WO2019015618A1

WO2019015618A1 - Communication tunnel endpoint address separation method, terminal, gateway and storage medium

Info

Publication number: WO2019015618A1
Application number: PCT/CN2018/096172
Authority: WO
Inventors: 李道红
Original assignee: 中兴通讯股份有限公司
Priority date: 2017-07-18
Filing date: 2018-07-18
Publication date: 2019-01-24
Also published as: CN109428852B; CN109428852A

Abstract

Disclosed are a communication tunnel endpoint address separation method, a terminal, a gateway and a storage medium. The method comprises the following steps: an evolved packet data gateway (ePDG) establishing an Internet key exchange (IKE) security association (SA) tunnel according to a first request message sent by a terminal, generating a corresponding first response message and returning said first response message to the terminal; and the ePDG establishing an Internet protocol security (IPSec) SA tunnel according to a received second request message sent by the terminal, generating a corresponding second response message and returning said second response message to the terminal, so as to complete establishment of the IPSec SA tunnel, the second request message carrying a separation tag, the separation tag indicating that the terminal supports endpoint address separation of the ePDG IKE SA tunnel and the IPSec SA tunnel.

Description

Communication tunnel endpoint address separation method, terminal, gateway and storage medium

Technical field

The present disclosure relates to the field of communications technologies, and in particular, to a communication tunnel endpoint address separation method, a terminal, a gateway, and a storage medium.

Background technique

The non-credited 3rd Generation Partnership Project (3GPP) access network can access the network architecture of the 3GPP Evolved Packet Core Network. In this case, Internet Protocol Security (IPSec) The two ends of the tunnel are the terminal and ePDG (Evolved Packet Data Gateway), and on the terminal side, the Internet Key Exchange (IKE) Security Association (SA) tunnel and The endpoint address of the IPSec SA tunnel is the same. On the ePDG side, the IKE SA tunnel and the IPSec SA tunnel have the same endpoint address. Therefore, in the existing architecture, the endpoint addresses of the IKE SA tunnel and the IPSec SA tunnel must be the same on the terminal side and the ePDG side.

In a virtualized environment, in order to optimize the performance of the control plane and the user plane, the IKE SA tunnel function and the IPSec SA tunnel function can be deployed on different virtual machines (VMs). A business address. However, the endpoint addresses of the IKE SA tunnel and the IPSec SA tunnel must be the same on the terminal side and the ePDG side. This prevents the function of the IKE SA tunnel and the function of the IPSec SA tunnel from being deployed on different VMs.

Summary of the invention

The present disclosure provides a method for separating a communication tunnel endpoint address, including the following steps: when an evolved packet data gateway ePDG receives a first request message sent by a terminal, establishing an Internet Key Exchange IKE Security Association SA according to the first request message Tunneling, and generating a first response message corresponding to the first request message, returning the first response message to the terminal; and the ePDG receiving a second request message sent by the terminal, according to the The second request message establishes an Internet Protocol Security IPSec SA tunnel, and generates a second response message corresponding to the second request message, and returns the second response message to the terminal to complete establishment of an IPSec SA tunnel, where The second request message carries a separation identifier, where the separation identifier indicates that the endpoints of the IKE SA tunnel and the IPSec SA tunnel that the terminal supports the ePDG are separated.

The present disclosure further provides a communication tunnel endpoint address separation method, including the steps of: sending a first request message to an evolved packet data gateway ePDG; and when receiving the ePDG, establishing an Internet key exchange IKE security according to the first request message Generating a second request message after the SA tunnel is sent, and generating the second request message, and sending the second request message to the ePDG; and receiving the ePDG to establish an Internet Protocol security IPSec SA according to the second request message. a second response message sent after the tunnel to complete the establishment of the IPSec SA tunnel, where the second request message carries a separate identifier, where the separated identifier indicates that the terminal supports the IKE SA tunnel and the IPSec SA of the ePDG. The endpoint address of the tunnel is separated.

The present disclosure also provides a terminal, the terminal comprising a memory, a processor, and a communication tunnel endpoint address separation program stored on the memory and operable on the processor, the communication tunnel endpoint address separation program being When the processor is executed, the following steps are implemented: sending a first request message to the evolved packet data gateway ePDG; and receiving the first sent after the ePDG establishes an Internet Key Exchange IKE SA SA tunnel according to the first request message. And responding to the message, generating a second request message, and sending the second request message to the ePDG; and receiving a second response message sent by the ePDG after establishing an Internet Protocol security IPSec SA tunnel according to the second request message And completing the establishment of the IPSec SA tunnel, where the second request message carries a separate identifier, where the separated identifier indicates that the endpoint address of the IKE SA tunnel and the IPSec SA tunnel that the terminal supports the ePDG is separated.

The present disclosure also provides an evolved packet data gateway ePDG, the ePDG including a memory, a processor, and a communication tunnel endpoint address separation program stored on the memory and operable on the processor, the communication tunnel endpoint When the address separation program is executed by the processor, the following steps are implemented: when receiving the first request message sent by the terminal, establishing an Internet Key Exchange IKE SA SA tunnel according to the first request message, and generating the Receiving, by the first response message corresponding to the request message, the first response message to the terminal; and receiving a second request message sent by the terminal, and establishing an Internet Protocol security IPSec SA tunnel according to the second request message, And generating a second response message corresponding to the second request message, and returning the second response message to the terminal, to complete establishment of an IPSec SA tunnel, where the second request message carries a separate identifier The separation identifier indicates that the terminal supports the separation of the endpoint addresses of the IKE SA tunnel and the IPSec SA tunnel of the ePDG.

The present disclosure also provides a computer readable storage medium having stored thereon a communication tunnel endpoint address separation program, wherein the computer readable storage medium stores a communication tunnel endpoint address separation program, the communication When the tunnel endpoint address separation program is executed by the processor, the following steps are performed: when receiving the first request message sent by the terminal, establishing an Internet Key Exchange IKE SA SA tunnel according to the first request message, and generating the Receiving, by the first response message corresponding to the request message, the first response message to the terminal; receiving a second request message sent by the terminal, establishing an Internet Protocol security IPSec SA tunnel according to the second request message, and Generating a second response message corresponding to the second request message, and returning the second response message to the terminal, to complete establishment of an IPSec SA tunnel, where the second request message carries a separation identifier, The separation identifier indicates that the terminal supports the endpoint address of the IKE SA tunnel and the IPSec SA tunnel of the ePDG. from.

