(Customer Premise Equipment，客户终端设备)下的UE建立L2TP over IPsec连接，不同的CPE可能具有相同的私网地址空间。在CPE设备上进行NAT 处理，将私网IP转换成公网IP。
如图2所示，报文在CPE设备上进行NAT处理后，不同的私网IP会被转换成相同的公网IP。这样的报文到达LNS，IPsec头部被解封装后，不同的UE的L2TP报文的三层和四层特征可能是一样的，LNS无法区分。比如，对于同一个CPE下的两个用户设备：UE1(IP4)和UE2(IP5)，IPsec处理前，UE1的IP头部(IP Head1)包括：IP1(目标IP地址)和IP4(源IP地址)，UE2的IP头部(IP Head1)包括：IP1(目标IP地址)和IP5(源IP地址)；IPsec处理后，IP头部保持不变，经过NAT转换后，UE1和UE2的IP头部(IP Head1)变为新的IP头部(IP Head2)，其中目的IP地址保持不变(还是IP1)，源IP地址均变为公网IP地址(IP2)。因此，LNS无法区分同一个CPE下的不同用户终端。
发明内容
本发明实施例提供一种实现L2TP over IPsec接入的方法和L2TP网络服务器，能够在存在NAT设备的组网中实现L2TP网络服务器(L2TP Network Server，LNS)对不同L2TP over IPsec接入用户的区分。
一种实现L2TP over IPsec接入的方法，应用于L2TP网络服务器，该方法包括：
在与L2TP over IPsec接入用户进行互联网密钥交换(IKE)协商过程中确定用户侧存在网络地址转换(NAT)设备时，将所述用户的私网IP地址和经过所述NAT设备转换后的公网IP地址作为IPsec安全策略库的索引；
接收入向IPsec加密报文并进行解密，在确定所述入向IPsec加密报文为L2TP报文且经过了NAT设备时，对所述用户的私网IP地址进行保存；
向所述用户发送L2TP报文前，如查找到所述用户的私网IP地址，则用所述用户的私网IP地址和所述L2TP报文的目的IP地址作为索引去匹配IPsec安全策略库。
可选地，
所述L2TP网络服务器包括IPsec模块和L2TP模块；
接收入向IPsec加密报文并进行解密，在确定所述报文为L2TP报文且经过了NAT设备时，对所述用户的私网IP地址进行保存，包括：
所述IPsec模块接收入向IPsec加密报文并进行解密，在确定所述报文为L2TP报文且从IPsec安全联盟中读取到发送该报文的用户的私网IP地址时，将所述用户的私网IP地址和解密后的报文一起发送给所述L2TP模块；
所述L2TP模块在接收到IPsec模块发送的用户的私网IP地址和解密后的报文后，对所述用户的私网IP地址进行保存。
可选地，
所述IPsec模块将所述用户的私网IP地址和解密后的报文一起发送给L2TP模块，包括：
所述IPsec模块将所述用户的私网IP地址作为cookie和解密后的报文一起发送给L2TP模块。
可选地，
所述L2TP模块对所述用户的私网IP地址进行保存，包括：所述L2TP模块将所述用户的私网IP地址保存在L2TP会话表中。
可选地，
向L2TP over IPsec接入用户发送L2TP报文前，如查找到所述用户的私网IP地址，则用所述用户的私网IP地址和所述L2TP报文的目的IP地址作为索引去匹配IPsec安全策略库，包括：
所述L2TP模块向L2TP over IPsec接入用户发送L2TP报文前，从L2TP会话表中读取所述用户的私网IP地址，如果成功读取到，则将该用户的私网IP地址作为cookie和所述L2TP报文一起发送给IPsec模块；
所述IPsec模块在接收到所述L2TP模块发送的包含用户的私网IP地址的cookie和L2TP报文后，用所述用户的私网IP地址和所述L2TP报文的目的IP地址作为索引去匹配IPsec安全策略库。
一种L2TP网络服务器，包括：
协商装置，其设置为：在与基于网络协议安全性的二层隧道协议(L2TP over IPsec)接入用户进行互联网密钥交换(IKE)协商过程中确定用户侧存在网络地址转换(NAT)设备时，将所述用户的私网IP地址和经过所述NAT设备转换后的公网IP地址作为IPsec安全策略库的索引；
入向报文处理装置，其设置为：接收入向IPsec加密报文并进行解密，在确定所述报文为L2TP报文且经过了NAT设备时，对所述用户的私网IP地址进行保存；
