28 results about "Internet Key Exchange" patented technology

The invention provides an IKE (Internet Key Exchange) protocol security enhancement method based on PUF (Physical Unclonable Function) dynamic authentication and a post-quantum mixed key, which organically combines a PUF, a post-quantum cryptographic algorithm (PQC, especially Kyber KEM) and an improved Internet Key Exchange Protocol (IKE) to realize key exchange of post-quantum security and enhanced identity authentication. The method comprises the following steps: generating a dynamic pre-shared key (PSK) by utilizing the PUF; the method comprises the following steps: integrating a Kyber KEM to an IKE protocol, and replacing traditional Diffie-Hellman key exchange; the PUF-driven dynamic PSK is used as an identity authentication method of the IKE; meanwhile, Kyber KEM and ECDH are adopted for key exchange, and a final session key is generated through joint participation of a Kyber negotiation key, an ECDH negotiation key and PSK derived by PUF; and an IKE protocol process is optimized, and Kyber key exchange and PUF (Physical Unclonable Function) authentication are completed in an IKESAINIT stage and an IKEINTERMEDIATE stage. According to the method, key exchange is post-quantum secure, identity authentication is also post-quantum secure, and the final key integrates three key components of Kyber, ECDH and PUF, so that triple security assurance is provided.

The invention discloses a quantum key fused block encryption method, a communication system and an evaluation method thereof, and the method comprises the steps: fusing a quantum key generated by quantum key division into an Internet key exchange protocol of IPsec to form a mixed key; the sender and the receiver carry out message transmission through the mixed key, the authentication head and the packaging security load, so that the quantum key is integrated into the IPsec framework; and meanwhile, different quantum keys are used in each VPN channel, so that one-time pad is realized. In addition, the invention further provides a method for evaluating the performances such as the key consumption rate, the maximum supportable VPN tunnel number and the total throughput. According to the invention, the security and stability of data transmission in the quantum computer era can be improved.

The invention discloses an IPSec (Internet Protocol Security) VPN (Virtual Private Network) security gateway communication method fused with a post quantum cryptography technology, which comprises the following steps of: S1, in a first-stage main mode of IKE (Internet Key Exchange) key agreement, replacing a traditional single SM2 algorithm and a digital certificate based on an SM2 cryptographic algorithm with an SM2 and PQC mixed algorithm and a mixed PQC digital certificate; s2, the initiator and the responder respectively use the PQC encryption key pair and the PQC signature key pair to carry out key exchange and data signature, and simultaneously use the SM2 encryption key pair and the SM2 signature key pair to carry out key exchange and data signature; s3, in the message 1, the initiator sends a security alliance load containing the attribute of the fused SM2 and PQC algorithm to the responder; s4, in the message 2, the responder feeds back a PQC series hybrid certificate and an SA proposal; and S5, in the message 3 and the message 4, the initiator and the responder complete key exchange and verification. According to the invention, the security of the IPSec VPN security gateway can be improved, and quantum computing attacks can be resisted.

Methods and systems for securely sending user plane data from a base station to an Artificial Intelligence (AI) server via a mobile telecommunication network are disclosed herein. A method performed by the base station located in a Radio Access Network (RAN) includes: sending an interface setup request to the (AI) server, receiving an interface setup response from the AI server, establishing, by exchanging cryptographic keys using an Internet Key Exchange (IKE) protocol, a data transport tunnel between the base station and the AI server based on an Internet Protocol Security (IPSec) network protocol, and sending the user plane data from the base station to the AI server for training artificial intelligence based models.

This invention proposes a hybrid quantum-resistant security enhancement method for IPSec VPNs. The method includes: intercepting Internet Key Exchange (ITE) packets and adding a proxy header between the transport layer header and the ISE payload of the packets; obtaining a quantum key from a key pool using quantum key distribution technology and generating a first-stage session key based on the quantum key; protecting the ISE key negotiation process using a quantum-resistant cryptographic algorithm to generate a second-stage session key; and using the first-stage and second-stage session keys as input parameters for a key derivation function to generate a final session key for encrypted data transmission. This invention, without modifying the original IPSec negotiation process, supports dynamic key combinations of different security levels, enhancing the quantum security protection capability of VPN data transmission while maintaining system flexibility and performance.

This application discloses a Wi-Fi control method and apparatus and an electronic device. The method includes: receiving a Wi-Fi disconnect request message; sending, in response to the Wi-Fi disconnect request message, a notification message to a target network device, where the notification message indicates that a VoWiFi de-registration operation has been completed and that an internet key exchange IKE connection has been disconnected; and performing, in a case that a response message for responding to the notification message is received, control to disconnect from Wi-Fi.

