Method and system for extended use of quantum keys in IPSec VPN (internet protocol security-virtual private network)

Abstract

The invention discloses a method and a system for extended use of quantum keys in an IPSec VPN (internet protocol security-virtual private network) system. The IPSec VPN system comprises at least two IPSec VPN gateways including an initiating IPSec VPN gateway and a responding IPSec VPN gateway as well as corresponding quantum key management terminals. The method comprises steps as follows: through parallel processing of negotiation of the quantum keys and IKE (internet key exchange) negotiated keys, the quantum keys are taken as first session keys for preferential use, and the IKE negotiated keys are taken as second session keys for safety communication. Besides, the invention further provides the corresponding IPSec VPN gateway, the quantum key management terminals and the IPSec VPN system. The quantum keys are taken as the session keys through extended use, so that the session key updating frequency is greatly increased and the safety communication performance of conventional IPSec VPN is guaranteed under the condition that an original IPSec VPN is compatible.

Description

technical field [0001] The present invention relates to the virtual private network (IPSec VPN) of the Internet security protocol, and in particular provides a method for expanding the use of quantum keys in the IPSec VPN, an IPSec VPN gateway, a quantum key management terminal and an IPSec VPN system. Background technique [0002] The Internet Key Exchange (IKE) protocol provides keys for the secure communication of IPSec VPN, and its key exchange process is divided into two stages, such as figure 1 shown. In the first phase of the exchange, the initiator and the responder negotiate to establish an Internet Security Association and Key Management Protocol (ISAKMP) Security Association (SA), that is, ISAKMP SA, which is used by the negotiating parties to establish IPSec SA Share policy and key, use this SA to protect the negotiation process of IPSec SA; in the second phase of exchange, the communication parties use the first phase of ISAKMP SA negotiation to establish IPSec...

AI Technical Summary

Problems solved by technology

Moreover, in the prior art, there is usually no mechanism for reading the quantum key in the key exchange protocol of IPSec VPN, or the quantum key is used to participate in the negotiation process of the first phase ISAKMP SA, or the quantum key is combined with IKE Negotiation keys are combined (for example, combined in an XOR mode) as a session key, and the processing process is relatively complicated, making it difficult to effectively improve the update frequency of the session key in the second-stage IPSec SA, and the prior art has not Make a clear description of the negotiation process of quantum keys exchanged between IPSec VPN and quantum devices

Images