出向报文处理装置，其设置为：向所述用户发送L2TP报文前，如查找到所述用户的私网IP地址，则用所述用户的私网IP地址和所述L2TP报文的目的IP地址作为索引去匹配IPsec安全策略库。
可选地，
所述入向报文处理装置和出向报文处理装置均包括IPsec模块和L2TP模块；
所述入向报文处理装置中，
所述IPsec模块设置为：接收入向IPsec加密报文并进行解密，在确定所述报文为L2TP报文且从IPsec安全联盟中读取到发送该报文的用户的私网IP地址时，将所述用户的私网IP地址和解密后的报文一起发送给所述L2TP模块；
所述L2TP模块设置为：在接收到IPsec模块发送的用户的私网IP地址和解密后的报文后，对所述用户的私网IP地址进行保存。
可选地，
cookie和解密后的报文一起发送给L2TP模块。
可选地，
所述L2TP模块是设置为将所述用户的私网IP地址保存在L2TP会话表中。
可选地，
所述出向报文处理装置中，
所述L2TP模块设置为：向L2TP over IPsec接入用户发送L2TP报文前，从L2TP会话表中读取所述用户的私网IP地址，如果成功读取到，则将该用户的私网IP地址作为cookie和所述L2TP报文一起发送给所述IPsec模块；
所述IPsec模块设置为：在接收到L2TP模块发送的包含用户的私网IP地址的cookie和L2TP报文后，用所述用户的私网IP地址和所述L2TP报文的目的IP地址作为索引去匹配IPsec安全策略库。
本发明实施例还提供一种计算机程序，包括程序指令，当该程序指令被L2TP网络服务器执行时，使得该L2TP网络服务器可执行上面所述的方法。
本发明实施例一种存储所述计算机程序的计算机可读存储介质。
本发明实施例能够在存在NAT设备的组网中实现L2TP网络服务器(L2TP Network Server，LNS)对不同L2TP over IPsec接入用户的区分。
附图概述
图1是相关技术中L2TP over IPsec的典型组网图。
图2是相关技术中L2TP报文在经过IPsec和NAT转换前后的IP报文格式。
图3为本发明实施例的一种实现L2TP over IPsec接入的方法的流程图。
图4为本发明实施例的LNS结构示意图。
图5是L2TP over IPsec用户接入的IKE协商流程。
图6是LNS对入向报文进行处理的流程图。
图7是LNS发送出向报文时的流程图。
本发明的较佳实施方式
下文中将结合附图对本发明的实施例进行详细说明。需要说明的是，在 不冲突的情况下，本申请中的实施例及实施例中的特征可以相互任意组合。
如图3所示，本发明实施例提供了一种实现L2TP over IPsec接入的方法，应用于二层隧道协议L2TP网络服务器，该方法包括：
S10，在与L2TP over IPsec接入用户进行互联网密钥交换IKE协商过程中确定用户侧存在网络地址转换NAT设备时，将所述用户的私网IP地址和经过所述NAT设备转换后的公网IP地址作为IPsec安全策略库的索引；
S20，接收入向IPsec加密报文并进行解密，在确定所述报文为L2TP报文且经过了NAT设备时，对所述用户的私网IP地址进行保存；
S30，向L2TP over IPsec接入用户发送L2TP报文前，如查找到所述用户的私网IP地址，则用所述用户的私网IP地址和所述L2TP报文的目的IP地址作为索引去匹配IPsec安全策略库。
其中，IPsec安全策略库是用于指明IP数据报文应该应用于何种安全服务以及如何获取该服务的数据结构。IPsec安全联盟是为安全目的创建的一个安全连接，所有经过同一个安全连接的数据流会得到同样的安全服务。IPsec安全联盟是通过IKE协商协商生成，生成后，IPsec安全策略库的某条记录会指向这个IPsec安全联盟。
其中，步骤S10中还可以包括：
在与L2TP over IPsec接入用户进行互联网密钥交换IKE协商过程中确定用户侧不存在网络地址转换NAT设备时，将所述用户的公网IP地址和L2TP网络服务器的公网IP地址作为IPsec安全策略库的索引；
其中，步骤S20中，接收入向IPsec加密报文并进行解密，在确定所述报文为L2TP报文且经过了NAT设备时，对所述用户的私网IP地址进行保存，可以包括：
IPsec模块接收入向IPsec加密报文并进行解密，在确定所述报文为L2TP报文且从IPsec安全联盟中读取到发送该报文的用户的私网IP地址时，将所述用户的私网IP地址和解密后的报文一起发送给L2TP模块；