A method for Internet Key Exchange (IKE) re-authentication optimization includes sending, by a first network device and a second network device, a notification, which contains new Security Parameters Index (SPI) for new security association (SA), and sending, by the first network device alone, an OLD_SPI notification to map SPI of Internet Protocol Security (IPsec) (Authentication Header (AH) / Encapsulating Security Payload (ESP)) with the old IPSec SA.

The embodiment of the invention provides a data transmission method and device, and relates to the technical field of quantum communication, and the method applied to a first device in communication connection with a quantum server comprises the following steps: establishing an Internet Key Exchange Security Association (IKESA) with a second device, the second device being in communication connection with the quantum server; a key application request is sent to the quantum server, a first quantum key fed back by the quantum server is received, and the first quantum key is generated by the quantum server based on a quantum key distribution (QKD) protocol; establishing an internet protocol security association (IPSecSA) with the second equipment; and encrypting the first to-be-sent data based on the first quantum key, and sending the encrypted data to the second device through an IPSec tunnel formed after the IPSec SA is established. By applying the scheme provided by the embodiment of the invention, the security of data transmission between equipment can be improved.

This invention relates to the field of communication technology, providing a method for IPsec traversal of dynamic NAT and a DVPN network. The method includes: a central device establishing IPsec tunnels with a first branch device and a second branch device respectively, and recording the address and port information of these two branch devices before and after NAT translation; when the central device receives a request from the first branch device to obtain network information of the second branch device, it sends the address and port information of the second branch device before and after translation to the first branch device, and vice versa; upon receiving the information, the second branch device sends a UDP packet to the first NAT device, causing the NAT device to create an entry for the first branch device to connect the communication link between the two branch devices; upon receiving the information, the first branch device negotiates an Internet key exchange with the second branch device to establish the IPsec tunnel between the two branch devices. This achieves traversal of dynamic NAT in the MGRE over IPsec scenario.

Methods are provided for decentralized key negotiation. One method includes initiating, by a first Internet Key Exchange (IKE) node from among a plurality of IKE nodes, a rekeying process for an Internet Protocol Security (IPSec) communication session established with a client device and serviced by a second IKE node from among the plurality of IKE nodes, and in which a first encryption key is used to encrypt traffic. The method further includes obtaining, by the first IKE node from a key value store, information about the IPSec communication session and performing, by the first IKE node, at least a part of the rekeying process in which the first encryption key is replaced with a second encryption key for the IPSec communication session.

Methods are provided for decentralized key negotiation. One method includes initiating, by a first Internet Key Exchange (IKE) node from among a plurality of IKE nodes, a rekeying process for an Internet Protocol Security (IPSec) communication session established with a client device and serviced by a second IKE node from among the plurality of IKE nodes, and in which a first encryption key is used to encrypt traffic. The method further includes obtaining, by the first IKE node from a key value store, information about the IPSec communication session and performing, by the first IKE node, at least a part of the rekeying process in which the first encryption key is replaced with a second encryption key for the IPSec communication session.

The present disclosure provides a network key exchange negotiation method, device and network equipment. The method comprises: obtaining user configuration information, the user configuration information comprising negotiation role information, negotiation policy information and SA information; the negotiation policy information being used to indicate a first policy adopted in negotiation, a policy effective time of the first policy, at least one second policy adopted in negotiation and a policy update time and a policy invalidation time of each second policy; when the negotiation role is an initiator and the policy effective time is reached, performing an Internet Key Exchange (IKE) negotiation based on the first policy to determine an SA; saving the SA in a database; whenever the policy update time is reached, performing an IKE negotiation based on the second policy corresponding to the policy update time to update the SA in the database; and when the policy invalidation time is reached, performing invalidation processing on the first policy, the second policy and the SA in the database.

The present disclosure relates to a network attack protection method and device, electronic equipment and storage medium, the method comprising: obtaining an initial message to be sent and a random payload, the payload type of the random payload being one of the Internet Key Exchange (IKE) payload reserved types; generating a new message based on the initial message and the random payload; and sending the new message to a receiving end. The present disclosure achieves the fuzzing of the IKE message, so that a malicious terminal cannot identify the IKE message without knowing the IP of the network device. Furthermore, even if the intercepted message is identified as an IKE message, the network device cannot be accurately located, increasing the difficulty of identifying the network device, thereby avoiding the risk of malicious cracking and attack on the network device.

A method for quantum-resistant security enhancement to an Internet key exchange protocol, comprising: (011) performing key agreement with a second network device to generate an initial key; (012) acquiring a quantum key from a first network node; (013) performing post-quantum password encryption on the quantum key, and sending to the second network device a first encryption result that has undergone encryption; (014) performing decryption on a received second encryption result, and obtaining a second decryption result; and, (015) on the basis of a first quantum key, a first encryption key, a first verification key, a first derivation key, the first encryption result, and the second decryption result, generating a second encryption key, a second verification key, and a second derivation key, so as to encrypt communication between a first network device and the second network device.

