Main-mode IKE negotiation method

Abstract

The invention discloses a main-mode IKE (Internet Key Exchange) negotiation method, which belongs to the field of network communication technology. The method comprises the following steps: embedding respective user identity information in a sending message at a first stage of the main-mode IKE negotiation initiated by the current end to the opposite end, when the current end and the opposite end are in first interaction negotiation; sending DH encryption information to the opposite end when the current end and the opposite end are in second interaction negotiation; and selecting corresponding secret key according to the user identity information of the opposite party and the DH encryption information when the current end and the opposite end are in third interaction negotiation. According to the invention, the respective user identity information is embedded in the sending message, when the current end and the opposite end are in first interaction negotiation, so that the method provided by the invention can be also realized when the ip address is uncertain.

Description

technical field [0001] The invention relates to the technical field of network communication, in particular to an IKE main mode negotiation method. Background technique [0002] The IKE negotiation method is divided into two modes: the main mode and the aggressive mode. In the aggressive mode, the corresponding key can be configured according to the user identity, and then the IKE negotiation interaction can be performed through this key. Aggressive mode can use the key corresponding to the user identity, because the user identity in the aggressive mode carries the local user identity information in the first negotiation packet, so after the peer end receives the negotiation packet, it can The user identity is matched to find the key corresponding to the user identity configured in advance on the local end. However, in the main mode, the user identity information of the local end is only carried when the information is negotiated for the third time in IKE, and because the k...

AI Technical Summary

Problems solved by technology

However, in the main mode, the user identity information of the local end is only carried when the information is negotiated for the third time in IKE, and because the key must be determined before the second IKE mutual negotiation in the main mode, only the information of the packet can be used in the negotiation in the main mode. ip address, but cannot use the user identity to confirm the negotiation key configured in advance at the local end

The advantage is that the main mode is much stronger in terms of security than the aggressive mode, but when the ip address is uncertain (for example, the ip address after network address translation NAT), and the more secure main mode needs to be used for IKE tunnel establishment , it will not be possible to complete

Images