DRAWINGS

1 is a network architecture of a non-trusted non-3GPP access network provided in accordance with an embodiment of the present disclosure.

FIG. 2 is a schematic flowchart of a method for separating a communication tunnel endpoint address according to an embodiment of the present disclosure.

FIG. 3 is a schematic diagram of implementing IKE SA tunnel and IPSec SA tunnel endpoint address separation on the ePDG side according to an embodiment of the present disclosure.

FIG. 4 is a schematic diagram of implementing IKE SA tunnel and IPSec SA tunnel endpoint address separation on the terminal side according to an embodiment of the present disclosure.

FIG. 5 is a schematic diagram of implementing IKE SA tunnel and IPSec SA tunnel endpoint address separation on both the terminal side and the ePDG side according to an embodiment of the present disclosure.

FIG. 6 is a schematic flowchart diagram of another communication tunnel endpoint address separation method according to an embodiment of the present disclosure.

FIG. 7 is a schematic diagram of data interaction in implementing an IKE SA tunnel and an IPSec SA tunnel endpoint address separation process on an ePDG side according to an embodiment of the present disclosure.

FIG. 8 is a schematic diagram of data interaction in an IKE SA tunnel and an IPSec SA tunnel endpoint address separation process performed on a terminal side according to an embodiment of the present disclosure.

FIG. 9 is a schematic diagram of data interaction in an IKE SA tunnel and an IPSec SA tunnel endpoint address separation process performed on both the terminal side and the ePDG side according to an embodiment of the present disclosure.

The implementation, functional features, and advantages of the present disclosure will be further described in conjunction with the embodiments and the accompanying drawings.

Detailed ways

It is understood that the specific embodiments described herein are merely illustrative of the disclosure and are not intended to limit the disclosure.

1 is a network architecture of a non-trusted non-3GPP access network provided in accordance with an embodiment of the present disclosure. As shown in FIG. 1 , in this architecture, a non-trusted non-3GPP access network refers to a Wireless Local Area Networks (WLAN), and the terminal can communicate with a Long Term Evolution (LTE) network through a WLAN network. For example, a voice service is performed.

The network architecture shown in FIG. 1 mainly includes the following devices/network elements: user equipment, evolved universal mobile communication system terrestrial radio access network, mobility management entity, home subscriber server, service gateway, packet data network gateway, policy and meter Fee rule function unit, wireless local area network, 3GPP authentication and authorization billing server, evolved packet data gateway, and internet protocol multimedia subsystem.

The User Equipment (UE) can be understood as a terminal, and the terminal can access a WLAN or an LTE network to access services of the 3GPP Evolved Packet Core Network.

The evolved universal mobile communication system Evolved UMTS Terrestrial Radio Access Network (E-UTRAN) is a mobile communication wireless network in LTE.

The Mobility Management Entity (MME) is a control plane function entity, which temporarily stores a user data server, and is responsible for managing and storing the terminal context (such as terminal/user identity, mobility management state, user security parameters, etc.). The user is assigned a temporary identity and handles all non-access stratum messages between the MME and the terminal.

The Home Subscriber Server (HSS) is used to permanently store user subscription data.

The Serving Gateway (SGW) is a user plane entity, which is responsible for processing user plane data routing, and is used for managing and storing a bearer context of the terminal, such as IP (Internet Protocol). Protocol) carries service parameters and internal routing information of the network. Serving GW is the anchor point of the internal user plane of the 3GPP system. A user can only have one Serving GW at a time;

The Packet Data Network Gateway (PDN GW), which is a PGW, is responsible for the terminal accessing the PDN (Public Data Network) and allocating the user IP address, and is also a 3GPP and non-3GPP access system. Mobility anchor, users can access multiple PDN GWs at the same time.

The Policy and Charging Rule Functionality (PCRF) is used to generate a QOS (Quality of Service) rule for controlling user data transmission according to the service information and the user subscription information and the configuration information of the operator. The charging rule, the functional entity can also control the establishment and release of bearers in the access network.

The Wireless Local Area Network (WLAN) is a non-trusted non-3GPP access network.

The 3GPP Authentication Authorization Accounting Server (3GPP Authentication, Authorization, Accounting Server, 3GPP AAA Server) is responsible for authentication and signing of the terminal.

The evolved Packet Data Network Gateway (ePDG) is an access gateway for non-trusted non-3GPP networks (WLANs) and 3GPP networks interworking. The terminal accessing from the WLAN can authenticate and sign the ePDG to the 3GPP AAA Server, and access the PDN GW through the ePDG to further use the resources of the LTE core network.

The Internet Multimedia Subsystem (IMS) is a subsystem supported by the 3GPP to support IP multimedia services. The salient features are: Session Initial Protocol (SIP) system; communication and access mode Irrelevant; with multiple multimedia services, control functions and bearer separation, call and session separation, application and service separation, service and network separation, and mobile network and Internet service integration capabilities.

In a non-trusted non-3GPP IP access network (WLAN), communication between a terminal and an EPC (Evolved Packet Core, 4G core network) is untrustworthy and unsecure. Secure communication between the terminal and the EPC needs to be ensured by establishing an Internet Protocol Security (IPSec) tunnel between the terminal and the ePDG. The establishment of an IPSec tunnel mainly includes the following three phases.

1) Internet Key Exchange_Security Association Initialization (IKE_SA_INIT) interaction phase. During this phase, security parameters are negotiated for IKE SA (Internet Key Exchange_Security Association), a temporary random number (nonce) is sent, and a Diffie-Hellman value is sent. ;

2) Internet Key Exchange_Authentication (IKE_AUTH) interaction phase. During this phase, an SA (Security Association) is established for the first (usually only one) CHILD_SA (Child_Security Association), which is the first IPSec SA (Internet Protocol Security_Security Association).

3) Create a _ child_secure alliance (CREATE_CHILD_SA) interaction phase. During this phase, create a CHILD_SA.

