Method and apparatus for negotiating internet cryptographic key exchanging safety coalition existence period

Abstract

The invention provides a process for negotiating the life cycle of internet key exchange security alliance and the device, wherein the process indicates an initiation end and a response end to conduct the negotiation of the life cycle of the IKE SA through utilizing the negotiation identification of the IKE SA life cycle in the IKE SA negotiation process, thereby negotiating the IKE SA into a smaller value in the IKE negotiation process.

Description

technical field [0001] The present invention relates to the technical field of Internet Protocol Security (IPsec, IP Security), in particular to a method for negotiating the lifetime of an IKE Security Association (SA, Security Association) during an Internet Key Exchange (IKE, Internet Key Exchange) negotiation process and corresponding device of. Background technique [0002] Network security includes two meanings: one is the security of the internal network, and the other is the security of data exchange in the public network. The former is realized by means of firewall, network address translation (NAT), etc.; the latter is realized by the emerging IPsec technology. IPsec provides a protection method for encrypting packets at the IP layer. IPsec security associations can be established through manual configuration, but when the number of nodes in the network increases, manual configuration will be very difficult, and it is difficult to ensure security. In this case, I...

AI Technical Summary

Problems solved by technology

[0007] 2. The responder accepts the negotiation, but the responder adopts a smaller life cycle;

Once the INFO message is lost during transmission, or the INFO message is not processed due to the busy task of the initiator, the IKE SA life cycle at both ends will be inconsistent, which may cause a problem similar to the second method: the responder does not have IKE SA cannot be negotiated for IPsec SA, resulting in communication interruption

Moreover, the INFO message is sent after the IKE / IPsec SA negotiation is completed, so after receiving the INFO message, the initiator needs to modify the life cycle of the established IKE SA, which is also troublesome in the actual implementation process

Images