Method and system for automatically restoring communication based on IPSEC after multi-route switching

Abstract

The present invention relates to the field of wireless communication technology, and in particular to a method and system for automatically restoring communication based on IPSEC after multi-route switching, comprising the following steps: IKE SA parameter negotiation and identity authentication and IPsec SA parameter negotiation are performed between a client and a security gateway; an IPSEC tunnel is formally established, and the client uses an ESP message to send a periodic heartbeat message to the security gateway with a period t1; when the security gateway does not receive the ESP message transmitted by the client within the t1 time, a DPD delay event is triggered, and when the client receives the DPD message, identity authentication and IPsec SA parameter negotiation are performed again to rebuild the IPSEC tunnel for restoring communication, and the security gateway obtains and applies new routing information, thereby improving the efficiency of communication recovery. The present invention is applicable to a base station system, and is also applicable to a base station plus a repeater extension coverage system, and is particularly applicable to a distributed wireless system, including a fiber-optic remote distributed system, a cable-remote frequency-shift repeater system, a frequency-shift system, a sea area communication, a low-altitude communication, and the like.

Description

Technical Field

[0001] The present invention relates to the field of wireless communication technology, and in particular to a method and system for automatically restoring communication based on IPSEC after multi-route switching. Background Art

[0002] At present, network security is becoming more and more important. IPSEC (Internet Protocol Security) is basically used for secure transmission of network data. Usually, a security gateway server is set up in the network, and the client communicates with the security gateway server through IPSEC to achieve data protection. At the same time, for transmission reliability, the client and the full gateway server will use multiple WANs for primary and backup work through routers. IPSEC can only be established on the WAN in use. Once a WAN fails, the router will immediately switch to an available WAN.

[0003] However, when the route in the network switches, the traditional IPSEC communication mechanism often cannot adapt to the change in time, resulting in the interruption of the IPSEC tunnel and the inability to automatically recover, and the communication cannot proceed normally. This will not only affect the normal use of users, but also may bring serious security risks and economic losses to enterprises and organizations. Summary of the invention

[0004] The purpose of the present invention is to provide a method and system for automatically restoring communication based on IPSEC after multiple route switching, which can automatically re-establish the IPSEC tunnel and restore normal data transmission when it is detected that the route switching causes communication interruption, thereby improving the reliability and stability of network communication.

[0005] The first aspect of the present invention provides a method for automatically restoring communication based on IPSEC after multi-route switching, comprising the following steps: IKE SA parameter negotiation between the client and the security gateway; Identity authentication and IPsec SA parameter negotiation between the client and the security gateway; After the client and the security gateway complete identity authentication and IPsec SA parameter negotiation, the IPSEC tunnel is formally established. The client and the security gateway transmit ESP encrypted messages through the IPSEC tunnel, and the security gateway records the routing information in the ESP encrypted messages. The client uses ESP messages to send periodic heartbeat messages to the security gateway at a period of t1; When the security gateway does not receive the ESP message transmitted by the client within t1, the DPD delay event is triggered and a DPD message is sent to the client via an IKE message. When the client receives the DPD message, the client and the security gateway re-authenticate and negotiate IPsec SA parameters to rebuild the IPSEC tunnel to restore communication, and the security gateway obtains and applies new routing information.

[0006] A further improvement is that the specific method for IKE SA parameter negotiation between the client and the security gateway includes: The client sends the IKE SA parameters including the encryption algorithm, authentication algorithm, and DH group information to the security gateway; After receiving the IKE SA parameters, the security gateway searches for matching parameters in its own configuration database. If the match is successful, the security gateway returns the matching parameters to the client. The client receives and confirms them. The two parties exchange temporary random numbers. Based on the DH algorithm, the two parties use the exchanged temporary random numbers and their respective private keys to generate a shared key material for deriving all keys of the IPsec SA.

[0007] A further improvement is that the specific method for identity authentication and IPsec SA parameter negotiation between the client and the security gateway includes: The client sends its identity information to the security gateway, which uses the negotiated algorithm and key to verify the client's identity and the previously exchanged IKE SA parameter negotiation information. At the same time, the two parties further negotiate the parameters of the IPsec SA, including the ESP mode and key lifetime. The security gateway sends its identity information to the client, and the client performs the same verification operation.

[0008] A further improvement is that the size of t1 is consistent with the time taken by the router to switch the WAN line.

[0009] A further improvement is that the encryption algorithm adopts any one of AES-128, AES-256, and 3DES.

[0010] A further improvement is that the verification algorithm adopts any one of SHA-1, SHA-256, and SHA-384.

