Method for negotiating about security alliance

Abstract

The invention comprises: setting the selection rule; when confirming that there is a conflict existed between two SA (security negotiation) the negotiation processes, according to the selection rule, acquiring the character of the two conflicted SA negotiation processes; according to the acquired character and selection rule; selecting one SA corresponding to the two conflicted SA negotiation processes. By the invention, when both communicational parties generates two different SAs for protecting same IP traffic or performs two SA negotiation processes for protecting same IP traffic, both of them can get matched SA.

Description

technical field [0001] The present invention relates to IP security (IPsec) technology, especially a method for negotiating security association (SA). Background technique [0002] In the prior art, the IPsec SA is usually obtained through negotiation using the Internet Key Exchange Protocol (IKE). IKE negotiation is divided into two phases. In phase 1, IKE SA is negotiated, and the IKE SA is used to protect the negotiation process in phase 2. In phase 2, IPsec SA is negotiated, and the SA is used to protect user IP traffic. During the IPsecSA negotiation process, in order to protect different IP traffic, the communication parties will conduct IPsec SA negotiation for each IP traffic to be protected. Here, the IKE SA used to protect the negotiation process of phase 2 can also be regarded as the SA that protects the IP traffic of phase 2. In the introduction of this document, unless otherwise specified, SA means IKE SA or IPsec SA. [0003] An SA negotiation process, wheth...

AI Technical Summary

Problems solved by technology

In this way, the final SA reserved by the communication parties is not a matching SA, so that the communication parties negotiate to generate two IKE SAs or two IPsec SAs to protect the same IP traffic, resulting in the failure of the SA negotiation process between the communication parties, which seriously affects the business. normal operation, resulting in an extreme waste of network resources

Images