The present disclosure also provides an ePDG that includes a memory, a processor, and a communication tunnel endpoint address separation program stored on the memory and operable on the processor. The memory may be a high speed RAM memory or a non-volatile memory such as a disk memory. The memory may also be a storage device that is separate from the aforementioned processor. The processor may be configured to invoke a communication tunnel endpoint address separation procedure stored in the memory to perform the following steps: when receiving the first request message sent by the terminal, establishing an Internet Key Exchange IKE Security Alliance according to the first request message An SA tunnel, and generating a first response message corresponding to the first request message, returning the first response message to the terminal; and receiving a second request message sent by the terminal, according to the second request The message establishes an Internet Protocol Security IPSec SA tunnel, and generates a second response message corresponding to the second request message, and returns the second response message to the terminal to complete establishment of an IPSec SA tunnel, where The second request message carries a separate identifier, where the separated identifier indicates that the terminal supports the separation of the endpoint addresses of the IKE SA tunnel and the IPSec SA tunnel of the ePDG.

In an embodiment, the second request message carries an IPSec SA tunnel endpoint address of the terminal.

In an embodiment, the second response message carries an IPSec SA tunnel endpoint address of the ePDG.

In an embodiment, when receiving the first request message sent by the terminal, establishing an IKE SA tunnel according to the first request message, and generating a first response message corresponding to the first request message, The step of returning the first response message to the terminal includes the following steps: when receiving the first request message sent by the terminal, negotiating a key parameter with the terminal according to the first request message, and exchanging with the terminal a random number and a Diffie-Hellman Diffie-Hellman value to establish an IKE SA tunnel; and generating a first response message based on the key parameter and the exchanged random number and the Diffie-Hellman value, and the first A response message is sent to the terminal.

In an embodiment, the receiving the second request message sent by the terminal, establishing an IPSec SA tunnel according to the second request message, and generating a second response message corresponding to the second request message, The step of returning the second response message to the terminal to complete the establishment of the IPSec SA tunnel includes the following steps: when receiving the second request message that is sent by the terminal and encrypted by the encryption algorithm corresponding to the encryption parameter, The decryption algorithm corresponding to the encryption algorithm decrypts the encrypted second request message to obtain plaintext information corresponding to the second request message, and sends the plaintext information to the authentication and authorization accounting server; and receives the authentication And authenticating, by the authorized accounting server, the authentication result obtained by the terminal according to the plaintext information, and generating a second response message according to the authentication result, encrypting the second response message, and encrypting the second response message Return to the terminal.

In an embodiment, the receiving the second request message sent by the terminal, establishing an IPSec SA tunnel according to the second request message, and generating a second response message corresponding to the second request message, After the second response message is returned to the terminal to complete the establishment of the IPSec SA tunnel, the processor may further be configured to invoke the communication tunnel endpoint address separation procedure stored in the memory to perform the following steps: when receiving the terminal to send Encrypting the Internet Protocol security data, decrypting the Internet Protocol security data, and transmitting the decrypted Internet Protocol security data to the packet data network gateway PGW; and receiving the PGW in response to the Internet Protocol security data Sending response data, and transmitting the response data to the terminal to implement data interaction between the terminal and the PGW.

In an embodiment, when receiving the first request message sent by the terminal, establishing an IKE SA tunnel according to the first request message, and generating a first response message corresponding to the first request message, The step of returning the first response message to the terminal includes the following steps: when receiving the first request message sent by the terminal using a protocol IP address interconnected between the local networks as a source address, according to the first request The message establishes an IKE SA tunnel, and generates a first response message corresponding to the first request message; and sends the first response message to the local IP address of the terminal by using an IKE SA tunnel endpoint address of the ePDG side as a source address. .

In an embodiment, when receiving the first request message sent by the terminal, establishing an IKE SA tunnel according to the first request message, and generating a first response message corresponding to the first request message, After the step of returning the first response message to the terminal, the processor may further be configured to invoke a communication tunnel endpoint address separation program stored in the memory to perform the following steps: when receiving the request for creating the child security association sent by the terminal The message creates a child security association according to the request message for creating a child security association, and returns a response message for creating a child security association to the terminal.

The above structure can be utilized to implement the communication tunnel endpoint address separation method.

Referring to FIG. 2, FIG. 2 is a schematic flowchart of a method for separating a communication tunnel endpoint address according to an embodiment of the present disclosure.

It should be noted that although an exemplary sequence of the communication tunnel endpoint address separation methods is shown in the flowchart, in some cases, the steps shown or described may be performed in an order different from that herein.

The communication tunnel endpoint address separation method includes the following steps S10-S40.

At step S10, when the evolved packet data gateway ePDG receives the first request message sent by the terminal, the Internet Key Exchange IKE SA SA tunnel is established according to the first request message, and the first request message is generated. And corresponding to the first response message, returning the first response message to the terminal.

The present disclosure is applicable to a scenario in which an IKE version 2 (IKEv2) protocol establishes an IPSec tunnel. For example, it can be applied to establish an IPSec tunnel between a terminal and an ePDG in a non-trusted non-3GPP IP access network (WLAN) or an access EPC network. Scene. In this scenario, the IKE SA tunnel is used to protect the IKE signaling packet between the terminal and the ePDG, and is the SA that belongs to the control plane. The IPSec SA tunnel is used to protect data packets between the terminal and the ePDG. The SA that belongs to the user plane. In the embodiment of the present disclosure, the terminal may be used as an initiator initiator of the IKEv2 mechanism, and the ePDG is used as a responder responder of the IKEv2 mechanism.

In the embodiment of the present disclosure, the endpoint address of the IKE SA tunnel and the IPSec SA tunnel may be separated on the ePDG side, or the endpoint address of the IKE SA tunnel and the IPSec SA tunnel may be separated on the terminal side, or both on the ePDG side and the terminal side. The endpoint address separation between the IKE SA tunnel and the IPSec SA tunnel is implemented. Specifically, reference may be made to FIG. 3, FIG. 4, and FIG. 5, wherein FIG. 3 is a schematic diagram of implementing IKE SA tunnel and IPSec SA tunnel endpoint address separation on the ePDG side according to an embodiment of the present disclosure; A schematic diagram of implementing an IKE SA tunnel and an IPSec SA tunnel endpoint address separation on the terminal side is provided by the embodiment. FIG. 5 is an implementation of an IKE SA tunnel and an IPSec SA tunnel endpoint on both the terminal side and the ePDG side according to an embodiment of the present disclosure. A schematic diagram of address separation.

