36 results about "Internet Key Exchange" patented technology

The invention provides an IKE (Internet Key Exchange) protocol security enhancement method based on PUF (Physical Unclonable Function) dynamic authentication and a post-quantum mixed key, which organically combines a PUF, a post-quantum cryptographic algorithm (PQC, especially Kyber KEM) and an improved Internet Key Exchange Protocol (IKE) to realize key exchange of post-quantum security and enhanced identity authentication. The method comprises the following steps: generating a dynamic pre-shared key (PSK) by utilizing the PUF; the method comprises the following steps: integrating a Kyber KEM to an IKE protocol, and replacing traditional Diffie-Hellman key exchange; the PUF-driven dynamic PSK is used as an identity authentication method of the IKE; meanwhile, Kyber KEM and ECDH are adopted for key exchange, and a final session key is generated through joint participation of a Kyber negotiation key, an ECDH negotiation key and PSK derived by PUF; and an IKE protocol process is optimized, and Kyber key exchange and PUF (Physical Unclonable Function) authentication are completed in an IKESAINIT stage and an IKEINTERMEDIATE stage. According to the method, key exchange is post-quantum secure, identity authentication is also post-quantum secure, and the final key integrates three key components of Kyber, ECDH and PUF, so that triple security assurance is provided.

The invention discloses a quantum key fused block encryption method, a communication system and an evaluation method thereof, and the method comprises the steps: fusing a quantum key generated by quantum key division into an Internet key exchange protocol of IPsec to form a mixed key; the sender and the receiver carry out message transmission through the mixed key, the authentication head and the packaging security load, so that the quantum key is integrated into the IPsec framework; and meanwhile, different quantum keys are used in each VPN channel, so that one-time pad is realized. In addition, the invention further provides a method for evaluating the performances such as the key consumption rate, the maximum supportable VPN tunnel number and the total throughput. According to the invention, the security and stability of data transmission in the quantum computer era can be improved.

The invention discloses an IPSec (Internet Protocol Security) VPN (Virtual Private Network) security gateway communication method fused with a post quantum cryptography technology, which comprises the following steps of: S1, in a first-stage main mode of IKE (Internet Key Exchange) key agreement, replacing a traditional single SM2 algorithm and a digital certificate based on an SM2 cryptographic algorithm with an SM2 and PQC mixed algorithm and a mixed PQC digital certificate; s2, the initiator and the responder respectively use the PQC encryption key pair and the PQC signature key pair to carry out key exchange and data signature, and simultaneously use the SM2 encryption key pair and the SM2 signature key pair to carry out key exchange and data signature; s3, in the message 1, the initiator sends a security alliance load containing the attribute of the fused SM2 and PQC algorithm to the responder; s4, in the message 2, the responder feeds back a PQC series hybrid certificate and an SA proposal; and S5, in the message 3 and the message 4, the initiator and the responder complete key exchange and verification. According to the invention, the security of the IPSec VPN security gateway can be improved, and quantum computing attacks can be resisted.

The invention discloses an IKE (Internet Key Exchange) protocol fuzzy testing method based on state guidance, which is characterized in that an IKE session is established and interacted with a target system based on an active learning algorithm in model learning, and a state learning module deduces a state machine model when the target system realizes an IKE protocol in a member query and equivalent query mode; and meanwhile, the fuzzy test module takes the deduced state machine model as guidance, extracts a preorder guidance message sequence and a tested message of each state, carries out a black box-based fuzzy test on each state, and mines deep program vulnerabilities related to the IKE protocol.

In some implementations, a first network device may communicate, with a second network device, one or more internet key exchange (IKE) messages to exchange a first identifier associated with the first network device and a second identifier associated with the second network device, and to indicate that a post-quantum preshared key (PPK) is to be used as a shared key for an IKE security association (SA) between the first network device and the second network device. The first network device may obtain, from a key management entity (KME), a quantum key based on providing the second identifier to the KME, wherein the PPK is based on the quantum key. The first network device may communicate, with the second network device, one or more IKE authentication messages to exchange a third identifier associated with the quantum key and to confirm that the second network device successfully obtained the PPK.

