Network key exchange negotiation method, apparatus and network device

Abstract

The present disclosure provides a network key exchange negotiation method, device and network equipment. The method comprises: obtaining user configuration information, the user configuration information comprising negotiation role information, negotiation policy information and SA information; the negotiation policy information being used to indicate a first policy adopted in negotiation, a policy effective time of the first policy, at least one second policy adopted in negotiation and a policy update time and a policy invalidation time of each second policy; when the negotiation role is an initiator and the policy effective time is reached, performing an Internet Key Exchange (IKE) negotiation based on the first policy to determine an SA; saving the SA in a database; whenever the policy update time is reached, performing an IKE negotiation based on the second policy corresponding to the policy update time to update the SA in the database; and when the policy invalidation time is reached, performing invalidation processing on the first policy, the second policy and the SA in the database.

Description

Technical Field

[0001] This disclosure relates to the field of network security, and in particular to a network key exchange negotiation method, apparatus, and network device. Background Technology

[0002] Internet Protocol Security (IPsec) includes two types of secure communication methods: those based on the kernel protocol stack and those based on the Data Plane Development Kit (DPDK). Communication methods based on DPDK typically use the Internet Key Exchange (IKE) protocol to negotiate a Security Association (SA) between the communicating parties. An SA is a collection of encryption algorithms and authentication algorithms.

[0003] In related technologies, IKE configuration is required via command-line programming during the process of negotiating and generating a security alliance. When the security alliance expires or becomes invalid, IKE configuration needs to be performed again via command-line programming.

[0004] This type of command-line programming is highly specialized and requires a high level of technical expertise from maintenance personnel. At the same time, the need for command-line programming for each update results in significant manpower costs and untimely updates. Summary of the Invention

[0005] This disclosure provides a network key exchange negotiation method, apparatus, and network device. The technical solution is as follows:

[0006] This disclosure provides at least one embodiment of a network key exchange negotiation method, applied to a network device, the method comprising:

[0007] Obtain user configuration information, which includes negotiation role information, negotiation policy information, and SA information. The negotiation role information is used to indicate whether the network device is the initiator or receiver of the negotiation. The negotiation policy information is used to indicate the first policy adopted in the negotiation and the policy effective time of the first policy, at least one second policy adopted in the negotiation and the policy update time and policy expiration time of each second policy. The first policy and the second policy are used to indicate the selection of SA during the negotiation process. The SA information includes alternative SAs.

[0008] When the negotiation role is the initiator and the policy takes effect, the network key exchange protocol IKE negotiation is performed based on the first policy and the SA information to determine the SA.

[0009] Save the SA to the database;

[0010] Whenever the policy update time is reached, IKE negotiation is performed based on the second policy corresponding to the policy update time and the SA information to update the SA in the database;

[0011] When the expiration time of the policy is reached, the first policy, the second policy, and the SA in the database are invalidated.

[0012] Optionally, obtaining user configuration information includes:

[0013] Provides a user configuration interface;

[0014] Receive user configuration information input by the user through the user configuration interface.

[0015] Optionally, the provision of a user configuration interface includes:

[0016] It provides user configuration interfaces with multiple themes, and the pre-filled content in the user configuration interface is different for different themes;

[0017] Based on the user's selection operation, output the user configuration interface corresponding to the user's selection operation.

[0018] Optionally, the user configuration information is stored in Extensible Markup Language (XML) format.

[0019] Optionally, when the negotiation role is the receiver, the user configuration information further includes a negotiation whitelist or negotiation blacklist and a third-party strategy; the method further includes:

[0020] When an IKE negotiation request is received, the identity information in the IKE negotiation request is obtained;

[0021] Confirm whether the identity information is in the negotiation whitelist or negotiation blacklist;

[0022] If the identity information is in the negotiation whitelist or not in the negotiation blacklist, then an IKE negotiation response is returned according to the third strategy; if the identity information is not in the negotiation whitelist or not in the negotiation blacklist, then the IKE negotiation request is discarded.

