A method and device for transmitting key information

Abstract

The invention discloses a key information transmission method and equipment. The key information transmission method comprises the steps that a KS determines the classification role of the KS; when the classification role of the KS is a distribution KS, the distribution KS generates a security strategy and key information and issues the security strategy and the key information to a lower-level KS of the distribution KS; when the classification role is a transition KS, the transition KS receives a security strategy and key information from an upper-level KS of the transition KS, the security strategy and the key information are stored locally and are issued to a lower-level KS of the transition KS; when the classification role is an access KS, the access KS receives a security strategy and key information of an upper-level KS of the access KS, and the security strategy and the key information are stored locally; the access KS determines the security strategy and the key information corresponding to a group where GMs are located, and the currently determined security strategy and key information are issued to the GMs in a unicast mode. In the key information transmission method and equipment, the network scale of a GDVPN system is no longer limited by the performance of CPUs of the KSs.

Description

technical field [0001] The present invention relates to the technical field of communication, in particular to a method and equipment for transmitting key information. Background technique [0002] GDVPN (Group Domain Virtual Private Network, Group Domain Virtual Private Network) provides a group-based IPsec (Internet Protocol Security, IP protocol security) security model. A group is a collection of security policies, and all members belonging to the same group share the same security policies and keys. [0003] Such as figure 1 As shown, it is a schematic diagram of the network of the GDVPN system. KS (Key Server, key server) manages different security policies and keys by dividing different groups, and GM (Group Member, group member) joins the corresponding group to Obtain the security policy and key corresponding to this group from the KS. [0004] Specifically, the GM sends the group ID (identification) of the group it belongs to to the KS. According to the group ID...

AI Technical Summary

Problems solved by technology

[0006] When there are a large number of GMs in the GDVPN system, the KS needs to periodically send key update messages to each GM, resulting in the KS needing to send a large number of key update messages in each sending cycle, resulting in network failures in the GDVPN system. The scale will be limited by the CPU (Central Processing Unit, central processing unit) performance of KS, and the number of GMs that can be deployed in the GDVPN system is limited

Images