Creation method of end-to-end secure link and system

Abstract

The invention relates to a creation method of end-to-end secure link and a system. The creation method comprises the following steps that: 1) a transmission source node NSource transmits akey request packet to a core switch device SWCenter; 2) after receiving the key request packet, the core switch device SWCenter creates a key announce packet to a destination node NDestination; 3) after receiving the key announce packet, the destination node NDestination creates a key announce response packet to be transmitted to the core switch device SWCenter; 4) after receiving the key announce response packet, the core switch device SWCenter creates a key response packet to be transmitted to the transmission source node NSource; 5) and the transmission source node NSource receives the key response packet and creates the end-to-end secure link. The creation method and the system have higher network security.

Description

technical field [0001] The invention relates to the application field of communication network security, in particular to a method and system for establishing an end-to-end secure connection. Background technique [0002] The wired LAN is generally a broadcast network, and the data sent by one node can be received by other nodes. All nodes on the network share the channel, which brings great security risks to the network. As long as the attacker accesses the network to monitor, he can capture all the data packets on the network. [0003] The local area network LAN defined by the existing national standard GB / T 15629.3 (corresponding to IEEE 802.3 or ISO / IEC 8802-3) does not provide data security methods, which makes it easy for attackers to steal key information. In the field of international research, the IEEE 802.1AE standard developed by IEEE provides a data encryption protocol for protecting Ethernet, and adopts hop-by-hop encryption security measures to realize the sa...

AI Technical Summary

Problems solved by technology

This security measure brings a huge computational burden to the switching devices in the LAN, which is easy to cause attackers to attack the switching devices; and the delay of data packets from the sending node to the destination node will also increase, reducing network transmission. efficiency

[0004] The topology of wired LAN is relatively complex, and the number of nodes involved (here, terminals and switching devices are collectively referred to as nodes) is also relatively large, so the data communication in the network is relatively complicated.

If a static key pair is allocated between LAN nodes to establish an end-to-end secure connection, the allocation and update process is extremely complicated

Therefore, the static key pair method is not suitable for establishing an end-to-end secure LAN connection

Images