[0023] Optionally, the user configuration information further includes a failure threshold, and the method further includes:

[0024] When IKE negotiation fails and the number of failures reaches the threshold, a failure message is output; when IKE negotiation fails but the number of failures does not reach the threshold, IKE negotiation is retried.

[0025] Optionally, the method further includes:

[0026] Record the time and result of each IKE negotiation and generate a log file.

[0027] At least one embodiment of this disclosure provides a network key exchange negotiation apparatus, the apparatus comprising:

[0028] The negotiation configuration module is used to obtain user configuration information, which includes negotiation role information, negotiation policy information, and SA information. The negotiation role information is used to indicate whether the network device is the initiator or receiver of the negotiation. The negotiation policy information is used to indicate the first policy adopted in the negotiation and the policy effective time of the first policy, at least one second policy adopted in the negotiation and the policy update time and policy expiration time of each second policy. The first policy and the second policy are used to indicate the selection of SA during the negotiation process. The SA information includes alternative SAs.

[0029] The automatic negotiation module is used to perform network key exchange protocol IKE negotiation based on the first policy and the SA information when the negotiation role is the initiator and the policy effective time has been reached, and to determine the SA.

[0030] An encryption management module is used to save the SA to a database;

[0031] The automatic negotiation module is further configured to perform IKE negotiation based on the second policy and the SA information corresponding to the policy update time whenever the policy update time is reached, and update the SA in the database; and to invalidate the first policy, the second policy and the SA in the database when the policy expiration time is reached.

[0032] Optionally, the negotiation configuration module is used to provide a user configuration interface and receive user configuration information input by the user through the user configuration interface.

[0033] Optionally, the negotiation configuration module is used to provide user configuration interfaces for multiple themes, with different pre-filled content in the user configuration interfaces for different themes; and to output the user configuration interface corresponding to the user's selection operation based on the user's selection operation.

[0034] Optionally, the user configuration information is stored in Extensible Markup Language (XML) format.

[0035] Optionally, when the negotiation role is the receiver, the user configuration information further includes a negotiation whitelist or negotiation blacklist and a third strategy; the automatic negotiation module is further configured to, when receiving an IKE negotiation request, obtain the identity information in the IKE negotiation request; confirm whether the identity information is in the negotiation whitelist or negotiation blacklist; if the identity information is in the negotiation whitelist or not in the negotiation blacklist, return an IKE negotiation response according to the third strategy; if the identity information is not in the negotiation whitelist or not in the negotiation blacklist, discard the IKE negotiation request.

[0036] Optionally, the user configuration information also includes a failure threshold. The automatic negotiation module is further configured to output a failure prompt when IKE negotiation fails and the number of failures reaches the threshold; and to re-attempt IKE negotiation when IKE negotiation fails but the number of failures does not reach the threshold.

[0037] Optionally, the device further includes:

[0038] The negotiation protection module is used to record the time and result of each IKE negotiation and generate a log file.

[0039] At least one embodiment of this disclosure provides a network device, the network device including a processor and a memory, the memory storing at least one piece of program code, the program code being loaded and executed by the processor to implement the network key exchange negotiation method as described above.

[0040] At least one embodiment of this disclosure provides a computer-readable storage medium storing at least one piece of program code, which is loaded and executed by a processor to implement the network key exchange negotiation method as described in any of the preceding claims.