The terminal sends a first request message to the ePDG, where the first request message is an Internet Key Exchange_Security Association_Initialization Request message (IKE_SA_INIT). The terminal may request to negotiate key parameters with the ePDG, exchange temporary random numbers, and exchange Diffie-Hellman values through the first request message. The temporary random number of the terminal is the current time payload of the terminal. In the process of the terminal requesting to negotiate the key parameters with the ePDG through the first request message, the terminal may provide a key algorithm for the ePDG to select. The key algorithm includes, but is not limited to, Data Encryption Standard (DES) and Advanced Encryption Standard (AES). It should be noted that DES may include multiple key lengths, and AES has more than one encryption form. The Diffie-Hellman algorithm is a key exchange algorithm that can be used to ensure that a shared key securely traverses an insecure network and is an integral part of the OAKLEY algorithm.

When the ePDG receives the first request message sent by the terminal, the Internet Key Exchange_Security Association (IKE SA) tunnel is established according to the first request message. Specifically, when the ePDG negotiates the key parameters with the terminal and completes the exchange of the temporary random number and the Diffie-Hellman value, it indicates that the IKE SA tunnel is successfully established. After the IKE SA tunnel is successfully established, the ePDG generates a first response message corresponding to the first request message, and returns the first response message to the terminal, so that the terminal sends the second request message after receiving the first response message. Give ePDG. The second request message carries a separate identifier, and the separated identifier indicates that the control plane address and the user plane address of the ePDG are separated, that is, the terminal supports the separation of the endpoint addresses of the IKE SA tunnel and the IPSec SA tunnel on the ePDG side. The second request message is an Internet Key Exchange_Authentication Request message (IKE_AUTH), and the separation identifier is a Control Plane User Face_Separation_Support (CU_SEPARATE_SUPPORT) Notify payload. The second request message may also carry a terminal identifier and an Access Point Name (APN) information.

In one embodiment, step S10 includes the following steps a-b.

At step a, when the ePDG receives the first request message sent by the terminal using the protocol IP address interconnected between the local networks as the source address, the ePDG establishes an IKE SA tunnel according to the first request message. And generating a first response message corresponding to the first request message.

In step b, the ePDG sends the first response message to the local IP address of the terminal by using the IKE SA tunnel endpoint address of the ePDG side as the source address.

Specifically, the terminal sends a negotiation request of the IKE_SA_INIT to the endpoint address (SWu IKE IP) of the IKE SA tunnel on the ePDG side using the local IP as the source address to request the ePDG negotiation key parameter, and the temporary random number and the Diffie. The -Hellman value is sent to the ePDG. When the ePDG receives the negotiation request of the IKE_SA_INIT and the temporary random number and the Diffie-Hellman value of the terminal, the ePDG negotiates the key parameter according to the negotiation request of the IKE_SA_INIT, and exchanges the temporary random number with the temporary random number of the terminal. And exchanging its Diffie-Hellman value with the Diffie-Hellman value of the terminal to establish an IKE SA tunnel. The ePDG generates a response message of the IKE_SA_INIT negotiation according to the negotiated key parameter, its temporary random number, and the Diffie-Hellman value, that is, generates a first response message, and sends the first address to the local IP of the terminal by using its SWu IKE IP as the source address. Response message. It should be noted that, after the IKE SA tunnel is established, the IKE signaling packet transmitted by the terminal and the ePDG is protected by the IKE SA.

In one embodiment, step S10 includes the following step c-d.

At step c, when the ePDG receives the first request message sent by the terminal, negotiates a key parameter with the terminal according to the first request message, and exchanges a random number with the terminal and Diffie-Hell. Man Diffie-Hellman value to establish an IKE SA tunnel.

At step d, the ePDG generates a first response message according to the key parameter and the exchanged random number and the Diffie-Hellman value, and sends the first response message to the terminal.

When receiving the first request message sent by the terminal, the ePDG negotiates a key parameter with the terminal according to the first request message, and exchanges a random number and a Diffie-Hellman value with the terminal to establish an IKE SA tunnel. The ePDG generates a first response message according to the negotiated key parameter and the exchanged random number and the Diffie-Hellman value, and sends the first response message to the terminal. After receiving the first response message, the terminal generates a second request message, and obtains an encryption algorithm corresponding to the key parameter in the first response message. The terminal encrypts the second request message by using the encryption algorithm to obtain the encrypted second request message, and sends the encrypted second request message to the ePDG. It should be noted that the encryption algorithm for the terminal to encrypt the second request message is an encryption algorithm negotiated between the ePDG and the terminal during the establishment of the IKE SA tunnel.

In step S20, the ePDG receives the second request message sent by the terminal, establishes an Internet Protocol security IPSec SA tunnel according to the second request message, and generates a second response message corresponding to the second request message, Returning the second response message to the terminal, to complete the establishment of the IPSec SA tunnel, where the second request message carries a separate identifier, where the separated identifier indicates that the terminal supports the IKE SA tunnel of the ePDG and The endpoint address of the IPSec SA tunnel is separated.

In an embodiment, step S20 further comprises the following steps e-f.

At step e, when the ePDG receives the second request message that is sent by the terminal and is encrypted by using a key parameter corresponding to an encryption algorithm, the ePDG decrypts and encrypts by using a decryption algorithm corresponding to the encryption algorithm. The second request message is used to obtain the plaintext information corresponding to the second request message, and the plaintext information is sent to the authentication and authorization charging server.

At step f, the ePDG receives the authentication result obtained by the authentication and authorization accounting server to authenticate the terminal according to the plaintext information, and generates a second response message according to the authentication result, and encrypts the second response. The message returns the encrypted second response message to the terminal.

Specifically, when the ePDG receives the encrypted second request message, the ePDG decrypts the encrypted second request message by using a decryption algorithm negotiated with the terminal, that is, using a decryption algorithm corresponding to the terminal encrypting the second request message encryption algorithm. Decrypting the encrypted second request message to obtain plaintext information corresponding to the second request message. It can be understood that the encryption algorithm of the terminal encrypting the second request message is the same algorithm as the decryption algorithm of the second request message after the ePDG decrypts the encrypted.