L2TP模块在接收到IPsec模块发送的用户的私网IP地址和解密后的报文后，对所述用户的私网IP地址进行保存；
其中，所述L2TP网络服务器可以包括IPsec模块和L2TP模块；
其中，IPsec模块将所述用户的私网IP地址和解密后的报文一起发送给L2TP模块，包括：
IPsec模块将所述用户的私网IP地址作为cookie和解密后的报文一起发送给L2TP模块。
用户的私网IP作为cookie传递，L2TP模块不感知其中的格式与内容。
其中，L2TP模块对所述用户的私网IP地址进行保存，可以包括：L2TP模块将所述用户的私网IP地址保存在L2TP会话表中。
IPsec模块之所以需要将用户的私网IP地址作为cookie传递给L2TP模块，是因为NAT穿越场景下的L2TP over IPsec用户，是使用用户的私网IP地址和CPE的公网IP(NAT转换后的公网IP地址)作为IPsec安全策略库的索引。当L2TP模块发送出向报文时，需要将用户的私网IP地址发送给IPsec模块，这样IPsec模块才能查找到正确的IPsec安全联盟，获得正确的安全策略去加密出向报文。
步骤S30中，向L2TP over IPsec接入用户发送L2TP报文前，如查找到所述用户的私网IP地址，则用所述用户的私网IP地址和所述L2TP报文的目的IP地址作为索引去匹配IPsec安全策略库，可以包括：
L2TP模块向L2TP over IPsec接入用户发送L2TP报文前，从L2TP会话表中读取所述用户的私网IP地址，如果成功读取到，则将该用户的私网IP地址和所述L2TP报文一起发送给IPsec模块；
IPsec模块在接收到L2TP模块发送的用户的私网IP地址和L2TP报文后，用所述用户的私网IP地址和所述L2TP报文的目的IP地址作为索引去匹配IPsec安全策略库。
其中，L2TP模块将所述用户的私网IP地址和L2TP报文一起发送给IPsec模块，可以包括：
L2TP模块将所述用户的私网IP地址作为cookie，和所述L2TP报文一起发送给IPsec模块。
其中，步骤S30还可以包括：向L2TP over IPsec接入用户发送L2TP报 文前，如未查找到所述用户的私网IP地址，则用所述L2TP报文的源IP地址和目的IP地址作为索引去匹配IPsec安全策略库。
其中，步骤S30中，还可以包括：在确定匹配成功后，根据匹配到的IPsec安全联盟对所述L2TP报文进行加密发送。
如图4所示，本发明实施例提供了一种L2TP网络服务器，包括：
协商装置，设置为在与L2TP over IPsec接入用户进行互联网密钥交换IKE协商过程中确定用户侧存在网络地址转换NAT设备时，将所述用户的私网IP地址和经过所述NAT设备转换后的公网IP地址作为IPsec安全策略库的索引；
入向报文处理装置，设置为接收入向IPsec加密报文并进行解密，在确定所述报文为L2TP报文且经过了NAT设备时，对所述用户的私网IP地址进行保存；
出向报文处理装置，设置为向L2TP over IPsec接入用户发送L2TP报文前，如查找到所述用户的私网IP地址，则用所述用户的私网IP地址和所述L2TP报文的目的IP地址作为索引去匹配IPsec安全策略库。
其中，所述协商装置，还设置为在与L2TP over IPsec接入用户进行互联网密钥交换IKE协商过程中确定用户侧不存在网络地址转换NAT设备时，将所述用户的公网IP地址和L2TP网络服务器的公网IP地址作为IPsec安全策略库的索引。
其中，所述入向报文处理装置和出向报文处理装置均可以包括IPsec模块和L2TP模块；
IPsec模块接收入向IPsec加密报文并进行解密，在确定所述报文为L2TP报文且从IPsec安全联盟中读取到发送该报文的用户的私网IP地址时，将所述用户的私网IP地址和解密后的报文一起发送给L2TP模块；
L2TP模块在接收到IPsec模块发送的用户的私网IP地址和解密后的报文后，对所述用户的私网IP地址进行保存；
IPsec模块将所述用户的私网IP地址作为cookie和解密后的报文一起发送给L2TP模块。
其中，L2TP模块对所述用户的私网IP地址进行保存，包括：L2TP模块将所述用户的私网IP地址保存在L2TP会话表中。
其中，L2TP模块向L2TP over IPsec接入用户发送L2TP报文前，从L2TP会话表中读取所述用户的私网IP地址，如果成功读取到，则将该用户的私网IP地址和所述L2TP报文一起发送给IPsec模块；