[0041] The beneficial effects of the technical solutions provided in this disclosure are:

[0042] In this embodiment, negotiation role information and negotiation policy information of the network device are configured in the user configuration information. Based on this, when the network device is the initiator of the negotiation and the policy's effective time has arrived, it automatically performs IKE negotiation based on the configured first policy to determine the SA. When the policy update time has arrived, it automatically performs IKE negotiation based on the configured second policy to update the SA in the database. Finally, when the policy expiration time has arrived, the first policy, the second policy, and the SA in the database are invalidated. This method automatically performs IKE negotiation by calling the content configured in the user configuration information, eliminating the need for command-line programming. Furthermore, this user configuration information can implement operations such as initiating, updating, and invalidating IKE negotiations, eliminating the need for command-line programming for each update, reducing labor costs, and ensuring more timely updates. In other words, this solution saves labor costs and improves system efficiency. Attached Figure Description

[0043] To more clearly illustrate the technical solutions in the embodiments of this disclosure, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0044] Figure 1 This is a flowchart of a network key exchange negotiation method provided in an embodiment of this disclosure;

[0045] Figure 2 This is a flowchart of a network key exchange negotiation method provided in an embodiment of this disclosure;

[0046] Figure 3 This is a block diagram of a network key exchange negotiation device provided in an embodiment of this disclosure;

[0047] Figure 4 This is a structural block diagram of a network device provided in an embodiment of this disclosure. Detailed Implementation

[0048] To make the objectives, technical solutions, and advantages of this disclosure clearer, the embodiments of this disclosure will be described in further detail below with reference to the accompanying drawings.

[0049] Unless otherwise defined, the technical or scientific terms used herein shall have the ordinary meaning as understood by one of ordinary skill in the art to which this disclosure pertains. The terms “first,” “second,” “third,” and similar terms used in this patent application specification and claims do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Similarly, the terms “an” or “a” and similar terms do not indicate a quantity limitation, but rather indicate the presence of at least one. The terms “comprising” or “including” and similar terms mean that the elements or objects preceding “comprising” or “including” encompass the elements or objects listed following “comprising” or “including” and their equivalents, but do not exclude other elements or objects.

[0050] Before the initiator and receiver communicate, they must first conduct IKE negotiation to determine the SA (Security Advisor). The initiator and receiver then use the negotiated SA to secure the communication data. The SA has a limited lifespan; when the SA expires or becomes invalid, IKE negotiation needs to be performed again to update the SA.

[0051] In this embodiment of the disclosure, the initiator and receiver can be network devices, such as terminals, servers, etc.

[0052] Figure 1 This is a flowchart of a network key exchange negotiation method provided in an embodiment of this disclosure. The method is executed by the aforementioned network device; see [link to relevant documentation]. Figure 1 The method includes:

[0053] 101: Retrieve user configuration information.

[0054] The user configuration information includes negotiation role information, negotiation policy information, and SA information. The negotiation role information is used to indicate whether the network device is the initiator or receiver of the negotiation. The negotiation policy information is used to indicate the first policy adopted in the negotiation and the policy effective time of the first policy, at least one second policy adopted in the negotiation and the policy update time and policy expiration time of each second policy. The first policy and the second policy are used to indicate the selection of SA during the negotiation process. The SA information includes alternative SAs.

[0055] For example, the first and second strategies can be used to indicate which type of SA to select. For instance, when the strategy is efficiency-first, a low-complexity SA is selected; when the strategy is security-first, a high-complexity, high-security SA is selected. The initiator can provide multiple SAs of different complexities or priorities to choose from, and the final selection is determined based on the negotiation results between the initiator and the receiver. This part belongs to the IKE algorithm and will not be elaborated here.

[0056] For example, an SA includes authentication methods, authentication algorithms, encryption algorithms, and key generation algorithms. Low SA complexity means that the authentication methods, authentication algorithms, encryption algorithms, and key generation algorithms included in the SA all have low complexity. High SA complexity means that the authentication methods, authentication algorithms, encryption algorithms, and key generation algorithms included in the SA all have high complexity.

[0057] 102: When the negotiation role is the initiator and the policy takes effect, the network key exchange protocol IKE is negotiated based on the first policy and the SA information to determine the SA.

[0058] In other words, when the policy takes effect, the initiator negotiates with the recipient using IKE. The negotiation process is also the process of selecting an SA from the alternative SAs based on the needs of both the initiator and the recipient.

[0059] Taking encryption algorithm negotiation as an example, the initiator provides encryption algorithms A, B, and C, ranging from simple to complex.