[0011] A further improvement is that the DH group adopts DH Group 14 or DH Group 15.

[0012] A further improvement is that the method for transmitting ESP encrypted messages between the client and the security gateway through the IPSEC tunnel includes: The client encapsulates and encrypts the user's original message according to the negotiated ESP mode, and then sends it to the security gateway. After receiving the ESP encrypted message, the security gateway decrypts and verifies it according to the previously negotiated SA parameters to ensure the authenticity and integrity of the message.

[0013] A further improvement is that the periodic heartbeat message contains a unique identifier and timestamp information of the client.

[0014] The second aspect of the present invention provides a system for automatically restoring communication based on IPSEC after multi-route switching, comprising: A first negotiation module, used for IKE SA parameter negotiation between the client and the security gateway; The second negotiation module is used for identity authentication and IPsec SA parameter negotiation between the client and the security gateway; The IPSEC tunnel establishment module is used to establish an IPSEC tunnel after the identity authentication and IPsec SA parameter negotiation are completed between the client and the security gateway. The client and the security gateway transmit ESP encrypted messages through the IPSEC tunnel, and the security gateway records the routing information in the ESP encrypted messages; A heartbeat message sending module is used to send periodic heartbeat messages to the security gateway at a period of t1 using ESP messages on the client side; DPD delay event triggering module, used to trigger the DPD delay event when the security gateway does not receive the ESP message transmitted by the client within t1 time, and send a DPD message to the client through the IKE message; The IPSEC tunnel reconstruction module is used for re-authentication and IPsec SA parameter negotiation between the client and the security gateway to rebuild the IPSEC tunnel to restore communication when the client receives the DPD message, and the security gateway obtains and applies new routing information.

[0015] The beneficial effects of the present invention are: The present invention can automatically, in real time and accurately detect the communication interruption caused by route switching through the coordinated work of the DPD mechanism and the periodic heartbeat message, and quickly and automatically trigger the reconstruction process of the IPSEC tunnel without manual intervention, which greatly shortens the time of communication interruption, improves the efficiency of communication recovery, and reduces the impact of communication interruption on the business. In a complex and changeable multi-route switching network environment, the present invention can ensure the continuity and stability of IPSEC communication, and by timely detecting and recovering communication interruption, the number of communication failures caused by route changes is reduced, and the reliability of network communication is improved. After testing, the IPSEC message of the router can be quickly restored after the WAN is successfully switched, and at most one ping data packet is lost under complex network conditions, and the effect is very good. The present invention is applicable to base station systems, and is also applicable to base station plus repeater extension coverage systems, and is particularly applicable to distributed wireless systems, including optical fiber remote distributed systems, cable remote frequency shift repeater systems, frequency shift systems, sea area communications, low-altitude communications, etc. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is the network topology diagram between the client and the security gateway; Figure 2 The present invention is a flow chart of a method for automatically restoring communication based on IPSEC after multi-route switching. DETAILED DESCRIPTION

[0017] In order to enable those skilled in the art to better understand the solution of the present invention, the technical solution in the embodiment of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiment of the present invention. Obviously, the described embodiment is only a part of the embodiment of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0018] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0019] In a complex and ever-changing network environment, route switching is a common phenomenon. Dynamic changes in network topology, network equipment failure repair, network traffic optimization and other factors may lead to route switching. When route switching occurs, traditional IPSEC communication mechanisms often find it difficult to quickly and effectively adapt to such changes, resulting in IPSEC tunnel interruption and communication failure. Figure 1 The figure shows the network topology between the client and the security gateway. The router has multiple WAN lines to the Internet, which work in a primary-backup manner. If a WAN currently in use fails, the route is switched to use the backup WAN line.

[0020] Therefore, there is an urgent need for a method that can automatically adapt to multi-route switching and ensure automatic continuation and recovery of IPSEC communications to meet the strict requirements of modern network communications for security, stability and reliability.

[0021] Please refer to Figure 2The first aspect of the embodiment of the present invention provides a method for automatically restoring communication based on IPSEC after multi-route switching, comprising the following steps: Step S1: IKE SA parameter negotiation is performed between the client and the security gateway.

[0022] It is understandable that the IKE (Internet Key Exchange) protocol is an important component of the IPSEC system and is responsible for establishing a security association (SA) between the communicating parties.

[0023] Step S2: Identity authentication and IPsec SA parameter negotiation are performed between the client and the security gateway.