IPsec模块在接收到L2TP模块发送的用户的私网IP地址和L2TP报文后，用所述用户的私网IP地址和所述L2TP报文的目的IP地址作为索引去匹配IPsec安全策略库。
其中，L2TP模块将所述用户的私网IP地址和L2TP报文一起发送给IPsec模块，可以包括：
L2TP模块将所述用户的私网IP地址作为cookie，和所述L2TP报文一起发送给IPsec模块。
其中，出向报文处理装置，还可以设置为向L2TP over IPsec接入用户发送L2TP报文前，如未查找到所述用户的私网IP地址，则用所述L2TP报文的源IP地址和目的IP地址作为索引去匹配IPsec安全策略库。
其中，出向报文处理装置，还可以设置为用所述用户的私网IP地址和所述L2TP报文的目的IP地址作为索引去匹配IPsec安全策略库后，在确定匹配成功后，根据匹配到的IPsec安全联盟对所述L2TP报文进行加密发送。
下面结合图5至图7对本发明实施所述方法进行详细阐述。
如图5所示，图5是本发明实施例中IKE协商的流程示意图，包括以下步骤：
(1)当用户进行L2TP OVER IPSEC连接时，发起IKE协商；
(2)LNS判断网络中是否存在NAT设备，获取用户的私网地址；
(3)判断是否是L2TP OVER IPSEC的接入方式；
(4)如果是L2TP OVER IPSEC的接入方式，并且网络中存在NAT设备，根据用户的私网IP和NAT转换后的公网IP建立并维护IPSEC安全策略 库；
(5)如果是L2TP OVER IPSEC的接入方式，但网络中不存在NAT设备，说明是公网接入，根据用户的公网IP和LNS的公网IP建立并维护IPSEC安全策略库；
(6)将IPSEC安全策略库与生成的IPSEC安全联盟关联。
协商完成后，IPSEC开始对L2TP的协商和数据报文进行保护，首先结合图6说明LNS设备入向流量的处理流程。
(1)LNS设备收到IPSEC加密报文，IPSEC模块根据IPSEC头部的SPI(Security Parameters Index，安全参数索引)字段查找IPSEC安全联盟；
(2)对报文进行解密；
(3)判断是否是L2TP报文，并且是否是NAT穿越场景；
其中，协商的双方将自己的源地址及端口和目的地址及端口分别进行HASH(哈希)处理，通过NAT-D载荷发送给对方，如果存在NAT设备，则将私网地址通过NAT-OA载荷发送给对端；
(4)如果两个条件都满足，需要从IPSEC安全联盟中取出NAT-OA源地址，这个地址是用户的私网地址，将这个地址作为cookie和报文一起上送给L2TP模块；
(5)L2TP模块收到报文和cookie后，将cookie存放在L2TP会话表中。
下面结合图7说明下LNS设备发送出向流量时的流程：
(1)L2TP报文封装完成后，将报文传递给IPSEC模块处理，如果会话表存在cookie，将cookie一起发送给IPSEC模块；
(2)IPSEC模块根据报文的五元组生成流量选择符；
(3)判断是否存在cookie，如果有cookie，用cookie中的私网IP地址替换流量选择符中的源IP地址；
(4)用流量选择符匹配安全策略库；
(5)如果能够匹配到，用匹配到的安全策略指向的IPSEC安全联盟对 报文进行加密，并发送。
本领域普通技术人员可以理解上述实施例的全部或部分步骤可以使用计算机程序流程来实现，所述计算机程序可以存储于一计算机可读存储介质中，所述计算机程序在相应的硬件平台上(如系统、设备、装置、器件等)执行，在执行时，包括方法实施例的步骤之一或其组合。
可选地，上述实施例的全部或部分步骤也可以使用集成电路来实现，这些步骤可以被分别制作成一个个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明不限制于任何特定的硬件和软件结合。
上述实施例中的各装置/功能模块/功能单元可以采用通用的计算装置来实现，它们可以集中在单个的计算装置上，也可以分布在多个计算装置所组成的网络上。
上述实施例中的各装置/功能模块/功能单元以软件功能模块的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。上述提到的计算机可读取存储介质可以是只读存储器，磁盘或光盘等。
工业实用性
本发明实施例能够在存在NAT设备的组网中实现LNS对不同L2TP over IPsec接入用户的区分。