[0060] For example, the initiator's first strategy is efficiency first, and the initiator initially provides the least complex key A. The initiator sends an IKE negotiation request to the receiver, carrying A in the IKE negotiation request. After receiving the IKE negotiation request, the receiver determines whether A meets its own strategy. If A does not meet the receiver's requirements, the receiver returns an IKE negotiation response to the initiator, indicating that A cannot be used as an encryption algorithm. At this point, the initiator re-provides the key B to the receiver through an IKE negotiation request, and the receiver indicates through an IKE negotiation response that B can be used as an encryption algorithm; the negotiation is complete.

[0061] 103: Save the SA to the database.

[0062] The initiator saves the SA to a database in memory, so that the SA can be retrieved from the database for encryption during subsequent IPsec communication.

[0063] 104: Whenever the policy update time is reached, IKE negotiation is performed based on the second policy corresponding to the policy update time and the SA information to update the SA in the database.

[0064] Here, the first and second strategies can be different, or they can be the same. Security is ensured by renegotiating and updating the SA in the database.

[0065] 105: When the expiration time of the policy is reached, the first policy, the second policy, and the SA in the database are invalidated.

[0066] In this embodiment, negotiation role information and negotiation policy information of the network device are configured in the user configuration information. Based on this, when the network device is the initiator of the negotiation and the policy's effective time has arrived, it automatically performs IKE negotiation based on the configured first policy to determine the SA. When the policy update time has arrived, it automatically performs IKE negotiation based on the configured second policy to update the SA in the database. Finally, when the policy expiration time has arrived, the first policy, the second policy, and the SA in the database are invalidated. This method automatically performs IKE negotiation by calling the content configured in the user configuration information, eliminating the need for command-line programming. Furthermore, this user configuration information can implement operations such as initiating, updating, and invalidating IKE negotiations, eliminating the need for command-line programming for each update, reducing labor costs, and ensuring more timely updates. In other words, this solution saves labor costs and improves system efficiency.

[0067] Figure 2 This is a flowchart of a network key exchange negotiation method provided in an embodiment of this disclosure. The method is executed by the aforementioned network device; see [link to relevant documentation]. Figure 2 The method includes:

[0068] 201: Provides a user configuration interface.

[0069] For example, step 201 may include:

[0070] It provides user configuration interfaces with multiple themes, and the pre-filled content in the user configuration interface is different for different themes;

[0071] Based on the user's selection operation, output the user configuration interface corresponding to the user's selection operation.

[0072] The topic can be related to the strategy used in the negotiation process. For example, if the topic is "efficiency first," then the first and second strategies pre-filled in the user configuration interface for that topic will both be "efficiency first," requiring the complexity of the determined SA to be below a first threshold. As another example, if the topic is "security first," then the first and second strategies pre-filled in the user configuration interface for that topic will both be "security first," requiring the complexity of the determined SA to be above a second threshold. It's worth noting that even if the first and second strategies are the same, the SA in the database may still be updated after negotiation using the second strategy.

[0073] In this embodiment of the disclosure, a complexity level can be set for different SAs, and the aforementioned first threshold and second threshold are the thresholds for the complexity level.

[0074] In this embodiment of the disclosure, the user configuration interface includes input boxes for each field in the user configuration information, allowing the user to enter or select the corresponding field.

[0075] Optionally, the user configuration information may also include a negotiated whitelist or negotiated blacklist and a third strategy.

[0076] When acting as the receiving party, the negotiation whitelist or blacklist is used by network devices to determine whether the initiator on the other end is secure and legitimate, and negotiation only proceeds if the other end is secure and legitimate. During the negotiation process, the receiving party follows a third strategy.

[0077] Similarly, there can be multiple third strategies. During negotiation, different third strategies are selected in turn to negotiate with the initiator.