[0024] It can be understood that through this step, it is possible to prevent middlemen from stealing and tampering with communication information, ensure that the identities of both communicating parties are authentic and reliable, and through further negotiation of IPsec SA parameters, both parties can customize the configuration of IPsec SA according to specific communication needs and security requirements, thereby improving the adaptability and security of communications.

[0025] Step S3: After the identity authentication and IPsec SA parameter negotiation are completed between the client and the security gateway, the IPSEC tunnel is formally established. The client and the security gateway transmit ESP (Encapsulating Security Payload) encrypted messages through the IPSEC tunnel, and the security gateway records the routing information in the ESP encrypted messages.

[0026] It is understandable that when identity authentication and IPsec SA parameter negotiation are completed, the two parties are qualified to establish a secure tunnel. The establishment of the IPSEC tunnel marks that the communication between the two parties has entered the security stage, and the user message is effectively protected during the transmission process. The IPSEC tunnel is realized by establishing a series of security associations (SA) between the two parties. These SAs define the encryption algorithm, key, verification method and other security parameters used by the two parties in communication. ESP encrypted messages are an important way to protect data transmission in the IPSEC protocol. It ensures the confidentiality, integrity and availability of data during transmission by encrypting and authenticating data. The security gateway records the routing information of the ESP message, which is an important link to ensure the normal communication. It ensures that the message can reach the destination accurately.

[0027] Step S4: The client uses ESP messages to send periodic heartbeat messages to the security gateway at a period of t1.

[0028] It is understandable that the security gateway can learn the client's survival status and the validity of the connection in real time by receiving the heartbeat message sent by the client. If the security gateway receives the heartbeat message within the expected time, it can be considered that the connection between the client and the security gateway is normal; conversely, if the heartbeat message is not received for a long time, it may mean that there is a problem with the connection.

[0029] Step S5: When the security gateway does not receive the ESP message transmitted by the client within time t1, a DPDdelay event is triggered, and a DPD message is sent to the client via an IKE message.

[0030] Specifically, the security gateway captures ESP messages from the client in real time by monitoring the network interface, and records the time when the message is received. When the security gateway does not receive the ESP message on time, it actively sends a DPD message. The DPD (Dead Peer Detection) mechanism is a technology used to detect whether the communication peer is alive. It is implemented by periodically sending specific control messages (such as DPD messages). It should be understood that if the route between the client and the security gateway is switched, the routing information changes, but the security gateway retains the previous routing information, resulting in the ESP message not being correctly transmitted after the switch. Since the periodic heartbeat message between the client's application and the security gateway is transmitted using ESP messages, the periodic heartbeat message period between the client's application and the security gateway is set to t1, which means that under normal circumstances, there must be ESP messages being transmitted within the t1 time. If not, a DPD delay event is triggered.

[0031] Step S6: When the client receives the DPD message, it determines that the route switching has caused the IPSEC tunnel to be interrupted. The client and the security gateway re-authenticate and negotiate IPsec SA parameters to rebuild the IPSEC tunnel to restore communication. The security gateway obtains and applies new routing information.

[0032] It is understandable that when the client receives the DPD message, it means that the IKE message can be transmitted normally, but the ESP message is interrupted, so it is judged that the IPSEC tunnel is interrupted due to the route switching. At this time, the client and the security gateway re-authenticate and negotiate the IPsec SA parameters to rebuild the IPSEC tunnel to restore communication. During the negotiation process, the security gateway retains and applies the new routing information to restore the normal transmission of ESP messages.

[0033] The present invention can automatically, in real time and accurately detect the communication interruption caused by route switching through the coordinated work of the DPD mechanism and the periodic heartbeat message, and quickly and automatically trigger the reconstruction process of the IPSEC tunnel without manual intervention, which greatly shortens the time of communication interruption, improves the efficiency of communication recovery, and reduces the impact of communication interruption on the business. In a complex and changeable multi-route switching network environment, the present invention can ensure the continuity and stability of IPSEC communication, and through timely detection and recovery of communication interruption, the number of communication failures caused by route changes is reduced, and the reliability of network communication is improved. After testing, the router can quickly recover the IPSEC message after successfully switching the WAN, and at most one ping data packet is lost under complex network conditions, and the effect is very good.

[0034] In a preferred solution of this embodiment, the specific method for performing IKE SA parameter negotiation between the client and the security gateway includes: The client sends IKE SA parameters including encryption algorithm, authentication algorithm and DH group information to the security gateway. These parameters are generated by the client according to its own security policy and configuration requirements, and represent the security algorithms and key exchange methods supported by the client.