Claims (12)

  1. 一种实现基于网络协议安全性的二层隧道协议(L2TP over IPsec)接入的方法，应用于L2TP网络服务器，该方法包括：
    在与L2TP over IPsec接入用户进行互联网密钥交换(IKE)协商过程中确定用户侧存在网络地址转换(NAT)设备时，将所述用户的私网IP地址和经过所述NAT设备转换后的公网IP地址作为IPsec安全策略库的索引；
    接收入向IPsec加密报文并进行解密，在确定所述入向IPsec加密报文为L2TP报文且经过了NAT设备时，对所述用户的私网IP地址进行保存；
    向所述用户发送L2TP报文前，如查找到所述用户的私网IP地址，则用所述用户的私网IP地址和所述L2TP报文的目的IP地址作为索引去匹配IPsec安全策略库。
  2. 如权利要求1所述的方法，其中：
    所述L2TP网络服务器包括IPsec模块和L2TP模块；
    接收入向IPsec加密报文并进行解密，在确定所述报文为L2TP报文且经过了NAT设备时，对所述用户的私网IP地址进行保存，包括：
    所述IPsec模块接收入向IPsec加密报文并进行解密，在确定所述报文为L2TP报文且从IPsec安全联盟中读取到发送该报文的用户的私网IP地址时，将所述用户的私网IP地址和解密后的报文一起发送给所述L2TP模块；
    所述L2TP模块在接收到IPsec模块发送的用户的私网IP地址和解密后的报文后，对所述用户的私网IP地址进行保存。
  3. 如权利要求2所述的方法，其中：
    所述IPsec模块将所述用户的私网IP地址和解密后的报文一起发送给L2TP模块，包括：
    所述IPsec模块将所述用户的私网IP地址作为cookie和解密后的报文一起发送给L2TP模块。
  4. 如权利要求3所述的方法，其中：
    所述L2TP模块对所述用户的私网IP地址进行保存，包括：所述L2TP模块将所述用户的私网IP地址保存在L2TP会话表中。
  5. 如权利要求4所述的方法，其中：
    向L2TP over IPsec接入用户发送L2TP报文前，如查找到所述用户的私网IP地址，则用所述用户的私网IP地址和所述L2TP报文的目的IP地址作为索引去匹配IPsec安全策略库，包括：
    所述L2TP模块向L2TP over IPsec接入用户发送L2TP报文前，从L2TP会话表中读取所述用户的私网IP地址，如果成功读取到，则将该用户的私网IP地址作为cookie和所述L2TP报文一起发送给IPsec模块；
    所述IPsec模块在接收到所述L2TP模块发送的包含用户的私网IP地址的cookie和L2TP报文后，用所述用户的私网IP地址和所述L2TP报文的目的IP地址作为索引去匹配IPsec安全策略库。
  6. 一种二层隧道协议(L2TP)网络服务器，包括：
    协商装置，其设置为：在与基于网络协议安全性的二层隧道协议(L2TP over IPsec)接入用户进行互联网密钥交换(IKE)协商过程中确定用户侧存在网络地址转换(NAT)设备时，将所述用户的私网IP地址和经过所述NAT设备转换后的公网IP地址作为IPsec安全策略库的索引；
    入向报文处理装置，其设置为：接收入向IPsec加密报文并进行解密，在确定所述报文为L2TP报文且经过了NAT设备时，对所述用户的私网IP地址进行保存；
    出向报文处理装置，其设置为：向所述用户发送L2TP报文前，如查找到所述用户的私网IP地址，则用所述用户的私网IP地址和所述L2TP报文的目的IP地址作为索引去匹配IPsec安全策略库。
  7. 如权利要求6所述的L2TP网络服务器，其中：
    所述入向报文处理装置和出向报文处理装置均包括IPsec模块和L2TP模块；
    所述入向报文处理装置中，
    所述IPsec模块设置为：接收入向IPsec加密报文并进行解密，在确定所述报文为L2TP报文且从IPsec安全联盟中读取到发送该报文的用户的私网IP地址时，将所述用户的私网IP地址和解密后的报文一起发送给所述L2TP模块；
    所述L2TP模块设置为：在接收到IPsec模块发送的用户的私网IP地址和解密后的报文后，对所述用户的私网IP地址进行保存。
  8. 如权利要求7所述的L2TP网络服务器，其中：
    所述IPsec模块是设置为将所述用户的私网IP地址作为cookie和解密后的报文一起发送给L2TP模块。
  9. 如权利要求8所述的L2TP网络服务器，其中：
    所述L2TP模块是设置为将所述用户的私网IP地址保存在L2TP会话表中。
  10. 如权利要求9所述的L2TP网络服务器，其中：
    所述出向报文处理装置中，
    所述L2TP模块设置为：向L2TP over IPsec接入用户发送L2TP报文前，从L2TP会话表中读取所述用户的私网IP地址，如果成功读取到，则将该用户的私网IP地址作为cookie和所述L2TP报文一起发送给所述IPsec模块；
    所述IPsec模块设置为：在接收到L2TP模块发送的包含用户的私网IP地址的cookie和L2TP报文后，用所述用户的私网IP地址和所述L2TP报文的目的IP地址作为索引去匹配IPsec安全策略库。
  11. 一种计算机程序，包括程序指令，当该程序指令被L2TP网络服务器执行时，使得该L2TP网络服务器可执行权利要求1-5任一项所述的方法。
  12. 一种存储权利要求11所述计算机程序的计算机可读存储介质。
PCT/CN2014/094002 2014-09-25 2014-12-16 一种实现L2TP over IPsec接入的方法 WO2015131609A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410499881.6A CN105516062B (zh) 2014-09-25 2014-09-25 一种实现L2TP over IPsec接入的方法
CN201410499881.6 2014-09-25