This application discloses a method for Internet key exchange protocol (IKE) authentication using a certificate. The method includes: A first device parses a certificate to obtain signature information in the certificate. The first device fills an AUTH payload field in an IKE identity authentication (AUTH) message based on the signature information in the certificate, where signature information indicated by the AUTH payload field matches the signature information in the certificate. The first device sends the IKE AUTH message to a second device. In the method for Internet key exchange protocol IKE authentication using a certificate provided in this application, the first device may automatically parse the signature information in the certificate, and fill the related field of the IKE AUTH message based on the signature information. Therefore, user configuration is simplified and product usability is improved.

Methods and systems for securely sending user plane data from a base station to an Artificial Intelligence (AI) server via a mobile telecommunication network are disclosed herein. A method performed by the base station located in a Radio Access Network (RAN) includes: sending an interface setup request to the (AI) server, receiving an interface setup response from the AI server, establishing, by exchanging cryptographic keys using an Internet Key Exchange (IKE) protocol, a data transport tunnel between the base station and the AI server based on an Internet Protocol Security (IPSec) network protocol, and sending the user plane data from the base station to the AI server for training artificial intelligence based models.

Various aspects of the present disclosure generally relate to wireless communication. In some aspects, a cellular modem may transmit, to an applications processor, an indication to use a non-Third Generation Partnership Project (non-3GPP) interworking function (N3IWF) for non-access stratum (NAS) signaling. Accordingly, the cellular modem may establish a first virtual interface with the applications processor. The cellular modem may further perform an Internet Key Exchange (IKE) procedure with a core network using the first virtual interface and the N3IWF and transmit a key generated during the IKE procedure to the applications processor. Numerous other aspects are described.

This invention proposes a hybrid quantum-resistant security enhancement method for IPSec VPNs. The method includes: intercepting Internet Key Exchange (ITE) packets and adding a proxy header between the transport layer header and the ISE payload of the packets; obtaining a quantum key from a key pool using quantum key distribution technology and generating a first-stage session key based on the quantum key; protecting the ISE key negotiation process using a quantum-resistant cryptographic algorithm to generate a second-stage session key; and using the first-stage and second-stage session keys as input parameters for a key derivation function to generate a final session key for encrypted data transmission. This invention, without modifying the original IPSec negotiation process, supports dynamic key combinations of different security levels, enhancing the quantum security protection capability of VPN data transmission while maintaining system flexibility and performance.

This application discloses a Wi-Fi control method and apparatus and an electronic device. The method includes: receiving a Wi-Fi disconnect request message; sending, in response to the Wi-Fi disconnect request message, a notification message to a target network device, where the notification message indicates that a VoWiFi de-registration operation has been completed and that an internet key exchange IKE connection has been disconnected; and performing, in a case that a response message for responding to the notification message is received, control to disconnect from Wi-Fi.

The invention relates to a network attack protection method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining a to-be-sent initial message and a random load, the load type of the random load being one of Internet Key Exchange (IKE) load reservation types; generating a new message based on the initial message and the random load; and sending the new message to a receiving end. By adopting the scheme disclosed by the invention, fuzzification of the IKE message is realized, so that a malicious terminal cannot identify the IKE message on the premise of not knowing the IP of the network equipment, further, even if the intercepted message is identified as the IKE message, the network equipment cannot be accurately positioned, the difficulty of identifying the network equipment is increased, and the user experience is improved. Therefore, the risk that the network equipment is maliciously cracked and attacked is avoided.

A method for Internet Key Exchange (IKE) re-authentication optimization includes sending, by a first network device and a second network device, a notification, which contains new Security Parameters Index (SPI) for new security association (SA), and sending, by the first network device alone, an OLD_SPI notification to map SPI of Internet Protocol Security (IPsec) (Authentication Header (AH) / Encapsulating Security Payload (ESP)) with the old IPSec SA.

