WO2016045307A1 - Ike认证方法、ike发起终端、ike响应终端及ike认证系统 - Google Patents

Ike认证方法、ike发起终端、ike响应终端及ike认证系统 Download PDF

Info

Publication number
WO2016045307A1
WO2016045307A1 PCT/CN2015/073052 CN2015073052W WO2016045307A1 WO 2016045307 A1 WO2016045307 A1 WO 2016045307A1 CN 2015073052 W CN2015073052 W CN 2015073052W WO 2016045307 A1 WO2016045307 A1 WO 2016045307A1
Authority
WO
WIPO (PCT)
Prior art keywords
ike
authentication
terminal
authentication request
response
Prior art date
Application number
PCT/CN2015/073052
Other languages
English (en)
French (fr)
Inventor
唐大圆
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2016045307A1 publication Critical patent/WO2016045307A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Definitions

  • the present invention relates to the field of communication network security, and specifically relates to an IKE (Internet Key Exchange) authentication method, an IKE originating terminal, an IKE response terminal, and an IKE authentication system.
  • IKE Internet Key Exchange
  • IPsec requires some parameters when it provides security protection for IP networks, including encryption and decryption algorithms and keys, integrity verification algorithms and keys, called SA (Security Alliance).
  • SA Security Alliance
  • the Internet Engineering Group has specified the IKE protocol for auto-negotiation of SA.
  • IKEv1 and IKEv2 There are currently two versions of IKEv1 and IKEv2. Compared with the IKEv1 version, IKEv2 reduces the number of negotiation packets and adds some new functions.
  • the data source authentication function is one of the functions provided by the IPsec protocol cluster. It is implemented by authenticating the IKE peer in the IKE negotiation process. During the IKE negotiation process, the two ends of the IKE communication authenticate the peer's identity by mutual authentication. The specific authentication type is different. The IKE authentication type depends on the local configuration. Once the configuration is determined, it is different. When the peer performs IKE negotiation, the same authentication type is adopted. In a many-to-one application scenario, multiple IKE clients may require different authentication types for the IKE server. This requirement is difficult to solve through the IKE server configuration.
  • the security gateway is an IPsec gateway device; many IPsec sites can establish an IPsec tunnel with an IPsec gateway for protection. Data communication between them.
  • the site and the gateway in Figure 1 exchange keys through the IKEv2 protocol.
  • the IPsec site acts as the IKE initiator and the IPsec gateway acts as the IKE response terminal.
  • the networks protected by the IPsec site and the IPsec gateway are invisible to each other. Communication between them is required.
  • the two ends authenticate each other during the IKEv2 negotiation process.
  • the identity authentication is one-way.
  • the authentication methods used may be different. In the multiple pairs of networks in Figure 1, many IPsec sites may support different authentication methods. Some sites may not support the authentication mode configured on the IPsec gateway, so the IPsec gateway. You cannot perform IKE negotiation with all IPsec sites in the authentication mode that you have configured. Otherwise, the authentication fails because the site does not support the authentication mode adopted by the IPsec gateway.
  • the IKE authentication method, the IKE initiator terminal, the IKE response terminal, and the IKE authentication system are provided to solve the problem that the authentication fails due to the authentication type adopted by the IKE initiator terminal not supporting the IKE response terminal in the existing IKE authentication process. .
  • an embodiment of the present invention provides an IKE authentication method, including:
  • the IKE responding terminal receives the first authentication request sent by the IKE originating terminal, where the first authentication request includes the authentication type used by the IKE originating terminal;
  • the IKE responding terminal sends the second authentication request to the IKE originating terminal.
  • the method before the IKE response terminal generates the second authentication request according to the acquired authentication type, the method further includes:
  • the IKE responding terminal verifies the first authentication request, and when the verification passes, generates a second authentication request according to the obtained authentication type.
  • the IKE response terminal sends the second authentication request to the IKE originating terminal by using a primary mode exchange response message or an authentication exchange response message.
  • the embodiment of the present invention further provides an IKE authentication method, including:
  • the IKE initiating terminal generates a first authentication request, where the first authentication request includes the IKE The type of authentication used by the terminal;
  • the IKE initiating terminal receives the second authentication request sent by the IKE response terminal, and the second authentication request is generated by the IKE response terminal according to the authentication type included in the first authentication request.
  • the IKE initiating terminal sends the first authentication request to the IKE response terminal by using a primary mode exchange request message or an authentication exchange request message.
  • the embodiment of the present invention further provides an IKE authentication method, including:
  • the IKE initiating terminal generates a first authentication request, and sends the first authentication request to the IKE response terminal, where the first authentication request includes an authentication type used by the IKE originating terminal;
  • the IKE initiating terminal receives the second authentication request sent by the IKE response terminal.
  • an embodiment of the present invention further provides an IKE response terminal, including a first receiving module, a first processing module, and a first sending module.
  • the first receiving module is configured to receive a first authentication request sent by the IKE initiating terminal, where the first authentication request includes an authentication type used by the IKE initiating terminal;
  • the first processing module is configured to acquire an authentication type used by the IKE originating terminal from the first authentication request, and generate a second authentication request according to the obtained authentication type;
  • the first sending module is configured to send the second authentication request to the IKE originating terminal.
  • the verification module is further configured to: after the first processing module generates the second authentication request according to the acquired authentication type, verify the first authentication request, and then When the verification is passed, the first processing module is notified to generate a second authentication request according to the acquired authentication type.
  • the first sending module includes a main mode exchange response message. a sending submodule, configured to send the second authentication request to the IKE initiating terminal by using a primary mode switching response message; or the first sending module includes an authentication exchange response packet sending submodule, configured to: The second authentication request is sent to the IKE originating terminal by using an authentication exchange response message.
  • the embodiment of the present invention further provides an IKE originating terminal, including a second receiving module, a second processing module, and a second sending module.
  • the second processing module is configured to generate a first authentication request, where the first authentication request includes an authentication type used by the IKE originating terminal;
  • the second sending module is configured to send the first authentication request to the IKE response terminal;
  • the second receiving module is configured to receive a second authentication request sent by the IKE response terminal, where the second authentication request is generated by the IKE response terminal according to an authentication type included in the first authentication request.
  • the second sending module includes a primary mode switching request packet sending submodule, and is configured to send the first authentication request to the IKE response terminal by using a primary mode switching request message.
  • the second sending module includes an authentication exchange request packet sending submodule, and is configured to send the first authentication request to the IKE response terminal by using an authentication exchange request message.
  • the embodiment of the present invention further provides an IKE authentication system, including an IKE originating terminal and an IKE response terminal.
  • the IKE originating terminal is configured to generate a first authentication request, and send the first authentication request to the IKE response terminal, where the first authentication request includes an authentication type used by the IKE originating terminal; and a receiving station Said that the IKE responds to the second authentication request sent by the terminal;
  • the IKE response terminal is configured to receive a first authentication request sent by the IKE initiating terminal, obtain an authentication type used by the IKE initiating terminal from the first authentication request, and generate a second authentication request according to the acquired authentication type; Sending the second authentication request to the IKE originating terminal.
  • the IKE initiating terminal sends the first authentication request to the IKE response terminal by using a primary mode exchange request message or an authentication exchange request message; correspondingly, the IKE response terminal exchanges a request message through the primary mode.
  • the text or the authentication exchange request message sends the second authentication request to the IKE originating terminal.
  • the embodiment of the present invention further provides a computer readable storage medium, where the storage medium stores a computer program, where the computer program includes program instructions, but when the program instruction is executed by the IKE originating terminal, the terminal performs the IKE authentication. method.
  • the embodiment of the present invention further provides a computer readable storage medium, where the storage medium stores a computer program, where the computer program includes program instructions, but when the program instruction is executed by the IKE response terminal, the terminal performs the above IKE authentication. method.
  • the IKE originating terminal generates a first authentication request including the currently used authentication type, and sends the first authentication request to the IKE response.
  • the IKE response terminal obtains the authentication type used by the IKE originating terminal, and then generates the second authentication request and sends the second authentication request to the IKE originating terminal. It can be seen that in the embodiment of the present invention, IKE The authentication type used by the response terminal to generate the second authentication request is obtained from the first authentication request, that is, the authentication type used by the terminal is consistent with the authentication type used by the IKE originating terminal, and the IKE originating terminal necessarily supports the authentication type.
  • the solution provided by the embodiment of the present invention can enable the IKE response terminal to initiate the terminal intelligent adaptation authentication type for different IKEs, thereby avoiding the problem that the authentication failure occurs because the IKE initiation terminal does not support the authentication type adopted by the IKE response terminal. .
  • FIG. 1 is a schematic structural diagram of a typical networking
  • FIG. 2 is a schematic flowchart of an IKE authentication method according to Embodiment 1 of the present invention.