The disclosed method and system optimize IPSec connectivity and security association establishment in trusted and / or untrusted non-3GPP access scenarios, such as non-3GPP access with a Trusted Non-3GPP Gateway Function (TNGF) and / or Non-3GPP Interworking Function (N3IWF) in a 5G network architecture. The method involves initiating an Internet Key Exchange (IKE) protocol initiation communication from the User Equipment (UE) to the TNGF or N3IWF, which includes a MOBIKE_SUPPORT indicator to signal the UE's MOBIKE capability. The TNGF or N3IWF, in response to the MOBIKE_SUPPORT indicator, enables the use of MOBIKE to optimize an Internet Protocol Security (IPSec) session re- establishment when the UE moves to a different Trusted Non-3GPP Access Point (TNAP) connected to the same TNGF. The system includes the UE and TNGF configured to perform the method. The method and system minimize disruptions and latency during IPSec session re- establishment.

Some examples relate to a verifying the authenticity of IKE exchange messages in a VPN. In an example, a VPN client sends a VPN server profile request message to a VPN server for establishing a VPN connection. In response, the VPN server provides a VPN server profile to the VPN client. The VPN server profile comprises a cryptographic public key associated with a server certificate of the VPN server. The VPN client stores the VPN server profile and sends an IKE message to the VPN server. In response to the IKE message, the VPN server sends a signed IKE response message. Upon receipt, the VPN client verifies the authenticity of the signed IKE response message. If the signed IKE message is successfully verified, the VPN client sends an identity of the VPN client to the VPN server.

A procedure that includes: at a first network device (120, 122) between a second network device (112) and a third network device (154), detecting an Internet Key Exchange Protocol (IKE) key negotiation between the second network device and the third network device; based on the detection of the IKE key negotiation! between the second network device and the third network device, creating a firewall session in the first network device between the second and the third network device, wherein a first Internet Protocol Security (IPSec) tunnel (212) is established by the first network device between the second and the third network device using the IKE key negotiation, the first tunnel being compliant with the firewall session and allowing the passage of IPSec data packets through the first network device between the second and the third network device; Passing the IPSec data packets exchanged between the second and third network devices through the first network device based on the establishment of the first tunnel using cloud-managed IPSec keys from a cloud-based orchestrator (142), wherein the IPSec data packets are exchanged as part of a handshake operation that results in the establishment of a second tunnel between the second and third network devices according to the cloud-managed IPSec keys, the second tunnel being an overlay tunnel (218) on an underlay network; and After the second tunnel has been established and the cloud-managed IPSec keys are active, discard the negotiated IKE and carefully dismantle the first IPSec tunnel without disrupting encrypted communication between the second and third network devices.

Disclosed herein are methods and systems for securely sending user plane data from a base station to an artificial intelligence (AI) server via a mobile telecommunication network. In one embodiment, a method performed by a base station located in a radio access network (RAN) includes sending an interface setup request to an (AI) server, receiving an interface setup response from the AI server, establishing an Internet Protocol Security (IPSec) network protocol based data transfer tunnel between the base station and the AI server by exchanging encryption keys using an Internet Key Exchange (IKE) protocol, and sending user plane data from the base station to the AI server for training an artificial intelligence based model.

An Internet Key Exchange protocol message indicating a first Internet Protocol Security traffic flow is to be established via a first device is obtained at the first device. The Internet Key Exchange protocol message is forwarded from the first device to a second device. An encryption key used to transmit traffic via the first Internet Protocol Security Traffic flow is received at the first device from a key value store. The key value store is populated with the encryption key in response to the second device obtaining the Internet Key Exchange protocol message. A first data packet to be transmitted via the first Internet Protocol Security traffic flow is obtained at the first device. The first device provides the first data packet encrypted with the encryption key of the first Internet Protocol Security traffic flow.

Various solutions for enhancements on message coding in secured communication session over non-third generation partnership project (3GPP) access are described. An apparatus may connect to a non-3GPP access network. Then, the apparatus may receive an internet key exchange (IKE) authentication response message from a network node in a 3GPP network via the non-3GPP access network. Also, the apparatus may transmit an IKE authentication request message to the network node in the 3GPP network via the non-3GPP access network. The IKE authentication request message may include an extensible authentication protocol (EAP) response or a fifth generation (5G) non-access stratum (NAS) message which includes a first indication of whether an access network (AN)-parameters field is absent or present in the EAP response or the 5G NAS message.

Various systems, apparatuses, and methods for Establishment of multi-access (MA) protocol data unit (PDU) Sessions using multipath (MP) QUIC based steering, switching, and splitting are provided. A user equipment (UE) requests a MA PDU Session. A session management function (SMF) determines that only MP QUIC steering is used. The SMF signals a non-third generation partnership project (non-3GPP) interworking function (N3IWF) to set up one or more user plane resources over one or more internet protocol (IP) security (IP Sec) tunnels with null encryption. The MA PDU session excludes standard IPSec encryption for user data. The N3IWF performs internet key exchange (IKE) signaling with the UE to negotiate the one or more IP Sec tunnels with null encryption. The N3IWF transparently transmits user data without applying IPSec encryption.