After the ePDG obtains the plaintext information, the illegitimate information is sent to the authentication and authorization accounting server AAA Server, so that the AAA server completes the authentication and authentication of the terminal according to the plaintext information, and obtains the authentication result, and returns the authentication result to the ePDG. Specifically, the authentication of the terminal may adopt a pre-shared key (PSK), a public key infrustructure (PK3) RSA, and an Extensible Authentication Protocol (EPA) algorithm. . In the scenario where the WLAN is used to access the EPC, the EPA algorithm can be used for the authentication of the terminal.

After receiving the authentication result sent by the AAA server, the ePDG generates a second response message according to the authentication result, and encrypts the second response message by using an encryption algorithm negotiated with the terminal to obtain the encrypted second response, and the encrypted second response. The second response message is returned to the terminal. In the second response message, the ePDG identifier and the authentication payload may be carried.

When the endpoint address of the IKE SA tunnel and the IPSec SA tunnel are separated on the ePDG side, the terminal sends the first request message and the second request message to the control plane of the ePDG, and the control plane of the ePDG returns the corresponding first response message and the first Second response message. In this case, the second response message further carries the IPSec SA tunnel endpoint address of the ePDG, that is, the second response message carries the Internet Protocol security_Security Management_Address_Responder Notification Load (IPSEC_SA_ADDRESSES_R Notify payload) To inform the terminal of the ePDG user plane address, and inform the terminal of the IPSec SA tunnel endpoint address of the ePDG side, so that the terminal can perform data interaction with the ePDG according to the endpoint address of the ePDG side IPSec SA tunnel.

When the endpoint address of the IKE SA tunnel and the IPSec SA tunnel are separated on the terminal side, the control plane of the terminal sends the first request message and the second request message to the ePDG, and the corresponding first response message and the second are returned by the ePDG. Response message. In this case, the second request message carries the IPSec SA tunnel endpoint address (UE SWu IPSec IP) of the terminal, that is, the second request message carries the Internet Protocol security_Security Management_Address_Initiator Notification Load (IPSEC_SA_ADDRESSES_I Notify) Payload), and the IPSEC_SA_ADDRESSES_I Notify payload contains the IPSec SA tunnel endpoint address of the terminal. If the second request message does not carry the IPSEC_SA_ADDRESSES_I Notify payload, the endpoint address of the IKE SA tunnel and the IPSec SA tunnel on the terminal side are the same.

In an embodiment, when the IKE SA tunnel is implemented on both the terminal side and the ePDG side, and the endpoint addresses of the IPSec SA tunnel are separated, the first control message and the second request message are sent by the terminal control plane to the ePDG control plane, and then The corresponding first response message and second response message are returned by the ePDG control plane to the terminal control plane. In this case, the second request message carries the IPSEC_SA_ADDRESSES_I Notify payload, and the second response message carries the IPSEC_SA_ADDRESSES_R Notify payload.

In an embodiment, different message types may be defined in the notification payloads CU_SEPARATE_SUPPORT, IPSEC_SA_ADDRESSES_R, and IPSEC_SA_ADDRESSES_I, and the payload data corresponding to IPSEC_SA_ADDRESSES_R and IPSEC_SA_ADDRESSES_I may be Internet Protocol version 4 (Internet Protocol version 4). , IPv4) address or Internet Protocol version 6, (IPv6) address.

According to the above embodiments, when the first request message sent by the terminal is received, the ePDG establishes an Internet Key Exchange IKE SA SA tunnel according to the first request message, and generates a first corresponding to the first request message. Responding to the message, returning the first response message to the terminal; and the ePDG receiving a second request message sent by the terminal, and establishing an Internet Protocol security IPSec SA tunnel with the terminal according to the second request message, And generating a second response message corresponding to the second request message, and returning the second response message to the terminal, to complete establishment of an IPSec SA tunnel, where the second request message carries a separate identifier The separation identifier indicates that the terminal supports address separation of the IKE SA tunnel and the IPSec SA tunnel of the ePDG. Therefore, the endpoint address of the IKE SA tunnel and the IPSec SA tunnel are separated on the terminal side and/or the ePDG side, so that the IKE SA tunnel function and the IPSec SA tunnel function are deployed on different virtual machines, thereby improving the IPSec SA. Data processing efficiency of the tunnel user plane.

The present disclosure also provides another embodiment of the communication tunnel endpoint address separation method.

Another embodiment of the communication tunnel endpoint address separation method differs from the above embodiments in that it further includes the following steps S30-S40 (see FIG. 6).

At step S30, when the ePDG receives the encrypted Internet Protocol security data sent by the terminal, decrypting the Internet Protocol security data, and transmitting the decrypted Internet Protocol security data to the packet data network gateway. PGW.

At step S40, the ePDG receives response data sent by the PGW after responding to the Internet Protocol security data, and sends the response data to the terminal to implement data between the terminal and the PGW. Interaction.

After the IPSec SA tunnel is established, the terminal encrypts the Internet Protocol security data and sends the encrypted Internet Protocol security data to the ePDG. When receiving the encrypted Internet Protocol security data sent by the terminal, the ePDG decrypts the encrypted Internet Protocol security data to obtain the decrypted Internet Protocol security data, and transmits the decrypted Internet Protocol security data to the PGW through the S2b interface. After receiving the Internet Protocol security data, the PGW obtains response data in response to the Internet Protocol security data, and transmits the response data to the ePDG through the S2b interface. When the ePDG receives the response data returned by the PGW, the response data is encrypted to obtain the encrypted response data, and the encrypted response data is sent to the terminal to implement data interaction between the terminal and the PGW. It should be noted that the encryption algorithm of the terminal encryption Internet Protocol security data, the decryption algorithm of the ePDG decryption Internet protocol security data, and the encryption algorithm for encrypting the response data are negotiated by the terminal and the ePDG.

When the endpoint address separation of the IKE SA tunnel and the IPSec SA tunnel is implemented on the ePDG side, the terminal sends Internet Protocol security data to the ePDG user plane. Specifically, the terminal sends the Internet Protocol security data to the ePDG user plane through the ePDG user plane IPSec SA tunnel endpoint address carried in the IPSEC_SA_ADDRESSES_R Notify payload, and then the ePDG user plane performs data interaction with the PGW. For a specific process, reference may be made to FIG. 7. FIG. 7 is a schematic diagram of providing data interaction in an IKE SA tunnel and an IPSec SA tunnel endpoint address separation process on an ePDG side according to an embodiment of the present disclosure.