Publications (1)

Publication Number Publication Date
WO2015131609A1 true WO2015131609A1 (zh) 2015-09-11

Family

ID=54054481

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/094002 WO2015131609A1 (zh) 2014-09-25 2014-12-16 一种实现L2TP over IPsec接入的方法

Country Status (2)

Country Link
CN (1) CN105516062B (zh)
WO (1) WO2015131609A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105610577A (zh) * 2016-01-07 2016-05-25 成都卫士通信息产业股份有限公司 一种防止IPSec VPN设备多隧道IKE协商失败的系统及方法
CN112751816A (zh) * 2019-10-31 2021-05-04 中国移动通信有限公司研究院 一种隧道建立方法、装置、设备及计算机可读存储介质
CN113067908A (zh) * 2020-01-02 2021-07-02 中国移动通信有限公司研究院 一种nat穿越方法、装置、电子设备和存储介质
CN114513387A (zh) * 2020-11-17 2022-05-17 中国移动通信有限公司研究院 一种隧道建立方法、装置及设备

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106027508A (zh) * 2016-05-11 2016-10-12 北京网御星云信息技术有限公司 一种认证加密的数据传输方法及装置
CN106027387B (zh) * 2016-07-05 2019-06-04 瑞斯康达科技发展股份有限公司 一种语音业务的处理方法、网关设备及系统
CN110519282A (zh) * 2019-08-30 2019-11-29 新华三信息安全技术有限公司 一种报文处理的方法及装置

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030135616A1 (en) * 2002-01-11 2003-07-17 Carrico Sandra Lynn IPSec Through L2TP
CN101217435A (zh) * 2008-01-16 2008-07-09 中兴通讯股份有限公司 一种L2TP over IPSEC远程接入的方法及装置
CN102833359A (zh) * 2011-06-14 2012-12-19 中兴通讯股份有限公司 隧道信息获取方法、安全网关及演进家庭基站/家庭基站

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
IES20050439A2 (en) * 2005-06-30 2006-08-09 Asavie R & D Ltd A method of network communication
CN101350759B (zh) * 2008-08-18 2011-04-13 成都市华为赛门铁克科技有限公司 一种报文处理方法、业务板、接口板及网络通信设备
US8555364B2 (en) * 2011-09-30 2013-10-08 Time Warner Cable Enterprises Llc System and method for cloning a wi-fi access point
CN102694808A (zh) * 2012-05-31 2012-09-26 汉柏科技有限公司 Ike远程接入的处理系统及方法