  • FIG. 3 is a schematic flowchart of an IKE authentication method according to Embodiment 2 of the present invention.
  • FIG. 4 is a schematic flowchart of an IKE authentication method according to Embodiment 3 of the present invention.
  • FIG. 5 is a schematic structural diagram of an IKE authentication system according to Embodiment 4 of the present invention.
  • FIG. 6 is a schematic structural diagram of an IKE response terminal according to Embodiment 4 of the present invention.
  • FIG. 7 is a schematic structural diagram of another IKE response terminal according to Embodiment 4 of the present invention.
  • FIG. 8 is a schematic structural diagram of an IKE originating terminal according to Embodiment 4 of the present invention.
  • FIG. 9 is a schematic flowchart of an IKE authentication method according to Embodiment 5 of the present invention.
  • Embodiment 1 is a diagrammatic representation of Embodiment 1:
  • the IKE authentication method provided in this embodiment includes:
  • Step 201 The IKE responding terminal receives the first authentication request sent by the IKE originating terminal, where the first authentication request includes the authentication type used by the IKE originating terminal.
  • Step 203 The IKE responds to the terminal to send the generated second authentication request to the IKE initiator terminal for authentication.
  • the IKE response terminal after the IKE response terminal receives the first authentication request, and before generating the second authentication request according to the authentication type obtained from the first authentication request, the IKE response terminal further includes:
  • the IKE responding terminal verifies the first authentication request, and if the verification succeeds, the second authentication request is generated according to the obtained authentication type; otherwise, the response message of the authentication failure may be directly fed back to the IKE initiating terminal.
  • the solution provided in this embodiment is applicable but not limited to the pre-shared key authentication type and the certificate authentication type.
  • the following takes the pre-shared key authentication type as an example to describe the process of verifying the first authentication request by the IKE response terminal:
  • the first authentication request may further include the identity information of the IKE originating terminal, and the calculation result data (hereinafter referred to as the first to-be-verified data) calculated by the IKE-initiating terminal to calculate the first original authentication data according to the authentication type configured locally;
  • the response terminal After receiving the first authentication request, acquires the identity information, searches for a corresponding key from the corresponding data correspondence relationship library, and combines the first identification.
  • the authentication type in the certificate request calculates the first original data to obtain the first verification data, and matches the first verification data with the first to-be-verified data, and if the two are consistent, the verification passes; otherwise, the verification fails.
  • the process of generating the second authentication request by the IKE response terminal is: the calculation result data (hereinafter referred to as the second to-be-verified data) calculated by the IKE response terminal to the second original authentication data according to the acquired authentication type; And adding the authentication type and the second to-be-verified data and the identity information of the self to the second authentication request.
  • the IKE response terminal may first send the second original authentication data to the IKE originating terminal, and may also send it to the IKE response terminal along with the second authentication request.
  • the MME may exchange the response packet (for IKEv1) or the authentication exchange response packet (that is, the IKE_AUTH response packet for IKEv2).
  • the second authentication request is sent to the IKE originating terminal.
  • the message may include an IDr payload and an AUTH payload, where the IDr payload includes the identity information of the IKE response terminal, and the AUTH payload includes the authentication type used by the IKE response terminal (used by the IKE originating terminal).
  • the authentication type is consistent) and the calculation result data (hereinafter referred to as the second to-be-verified data) obtained by the IKE response terminal calculating the second original authentication data according to the authentication type.
  • the first original authentication data used by the IKE initiating terminal for performing authentication and the second original authentication data used by the IKE responding terminal for performing authentication may be respectively before the IKE initiating terminal sends the first authentication request to the IKE responding terminal.
  • the peer end is sent to the peer end; of course, according to the actual application, the first authentication request and the second authentication request may be sent to the peer end respectively.
  • Embodiment 2 is a diagrammatic representation of Embodiment 1:
  • the IKE authentication method provided in this embodiment includes:
  • Step 301 The IKE initiating terminal generates a first authentication request, where the generated first authentication request includes an authentication type used by the IKE initiating terminal.
  • Step 302 The IKE initiating terminal sends a first authentication request to the IKE response terminal.
  • Step 303 The IKE initiating terminal receives the second authentication request sent by the IKE response terminal.
  • the authentication request is generated by the IKE response terminal according to the authentication type included in the first authentication request.
  • the process of generating the first authentication request by the IKE initiating terminal is: the calculation result data calculated by the IKE initiating terminal to calculate the first original authentication data according to the locally configured authentication type (hereinafter referred to as the first to-be-verified data) And adding the authentication type and the first to-be-verified data and its own identity information to the first authentication request.
  • the IKE originating terminal may first send the first original authentication data to the IKE response terminal, and may also send it to the IKE response terminal along with the first authentication request.
  • the IKE initiating terminal may send the first authentication request to the IKE response terminal by using the primary mode exchange request message (for IKEv1) or the authentication exchange request message (that is, the IKE_AUTH request message, for IKEv2).
  • the message may include an IDi payload and an AUTH payload, where the IDi payload includes the identity information of the IKE originating terminal, the AUTH payload includes the authentication type adopted by the IKE originating terminal, and the IKE originating terminal according to its local The first to-be-verified data obtained by calculating the first original authentication data by the authentication type.
  • the process of generating the second authentication request by the IKE response terminal is: the calculation result data (hereinafter referred to as the second to-be-verified data) calculated by the IKE response terminal to the second original authentication data according to the acquired authentication type; And adding the authentication type and the second to-be-verified data and the identity information of the self to the second authentication request.
  • the IKE initiating terminal may send the second original authentication data to the IKE initiating terminal first, and may also send the second original authentication request to the IKE responding terminal.
  • the IKE initiating terminal After the step 303 is performed, after receiving the second authentication request, the IKE initiating terminal performs verification verification on the second authentication request.
  • the following takes the pre-shared key authentication type as an example to describe the process of verifying the second authentication request by the IKE originating terminal:
  • the second authentication request further includes the identity information of the IKE response terminal, and the calculation result data (hereinafter referred to as the second to-be-verified data) obtained by the IKE response terminal calculating the second original authentication data according to the acquired authentication type; the IKE originating terminal receives the After the second authentication request, acquiring the identity information, searching for the corresponding key from the corresponding data correspondence relationship library, and calculating the second original data according to the authentication type in the second authentication request to obtain the second verification data, The second verification data is matched with the second to-be-verified data, and if the two are consistent, the verification is passed; otherwise, if the verification fails, the response message of the authentication failure may be directly fed back to the IKE response terminal.
  • the IKE authentication method provided in this embodiment includes:
  • Step 401 The IKE initiating terminal generates a first authentication request, and sends the first authentication request to the IKE response terminal, where the first authentication request includes the authentication type used by the IKE originating terminal.
  • Step 402 The IKE response terminal receives the first authentication request sent by the IKE originating terminal, and obtains the authentication type used by the IKE originating terminal from the first authentication request.
  • Step 403 The IKE response terminal generates a second authentication request according to the obtained authentication type, and sends the second authentication request to the IKE initiator terminal.
  • Step 404 The IKE initiating terminal receives the second authentication request sent by the IKE response terminal.
  • the IKE initiating terminal may send the first authentication request to the IKE response terminal by using the primary mode exchange request message (for IKEv1) or the authentication exchange request message (that is, the IKE_AUTH request message, for IKEv2).
  • the second authentication request may be sent to the IKEv2 by using the primary mode exchange response packet (for IKEv1) or the authentication exchange response packet (ie, IKE_AUTH response packet for IKEv2).
  • IKE initiates a terminal.
  • the IKE response terminal after the IKE response terminal receives the first authentication request, and before generating the second authentication request according to the authentication type obtained from the first authentication request, the IKE response terminal further includes:
  • the IKE responding terminal verifies the first authentication request, and if the verification succeeds, the second authentication request is generated according to the obtained authentication type; otherwise, the response message of the authentication failure may be directly fed back to the IKE initiating terminal.
  • the IKE initiating terminal after receiving the second authentication request, performs verification verification on the second authentication request.
  • the following takes the pre-shared key authentication type as an example to describe the process of verifying the second authentication request by the IKE initiating terminal.
  • the authentication process of the first authentication request by the IKE responding terminal is not repeated here:
  • the second authentication request further includes the identity information of the IKE response terminal, and the calculation result data (hereinafter referred to as the second to-be-verified data) obtained by the IKE response terminal calculating the second original authentication data according to the acquired authentication type; the IKE originating terminal receives the After the second authentication request, obtain an identity letter And searching for the corresponding key from the corresponding data correspondence relation library, and calculating the second original data according to the authentication type in the second authentication request to obtain the second verification data, and the second verification data and the second to be verified The data is matched. If the two are consistent, the verification is passed. Otherwise, if the verification fails, the response message of the authentication failure may be directly fed back to the IKE response terminal.
  • the calculation result data hereinafter referred to as the second to-be-verified data
  • Embodiment 4 is a diagrammatic representation of Embodiment 4:
  • the IKE authentication system includes an IKE originating terminal and an IKE response terminal, which respectively include a processor and a program storage device, where:
  • the IKE initiating terminal is configured to generate a first authentication request, and send the first authentication request to the IKE response terminal, where the first authentication request includes an authentication type used by the IKE initiating terminal, and is applicable to the first sending of the IKE response terminal.
  • Second authentication request ;
  • the IKE response terminal is configured to receive the first authentication request sent by the IKE initiating terminal, obtain the authentication type used by the IKE initiating terminal from the first authentication request, generate a second authentication request according to the obtained authentication type, and send the second authentication request to IKE initiates a terminal.
  • the IKE response terminal in this embodiment includes a first receiving module, a first processing module, and a first sending module.
  • the first receiving module is configured to receive a first authentication request sent by the IKE initiating terminal, where the first authentication request includes an authentication type used by the IKE initiating terminal;
  • the first processing module is configured to obtain an authentication type used by the IKE originating terminal from the first authentication request, and generate a second authentication request according to the obtained authentication type;
  • the first sending module is adapted to send the second authentication request to the IKE originating terminal.
  • the IKE response terminal further includes a verification module (hereinafter referred to as a first verification module), and is applicable to the first authentication request before the first processing module generates the second authentication request according to the acquired authentication type.
  • the verification is performed, and if the verification is passed, the first processing module is notified to generate a second authentication request according to the acquired authentication type.
  • the following takes the pre-shared key authentication type as an example to describe the process of verifying the first authentication request by the first verification module:
  • the first authentication request may further include identity information of the IKE originating terminal, and calculation result data obtained by the IKE originating terminal calculating the first original authentication data according to the locally configured authentication type. (hereinafter referred to as the first to-be-verified data); after receiving the first authentication request, the first verification module acquires the identity information, and finds the corresponding key from the corresponding data correspondence relationship library, and combines the The authentication type in the authentication request calculates the first original data to obtain the first verification data, and matches the first verification data with the first to-be-verified data, and if the two are consistent, the verification passes; otherwise, the verification fails.
  • the process of generating the second authentication request by the first processing module is: the calculation result data calculated by the first processing module on the second original authentication data according to the acquired authentication type (hereinafter referred to as the second to-be-verified data) And adding the authentication type and the second to-be-verified data and its own identity information to the second authentication request.
  • the IKE response terminal may first send the second original authentication data to the IKE originating terminal, and may also send it to the IKE response terminal along with the second authentication request.
  • the first sending module includes a primary mode switching response packet sending submodule, and is configured to send the second authentication request to the IKE originating terminal by using a primary mode exchange response packet (for IKEv1); or the first sending The module includes an authentication exchange response packet sending submodule, and is configured to send the second authentication request to the IKE initiating terminal by using an authentication exchange response packet (ie, an IKE_AUTH response packet for IKEv2).
  • the IKE originating terminal provided in this embodiment includes a second receiving module, a second processing module, and a second sending module.
  • the second processing module is configured to generate a first authentication request, where the first authentication request includes an authentication type used by the IKE originating terminal;
  • the second sending module is adapted to send the first authentication request to the IKE response terminal;
  • the second receiving module is configured to receive the second authentication request sent by the IKE response terminal, where the second authentication request is generated by the IKE response terminal according to the authentication type included in the first authentication request.
  • the process of generating the first authentication request by the second processing module is: the calculation result data calculated by the second processing module on the first original authentication data according to the authentication type configured by the IKE originating terminal (hereinafter referred to as the first to-be-verified data); And adding the authentication type and the first to-be-verified data and the identity information of the self to the first authentication request.
  • the IKE originating terminal may first send the first original authentication data to the IKE response terminal, and may also send it to the IKE ring with the first authentication request. Should be terminal.
  • the second sending module includes a primary mode switching request packet sending submodule, and is configured to send the first authentication request to the IKE response terminal by using the primary mode switching request packet (for IKEv1); or the second sending module includes The authentication exchange request packet (ie, the IKE_AUTH request packet, for the IKEv2) is sent to the IKE response terminal, and the first authentication request is sent to the IKE response terminal.
  • the authentication exchange request packet ie, the IKE_AUTH request packet, for the IKEv2
  • the IKE initiating terminal in this embodiment further includes a second verification module, which is configured to perform verification after the second receiving module receives the second authentication request, and the following uses the pre-shared key authentication type as an example. Be explained:
  • the second authentication request further includes the identity information of the IKE response terminal, and the calculation result data (hereinafter referred to as the second to-be-verified data) calculated by the IKE response terminal to the second original authentication data according to the acquired authentication type; the second verification module receives After the second authentication request, obtaining the identity information, searching for the corresponding key from the corresponding data correspondence database, and calculating the second original data by using the authentication type in the second authentication request to obtain the second verification data, The second verification data is matched with the second to-be-verified data, and if the two are consistent, the verification is passed; otherwise, if the verification fails, the response message of the authentication failure may be directly fed back to the IKE response terminal.
  • Embodiment 5 is a diagrammatic representation of Embodiment 5:
  • a switch module for enabling and disabling the smart type matching function of the authentication type may be configured on the IKE response terminal.
  • the function is enabled, the smart matching process is performed. Otherwise, the IKE response terminal is directly used.
  • the configured authentication type is used for authentication.
  • IKEv2 takes IKEv2 as an example. See Figure 9, which includes:
  • Step 901 The IKE response terminal receives the AUTH payload in the IKE_AUTH exchange message (that is, the first authentication request message) sent by the IKE initiator terminal.
  • Step 902 The IKE response terminal obtains the authentication type used by the IKE originating terminal from the AUTH payload.
  • Step 903 The IKE response terminal reads the configuration information of the smart authentication function of the local authentication type, and determines whether the authentication type intelligent matching function is enabled. If yes, go to step 905; otherwise, go to step Step 904;
  • Step 904 The IKE response terminal reads the configuration of the local authentication type, and calculates the IDr payload and the AUTH payload of the local end according to the authentication type configured by the local end to obtain a second authentication request, and proceeds to step 906.
  • Step 905 The IKE response terminal calculates the IDr payload and the AUTH payload of the local end according to the authentication type of the IKE originating terminal to obtain a second authentication request.
  • Step 906 The IKE responding terminal initiates the IKEv2 negotiation process by initiating the second authentication request IKE.
  • the embodiment of the present invention introduces an authentication policy of the smart adaptation authentication type in the IKE negotiation process, so that the IKE gateway can simultaneously access the IKE client devices supporting different authentication types when the pair of networks are connected to one network, and the IKE client is reduced on the one hand.
  • the network access requirements of the gateway access network can make the network expansion and change more flexible.
  • all or part of the steps of the above embodiments may also be implemented by using an integrated circuit. These steps may be separately fabricated into individual integrated circuit modules, or multiple modules or steps may be fabricated into a single integrated circuit module. achieve. Thus, the invention is not limited to any specific combination of hardware and software.
  • the devices/function modules/functional units in the above embodiments may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices.
  • each device/function module/functional unit in the above embodiment When each device/function module/functional unit in the above embodiment is implemented in the form of a software function module and sold or used as a stand-alone product, it can be stored in a computer readable storage medium.
  • the above mentioned computer readable storage medium may be a read only memory, a magnetic disk or an optical disk or the like.
  • the IKE response terminal when the second authentication request is generated, the IKE response terminal obtains the authentication type from the first authentication request sent by the IKE initiator, and generates and sends the second authentication request by using the same authentication type as the IKE initiator. Therefore, the terminal intelligent adaptation authentication type can be initiated for different IKEs, and the problem that the authentication fails due to the authentication type adopted by the IKE originating terminal not supporting the IKE response terminal is avoided.