When the endpoint address separation of the IKE SA tunnel and the IPSec SA tunnel is implemented on the terminal side, the terminal user sends Internet Protocol security data to the ePDG. Specifically, the terminal sends the Internet Protocol security data to the ePDG through the end user plane IPSec SA tunnel endpoint address carried in the IPSEC_SA_ADDRESSES_I Notify payload, and then the ePDG performs data interaction with the PGW. For a specific process, reference may be made to FIG. 8. FIG. 8 is a schematic diagram of providing data interaction in an IKE SA tunnel and an IPSec SA tunnel endpoint address separation process on a terminal side according to an embodiment of the present disclosure.

When the IKE SA tunnel on the terminal side and the ePDG side and the endpoint address of the IPSec SA tunnel are separated, the end user sends the Internet Protocol security data to the ePDG user plane. Specifically, the end user plane sends the Internet Protocol security data to the ePDG user plane through the end user plane IPSec SA tunnel endpoint address carried in the IPSEC_SA_ADDRESSES_I Notify payload, and the end user plane passes the ePDG user plane IPSec SA tunnel endpoint address carried in the IPSEC_SA_ADDRESSES_R Notify payload. The ePDG user plane is determined, and then the ePDG user plane interacts with the PGW. For a specific process, reference may be made to FIG. 9. FIG. 9 is a schematic diagram of providing data interaction between an IKE SA tunnel and an IPSec SA tunnel endpoint address separation process on both the terminal side and the ePDG side according to an embodiment of the present disclosure.

It should be noted that, in this embodiment, the encryption and decryption function of the ePDG is separately described as one component (ie, the encryption and decryption component), and in other embodiments, the encryption and decryption function of the ePDG and the ePDG control plane function may be The body or ePDG user plane functions are combined.

In this embodiment, after the IKE SA tunnel and the IPSec SA tunnel endpoint address are separated on the terminal side and/or the ePDG side, the terminal performs data interaction with the ePDG through the separated endpoint address to improve data interaction efficiency between the terminal and the PGW.

The present disclosure also provides yet another embodiment of the communication tunnel endpoint address separation method.

A further embodiment of the communication tunnel endpoint address separation method differs from the foregoing embodiments in that it further comprises the following step g.

At step g, when the ePDG receives the request message for creating a sub-security association sent by the terminal, the ePDG creates a sub-security association according to the request message for creating a sub-security association, and returns to create a sub-security alliance. A response message is sent to the terminal.

After the IKE SA tunnel is established, the terminal directly sends a request message for creating a sub-security association (CREATE_CHILD_SA) to the ePDG. Upon receiving the request message for creating a sub-security association sent by the terminal, the ePDG creates a sub-security association according to the request message, that is, creates a CHILD_SA, and after creating the CHILD_SA, returns a response message for creating a sub-security association to the terminal.

Specifically, when the endpoint address of the IKE SA tunnel and the IPSec SA tunnel are separated on the terminal side, the terminal control plane sends a request message for creating a sub-security association to the ePDG; when the IKE SA tunnel and the IPSec SA tunnel are implemented on the ePDG side, When the address is separated, the terminal sends a sub-security association request message to the ePDG control plane. When both the terminal side and the ePDG side implement the IKE SA tunnel and the endpoint address of the IPSec SA tunnel is separated, the terminal control plane creates a sub-security association. The request message is sent to the ePDG control plane.

In an embodiment, after the IKE SA tunnel is established, in the key negotiation process between the terminal and the ePDG, if the terminal needs to send a message or needs to notify the ePDG of certain events, for example, the terminal finds that the first request message sent to the ePDG is In case of an error, the terminal sends an information request message to the ePDG. Upon receiving the information request message, the ePDG responds to the information request message and returns a corresponding information response message to the terminal. If the ePDG needs to send a message or needs to notify the terminal of certain events, for example, the ePDG finds that the first response message sent to the terminal has an error, the ePDG sends an information request message to the terminal. The terminal receives the information request message, responds to the information request message, and returns a corresponding information response message to the ePDG.

Specifically, when the endpoint address of the IKE SA tunnel and the IPSec SA tunnel are separated on the terminal side, the terminal control plane sends an information request message to the ePDG. When the endpoint address of the IKE SA tunnel and the IPSec SA tunnel are separated on the ePDG side, The terminal sends an information request message to the ePDG control plane. When the IKE SA tunnel is implemented on both the terminal side and the ePDG side, and the endpoint address of the IPSec SA tunnel is separated, the terminal control plane sends an information request message to the ePDG control plane.

In this embodiment, the user plane and the control plane of the terminal and/or the ePDG are separately deployed in different virtual machines by separating the endpoint addresses of the IKE SA tunnel and the IPSec SA tunnel of the ePDG, thereby improving the terminal and the ePDG data transmission efficiency.

In addition, the present disclosure further provides a communication tunnel endpoint address separation method, including the steps of: sending a first request message to an evolved packet data gateway ePDG; and when receiving the ePDG, establishing an internet key exchange according to the first request message And generating, by the IKE SA, the first response message sent by the SA tunnel, and sending the second request message to the ePDG; and receiving the ePDG to establish an Internet protocol security according to the second request message. a second response message sent after the IPSec SA tunnel to complete the establishment of the IPSec SA tunnel, where the second request message carries a separate identifier, where the separated identifier indicates that the terminal supports the IKE SA tunnel of the ePDG and The endpoint address of the IPSec SA tunnel is separated.

In an embodiment, after receiving the first response message sent by the ePDG, generating a second request message, and encrypting the second request message by using an encryption algorithm corresponding to the key parameter, and encrypting the The second request message is sent to the ePDG.