[0078] Optionally, the method may further include:

[0079] Before step 201, user login information is received and verified. If the user login information is successfully verified, step 201 is executed; otherwise, the process ends. This step can be performed by the IKE negotiation protection module in the network device, enabling multi-user login.

[0080] 202: Receive user configuration information input by the user through the user configuration interface.

[0081] The user configuration information includes negotiation role information, negotiation policy information, and SA information. The negotiation role information is used to indicate whether the network device is the initiator or receiver of the negotiation. The negotiation policy information is used to indicate the first policy adopted in the negotiation and the policy effective time of the first policy, at least one second policy adopted in the negotiation and the policy update time and policy expiration time of each second policy. The first policy and the second policy are used to indicate the selection of SA during the negotiation process. The SA information includes alternative SAs.

[0082] For example, the first and second strategies can be used to indicate which type of SA to select. For instance, when the strategy is efficiency-first, a low-complexity SA is selected; when the strategy is security-first, a high-complexity, high-security SA is selected. The initiator can provide multiple SAs of different complexities or priorities to choose from, and the final selection is determined based on the negotiation results between the initiator and the receiver. This part belongs to the IKE algorithm and will not be elaborated here.

[0083] For example, SA includes authentication methods, authentication algorithms, encryption algorithms, and key generation algorithms.

[0084] For example, the authentication method refers to the identity authentication mode of the negotiating parties during the target security association's processing. For example, the authentication method includes the PSK (Pre-Shared Key) mode.

[0085] The authentication algorithms in the set are selected from the following: SHA1 (Secure Hash Algorithm 1), SHA2 (Secure Hash Algorithm 2), MD5 (Message Digest Algorithm 5), SM3 (Chinese National Cryptography 3), SM4 (Chinese National Cryptography 4), etc. Examples of SHA2 algorithms include SHA2-256 and SHA2-384.

[0086] An encryption algorithm refers to the encryption algorithm permitted by both parties in the target security alliance process. This encryption algorithm is a set of encryption algorithms, which includes at least one encryption algorithm. For example, the encryption algorithms in the set are selected from the following: DES (Data Encryption Standard), 3DES (Triple Data Encryption Standard), AES (Advanced Encryption Standard), etc. Examples of AES algorithms include AES-128 and AES-256.

[0087] A key generation algorithm refers to the algorithm used by both parties in a target security alliance to generate an encryption key during the processing of the encryption. Key generation algorithms include, but are not limited to, the Diffie-Hellman (DH) algorithm.

[0088] In this step, in one scenario, the user enters their configuration information via manual input. In another scenario, the user imports their configuration information saved in an XML file through the user configuration interface.

[0089] In addition, the method also includes: exporting user configuration information from the user configuration interface.

[0090] 203: Stores user configuration information.

[0091] For example, the user configuration information is stored in Extensible Markup Language (XML) format.

[0092] Optionally, the method may also include: querying, modifying, and deleting user configuration information.

[0093] 204: Import user configuration information into the IKE auto-negotiation module.

[0094] In this embodiment, steps 201 and 202 are executed by the IKE negotiation configuration module in the initiator. Subsequent negotiation is performed by the IKE auto-negotiation module using the IKE protocol. Therefore, user configuration information needs to be imported into the IKE auto-negotiation module. This allows the IKE auto-negotiation module to initiate negotiation based on the policy effective time and policy update time in the user configuration information. During each negotiation, it calls the set policy and SA information as parameters required by the IKE protocol. When the policy expires, the first policy, the second policy, and the SA in the database are invalidated.

[0095] The IKE auto-negotiation module automatically fills in the parameters required by the IKE protocol by calling the configuration information through the program, and can refill the parameters required by the IKE protocol based on the policy to achieve updates.

[0096] 205: When the negotiation role is the initiator and the policy takes effect, the network key exchange protocol IKE is negotiated based on the first policy and the SA information to determine the SA.

[0097] In other words, when the policy takes effect, the initiator negotiates with the recipient using IKE. The negotiation process is also the process of selecting an SA from the alternative SAs based on the needs of both the initiator and the recipient.