The embodiment of the invention provides a data transmission method and device, and relates to the technical field of quantum communication, and the method applied to a first device in communication connection with a quantum server comprises the following steps: establishing an Internet Key Exchange Security Association (IKESA) with a second device, the second device being in communication connection with the quantum server; a key application request is sent to the quantum server, a first quantum key fed back by the quantum server is received, and the first quantum key is generated by the quantum server based on a quantum key distribution (QKD) protocol; establishing an internet protocol security association (IPSecSA) with the second equipment; and encrypting the first to-be-sent data based on the first quantum key, and sending the encrypted data to the second device through an IPSec tunnel formed after the IPSec SA is established. By applying the scheme provided by the embodiment of the invention, the security of data transmission between equipment can be improved.

In some implementations, an egress network device of a multiprotocol label switching (MPLS) network may exchange Internet key exchange (IKE) messages with an ingress network device of the MPLS network to establish a security association between the egress network device and the ingress network device. The egress network device may receive an MPLS packet that includes an MPLS header, a secure MPLS data header, and an MPLS payload. The egress network device may process the MPLS header to determine a label associated with a label-switched path (LSP) and a secure function indicator. The egress network device may decrypt, using a secure function identified based on the secure MPLS data header, the MPLS payload to generate a decrypted packet. The egress network device may transmit the decrypted packet towards a destination device.

This invention relates to the field of communication technology, providing a method for IPsec traversal of dynamic NAT and a DVPN network. The method includes: a central device establishing IPsec tunnels with a first branch device and a second branch device respectively, and recording the address and port information of these two branch devices before and after NAT translation; when the central device receives a request from the first branch device to obtain network information of the second branch device, it sends the address and port information of the second branch device before and after translation to the first branch device, and vice versa; upon receiving the information, the second branch device sends a UDP packet to the first NAT device, causing the NAT device to create an entry for the first branch device to connect the communication link between the two branch devices; upon receiving the information, the first branch device negotiates an Internet key exchange with the second branch device to establish the IPsec tunnel between the two branch devices. This achieves traversal of dynamic NAT in the MGRE over IPsec scenario.

Methods are provided for decentralized key negotiation. One method includes initiating, by a first Internet Key Exchange (IKE) node from among a plurality of IKE nodes, a rekeying process for an Internet Protocol Security (IPSec) communication session established with a client device and serviced by a second IKE node from among the plurality of IKE nodes, and in which a first encryption key is used to encrypt traffic. The method further includes obtaining, by the first IKE node from a key value store, information about the IPSec communication session and performing, by the first IKE node, at least a part of the rekeying process in which the first encryption key is replaced with a second encryption key for the IPSec communication session.

Methods are provided for decentralized key negotiation. One method includes initiating, by a first Internet Key Exchange (IKE) node from among a plurality of IKE nodes, a rekeying process for an Internet Protocol Security (IPSec) communication session established with a client device and serviced by a second IKE node from among the plurality of IKE nodes, and in which a first encryption key is used to encrypt traffic. The method further includes obtaining, by the first IKE node from a key value store, information about the IPSec communication session and performing, by the first IKE node, at least a part of the rekeying process in which the first encryption key is replaced with a second encryption key for the IPSec communication session.

The present disclosure provides a network key exchange negotiation method, device and network equipment. The method comprises: obtaining user configuration information, the user configuration information comprising negotiation role information, negotiation policy information and SA information; the negotiation policy information being used to indicate a first policy adopted in negotiation, a policy effective time of the first policy, at least one second policy adopted in negotiation and a policy update time and a policy invalidation time of each second policy; when the negotiation role is an initiator and the policy effective time is reached, performing an Internet Key Exchange (IKE) negotiation based on the first policy to determine an SA; saving the SA in a database; whenever the policy update time is reached, performing an IKE negotiation based on the second policy corresponding to the policy update time to update the SA in the database; and when the policy invalidation time is reached, performing invalidation processing on the first policy, the second policy and the SA in the database.