Abstract

一种IKE认证方法、IKE发起终端、IKE响应终端及IKE认证系统，IKE发起终端生成包含其当前使用的认证类型的第一认证请求，并将该第一认证请求发给IKE响应终端；IKE响应终端接收到第一认证请求后，从中获取IKE发起终端使用的认证类型，然后该认证类型生成第二认证请求并发给所述IKE发起终端，其中，IKE响应终端生成第二认证请求时所采用的认证类型是从第一认证请求中获取的，因此，IKE响应终端采用的认证类型与IKE发起终端采用的认证类型是一致的。通过本发明实施例提供的方案，IKE响应终端可以针对不同的IKE发起终端智能适配认证类型，从而避免因IKE发起终端不支持IKE响应终端所采用的认证类型导致认证失败的问题。

Description

IKE认证方法、IKE发起终端、IKE响应终端及IKE认证系统 技术领域
本发明涉及通信网络安全领域，具体涉及一种IKE(Internet Key Exchange，因特网密钥交换协议)认证方法、IKE发起终端、IKE响应终端及IKE认证系统。
背景技术
随着因特网的高速发展，IP网络逐渐成为人们日常工作和生活中必不可少的工具，而在IP网络上进行数据传输的安全性保证的需求也日趋强烈。众所周知，IP网络是个开放的网络，不采取任何措施就利用IP网络进行数据通信是毫无安全性可言的。为了满足在IP网上获得安全通信的需要，互联网工程任务组的IPSec(IP Security，IP安全)工作组制定了一组基于密码学的开放网络安全协议，总称IPSec体系结构。IPSec协议提供了访问控制、无连接的数据完整性、数据保密性、数据源验证、防重放攻击、自动密钥管理等安全服务。IPsec在对IP网络提供安全保护时需要一些参数，包括加解密算法及密钥，完整性验证算法及密钥等集合，称之为SA(安全联盟)。生成SA有两种方法，手工配置和自动协商，在大型的网络部署中，需要采用自动协商方式为IPsec通讯两端生成SA。互联网工程组指定了IKE协议用于自动协商SA，目前已有两个版本IKEv1和IKEv2。IKEv2相对于IKEv1版本减少了协商报文个数，增加了一些新的功能。
数据源认证功能是IPsec协议簇提供的功能之一，通过在IKE协商过程中对IKE对端进行身份认证来实现。在IKE协商过程中，IKE通讯两端通过相互认证对端的身份ID来确认对端的合法性；具体的认证类型有多种，IKE认证类型取决于本端配置，一旦配置确定了，在与不同的对端进行IKE协商时，都会采用同一种认证类型。在一些多对一的应用场景中，多个不同的IKE客户端可能会要求IKE服务端采用不同的认证类型，这种需求很难通过IKE服务端的配置解决。例如如图1所示，图中安全网关是一台IPsec网关设备；众多IPsec站点可与一台IPsec网关之间建立IPsec隧道，用于保护 它们之间的数据通讯。图1中的站点与网关之间通过IKEv2协议交换密钥，IPsec站点作为IKE发起终端，IPsec网关作为IKE响应终端。IPsec站点和IPsec网关所保护的网络是相互不可见的，它们之间需要通讯，为了保证通讯数据的数据源可靠，在IKEv2协商过程中两端相互进行身份认证，身份认证是单向的，所采用的认证方式可不相同，在图1的多对一组网中，众多IPsec站点可能支持的是不同的认证方式，某些站点可能对IPsec网关上配置那一种认证方式不支持，这样IPsec网关就不能以自身已经配置好的那一种认证方式来与所有的IPsec站点进行IKE协商，否则会导致因站点不支持IPsec网关所采用的认证方式导致认证失败。
发明内容
本发明实施例提供一种IKE认证方法、IKE发起终端、IKE响应终端及IKE认证系统，以解决现有IKE认证过程中因IKE发起终端不支持IKE响应终端所采用的认证类型导致认证失败的问题。
为解决上述技术问题，本发明实施例提供了一种IKE认证方法，包括：
IKE响应终端接收IKE发起终端发送的第一认证请求，所述第一认证请求中包含所述IKE发起终端使用的认证类型；
所述IKE响应终端从所述第一认证请求中获取所述IKE发起终端使用的认证类型，根据获取的认证类型生成第二认证请求；
所述IKE响应终端将所述第二认证请求发给所述IKE发起终端。
在本发明的一种实施例中，在所述IKE响应终端根据获取的认证类型生成第二认证请求之前，还包括：
所述IKE响应终端对所述第一认证请求进行校验，当校验通过时，根据获取的认证类型生成第二认证请求。
在本发明的一种实施例中，所述IKE响应终端通过主模式交换响应报文或认证交换响应报文将所述第二认证请求发给所述IKE发起终端。
为了解决上述问题，本发明实施例还提供了一种IKE认证方法，包括：
IKE发起终端生成第一认证请求，所述第一认证请求中包含所述IKE发 起终端使用的认证类型；
所述IKE发起终端向IKE响应终端发送第一认证请求；
所述IKE发起终端接收所述IKE响应终端发送的第二认证请求；所述第二认证请求为所述IKE响应终端根据所述第一认证请求中包含的认证类型生成。
在本发明的一种实施例中，所述IKE发起终端通过主模式交换请求报文或认证交换请求报文将所述第一认证请求发给所述IKE响应终端。
为了解决上述问题，本发明实施例还提供了一种IKE认证方法，包括：
IKE发起终端生成第一认证请求，并将该第一认证请求发给IKE响应终端，所述第一认证请求中包含所述IKE发起终端使用的认证类型；
所述IKE响应终端接收所述IKE发起终端发送的第一认证请求，从所述第一认证请求中获取所述IKE发起终端使用的认证类型，根据获取的认证类型生成第二认证请求，将所述第二认证请求发给所述IKE发起终端；
所述IKE发起终端接收所述IKE响应终端发送的第二认证请求。
为了解决上述问题，本发明实施例还提供了一种IKE响应终端，包括第一接收模块、第一处理模块和第一发送模块；
所述第一接收模块，设置为接收IKE发起终端发送的第一认证请求，所述第一认证请求中包含所述IKE发起终端使用的认证类型；
所述第一处理模块，设置为从所述第一认证请求中获取所述IKE发起终端使用的认证类型，根据获取的认证类型生成第二认证请求；
所述第一发送模块，设置为将所述第二认证请求发给所述IKE发起终端。
在本发明的一种实施例中，还包括校验模块，设置为在所述第一处理模块根据获取的认证类型生成第二认证请求之前，对所述第一认证请求进行校验，当校验通过时，通知所述第一处理模块根据获取的认证类型生成第二认证请求。