A first network device (102-1) in a network (100, 200) implements one or more techniques to determine the reachability of an Internet Protocol security (IPsec) framework (601, 605). For example, upon establishment of an IPsec tunnel (605) with a second network device (102-2), the first network device sends at least a first probe message (606-1) to the second network device through the IPsec tunnel. In response to a first reply probe message (608-1) from the second network device, the first network device sends a second probe message (606-2) through the IPsec tunnel when one or more indications of an issue are detected with the framework. In response to a second reply probe message (608-2) having not been received from the second network device in response to the second probe message, the first network device determines that an issue exists with IPsec framework, and performs one or more IPsec recovery actions.

Methods and systems for securely sending user plane data from a base station to an Artificial Intelligence (AI) server via a mobile telecommunication network are disclosed herein. In one embodiment, a method performed by the base station located in a Radio Access Network (RAN) includes: sending an interface setup request to the (AI) server, receiving an interface setup response from the AI server, establishing, by exchanging cryptographic keys using an Internet Key Exchange (IKE) protocol, a data transport tunnel between the base station and the AI server based on an Internet Protocol Security (IPSec) network protocol, and sending the user plane data from the base station to the AI server for training artificial intelligence based models.

This application belongs to the field of network encryption technology, specifically disclosing a VPN tunnel establishment method and apparatus based on traffic triggering. This application, through minor modifications to the existing IKE negotiation process, sends a first negotiation probe packet to a first terminal, enabling a second VPN encryption device to intercept the first negotiation probe packet and initiate an Internet Key Exchange (IKEY) process with the first VPN encryption device. The first VPN encryption device, by responding to the IKEY process, configures its interoperability policy with the second VPN encryption device or extends the interoperability policy, obtaining a third negotiation probe packet. This allows the second VPN encryption device to obtain its session key with the first VPN encryption device based on the third negotiation probe packet, completing the VPN tunnel establishment. This achieves configuration-free interoperability policy configuration between VPN encryption devices, reducing the complexity of manual configuration and improving configuration efficiency.

The method provides for dynamic retrieval of certificates, with remote, secure, and scalable lifecycle management. It enables the importation, distribution, renewal, and rekey of leaf certificates and associated private keys to applications executing on devices with two-factor authentication for devices. It is an agentless method to achieve device protection, application security, and data protection with data authenticity and confidentiality in intra-device, inter-device, device-to-edge, and device-to-cloud communications. It helps Transport Layer Security (TLS) and Internet Key Exchange (IKE) enabled applications retrieve leaf certificates and the associated private key, and verify certificates, programmatically for certificate-based authentication during protocol handshake, with policy-based authorization of trusted applications. It enables applications and command line utilities retrieve and use leaf certificates for mutual authentication, data signing with digital signatures, and key unwrapping. It further enables dynamic retrieval of trusted intermediate and root certificates.

The disclosed method and system optimize IPSec connectivity and security association establishment in trusted and / or untrusted non-3GPP access scenarios, such as non-3GPP access with a Trusted Non-3GPP Gateway Function (TNGF) and / or Non-3GPP Interworking Function (N3IWF) in a 5G network architecture. The method involves initiating an Internet Key Exchange (IKE) protocol initiation communication from the User Equipment (UE) to the TNGF or N3IWF, which includes a MOBIKE_SUPPORT indicator to signal the UE's MOBIKE capability. The TNGF or N3IWF, in response to the MOBIKE_SUPPORT indicator, enables the use of MOBIKE to optimize an Internet Protocol Security (IPSec) session re-establishment when the UE moves to a different Trusted Non-3GPP Access Point (TNAP) connected to the same TNGF. The system includes the UE and TNGF configured to perform the method. The method and system minimize disruptions and latency during IPSec session re-establishment.

Embodiments descried herein relate to a method and apparatus for managing internet key exchange between internet protocol security endpoints. A method, performed by a first Radio Access Network, RAN, entity, for applying transport security in transmitting data between the first RAN entity and a second RAN entity, the first RAN entity being associated with a plurality of first entity IP addresses, and the second RAN entity being associated with a plurality of second entity IP addresses. The method comprises setting up a first internet key exchange, IKE, security association, SA, between a first Internet Protocol, IP, address of the first entity IP addresses and a second IP address of the second entity IP addresses; and utilizing the first IKE SA to negotiate a plurality of first child SA pairs, wherein the plurality of first child SA pairs are set up between first child IP addresses of the plurality of first entity IP addresses and second child IP addresses of the plurality of second entity IP addresses.