Security alliance management method and security alliance management equipment
A kind of alliance and security technology, applied in the field of routing security in the field of communication network, can solve the problem of Kerberos protocol key update timing cannot well solve replay attacks, not defined Kerberos protocol key update, complex configuration and so on
- Summary
- Abstract
- Description
- Claims
- Application Information
AI Technical Summary
Problems solved by technology
Method used
Image
Examples
Embodiment 1
[0128] figure 1 It shows a schematic flow chart of the SA creation method of the present invention, as figure 1 As shown, the specific steps include:
[0129] Step 101: the first router finds the record r corresponding to the second router from its own Key Table, and generates a Nonce value;
[0130] Specifically, the first router first finds the record r corresponding to the second router from its own Key Table, and randomly generates a 64-bit random number Nonce value.
[0131] It should be noted that the two operations of the first router searching for the record r corresponding to the second router and generating the random number Nonce value can be performed simultaneously, and are not limited to a chronological order.
[0132] Step 102: the first router uses the Nonce value and the record r to generate KeyID and Ks through a pseudo-random function prf;
[0133] Specifically, the first router generates the KeyID field and Ks of the RSVP-TE protocol defined in RFC2747 b...
Embodiment 2
[0143] In this embodiment, when the first router sends the first RSVP-TE protocol message to the second router, both parties only configure shared items in the Key Table, but do not establish SA. In addition, the first message exchanged between the two parties is usually Hello. It should be noted that the Hello message is defined by the RSVP-TE protocol, and the traditional RSVP protocol does not define the Hello message; the Hello message is defined by RFC3209. Therefore, this embodiment takes the Hello message interaction of the RSVP-TE protocol as an example, and introduces how to establish an SA based on a single-party Nonce in a Hello message between the first router and the second router; The method is also suitable for other RSVP-TE protocol messages.
[0144] In this embodiment, the content of the message 112 and the message 114 that the first router interacts with the second router is defined as follows:
[0145]
[0146]
[0147] figure 2 It shows a schemat...
Embodiment 3
[0162] Embodiment 2 takes the Hello message interaction of the RSVP-TE protocol as an example, and introduces how to establish an SA based on a unilateral Nonce in the Hello message between the first router and the second router.
[0163] This embodiment still takes the Hello message interaction of the RSVP-TE protocol as an example, and will introduce how the first router and the second router establish an SA based on the Nonce of both parties in the Hello message. The method for establishing an SA based on the Nonce of both parties provided in this embodiment is also applicable to other RSVP-TE protocol messages.
[0164] In this embodiment, the content of the message 116 and message 118 exchanged between the first router and the second router is basically the same as that of the message 112 and message 114 in the second embodiment; the difference is that the C-Type field of the SMO object in the message 116 The value is 3, and the value of the C-Type field of the SMO object...
PUM
Login to View More Abstract
Description
Claims
Application Information
Login to View More