The present disclosure relates to a network attack protection method and device, electronic equipment and storage medium, the method comprising: obtaining an initial message to be sent and a random payload, the payload type of the random payload being one of the Internet Key Exchange (IKE) payload reserved types; generating a new message based on the initial message and the random payload; and sending the new message to a receiving end. The present disclosure achieves the fuzzing of the IKE message, so that a malicious terminal cannot identify the IKE message without knowing the IP of the network device. Furthermore, even if the intercepted message is identified as an IKE message, the network device cannot be accurately located, increasing the difficulty of identifying the network device, thereby avoiding the risk of malicious cracking and attack on the network device.

A method for quantum-resistant security enhancement to an Internet key exchange protocol, comprising: (011) performing key agreement with a second network device to generate an initial key; (012) acquiring a quantum key from a first network node; (013) performing post-quantum password encryption on the quantum key, and sending to the second network device a first encryption result that has undergone encryption; (014) performing decryption on a received second encryption result, and obtaining a second decryption result; and, (015) on the basis of a first quantum key, a first encryption key, a first verification key, a first derivation key, the first encryption result, and the second decryption result, generating a second encryption key, a second verification key, and a second derivation key, so as to encrypt communication between a first network device and the second network device.

The disclosed method and system optimize IPSec connectivity and security association establishment in trusted and / or untrusted non-3GPP access scenarios, such as non-3GPP access with a Trusted Non-3GPP Gateway Function (TNGF) and / or Non-3GPP Interworking Function (N3IWF) in a 5G network architecture. The method involves initiating an Internet Key Exchange (IKE) protocol initiation communication from the User Equipment (UE) to the TNGF or N3IWF, which includes a MOBIKE_SUPPORT indicator to signal the UE's MOBIKE capability. The TNGF or N3IWF, in response to the MOBIKE_SUPPORT indicator, enables the use of MOBIKE to optimize an Internet Protocol Security (IPSec) session re- establishment when the UE moves to a different Trusted Non-3GPP Access Point (TNAP) connected to the same TNGF. The system includes the UE and TNGF configured to perform the method. The method and system minimize disruptions and latency during IPSec session re- establishment.

Some examples relate to a verifying the authenticity of IKE exchange messages in a VPN. In an example, a VPN client sends a VPN server profile request message to a VPN server for establishing a VPN connection. In response, the VPN server provides a VPN server profile to the VPN client. The VPN server profile comprises a cryptographic public key associated with a server certificate of the VPN server. The VPN client stores the VPN server profile and sends an IKE message to the VPN server. In response to the IKE message, the VPN server sends a signed IKE response message. Upon receipt, the VPN client verifies the authenticity of the signed IKE response message. If the signed IKE message is successfully verified, the VPN client sends an identity of the VPN client to the VPN server.

A procedure that includes: at a first network device (120, 122) between a second network device (112) and a third network device (154), detecting an Internet Key Exchange Protocol (IKE) key negotiation between the second network device and the third network device; based on the detection of the IKE key negotiation! between the second network device and the third network device, creating a firewall session in the first network device between the second and the third network device, wherein a first Internet Protocol Security (IPSec) tunnel (212) is established by the first network device between the second and the third network device using the IKE key negotiation, the first tunnel being compliant with the firewall session and allowing the passage of IPSec data packets through the first network device between the second and the third network device; Passing the IPSec data packets exchanged between the second and third network devices through the first network device based on the establishment of the first tunnel using cloud-managed IPSec keys from a cloud-based orchestrator (142), wherein the IPSec data packets are exchanged as part of a handshake operation that results in the establishment of a second tunnel between the second and third network devices according to the cloud-managed IPSec keys, the second tunnel being an overlay tunnel (218) on an underlay network; and After the second tunnel has been established and the cloud-managed IPSec keys are active, discard the negotiated IKE and carefully dismantle the first IPSec tunnel without disrupting encrypted communication between the second and third network devices.