[0035] After receiving the IKE SA parameters, the security gateway searches for matching parameters in its own configuration database. If a match is successful, it means that both parties have reached an agreement on the security algorithm and key exchange method. The security gateway returns the matching parameters to the client, which receives and confirms them. The two parties exchange temporary random numbers. Based on the DH algorithm, the two parties use the exchanged temporary random numbers and their respective private keys to generate a shared key material for deriving all keys for the IPsec SA.

[0036] It is understandable that the encryption algorithm adopts any one of AES-128, AES-256, and 3DES, and the encryption algorithm is used to encrypt data to ensure the confidentiality of data during transmission; the verification algorithm adopts any one of SHA-1, SHA-256, and SHA-384, and the verification algorithm is used to verify the integrity of data and the authenticity of the source to prevent data from being tampered with and forged; the DH group adopts DH Group 14 or DH Group 15, and the DH (Diffie-Hellman) group is used to implement key exchange, so that both parties can safely generate shared keys in an insecure network environment. The introduction of temporary random numbers increases the randomness and security of key generation, preventing the key from being guessed and cracked; generating shared key materials through DH exchange is the core of the whole process, and the shared key materials will serve as the basis for all subsequent derivation of IPsec SA keys, providing protection for subsequent secure communications.

[0037] In a preferred solution of this embodiment, the specific method for identity authentication and IPsec SA parameter negotiation between the client and the security gateway includes: The client sends its identity information to the security gateway, which uses the negotiated algorithm and key to verify the client's identity and the previously exchanged IKE SA parameter negotiation information. At the same time, the two parties further negotiate the parameters of the IPsec SA, including the ESP mode and key lifetime. The security gateway sends its identity information to the client, and the client performs the same verification operation.

[0038] In a preferred solution of this embodiment, the size of t1 is consistent with the time taken by the router to switch the WAN line.

[0039] It is understandable that when the router switches the WAN line, the network connection will be interrupted. If t1 is set to the same time as the router switching the WAN line, then when the router just finishes switching the line, the security gateway will just detect the client's "heartbeat" pause (because the client cannot send heartbeat messages normally during the line switching), thereby triggering the DPD delay event. In this way, the abnormality of the network connection can be discovered in time, and the recovery mechanism can be quickly activated to minimize the communication interruption time.

[0040] In this embodiment, the method for transmitting ESP encrypted messages between the client and the security gateway through the IPSEC tunnel includes: The client encapsulates and encrypts the user's original message according to the negotiated ESP mode, and then sends it to the security gateway. After receiving the ESP encrypted message, the security gateway decrypts and verifies it according to the previously negotiated SA parameters to ensure the authenticity and integrity of the message.

[0041] Specifically, a heartbeat message is usually a simple message that contains only a small amount of identification information and is used to indicate the activity status of the client. In this embodiment, the periodic heartbeat message contains a unique identifier and timestamp information of the client.

[0042] The second aspect of an embodiment of the present invention proposes a system for automatically restoring communication based on IPSEC after switching multiple routes, which corresponds to a method for automatically restoring communication based on IPSEC after switching multiple routes provided in the above-mentioned embodiment of the present invention. Since the system for automatically restoring communication based on IPSEC after switching multiple routes provided in the embodiment of the present invention corresponds to the method for automatically restoring communication based on IPSEC after switching multiple routes provided in the above-mentioned embodiment of the present invention, the implementation method of the aforementioned method for automatically restoring communication based on IPSEC after switching multiple routes is also applicable to the system for automatically restoring communication based on IPSEC after switching multiple routes provided in this embodiment.

[0043] Specifically, a system for automatically restoring communication based on IPSEC after multi-route switching includes: The first negotiation module is used for performing IKE SA parameter negotiation between the client and the security gateway.

[0044] The second negotiation module is used for identity authentication and IPsec SA parameter negotiation between the client and the security gateway.

[0045] The IPSEC tunnel establishment module is used to establish an IPSEC tunnel after the client and the security gateway complete identity authentication and IPsec SA parameter negotiation. The client and the security gateway transmit ESP encrypted messages through the IPSEC tunnel, and the security gateway records the routing information in the ESP encrypted messages.

[0046] The heartbeat message sending module is used to send periodic heartbeat messages to the security gateway at a period of t1 using ESP messages on the client side.

[0047] The DPD delay event triggering module is used to trigger the DPD delay event when the security gateway does not receive the ESP message transmitted by the client within the t1 time, and send a DPD message to the client through the IKE message.

[0048] The IPSEC tunnel reconstruction module is used for re-authentication and IPsec SA parameter negotiation between the client and the security gateway to rebuild the IPSEC tunnel to restore communication when the client receives the DPD message, and the security gateway obtains and applies new routing information.