In addition, the present disclosure also provides a terminal, the terminal including a memory, a processor, and a communication tunnel endpoint address separating program stored on the memory and operable on the processor, the communication tunnel endpoint address separating program When executed by the processor, the following steps are implemented: sending a first request message to the evolved packet data gateway ePDG; and transmitting after receiving the ePDG establishing an Internet Key Exchange IKE SA SA tunnel according to the first request message And generating, by the first response message, a second request message, and sending the second request message to the ePDG; and receiving a second sent by the ePDG after establishing an Internet Protocol security IPSec SA tunnel according to the second request message The response message is used to complete the establishment of the IPSec SA tunnel, where the second request message carries a separate identifier, and the split identifier indicates that the endpoint address of the IKE SA tunnel and the IPSec SA tunnel that the terminal supports the ePDG is separated. In addition, the present disclosure also provides a computer readable storage medium having a communication tunnel endpoint address separation program stored thereon, and the communication tunnel endpoint address separation program is implemented by a processor to implement the above The steps of the described communication tunnel endpoint address separation method. The specific steps of the method for separating the endpoint address of each communication tunnel are not described herein again.

In addition, the present disclosure also provides a communication tunnel endpoint address separation apparatus that is applied to an evolved packet data gateway ePDG. The communication tunnel endpoint address separation device includes: a first setup module and a second setup module.

The first establishing module is configured to: when receiving the first request message sent by the terminal, establish an Internet Key Exchange IKE SA SA tunnel according to the first request message, and generate a corresponding to the first request message The first response message returns the first response message to the terminal.

The second establishing module is configured to: receive a second request message sent by the terminal, establish an Internet Protocol security IPSec SA tunnel according to the second request message, and generate a second response message corresponding to the second request message Returning the second response message to the terminal, to complete the establishment of the IPSec SA tunnel, where the second request message carries a separate identifier, where the separated identifier indicates that the terminal supports the ePDG IKE. The endpoint addresses of the SA tunnel and the IPSec SA tunnel are separated.

In an embodiment, the first establishing module comprises: a negotiating unit, an exchanging unit and a first generating unit.

The negotiating unit is configured to: when receiving the first request message sent by the terminal, negotiate a key parameter with the terminal according to the first request message.

The switching unit is configured to exchange a random number and a Diffie-Hellman Diffie-Hellman value with the terminal to establish an IKE SA tunnel.

The first generating unit is configured to: generate a first response message according to the key parameter, and the exchanged random number and the Diffie-Hellman value, and send the first response message to the terminal.

In an embodiment, the second establishing module comprises: a decrypting unit, a transmitting unit, a second generating unit, and an encrypting unit.

The decrypting unit is configured to: when receiving the second request message that is sent by the terminal and encrypted by using a key parameter corresponding to an encryption algorithm, decrypting the encrypted second by using a decryption algorithm corresponding to the encryption algorithm The message is requested to obtain the plaintext information corresponding to the second request message.

The sending unit is configured to send the plaintext information to an authentication and authorization charging server.

The second generating unit is configured to receive an authentication result that is obtained by the authentication authorization charging server and that is used to authenticate the terminal according to the plaintext information, and generate a second response message according to the authentication result.

The encryption unit is configured to encrypt the second response message, and return the encrypted second response message to the terminal.

In an embodiment, the communication tunnel endpoint address separation device further includes: a decryption module, a sending module, and a receiving module.

The decryption module is configured to decrypt the Internet Protocol security data when the encrypted Internet Protocol security data sent by the terminal is received.

The sending module is configured to send the decrypted Internet Protocol security data to the packet data network gateway PGW.

The receiving module is configured to receive response data sent by the PGW after responding to the Internet Protocol security data.

The sending module is further configured to send the response data to the terminal to implement data interaction between the terminal and the PGW.

In an embodiment, the first establishing module is further configured to: according to the first request message, when receiving, by the terminal, a first request message sent by using a protocol IP address interconnected between local networks as a source address Establishing an IKE SA tunnel, and generating a first response message corresponding to the first request message; and sending the first response message to the local IP address of the terminal by using an IKE SA tunnel endpoint address of the ePDG side as a source address.

In one embodiment, the communication tunnel endpoint address separation device further includes: a creation module.

The creating module is configured to: when receiving a request message for creating a child security association sent by the terminal, create a child security association according to the request message for creating a child security association, and return a response message for creating a child security association to the terminal.

It is to be understood that the term "comprises", "comprising", or any other variants thereof, is intended to encompass a non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes those elements. It also includes other elements that are not explicitly listed, or elements that are inherent to such a process, method, article, or device. An element that is defined by the phrase "comprising a ..." does not exclude the presence of additional elements in the process, method, article, or device that comprises the element.

The above-mentioned embodiments of the present disclosure are for the purpose of description only, and do not represent the advantages and disadvantages of the embodiments.

Through the description of the above embodiments, those skilled in the art can clearly understand that the foregoing method can be implemented by means of software plus a necessary general hardware platform, and can also be implemented by hardware. Based on such understanding, an essential part of the technical solution of the present disclosure or a part contributing to the prior art can be embodied in the form of a software product that can be stored in a storage medium (such as ROM/RAM, magnetic A disc, an optical disc, and a number of instructions for causing a terminal device (which may be a cell phone, a computer, a server, an air conditioner, or a network device, etc.) to perform the methods described in various embodiments of the present disclosure.

The above embodiments are merely exemplary embodiments of the present disclosure, and are not intended to limit the scope of the disclosure. The equivalent structure or equivalent flow transformations made by the present disclosure and the contents of the drawings, or the application of the embodiments and variations thereof, directly or indirectly in other related technical fields, are included in the patents of the present disclosure. Within the scope of protection.

Claims

A communication tunnel endpoint address separation method includes the following steps:

When the evolved packet data gateway ePDG receives the first request message sent by the terminal, establishes an Internet Key Exchange IKE SA SA tunnel according to the first request message, and generates a first response corresponding to the first request message. a message, returning the first response message to the terminal;

Receiving, by the ePDG, the second request message sent by the terminal, establishing an Internet Protocol security IPSec SA tunnel according to the second request message, and generating a second response message corresponding to the second request message, where the second A response message is returned to the terminal to complete establishment of the IPSec SA tunnel.