[0098] Taking encryption algorithm negotiation as an example, the initiator provides encryption algorithms A, B, and C, ranging from simple to complex.

[0099] For example, the initiator's first strategy is efficiency first, and the initiator initially provides the least complex key A. The initiator sends an IKE negotiation request to the receiver, carrying A in the IKE negotiation request. After receiving the IKE negotiation request, the receiver determines whether A meets its own strategy. If A does not meet the receiver's requirements, the receiver returns an IKE negotiation response to the initiator, indicating that A cannot be used as an encryption algorithm. At this point, the initiator re-provides the key B to the receiver through an IKE negotiation request, and the receiver indicates through an IKE negotiation response that B can be used as an encryption algorithm; the negotiation is complete.

[0100] Optionally, the user configuration information further includes a failure threshold, and the method may further include:

[0101] When IKE negotiation fails and the number of failures reaches the threshold, a failure message is output; when IKE negotiation fails but the number of failures does not reach the threshold, IKE negotiation is retried.

[0102] Optionally, the method may further include:

[0103] Record the time and result of each IKE negotiation and generate a log file.

[0104] For example, the log file includes: the initial SA creation time, the SA update time, etc. In addition, the log file may also include user access records, etc. The log file provides maintenance personnel with a basis for maintaining the IKE function of network devices.

[0105] 206: Save the SA to the database.

[0106] The initiator saves the SA to a database in memory, so that the SA can be retrieved from the database for encryption during subsequent IPsec communication.

[0107] 207: Whenever the policy update time is reached, IKE negotiation is performed based on the second policy corresponding to the policy update time and the SA information to update the SA in the database.

[0108] Here, the first and second strategies can be different, or they can be the same. Security is ensured by renegotiating and updating the SA in the database.

[0109] 208: When the expiration time of the policy is reached, the first policy, the second policy, and the SA in the database are invalidated.

[0110] 209: When the negotiation role is the receiver, when receiving the IKE negotiation request, obtain the identity information in the IKE negotiation request.

[0111] 210: Confirm whether the identity information is in the negotiation whitelist or negotiation blacklist.

[0112] For example, the negotiated whitelist or negotiated blacklist can be an IP address or port information.

[0113] In this step, the network device takes the IP address or port information from the IKE negotiation request and then determines whether it is in the negotiation whitelist or negotiation blacklist.

[0114] In addition, IKE's negotiation request also included an alternative SA.

[0115] In this embodiment of the disclosure, step 210 can be performed by the IKE negotiation protection module in the network device.

[0116] In addition, the IKE negotiation protection module 304 can also perform network self-testing and denial-of-service (DoS) attack prevention. For example, when a DoS attack is detected, it blocks the attacker and releases connection resources to the attacker.

[0117] 211: If the identity information is in the negotiation whitelist or not in the negotiation blacklist, then return the IKE negotiation response according to the third strategy; if the identity information is not in the negotiation whitelist or not in the negotiation blacklist, then discard the IKE negotiation request.

[0118] The network device determines whether the alternative SA in the IKE negotiation request is suitable according to the third strategy. If it is suitable, it returns an IKE negotiation response agreeing to the request; if it is not suitable, it returns an IKE negotiation response to continue negotiation.

[0119] Figure 3 This is a schematic diagram of a network key exchange and negotiation device provided in an embodiment of this disclosure. See also... Figure 3 The network key exchange negotiation device includes: a negotiation configuration module 301, an automatic negotiation module 302, and an encryption management module 303.

[0120] The negotiation configuration module 301 is used to obtain user configuration information, which includes negotiation role information, negotiation policy information, and SA information. The negotiation role information is used to indicate whether the network device is the initiator or receiver of the negotiation. The negotiation policy information is used to indicate the first policy adopted in the negotiation and the policy effective time of the first policy, at least one second policy adopted in the negotiation and the policy update time and policy expiration time of each second policy. The first policy and the second policy are used to indicate the selection of SA during the negotiation process. The SA information includes alternative SAs.