[0049] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A method for automatically restoring communication based on IPSEC after multi-route switching, characterized in that: The following steps are involved: IKE SA parameter negotiation between the client and the security gateway; Identity authentication and IPsec SA parameter negotiation between the client and the security gateway; After the client and the security gateway complete identity authentication and IPsec SA parameter negotiation, the IPSEC tunnel is formally established. The client and the security gateway transmit ESP encrypted messages through the IPSEC tunnel, and the security gateway records the routing information in the ESP encrypted messages. The client uses ESP messages to send periodic heartbeat messages to the security gateway at a period of t1; When the security gateway does not receive the ESP message transmitted by the client within t1, the DPD delay event is triggered and a DPD message is sent to the client via an IKE message. When the client receives the DPD message, the client and the security gateway re-authenticate and negotiate IPsec SA parameters to rebuild the IPSEC tunnel to restore communication, and the security gateway obtains and applies new routing information.

2. A method for automatically restoring communication based on IPSEC after multi-route switching according to claim 1, characterized in that: The specific methods for IKE SA parameter negotiation between the client and the security gateway include: The client sends the IKE SA parameters including the encryption algorithm, authentication algorithm, and DH group information to the security gateway; After receiving the IKE SA parameters, the security gateway searches for matching parameters in its own configuration database. If the match is successful, the security gateway returns the matching parameters to the client. The client receives and confirms them. The two parties exchange temporary random numbers. Based on the DH algorithm, the two parties use the exchanged temporary random numbers and their respective private keys to generate a shared key material for deriving all keys of the IPsecSA.

3. A method for automatically restoring communication based on IPSEC after multi-route switching according to claim 2, characterized in that: The specific methods for identity authentication and IPsec SA parameter negotiation between the client and the security gateway include: The client sends its identity information to the security gateway, which uses the negotiated algorithm and key to verify the client's identity and the previously exchanged IKE SA parameter negotiation information. At the same time, the two parties further negotiate the parameters of the IPsec SA, including the ESP mode and key lifetime. The security gateway sends its identity information to the client, and the client performs the same verification operation.

4. The method for automatically restoring communication based on IPSEC after multi-route switching according to claim 1, characterized in that: The size of t1 is consistent with the time it takes for the router to switch the WAN line.

5. The method for automatically restoring communication based on IPSEC after multi-route switching according to claim 2 is characterized in that: The encryption algorithm adopts any one of AES-128, AES-256, and 3DES.

6. A method for automatically restoring communication based on IPSEC after multi-route switching according to claim 2, characterized in that: The verification algorithm adopts any one of SHA-1, SHA-256, and SHA-384.

7. A method for automatically restoring communication based on IPSEC after multi-route switching according to claim 2, characterized in that: The DH group used is DH Group 14 or DH Group 15.

8. The method of automatically restoring communication based on IPSEC after multi-route switching according to claim 1, characterized in that: The method of transmitting ESP encrypted messages between the client and the security gateway through the IPSEC tunnel includes: The client encapsulates and encrypts the user's original message according to the negotiated ESP mode, and then sends it to the security gateway. After receiving the ESP encrypted message, the security gateway decrypts and verifies it according to the previously negotiated SA parameters to ensure the authenticity and integrity of the message.

9. The method of automatically restoring communication based on IPSEC after multi-route switching according to claim 1, characterized in that: The periodic heartbeat message includes the unique identifier and timestamp information of the client.

10. A system based on automatic IPSEC communication recovery after multi-route switching, characterized in that: include: A first negotiation module, used for IKE SA parameter negotiation between the client and the security gateway; The second negotiation module is used for identity authentication and IPsec SA parameter negotiation between the client and the security gateway; The IPSEC tunnel establishment module is used to establish an IPSEC tunnel after the identity authentication and IPsec SA parameter negotiation are completed between the client and the security gateway. The client and the security gateway transmit ESP encrypted messages through the IPSEC tunnel, and the security gateway records the routing information in the ESP encrypted messages; A heartbeat message sending module is used to send periodic heartbeat messages to the security gateway at a period of t1 using ESP messages on the client side; DPD delay event triggering module, used to trigger the DPD delay event when the security gateway does not receive the ESP message transmitted by the client within t1 time, and send a DPD message to the client through the IKE message; The IPSEC tunnel reconstruction module is used for re-authentication and IPsec SA parameter negotiation between the client and the security gateway to rebuild the IPSEC tunnel to restore communication when the client receives the DPD message, and the security gateway obtains and applies new routing information.

Images