Method and system for establishing key between nodes

Abstract

The invention discloses a method for establishing a key between nodes. The method comprises the following steps that: 1) a sending source node NSource sends a first key negotiation request packet to switching equipment SWFirst; 2) the switching equipment SWFirst sends a second key negotiation request packet to switching equipment SWLast; 3) the switching equipment SWLast sends a third key negotiation request packet to a destination node NDestination; 4) the destination node NDestination sends a third key negotiation response packet to the switching equipment SWLast; 5) the switching equipmentSWLast sends a second key negotiation response packet to the switching equipment SWFirst; 6) the switching equipment SWFirst sends a first key negotiation response packet to the sending source node NSource; and 7) the sending source node NSource receives the first key negotiation response packet. The key between legal nodes of a local area network can be flexibly established and updated, and a manager does not need deploying a shared static key pair between every two nodes of the total network.

Description

technical field [0001] The invention relates to the application field of communication network security, in particular to a method and system for establishing keys between nodes. Background technique [0002] The wired LAN is generally a broadcast network, and the data sent by one node can be received by other nodes. All nodes on the network share the channel, which brings great security risks to the network. As long as the attacker accesses the network to monitor, he can capture all the data packets on the network. The local area network LAN defined by the existing national standard GB / T 15629.3 (corresponding to IEEE 802.3 or ISO / IEC 8802-3) does not provide data security methods, which makes it easy for attackers to steal key information. [0003] In the wired LAN, the standard organization IEEE realizes the security of the link layer by enhancing the security of IEEE 802.3. IEEE 802.1AE provides a data encryption protocol for protecting Ethernet, and adopts hop-by-hop...

AI Technical Summary

Problems solved by technology

This security measure brings a huge computational burden to the switching devices in the LAN, which is easy to cause attackers to attack the switching devices; and the delay of data packets from the sending node to the destination node will also increase, reducing network transmission. efficiency

[0004] The topology of the wired LAN is relatively complex, and the number of nodes involved is relatively large, so the data communication in the network is relatively complicated.

If a static key is distributed between LAN nodes to ensure confidential communication between nodes, the distribution and update process is extremely complicated

Images