[0121] Automatic negotiation module 302 is used to perform network key exchange protocol IKE negotiation based on the first policy and the SA information when the negotiation role is the initiator and the policy effective time is reached, and to determine the SA;

[0122] Encryption management module 303 is used to save the SA to a database;

[0123] The automatic negotiation module 302 is further configured to perform IKE negotiation based on the second policy and the SA information corresponding to the policy update time whenever the policy update time is reached, and update the SA in the database; and to perform invalidation processing on the first policy, the second policy and the SA in the database when the policy expiration time is reached.

[0124] Optionally, the negotiation configuration module 301 is used to provide a user configuration interface and receive user configuration information input by the user through the user configuration interface.

[0125] Optionally, the negotiation configuration module 301 is used to provide user configuration interfaces for multiple themes, with different pre-filled contents in the user configuration interfaces for different themes; and to output the user configuration interface corresponding to the user's selection operation according to the user's selection operation.

[0126] Optionally, the user configuration information is stored in Extensible Markup Language (XML) format.

[0127] Optionally, when the negotiation role is the receiver, the user configuration information further includes a negotiation whitelist or negotiation blacklist and a third strategy; the automatic negotiation module 302 is further configured to, when receiving an IKE negotiation request, obtain the identity information in the IKE negotiation request; confirm whether the identity information is in the negotiation whitelist or negotiation blacklist; if the identity information is in the negotiation whitelist or not in the negotiation blacklist, then return an IKE negotiation response according to the third strategy; if the identity information is not in the negotiation whitelist or not in the negotiation blacklist, then discard the IKE negotiation request.

[0128] Optionally, the user configuration information also includes a failure threshold. The automatic negotiation module 302 is further configured to output a failure prompt when IKE negotiation fails and the number of failures reaches the threshold; and to re-attempt IKE negotiation when IKE negotiation fails but the number of failures does not reach the threshold.

[0129] Optionally, the device further includes:

[0130] The negotiation protection module 304 is used to record the time and result of each IKE negotiation and generate a log file.

[0131] It should be noted that the network key exchange negotiation device provided in the above embodiments is only illustrated by the division of the above functional modules during encryption negotiation. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the network key exchange negotiation device and the network key exchange negotiation method embodiments provided in the above embodiments belong to the same concept, and the specific implementation process can be found in the method embodiments, which will not be repeated here.

[0132] Figure 4 This is a structural block diagram of a network device provided in an embodiment of this disclosure. Typically, the network device includes a processor 601 and a memory 602.

[0133] Processor 601 may include one or more processing cores, such as a quad-core processor or an octa-core processor. Processor 601 may be implemented using at least one of the following hardware forms: DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), or PLA (Programmable Logic Array). Processor 601 may also include a main processor and a coprocessor. The main processor, also known as a CPU (Central Processing Unit), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state.

[0134] Memory 602 may include one or more computer-readable storage media, which may be non-transitory. Memory 602 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory devices. In some embodiments, the non-transitory computer-readable storage media in memory 602 is used to store at least one instruction, which is executed by processor 601 to implement the network key exchange negotiation method performed by a network device provided in the method embodiments of this application.

[0135] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware or by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0136] The above description is merely an optional embodiment of this disclosure and is not intended to limit this disclosure. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this disclosure should be included within the protection scope of this disclosure.