在本发明的一种实施例中，所述第一发送模块包括主模式交换响应报文 发送子模块，设置为将所述第二认证请求通过主模式交换响应报文发给所述IKE发起终端；或所述第一发送模块包括认证交换响应报文发送子模块，设置为将所述第二认证请求通过认证交换响应报文发给所述IKE发起终端。
为了解决上述问题，本发明实施例还提供了一种IKE发起终端，包括第二接收模块、第二处理模块和第二发送模块；
所述第二处理模块，设置为生成第一认证请求，所述第一认证请求中包含所述IKE发起终端使用的认证类型；
所述第二发送模块，设置为向IKE响应终端发送所述第一认证请求；
所述第二接收模块，设置为接收所述IKE响应终端发送的第二认证请求；所述第二认证请求为所述IKE响应终端根据所述第一认证请求中包含的认证类型生成。
在本发明的一种实施例中，所述第二发送模块包括主模式交换请求报文发送子模块，设置为将所述第一认证请求通过主模式交换请求报文发送给所述IKE响应终端；或所述第二发送模块包括认证交换请求报文发送子模块，设置为将所述第一认证请求通过认证交换请求报文发给所述IKE响应终端。
为了解决上述问题，本发明实施例还提供了一种IKE认证系统，包括IKE发起终端和IKE响应终端；
所述IKE发起终端，设置为生成第一认证请求，并将该第一认证请求发给所述IKE响应终端，所述第一认证请求中包含所述IKE发起终端使用的认证类型；以及接收所述IKE响应终端发送的第二认证请求；
所述IKE响应终端，设置为接收IKE发起终端发送的第一认证请求，从所述第一认证请求中获取所述IKE发起终端使用的认证类型，根据获取的认证类型生成第二认证请求；以及将所述第二认证请求发给所述IKE发起终端。
其中，所述IKE发起终端通过主模式交换请求报文或认证交换请求报文将所述第一认证请求发给所述IKE响应终端；相应地，所述IKE响应终端，通过主模式交换请求报文或认证交换请求报文将所述第二认证请求发给所述IKE发起终端。
本发明实施例还提供一种计算机可读存储介质，所述存储介质存储有计算机程序，所述计算机程序包括程序指令，但该程序指令被IKE发起终端执行时，使得该终端执行上述的IKE认证方法。
本发明实施例还提供一种计算机可读存储介质，所述存储介质存储有计算机程序，所述计算机程序包括程序指令，但该程序指令被IKE响应终端执行时，使得该终端执行上述的IKE认证方法。
本发明实施例的有益效果是：
本发明实施例提供的IKE认证方法、IKE发起终端、IKE响应终端及IKE认证系统，IKE发起终端生成包含其当前使用的认证类型的第一认证请求，并将该第一认证请求发给IKE响应终端；IKE响应终端接收到第一认证请求后，从中获取IKE发起终端使用的认证类型，然后该认证类型生成第二认证请求并发给所述IKE发起终端；可见，在本发明实施例中，IKE响应终端生成第二认证请求时所采用的认证类型是从第一认证请求中获取的，也即采用的认证类型与IKE发起终端采用的认证类型是一致的，IKE发起终端必然支持该认证类型。因此，通过本发明实施例提供的该方案可以IKE响应终端可以针对不同的IKE发起终端智能适配认证类型，进而可避免因IKE发起终端不支持IKE响应终端所采用的认证类型导致认证失败的问题。
附图概述
图1为一种典型组网的结构示意图；
图2为本发明实施例一中IKE认证方法流程示意图；
图3为本发明实施例二中IKE认证方法流程示意图；
图4为本发明实施例三中IKE认证方法流程示意图；
图5为本发明实施例四中IKE认证系统结构示意图；
图6为本发明实施例四中IKE响应终端结构示意图；
图7为本发明实施例四中另一种IKE响应终端结构示意图；
图8为本发明实施例四中IKE发起终端结构示意图；
图9为本发明实施例五中IKE认证方法流程示意图。
本发明的较佳实施方式
下文中将结合附图对本发明的实施例进行详细说明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互任意组合。另外，虽然在流程图中示出了逻辑顺序，但是在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤。
实施例一：
请参考图2所示，本实施例提供的IKE认证方法包括：
步骤201：IKE响应终端接收IKE发起终端发送的第一认证请求，该第一认证请求中包含IKE发起终端使用的认证类型；
步骤202：IKE响应终端从第一认证请求中获取IKE发起终端使用的认证类型，根据获取的认证类型生成第二认证请求；也即采用获取的认证类型生成第二认证请求，以保证IKE发起终端能支持识别该认证类型；
步骤203：IKE响应终端将生成的第二认证请求发给IKE发起终端以进行认证。
在本实施例中，IKE响应终端接收到第一认证请求后，根据从第一认证请求中获取的认证类型生成第二认证请求之前，还包括：
IKE响应终端对第一认证请求进行校验，如校验通过，才根据获取的认证类型生成第二认证请求；否则，可直接向IKE发起终端反馈认证失败的响应消息。
本实施例中提供的方案可适用但并不局限于预共享密钥认证类型和证书认证类型。下面以预共享密钥认证类型为例，对IKE响应终端对第一认证请求进行校验的过程进行示例性说明：
第一认证请求还可包括IKE发起终端的身份信息，以及IKE发起终端根据其本地配置的认证类型对第一原始认证数据进行计算得到的计算结果数据(以下称为第一待验证数据)；IKE响应终端接收到该第一认证请求后，获取身份信息，从相应的数据对应关系库中查找到对应的密钥，并结合第一认 证请求中的认证类型对所述第一原始数据进行计算得到第一验证数据，将第一验证数据与第一待验证数据进行匹配，如二者一致则验证通过；否则，验证失败。
本实施例中，IKE响应终端生成第二认证请求的过程为：IKE响应终端根据获取配置的认证类型对第二原始认证数据进行计算得到的计算结果数据(以下称为第二待验证数据)；并将认证类型和第二待验证数据以及自身的身份信息加入第二认证请求中。在此之前，IKE响应终端可以将该第二原始认证数据先发给IKE发起终端，当然也可将其随着第二认证请求发给IKE响应终端。