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030135616A1 (en) * 2002-01-11 2003-07-17 Carrico Sandra Lynn IPSec Through L2TP
CN101217435A (zh) * 2008-01-16 2008-07-09 中兴通讯股份有限公司 一种L2TP over IPSEC远程接入的方法及装置
CN102833359A (zh) * 2011-06-14 2012-12-19 中兴通讯股份有限公司 隧道信息获取方法、安全网关及演进家庭基站/家庭基站

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
"IPsec-Network Address Translation ( NAT ) Compatibility Requirements", NETWORK WORKING GROUP., 31 March 2004 (2004-03-31), pages 8 - 13 *

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105610577A (zh) * 2016-01-07 2016-05-25 成都卫士通信息产业股份有限公司 一种防止IPSec VPN设备多隧道IKE协商失败的系统及方法
CN105610577B (zh) * 2016-01-07 2018-09-14 成都卫士通信息产业股份有限公司 一种防止IPSec VPN设备多隧道IKE协商失败的系统及方法
CN112751816A (zh) * 2019-10-31 2021-05-04 中国移动通信有限公司研究院 一种隧道建立方法、装置、设备及计算机可读存储介质
CN112751816B (zh) * 2019-10-31 2023-05-12 中国移动通信有限公司研究院 一种隧道建立方法、装置、设备及计算机可读存储介质
CN113067908A (zh) * 2020-01-02 2021-07-02 中国移动通信有限公司研究院 一种nat穿越方法、装置、电子设备和存储介质
CN114513387A (zh) * 2020-11-17 2022-05-17 中国移动通信有限公司研究院 一种隧道建立方法、装置及设备

Also Published As

Publication number Publication date
CN105516062A (zh) 2016-04-20
CN105516062B (zh) 2020-07-31

Similar Documents

Publication Publication Date Title
CN107018134B (zh) 一种配电终端安全接入平台及其实现方法
WO2015131609A1 (zh) 一种实现L2TP over IPsec接入的方法
US9369491B2 (en) Inspection of data channels and recording of media streams
CN102882789B (zh) 一种数据报文处理方法、系统及设备
CN102347870B (zh) 一种流量安全检测方法、设备和系统
US8327129B2 (en) Method, apparatus and system for internet key exchange negotiation
CN108769292B (zh) 报文数据处理方法及装置
US20240114010A1 (en) Systems and methods for encrypting and transmitting data packets using a unicast address
US8745381B2 (en) Methods, systems, and computer readable media for performing encapsulating security payload (ESP) rehashing
US20100268935A1 (en) Methods, systems, and computer readable media for maintaining flow affinity to internet protocol security (ipsec) sessions in a load-sharing security gateway
CN101521667B (zh) 一种安全的数据通信方法及装置
CN110266725B (zh) 密码安全隔离模块及移动办公安全系统
WO2020134413A1 (zh) 一种数据传输方法、装置、相关设备及存储介质
US20220263811A1 (en) Methods and Systems for Internet Key Exchange Re-Authentication Optimization
Elezi et al. Conception of Virtual Private Networks using IPsec suite of protocols, comparative analysis of distributed database queries using different IPsec modes of encryption
CN103227742B (zh) 一种IPSec隧道快速处理报文的方法
WO2016165277A1 (zh) 一种实现IPsec分流的方法和装置
Touil et al. Secure and guarantee QoS in a video sequence: a new approach based on TLS protocol to secure data and RTP to ensure real-time exchanges
CN105591748B (zh) 一种认证方法和装置
Cisco Configuring IPSec Network Security
JP2008199420A (ja) ゲートウェイ装置および認証処理方法
EP3131269B1 (en) Method and device for conducting ah authentication on ipsec packet which has gone through nat traversal
KR100450774B1 (ko) ＮＡＴ 기능을 갖는 사설망에서 ＩＰＳｅｃ을 이용한종단과 종단 간의 ｐｒｉｖａｔｅ 정보 전송 방법 및 이를이용한 보안 서비스 방법
CN117201200B (zh) 基于协议栈的数据安全传输方法
Alhaj Performance Evaluation of Secure Data Transmission Mechanism (SDTM) for Cloud Outsourced Data and Transmission Layer Security (TLS)

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14884521

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 14884521

Country of ref document: EP

Kind code of ref document: A1