Claims

1. A network key exchange negotiation method, characterized in that, Applied to network devices, the method includes: The system provides user configuration interfaces for various themes, with different pre-filled content for each theme. The theme is related to the strategy used during the negotiation process. If the theme is efficiency-first, then the first and second pre-filled strategies in the user configuration interface for that theme are both efficiency-first strategies, requiring the complexity of the determined SA to be below a first threshold. If the theme is security-first, then the first and second pre-filled strategies in the user configuration interface for that theme are both security-first strategies, requiring the complexity of the determined SA to be above a second threshold. Based on the user's selected action, output the user configuration interface corresponding to the user's selected action; The system receives user configuration information input by the user through the user configuration interface. The user configuration information includes negotiation role information, negotiation policy information, and security association (SA) information. The negotiation role information is used to indicate whether the network device is the initiator or receiver of the negotiation. The negotiation policy information is used to indicate the first policy adopted in the negotiation and the policy effective time of the first policy, at least one second policy adopted in the negotiation and the policy update time and policy expiration time of each second policy. The first policy and the second policy are used to indicate the selection of SA during the negotiation process. The SA information includes alternative SAs. When the negotiation role is the initiator and the policy takes effect, the network key exchange protocol IKE negotiation is performed based on the first policy and the SA information to determine the SA. Save the SA to the database; Whenever the policy update time is reached, IKE negotiation is performed based on the second policy corresponding to the policy update time and the SA information to update the SA in the database; When the expiration time of the policy is reached, the first policy, the second policy, and the SA in the database are invalidated.

2. The method according to claim 1, characterized in that, The user configuration information is stored in Extensible Markup Language (XML) format.

3. The method according to claim 1, characterized in that, When the negotiation role is the receiver, the user configuration information also includes a negotiation whitelist or negotiation blacklist and a third-party strategy; the method further includes: When an IKE negotiation request is received, the identity information in the IKE negotiation request is obtained; Confirm whether the identity information is in the negotiation whitelist or negotiation blacklist; If the identity information is in the negotiation whitelist or not in the negotiation blacklist, then an IKE negotiation response is returned according to the third strategy; if the identity information is not in the negotiation whitelist or not in the negotiation blacklist, then the IKE negotiation request is discarded.

4. The method according to claim 1, characterized in that, The user configuration information also includes a failure threshold, and the method further includes: When IKE negotiation fails and the number of failures reaches the threshold, a failure message is output; when IKE negotiation fails but the number of failures does not reach the threshold, IKE negotiation is retried.

5. The method according to claim 4, characterized in that, The method further includes: Record the time and result of each IKE negotiation and generate a log file.

6. A network key exchange negotiation device, characterized in that, The device includes: The negotiation configuration module provides user configuration interfaces for various themes, with different pre-filled content for each theme. The theme is related to the strategy used during negotiation. For example, if the theme is efficiency-first, the first and second strategies pre-filled in the user configuration interface for that theme are both efficiency-first strategies, requiring the determined SA complexity to be below a first threshold. If the theme is security-first, the first and second strategies pre-filled in the user configuration interface for that theme are both security-first strategies, requiring the determined SA complexity to be above a second threshold. Based on the user's selection, the module outputs a user configuration interface corresponding to the user's selection. It also receives user configuration information input by the user through the user configuration interface. This user configuration information includes negotiation role information, negotiation strategy information, and SA information. The negotiation role information indicates whether the network device is the initiator or receiver of the negotiation. The negotiation strategy information indicates the first strategy adopted in the negotiation, its effective time, at least one second strategy adopted in the negotiation, its update time, and its expiration time. The first and second strategies indicate the selection of SAs during the negotiation process, and the SA information includes alternative SAs. The automatic negotiation module is used to perform network key exchange protocol IKE negotiation based on the first policy and the SA information when the negotiation role is the initiator and the policy effective time has been reached, and to determine the SA. An encryption management module is used to save the SA to a database; The automatic negotiation module is further configured to perform IKE negotiation based on the second policy and the SA information corresponding to the policy update time whenever the policy update time is reached, and update the SA in the database; and to invalidate the first policy, the second policy and the SA in the database when the policy expiration time is reached.

7. A network device, characterized in that, The network device includes a processor and a memory, the memory storing at least one piece of program code, which is loaded and executed by the processor to implement the network key exchange negotiation method as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one piece of program code, which is loaded and executed by a processor to implement the network key exchange negotiation method as described in any one of claims 1 to 5.

Images