本实施例中，IKE响应终端向IKE发起终端反馈第二认证请求时，具体可通过主模式交换响应报文(针对IKEv1)或认证交换响应报文(即IKE_AUTH响应报文,针对IKEv2)将第二认证请求发给IKE发起终端。通过IKE_AUTH响应报文发送时，该报文中具体可包括IDr载荷和AUTH载荷，其中IDr载荷包括IKE响应终端的身份信息，AUTH载荷包括IKE响应终端采用的认证类型(与IKE发起终端所采用的认证类型一致)以及IKE响应终端根据该认证类型对第二原始认证数据进行计算得到的计算结果数据(以下称为第二待验证数据)。
本实施例中，IKE发起终端的用于进行认证的第一原始认证数据和IKE响应终端的用于进行认证的第二原始认证数据可以在IKE发起终端向IKE响应终端发送第一认证请求前分别发给对端；当然，根据实际应用，也可分别随着第一认证请求和第二认证请求发给对端。
实施例二：
请参考图3所示，本实施例提供的IKE认证方法包括：
步骤301：IKE发起终端生成第一认证请求，生成的第一认证请求中包含IKE发起终端使用的认证类型；
步骤302：IKE发起终端向IKE响应终端发送第一认证请求；
步骤303：IKE发起终端接收IKE响应终端发送的第二认证请求；第二 认证请求为IKE响应终端根据第一认证请求中包含的认证类型生成。
在本实施例中，IKE发起终端生成第一认证请求的过程为：IKE发起终端根据本地配置的认证类型对第一原始认证数据进行计算得到的计算结果数据(以下称为第一待验证数据)；并将认证类型和第一待验证数据以及自身的身份信息加入第一认证请求中。在此之前，IKE发起终端可以将该第一原始认证数据先发给IKE响应终端，当然也可将其随着第一认证请求发给IKE响应终端。
本实施例中，IKE发起终端具体可通过主模式交换请求报文(针对IKEv1)或认证交换请求报文(即IKE_AUTH请求报文,针对IKEv2)将第一认证请求发给所述IKE响应终端。通过IKE_AUTH请求报文发送时，该报文中具体可包括IDi载荷和AUTH载荷，其中IDi载荷包括IKE发起终端的身份信息，AUTH载荷包括IKE发起终端采用的认证类型以及IKE发起终端根据其本地的认证类型对第一原始认证数据进行计算得到的第一待验证数据。
本实施例中，IKE响应终端生成第二认证请求的过程为：IKE响应终端根据获取配置的认证类型对第二原始认证数据进行计算得到的计算结果数据(以下称为第二待验证数据)；并将认证类型和第二待验证数据以及自身的身份信息加入第二认证请求中。在此之前，IKE发起终端可以将该第二原始认证数据先发给IKE发起终端，当然也可将其随着第二认证请求发给IKE响应终端。
在上述步骤303之后，IKE发起终端收到第二认证请求后，对第二认证请求进行校验认证。下面仍以预共享密钥认证类型为例，对IKE发起终端对第二认证请求进行校验的过程进行示例性说明：
第二认证请求还包括IKE响应终端的身份信息，以及IKE响应终端根据获取认证类型对第二原始认证数据进行计算得到的计算结果数据(以下称为第二待验证数据)；IKE发起终端接收到该第二认证请求后，获取身份信息，从相应的数据对应关系库中查找到对应的密钥，并结合第二认证请求中的认证类型对第二原始数据进行计算得到第二验证数据，将第二验证数据与第二待验证数据进行匹配，如二者一致则验证通过；否则，验证失败，可直接向IKE响应终端反馈认证失败的响应消息。
实施例三：
请参见图4所示，本实施例提供的IKE认证方法包括：
步骤401：IKE发起终端生成第一认证请求，并将该第一认证请求发给IKE响应终端，第一认证请求中包含所述IKE发起终端使用的认证类型；
步骤402：IKE响应终端接收IKE发起终端发送的第一认证请求，从第一认证请求中获取IKE发起终端使用的认证类型；
步骤403：IKE响应终端根据获取的认证类型生成第二认证请求，将第二认证请求发给IKE发起终端；
步骤404：IKE发起终端接收IKE响应终端发送的第二认证请求。
本实施例中，IKE发起终端具体可通过主模式交换请求报文(针对IKEv1)或认证交换请求报文(即IKE_AUTH请求报文,针对IKEv2)将第一认证请求发给所述IKE响应终端。IKE响应终端向IKE发起终端反馈第二认证请求时，具体可通过主模式交换响应报文(针对IKEv1)或认证交换响应报文(即IKE_AUTH响应报文,针对IKEv2)将第二认证请求发给IKE发起终端。
在本实施例中，IKE响应终端接收到第一认证请求后，根据从第一认证请求中获取的认证类型生成第二认证请求之前，还包括：
IKE响应终端对第一认证请求进行校验，如校验通过，才根据获取的认证类型生成第二认证请求；否则，可直接向IKE发起终端反馈认证失败的响应消息。
在本实施例中，IKE发起终端收到第二认证请求后，对第二认证请求进行校验认证。下面仍以预共享密钥认证类型为例，对IKE发起终端对第二认证请求进行校验的过程进行示例性说明；对于IKE响应终端对第一认证请求的认证过程在此不再赘述：
第二认证请求还包括IKE响应终端的身份信息，以及IKE响应终端根据获取认证类型对第二原始认证数据进行计算得到的计算结果数据(以下称为第二待验证数据)；IKE发起终端接收到该第二认证请求后，获取身份信 息，从相应的数据对应关系库中查找到对应的密钥，并结合第二认证请求中的认证类型对第二原始数据进行计算得到第二验证数据，将第二验证数据与第二待验证数据进行匹配，如二者一致则验证通过；否则，验证失败，可直接向IKE响应终端反馈认证失败的响应消息。
实施例四：
请参见图5所示，本实施例提供的IKE认证系统包括IKE发起终端和IKE响应终端，分别包括处理器和程序存储设备，其中：
IKE发起终端适用于生成第一认证请求，并将该第一认证请求发给所述IKE响应终端，第一认证请求中包含IKE发起终端使用的认证类型；以及适用于接收IKE响应终端发送的第二认证请求；
IKE响应终端适用于接收IKE发起终端发送的第一认证请求，从第一认证请求中获取IKE发起终端使用的认证类型，根据获取的认证类型生成第二认证请求；以及将第二认证请求发给IKE发起终端。
具体的，请参见图6所示，本实施例中的IKE响应终端包括第一接收模块、第一处理模块和第一发送模块；
第一接收模块适用于接收IKE发起终端发送的第一认证请求，第一认证请求中包含IKE发起终端使用的认证类型；
第一处理模块适用于从第一认证请求中获取IKE发起终端使用的认证类型，根据获取的认证类型生成第二认证请求；
第一发送模块适用于将第二认证请求发给IKE发起终端。
