Reliable IKE message negotiation method, device and system thereof

Abstract

The invention discloses a reliable IKE message negotiation method, a device and a system thereof, wherein, the method is applied to a system comprising first equipment and second equipment. The method comprises the following steps: a. the first equipment judges whether a response message from the second equipment is received within a preset cycle after the first equipment sends a last negotiation message to the second equipment; and b. if the response message from the second equipment is judged to be received within the preset cycle, the first equipment establishes a security alliance (SA) immediately. The method, the device and the system can guarantee reliable establishment of IKE SA and IPsec SA and reliable transmission of data message encrypted according to an IPsec Protocol when a network is in poor state, and the last message of message negotiation in a first stage or a second stage of the IKE misses or is delayed.

Description

technical field [0001] The invention relates to the field of communication technology, in particular to a method, device and system for IKE reliable message negotiation. Background technique [0002] The IKE protocol (Internet Key Exchange, Internet Key Exchange) is used to establish a security association in IPsec (IPsecurity, IP security), and securely establish and update a shared key in an insecure network environment such as the Internet. In order to ensure the safe operation of IPv6 (Internet Protocol Version 6, the sixth edition of the Internet Protocol), it is necessary to establish an IKE security association to realize encrypted forwarding and transmission of data. [0003] IKE is based on the framework defined by ISAKMP (Internet Security Association and Key Management Protocol, Security Association and Key Management Protocol). Usually, the establishment of IKE includes two phases. The first phase is used to establish a communication channel IKE SA (security ass...

AI Technical Summary

Problems solved by technology

At this time, the initiator device sends data packets encrypted according to the IPsec protocol to the responder device through the IPsec SA channel. The responder device discards these data packets, causing the initiator device to fail to transmit encrypted data

In addition, if the initiator of the second stage does not send the encrypted data packet at this time, but waits for the responder to send the encrypted data packet, and the responder device cannot send the encrypted data packet because the IPsec SA has not been established. Data packets will also cause the initiator device to fail to transmit encrypted data

[0010] To sum up, in the prior art, during the packet negotiation process of establishing IKE, due to the loss of the last packet in the first phase or the second phase or the inability of the responding device to receive the packet, the responding device cannot normally establish IKE SA or IPsec SA, resulting in subsequent IKE negotiation or encrypted data packet forwarding failure

And the existing IKE protocol does not define how to reliably transmit the last message, so once the last message is lost in the network or the responder device cannot receive the message, it will lead to subsequent IKE negotiation or encrypted datagram File forwarding failed

Images