Extensible authentication method and system based on ISAKMP (Internet Security Association and Key Management Protocol)

Abstract

The invention discloses an extensible authentication method based on an internet security association and key management protocol (ISAKMP). The extensible authentication method comprises the steps of: negotiating to carry out authentication by adopting an extensible authentication protocol (EAP) through an initiator and a responder once a first route message is required to be sent; calculating message authentication code (HMAC) value with a key in AUTH load through the initiator and the responder according to a master session key (MSK) produced in the EAP process or a shared key after passing the EAP authentication, and sending the AUTH load to the opposite side, so as to finish the authentication in the ISAKMP. The invention also discloses an extensible authentication system based on the ISAKMP. By adopting the method and system disclosed by the invention, the authentication method can be flexibly selected from the ISAKMP, so that the development of the modern authentication technology can be followed.

Description

technical field [0001] The invention relates to key management and authentication technology of routing equipment in a communication network, in particular to an extended authentication method and system based on Internet Security Association and Key Management Protocol (ISAKMP, Internet Security Association and Key Management Protocol). Background technique [0002] The Internet (Internet) has become an indispensable infrastructure in modern society and plays a very important role in politics, economy and people's livelihood. Once the Internet is damaged or attacked, it will bring serious harm and influence, so network security has attracted worldwide attention. The core device in the Internet is the routing device. Ensuring the security of the routing device is an important aspect of network security, and in the security mechanism of the routing device (including the running routing protocol), key management and authentication are very important aspects. Here, the Interne...

AI Technical Summary

Problems solved by technology

[0005] First, the choice of authentication mechanisms is limited

Since only a simple hash algorithm or signature algorithm can be used to generate HMAC to complete the authentication process, the latest authentication methods such as Transport Layer Security (TLS, Transport Layer Security) authentication methods cannot be used for authentication, thus limiting the choice of authentication mechanisms for routing devices Freedom, unable to keep up with the development of modern authentication technology

[0006] Second, the configuration is complex

[0007] Third, the three-party authentication technology cannot be used

However, in practical applications, it is often impossible to configure trust relationships between routing devices in advance, especially when the routing devices belong to different network domains.

In this case, because ISAKMP does not define a three-party authentication mechanism, ISAKMP cannot solve the situation that the trust relationship between routing devices is not configured in advance.

[0008] Fourth, it is not conducive to long-term key updates and increased removal of routing equipment

When a routing device needs to update the shared key, all other related routing devices must also update the key. This process is a huge workload and will affect other routing devices.

When it is necessary to add a routing device to the network, all related routing devices must add security materials related to this routing device. This process is also a huge workload and will affect other routing devices.

When a routing device is removed, the security material related to this routing device must be deleted on all other related routing devices. This process is also a heavy workload and will affect other routing devices.

Images