请参见图7所示，IKE响应终端还包括校验模块(以下称为第一校验模块)，适用于在第一处理模块根据获取的认证类型生成第二认证请求之前，对第一认证请求进行校验，如校验通过，才通知第一处理模块根据获取的认证类型生成第二认证请求。下面以预共享密钥认证类型为例，对第一校验模块对第一认证请求进行校验的过程进行示例性说明：
第一认证请求还可包括IKE发起终端的身份信息，以及IKE发起终端根据其本地配置的认证类型对第一原始认证数据进行计算得到的计算结果数据 (以下称为第一待验证数据)；IKE响应终端接收到该第一认证请求后，第一校验模块获取身份信息，从相应的数据对应关系库中查找到对应的密钥，并结合第一认证请求中的认证类型对所述第一原始数据进行计算得到第一验证数据，将第一验证数据与第一待验证数据进行匹配，如二者一致则验证通过；否则，验证失败。
本实施例中，第一处理模块生成第二认证请求的过程为：第一处理模块根据获取配置的认证类型对第二原始认证数据进行计算得到的计算结果数据(以下称为第二待验证数据)；并将认证类型和第二待验证数据以及自身的身份信息加入第二认证请求中。在此之前，IKE响应终端可以将该第二原始认证数据先发给IKE发起终端，当然也可将其随着第二认证请求发给IKE响应终端。
本实施例中，第一发送模块包括主模式交换响应报文发送子模块，适用于将第二认证请求通过主模式交换响应报文(针对IKEv1)发给所述IKE发起终端；或第一发送模块包括认证交换响应报文发送子模块，适用于将第二认证请求通过认证交换响应报文(即IKE_AUTH响应报文,针对IKEv2)发给IKE发起终端。
请参见图8所示，本实施例提供的IKE发起终端包括第二接收模块、第二处理模块和第二发送模块；
第二处理模块适用于生成第一认证请求，第一认证请求中包含所述IKE发起终端使用的认证类型；
第二发送模块适用于向IKE响应终端发送第一认证请求；
第二接收模块适用于接收IKE响应终端发送的第二认证请求；第二认证请求为IKE响应终端根据所述第一认证请求中包含的认证类型生成。
第二处理模块生成第一认证请求的过程为：第二处理模块根据IKE发起终端本地配置的认证类型对第一原始认证数据进行计算得到的计算结果数据(以下称为第一待验证数据)；并将认证类型和第一待验证数据以及自身的身份信息加入第一认证请求中。在此之前，IKE发起终端可以将该第一原始认证数据先发给IKE响应终端，当然也可将其随着第一认证请求发给IKE响 应终端。
本实施例中，第二发送模块包括主模式交换请求报文发送子模块，适用于将第一认证请求通过主模式交换请求报文(针对IKEv1)发送给IKE响应终端；或第二发送模块包括认证交换请求报文(即IKE_AUTH请求报文,针对IKEv2)发送子模块，适用于将第一认证请求通过认证交换请求报文发给IKE响应终端。
本实施例中的IKE发起终端还包括第二校验模块，适用于在第二接收模块接收到第二认证请求后，对其进行校验，下面以预共享密钥认证类型为例对该过程进行说明：
第二认证请求还包括IKE响应终端的身份信息，以及IKE响应终端根据获取认证类型对第二原始认证数据进行计算得到的计算结果数据(以下称为第二待验证数据)；第二验证模块接收到该第二认证请求后，获取身份信息，从相应的数据对应关系库中查找到对应的密钥，并结合第二认证请求中的认证类型对第二原始数据进行计算得到第二验证数据，将第二验证数据与第二待验证数据进行匹配，如二者一致则验证通过；否则，验证失败，可直接向IKE响应终端反馈认证失败的响应消息。
实施例五：
在本实施例中，在IKE响应终端上可配置一个用于开启和关闭上述认证类型智能匹配功能的开关模块，在该功能开启时，才进行上述智能匹配过程，否则，直接采用IKE响应终端本地配置的认证类型进行认证。下面以IKEv2为例进行说明，请参见图9所示，包括：
步骤901：IKE响应终端接收IKE发起终端发送的IKE_AUTH交换报文(即第一认证请求报文)中的AUTH载荷；
步骤902：IKE响应终端从该AUTH载荷中获取IKE发起终端使用的认证类型；
步骤903：IKE响应终端读取本端认证类型智能适配功能的配置信息，判断认证类型智能匹配功能是否开启，如是，转至步骤905，否则，转至步 骤904；
步骤904：IKE响应终端读取本端认证类型配置，根据本端配置的认证类型计算本端的IDr载荷和AUTH载荷得到第二认证请求，转步骤906；
步骤905：IKE响应终端根据IKE发起终端的认证类型计算本端的IDr载荷和AUTH载荷得到第二认证请求；
步骤906：IKE响应终端将第二认证请求IKE发起终端，继续IKEv2协商流程。
可见，本发明实施例引入了IKE协商过程中智能适配认证类型的认证策略，使得IKE网关在多对一组网时能同时接入支持不同认证类型的IKE客户端设备，一方面降低了IKE网关接入网络对组网的要求，另一方面也能让组网扩容及变动更加灵活。
本领域普通技术人员可以理解上述实施例的全部或部分步骤可以使用计算机程序流程来实现，所述计算机程序可以存储于一计算机可读存储介质中，所述计算机程序在相应的硬件平台上(如系统、设备、装置、器件等)执行，在执行时，包括方法实施例的步骤之一或其组合。
可选地，上述实施例的全部或部分步骤也可以使用集成电路来实现，这些步骤可以被分别制作成一个个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明不限制于任何特定的硬件和软件结合。
上述实施例中的各装置/功能模块/功能单元可以采用通用的计算装置来实现，它们可以集中在单个的计算装置上，也可以分布在多个计算装置所组成的网络上。
上述实施例中的各装置/功能模块/功能单元以软件功能模块的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。上述提到的计算机可读取存储介质可以是只读存储器，磁盘或光盘等。
任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应以权利要求所述的保护范围为准。
工业实用性
本发明实施例提供的方案，IKE响应终端在生成第二认证请求时，从IKE发起终端发送的第一认证请求中获取认证类型，采用与IKE发起终端相同的认证类型生成和发送第二认证请求，从而可以针对不同的IKE发起终端智能适配认证类型，避免因IKE发起终端不支持IKE响应终端所采用的认证类型导致认证失败的问题。