The second request message carries a separate identifier, where the separated identifier indicates that the endpoint address of the IKE SA tunnel and the IPSec SA tunnel that the terminal supports the ePDG is separated.
The communication tunnel endpoint address separation method according to claim 1, wherein the second request message carries an IPSec SA tunnel endpoint address of the terminal.
The communication tunnel endpoint address separation method of claim 2, wherein the second response message carries an IPSec SA tunnel endpoint address of the ePDG.
The communication tunnel endpoint address separation method according to claim 1, wherein when the ePDG receives the first request message sent by the terminal, the IKE SA tunnel is established according to the first request message, and is generated with the first The first response message corresponding to the request message, the step of returning the first response message to the terminal includes the following steps:

And when the ePDG receives the first request message sent by the terminal, negotiates a key parameter with the terminal according to the first request message, and exchanges a random number and a Diffie-Hellman Diffie-Hellman value with the terminal. To establish an IKE SA tunnel;

The ePDG generates a first response message according to the key parameter and the exchanged random number and the Diffie-Hellman value, and sends the first response message to the terminal.
The communication tunnel endpoint address separation method according to claim 4, wherein the ePDG receives a second request message sent by the terminal, establishes an IPSec SA tunnel according to the second request message, and generates a second request The step of responding to the second response message and returning the second response message to the terminal to complete the establishment of the IPSec SA tunnel includes the following steps:

When the ePDG receives the second request message that is sent by the terminal and is encrypted by using a key parameter corresponding to an encryption algorithm, the ePDG decrypts the encrypted second by using a decryption algorithm corresponding to the encryption algorithm. Requesting a message to obtain the plaintext information corresponding to the second request message, and sending the plaintext information to the authentication and authorization charging server;

The ePDG receives the authentication result obtained by the authentication and authorization accounting server according to the plaintext information, and generates a second response message according to the authentication result, encrypting the second response message, and encrypting the second response message. The second response message is returned to the terminal.
The communication tunnel endpoint address separation method according to claim 1, wherein the ePDG receives a second request message sent by the terminal, establishes an IPSec SA tunnel according to the second request message, and generates a second request After the step of returning the second response message to the terminal to complete the establishment of the IPSec SA tunnel, the second response message corresponding to the message further includes the following steps:

And when the ePDG receives the encrypted Internet Protocol security data sent by the terminal, decrypting the Internet Protocol security data, and transmitting the decrypted Internet Protocol security data to the packet data network gateway PGW;

The ePDG receives the response data sent by the PGW after responding to the Internet Protocol security data, and sends the response data to the terminal to implement data interaction between the terminal and the PGW.
The communication tunnel endpoint address separation method according to claim 1, wherein when the ePDG receives the first request message sent by the terminal, the IKE SA tunnel is established according to the first request message, and is generated with the first The first response message corresponding to the request message, the step of returning the first response message to the terminal includes the following steps:

When the ePDG receives the first request message sent by the terminal using the protocol IP address interconnected between the local networks as the source address, the ePDG establishes an IKE SA tunnel according to the first request message, and generates an Decoding a first response message corresponding to the first request message;

The ePDG sends the first response message to the local IP address of the terminal by using the IKE SA tunnel endpoint address of the ePDG side as the source address.
The communication tunnel endpoint address separation method according to any one of claims 1 to 7, wherein when the ePDG receives the first request message sent by the terminal, the IKE SA tunnel is established according to the first request message, and is generated. After the step of returning the first response message to the terminal, the first response message corresponding to the first request message further includes the following steps:

When the ePDG receives the request message for creating a sub-security association sent by the terminal, the ePDG creates a sub-security association according to the request message for creating a sub-security association, and returns a response message for creating a sub-security association to the terminal.
A communication tunnel endpoint address separation method includes the following steps:

Sending a first request message to the evolved packet data gateway ePDG;

And after receiving the first response message sent by the ePDG after establishing the Internet Key Exchange IKE SA SA tunnel according to the first request message, generating a second request message, and sending the second request message to the ePDG; and

Receiving a second response message sent by the ePDG after establishing an Internet Protocol security IPSec SA tunnel according to the second request message, to complete establishment of an IPSec SA tunnel,

The second request message carries a separate identifier, where the separated identifier indicates that the endpoint address of the IKE SA tunnel and the IPSec SA tunnel that the terminal supports the ePDG is separated.
A terminal, the terminal comprising a memory, a processor, and a communication tunnel endpoint address separation program stored on the memory and operable on the processor, the communication tunnel endpoint address separation program being executed by the processor The following steps are implemented:

Sending a first request message to the evolved packet data gateway ePDG;

And after receiving the first response message sent by the ePDG after establishing the Internet Key Exchange IKE SA SA tunnel according to the first request message, generating a second request message, and sending the second request message to the ePDG; and

Receiving a second response message sent by the ePDG after establishing an Internet Protocol security IPSec SA tunnel according to the second request message, to complete establishment of an IPSec SA tunnel,

The second request message carries a separate identifier, where the separated identifier indicates that the endpoint address of the IKE SA tunnel and the IPSec SA tunnel that the terminal supports the ePDG is separated.
An evolved packet data gateway ePDG, the ePDG comprising a memory, a processor, and a communication tunnel endpoint address separation program stored on the memory and operable on the processor, the communication tunnel endpoint address separation procedure being The processor implements the following steps when executed:

When receiving the first request message sent by the terminal, establishing an Internet Key Exchange IKE SA SA tunnel according to the first request message, and generating a first response message corresponding to the first request message, where the a response message is returned to the terminal;

Receiving a second request message sent by the terminal, establishing an Internet Protocol security IPSec SA tunnel according to the second request message, and generating a second response message corresponding to the second request message, and returning the second response message Giving the terminal to complete the establishment of the IPSec SA tunnel,

The second request message carries a separate identifier, where the separated identifier indicates that the endpoint address of the IKE SA tunnel and the IPSec SA tunnel that the terminal supports the ePDG is separated.
A computer readable storage medium having a communication tunnel endpoint address separation program stored thereon, the communication tunnel endpoint address separation program being executed by a processor to implement the following steps:

When receiving the first request message sent by the terminal, establishing an Internet Key Exchange IKE SA SA tunnel according to the first request message, and generating a first response message corresponding to the first request message, where the a response message is returned to the terminal;

Receiving a second request message sent by the terminal, establishing an Internet Protocol security IPSec SA tunnel according to the second request message, and generating a second response message corresponding to the second request message, and returning the second response message Giving the terminal to complete the establishment of the IPSec SA tunnel,

The second request message carries a separate identifier, where the separated identifier indicates that the endpoint address of the IKE SA tunnel and the IPSec SA tunnel that the terminal supports the ePDG is separated.