Disclosed herein are methods and systems for securely sending user plane data from a base station to an artificial intelligence (AI) server via a mobile telecommunication network. In one embodiment, a method performed by a base station located in a radio access network (RAN) includes sending an interface setup request to an (AI) server, receiving an interface setup response from the AI server, establishing an Internet Protocol Security (IPSec) network protocol based data transfer tunnel between the base station and the AI server by exchanging encryption keys using an Internet Key Exchange (IKE) protocol, and sending user plane data from the base station to the AI server for training an artificial intelligence based model.

An Internet Key Exchange protocol message indicating a first Internet Protocol Security traffic flow is to be established via a first device is obtained at the first device. The Internet Key Exchange protocol message is forwarded from the first device to a second device. An encryption key used to transmit traffic via the first Internet Protocol Security Traffic flow is received at the first device from a key value store. The key value store is populated with the encryption key in response to the second device obtaining the Internet Key Exchange protocol message. A first data packet to be transmitted via the first Internet Protocol Security traffic flow is obtained at the first device. The first device provides the first data packet encrypted with the encryption key of the first Internet Protocol Security traffic flow.

Various solutions for enhancements on message coding in secured communication session over non-third generation partnership project (3GPP) access are described. An apparatus may connect to a non-3GPP access network. Then, the apparatus may receive an internet key exchange (IKE) authentication response message from a network node in a 3GPP network via the non-3GPP access network. Also, the apparatus may transmit an IKE authentication request message to the network node in the 3GPP network via the non-3GPP access network. The IKE authentication request message may include an extensible authentication protocol (EAP) response or a fifth generation (5G) non-access stratum (NAS) message which includes a first indication of whether an access network (AN)-parameters field is absent or present in the EAP response or the 5G NAS message.

Various systems, apparatuses, and methods for Establishment of multi-access (MA) protocol data unit (PDU) Sessions using multipath (MP) QUIC based steering, switching, and splitting are provided. A user equipment (UE) requests a MA PDU Session. A session management function (SMF) determines that only MP QUIC steering is used. The SMF signals a non-third generation partnership project (non-3GPP) interworking function (N3IWF) to set up one or more user plane resources over one or more internet protocol (IP) security (IP Sec) tunnels with null encryption. The MA PDU session excludes standard IPSec encryption for user data. The N3IWF performs internet key exchange (IKE) signaling with the UE to negotiate the one or more IP Sec tunnels with null encryption. The N3IWF transparently transmits user data without applying IPSec encryption.

A first network device (102-1) in a network (100, 200) implements one or more techniques to determine the reachability of an Internet Protocol security (IPsec) framework (601, 605). For example, upon establishment of an IPsec tunnel (605) with a second network device (102-2), the first network device sends at least a first probe message (606-1) to the second network device through the IPsec tunnel. In response to a first reply probe message (608-1) from the second network device, the first network device sends a second probe message (606-2) through the IPsec tunnel when one or more indications of an issue are detected with the framework. In response to a second reply probe message (608-2) having not been received from the second network device in response to the second probe message, the first network device determines that an issue exists with IPsec framework, and performs one or more IPsec recovery actions.

Methods are provided for decentralized key negotiation. One method includes initiating, by a first Internet Key Exchange (IKE) node from among a plurality of IKE nodes, a rekeying process for an Internet Protocol Security (IPSec) communication session established with a client device and serviced by a second IKE node from among the plurality of IKE nodes, and in which a first encryption key is used to encrypt traffic. The method further includes obtaining, by the first IKE node from a key value store, information about the IPSec communication session and performing, by the first IKE node, at least a part of the rekeying process in which the first encryption key is replaced with a second encryption key for the IPSec communication session.