Claims (15)

  1. 一种因特网密钥交换协议(IKE)认证方法，包括：
    IKE响应终端接收IKE发起终端发送的第一认证请求，所述第一认证请求中包含所述IKE发起终端使用的认证类型；
    所述IKE响应终端从所述第一认证请求中获取所述IKE发起终端使用的认证类型，根据获取的认证类型生成第二认证请求；
    所述IKE响应终端将所述第二认证请求发给所述IKE发起终端。
  2. 如权利要求1所述的方法，在所述IKE响应终端根据获取的认证类型生成第二认证请求之前，还包括：
    所述IKE响应终端对所述第一认证请求进行校验，当校验通过时，根据获取的认证类型生成第二认证请求。
  3. 如权利要求1或2所述的方法，其中，所述IKE响应终端通过主模式交换响应报文或认证交换响应报文将所述第二认证请求发给所述IKE发起终端。
  4. 一种IKE认证方法，包括：
    IKE发起终端生成第一认证请求，所述第一认证请求中包含所述IKE发起终端使用的认证类型；
    所述IKE发起终端向IKE响应终端发送第一认证请求；
    所述IKE发起终端接收所述IKE响应终端发送的第二认证请求；所述第二认证请求为所述IKE响应终端根据所述第一认证请求中包含的认证类型生成。
  5. 如权利要求4所述的方法，其中，所述IKE发起终端通过主模式交换请求报文或认证交换请求报文将所述第一认证请求发给所述IKE响应终端。
  6. 一种IKE认证方法，包括：
    IKE发起终端生成第一认证请求，并将该第一认证请求发给IKE响应终端，所述第一认证请求中包含所述IKE发起终端使用的认证类型；
    所述IKE响应终端接收所述IKE发起终端发送的第一认证请求，从所述 第一认证请求中获取所述IKE发起终端使用的认证类型，根据获取的认证类型生成第二认证请求，将所述第二认证请求发给所述IKE发起终端；
    所述IKE发起终端接收所述IKE响应终端发送的第二认证请求。
  7. 一种IKE响应终端，包括第一接收模块、第一处理模块和第一发送模块；
    所述第一接收模块，设置为接收IKE发起终端发送的第一认证请求，所述第一认证请求中包含所述IKE发起终端使用的认证类型；
    所述第一处理模块，设置为用于从所述第一认证请求中获取所述IKE发起终端使用的认证类型，根据获取的认证类型生成第二认证请求；
    所述第一发送模块，设置为将所述第二认证请求发给所述IKE发起终端。
  8. 如权利要求7所述的IKE响应终端，还包括校验模块，设置为在所述第一处理模块根据获取的认证类型生成第二认证请求之前，对所述第一认证请求进行校验，当校验通过时，通知所述第一处理模块根据获取的认证类型生成第二认证请求。
  9. 如权利要求7或8所述的IKE响应终端，其中，所述第一发送模块包括主模式交换响应报文发送子模块，设置为将所述第二认证请求通过主模式交换响应报文发给所述IKE发起终端；或所述第一发送模块包括认证交换响应报文发送子模块，设置为将所述第二认证请求通过认证交换响应报文发给所述IKE发起终端。
  10. 一种IKE发起终端，包括第二接收模块、第二处理模块和第二发送模块；
    所述第二处理模块，设置为生成第一认证请求，所述第一认证请求中包含所述IKE发起终端使用的认证类型；
    所述第二发送模块，设置为向IKE响应终端发送所述第一认证请求；
    所述第二接收模块，设置为接收所述IKE响应终端发送的第二认证请求；所述第二认证请求为所述IKE响应终端根据所述第一认证请求中包含的认证类型生成。
  11. 如权利要求10所述的IKE发起终端，其中，所述第二发送模块包括主模式交换请求报文发送子模块，设置为将所述第一认证请求通过主模式交 换请求报文发送给所述IKE响应终端；或所述第二发送模块包括认证交换请求报文发送子模块，设置为将所述第一认证请求通过认证交换请求报文发给所述IKE响应终端。
  12. 一种IKE认证系统，包括IKE发起终端和IKE响应终端；
    所述IKE发起终端，设置为生成第一认证请求，并将该第一认证请求发给所述IKE响应终端，所述第一认证请求中包含所述IKE发起终端使用的认证类型；以及接收所述IKE响应终端发送的第二认证请求；
    所述IKE响应终端，设置为接收IKE发起终端发送的第一认证请求，从所述第一认证请求中获取所述IKE发起终端使用的认证类型，根据获取的认证类型生成第二认证请求；以及将所述第二认证请求发给所述IKE发起终端。
  13. 如权利要求12所述的系统，其中，所述IKE发起终端通过主模式交换请求报文或认证交换请求报文将所述第一认证请求发给所述IKE响应终端；相应地，所述IKE响应终端，通过主模式交换请求报文或认证交换请求报文将所述第二认证请求发给所述IKE发起终端。
  14. 一种计算机可读存储介质，所述存储介质存储有计算机程序，所述计算机程序包括程序指令，但该程序指令被IKE发起终端执行时，使得该终端执行权利要求1-3任一项所述的方法。
  15. 一种计算机可读存储介质，所述存储介质存储有计算机程序，所述计算机程序包括程序指令，但该程序指令被IKE响应终端执行时，使得该终端执行权利要求4-5任一项所述的方法。
PCT/CN2015/073052 2014-09-22 2015-02-13 Ike认证方法、ike发起终端、ike响应终端及ike认证系统 WO2016045307A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410486241.1A CN105450418A (zh) 2014-09-22 2014-09-22 Ike认证方法、ike发起终端、ike响应终端及ike认证系统
CN201410486241.1 2014-09-22

Publications (1)

Publication Number Publication Date
WO2016045307A1 true WO2016045307A1 (zh) 2016-03-31

Family

ID=55560230

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/073052 WO2016045307A1 (zh) 2014-09-22 2015-02-13 Ike认证方法、ike发起终端、ike响应终端及ike认证系统

Country Status (2)

Country Link
CN (1) CN105450418A (zh)
WO (1) WO2016045307A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111147471B (zh) * 2019-12-20 2023-02-28 视联动力信息技术股份有限公司 一种终端入网认证方法、装置、系统和存储介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101815296A (zh) * 2009-02-23 2010-08-25 华为技术有限公司 一种进行接入认证的方法、装置及系统
WO2012030467A1 (en) * 2010-08-31 2012-03-08 Intel Corporation Roaming between networks employing different authentication protocols
CN102611683A (zh) * 2011-12-14 2012-07-25 上海聚力传媒技术有限公司 一种用于执行第三方认证的方法、装置、设备和系统

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1835436B (zh) * 2005-03-14 2010-04-14 华为技术有限公司 一种通用鉴权网络及一种实现鉴权的方法
CN100518063C (zh) * 2007-06-19 2009-07-22 北京握奇数据系统有限公司 一种物理认证的方法及装置
WO2009111522A1 (en) * 2008-03-04 2009-09-11 Alcatel-Lucent Usa Inc. System and method for securing a base station using sim cards
CN101772020B (zh) * 2009-01-05 2011-12-28 华为技术有限公司 鉴权处理方法和系统、3gpp认证授权计费服务器及用户设备
CN101997684B (zh) * 2009-08-10 2013-01-23 北京多思科技发展有限公司 一种授权认证方法、装置以及系统

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101815296A (zh) * 2009-02-23 2010-08-25 华为技术有限公司 一种进行接入认证的方法、装置及系统
WO2012030467A1 (en) * 2010-08-31 2012-03-08 Intel Corporation Roaming between networks employing different authentication protocols
CN102611683A (zh) * 2011-12-14 2012-07-25 上海聚力传媒技术有限公司 一种用于执行第三方认证的方法、装置、设备和系统

Also Published As

Publication number Publication date
CN105450418A (zh) 2016-03-30

Similar Documents

Publication Publication Date Title
US10237241B2 (en) Transport layer security latency mitigation
EP3641266B1 (en) Data processing method and apparatus, terminal, and access point computer
CN103118027B (zh) 基于国密算法建立tls通道的方法
CN107040513B (zh) 一种可信访问认证处理方法、用户终端和服务端
CN110024325B (zh) 用于设备之间mka协商的系统、方法和设备
CN104145465B (zh) 机器类型通信中基于群组的自举的方法和装置
TW201706900A (zh) 終端的認證處理、認證方法及裝置、系統
WO2019178942A1 (zh) 一种进行ssl握手的方法和系统
WO2016115807A1 (zh) 无线路由器的接入处理、接入方法及装置
WO2015085848A1 (zh) 一种安全认证方法和双向转发检测bfd设备
WO2011140924A1 (zh) 一种网关、节点和服务器进行鉴权的方法、装置及系统
RU2530691C1 (ru) Способ защищенного удаленного доступа к информационным ресурсам
US9398024B2 (en) System and method for reliably authenticating an appliance
Toris et al. Message authentication codes for secure remote non-native client connections to ros enabled robots
EP4231680A1 (en) Identity authentication system, method and apparatus, device, and computer readable storage medium
CN104901940A (zh) 一种基于cpk标识认证的802.1x网络接入方法
CN110839240B (zh) 一种建立连接的方法及装置
RU2645597C2 (ru) Способ аутентификации в канале скрытой передачи данных
BR112021003460A2 (pt) dispositivo sem identidade de assinante, dispositivo de identidade do assinante, método para uso em um dispositivo sem identidade de assinante, método para uso em um dispositivo com identidade de assinante e produto de programa de computador
CN116015807A (zh) 一种基于边缘计算的轻量级终端安全接入认证方法
WO2015180399A1 (zh) 一种认证方法及装置系统
Krishnasrija et al. A lightweight mutual and transitive authentication mechanism for IoT network
CN113411187A (zh) 身份认证方法和系统、存储介质及处理器
US20180183584A1 (en) IKE Negotiation Control Method, Device and System
JP5614465B2 (ja) 暗号通信装置、代行サーバ、暗号通信装置プログラム及び代行サーバプログラム

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15843219

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15843219

Country of ref document: EP

Kind code of ref document: A1