232 results about "IPsec" patented technology

The embodiment of the invention provides an IPSec hybrid anti-quantum computing security method and electronic equipment, and relates to the technical field of communication security, the method comprises the following steps: when a key negotiation request sent by an initiator is received, sending a first key negotiation message to the initiator; receiving a second key negotiation message sent by the initiator; decrypting the received first encrypted information by using a private key corresponding to the encryption certificate of the responder, and decrypting the received second encrypted information to obtain a first anti-quantum encryption public key; packaging the second random key by using the first anti-quantum encryption public key, and encrypting by using the third random key to obtain third encrypted information; encrypting the third random key by using a public key in an encryption certificate of the initiator to obtain fourth encrypted information; and sending a third key negotiation message containing the third encrypted information and the fourth encrypted information to the initiator. According to the scheme, cracking of the key by quantum computing can be resisted.

A system and associated methods provide solutions for end-to-end privacy and per-hop routing and policy decision in multi-hop and Software-Defined Wide Area Networks (SD-WANs) by leveraging unique SDWAN edge identities of edge devices. The system enables end-to-end encryption between traffic source and destination sites using IPsec ESP tunnel mode, with System IPs as the outer IP addresses. The system further enables per-hop integrity protection using IPsec AH transport mode, with WAN IPs as the outer IP addresses. By having some information encrypted between a source device and a destination device and other information encapsulated between hops (e.g., between source device and an intermediate device), the system enables route and policy lookup based on destination site System-IP, along with integrity protection based on SLA-class in packet metadata for independent path selection at intermediate hops.

The invention discloses a quantum key fused block encryption method, a communication system and an evaluation method thereof, and the method comprises the steps: fusing a quantum key generated by quantum key division into an Internet key exchange protocol of IPsec to form a mixed key; the sender and the receiver carry out message transmission through the mixed key, the authentication head and the packaging security load, so that the quantum key is integrated into the IPsec framework; and meanwhile, different quantum keys are used in each VPN channel, so that one-time pad is realized. In addition, the invention further provides a method for evaluating the performances such as the key consumption rate, the maximum supportable VPN tunnel number and the total throughput. According to the invention, the security and stability of data transmission in the quantum computer era can be improved.

The invention discloses an IPSec (Internet Protocol Security) VPN (Virtual Private Network) security gateway communication method fused with a post quantum cryptography technology, which comprises the following steps of: S1, in a first-stage main mode of IKE (Internet Key Exchange) key agreement, replacing a traditional single SM2 algorithm and a digital certificate based on an SM2 cryptographic algorithm with an SM2 and PQC mixed algorithm and a mixed PQC digital certificate; s2, the initiator and the responder respectively use the PQC encryption key pair and the PQC signature key pair to carry out key exchange and data signature, and simultaneously use the SM2 encryption key pair and the SM2 signature key pair to carry out key exchange and data signature; s3, in the message 1, the initiator sends a security alliance load containing the attribute of the fused SM2 and PQC algorithm to the responder; s4, in the message 2, the responder feeds back a PQC series hybrid certificate and an SA proposal; and S5, in the message 3 and the message 4, the initiator and the responder complete key exchange and verification. According to the invention, the security of the IPSec VPN security gateway can be improved, and quantum computing attacks can be resisted.

This application provides a communication method and apparatus, to reduce a risk of user plane data exposure. In the communication method, after an IPsec connection is established between a first user plane network element and a terminal, the terminal or the first user plane network element may be used as an endpoint device on the IPsec connection. In this case, when transmission of user plane data protected by IPsec is performed between endpoint devices, an intermediate transmission device (for example, an access network device) located between the endpoint devices, that is, an access network device on the IPsec connection, may directly perform transparent transmission of the user plane data.

Techniques and architecture are described for reauthentication of two IPsec peers, during a key refresh process. The peers may reauthenticate each other based upon a shared secret, which in configurations, is a PPK. In configurations the PPKs are stirred (mixed with DH / ECDH) during key derivation while refreshing the session keys during IKE_v2 and IPsec rekey. This may involve communicating the PPK-ID from a rekey initiator to a rekey responder by adding a PPK_ID payload in the rekey message exchange. This enables stronger quantum safe session keys, when dynamic PPK is used or when the manual PPK is rotated frequently. In configurations, the knowledge of the shared PPK is proved by having both peers exchange authentication payloads signed with a PPK. This involves exchanging a IKEv2 NOTIFY payload “AUTH_PPK” to carry PPK-signed authentication data. This serves the purpose of frequent re-authentication of the peers as part of the key refreshes.

The invention discloses an anti-quantum-attack national secret IPSec communication system and method, and belongs to the technical field of information security. The national secret IPSec communication system capable of resisting the quantum attack in the scheme comprises a traditional IPSec device, an anti-quantum IPSec device agent and a mixed IPSec device. Traditional IPSec equipment does not support an anti-quantum cryptography algorithm, and hybrid IPSec equipment has a traditional cryptography technology and an anti-quantum cryptography technology at the same time. And the anti-quantum IPSec equipment proxy performs anti-quantum cryptography algorithm transformation on a message sent by the traditional IPSec equipment and then sends the message to the mixed IPSec equipment, and performs anti-quantum cryptography algorithm inverse transformation on a message sent by the mixed IPSec equipment and then sends the message to the traditional IPSec equipment. According to the scheme, the quantum attack resistance of the system is improved in a manner of incrementally deploying the anti-quantum IPSec equipment agent on the IPSec equipment, the transformation period is short, and the transformation cost is low.

The invention discloses an IPSec VPN security gateway communication method based on a post quantum cryptography technology, and the method comprises the following steps: S1, replacing a conventional SM2 algorithm and a certificate with a PQC algorithm and a digital certificate in a first-stage main mode of IKE key negotiation; s2, the initiator and the responder respectively use the PQC key pair to complete key exchange and signature; s3, in the message 1, the initiator sends a security alliance load containing a PQC public key algorithm attribute to the responder; s4, in the message 2, the responder sends an SA load containing a PQC signature certificate and an encryption certificate, and a received SA proposal sent by the initiator is marked; s5, in the message 3 and the message 4, the initiator and the responder complete key exchange and verification; and S6, in the message 5 and the message 6, the initiator and the responder encrypt the transmitted information by using a symmetric cryptographic algorithm, and identify the previous exchange process. According to the invention, the security of the IPSec VPN security gateway is improved, and quantum computing attacks can be resisted.

The invention discloses a cloud edge container network communication and optimization system based on network performance perception, and the system comprises a control management module which is used for the centralized management and storage of edge node information, also has the function of an STUN server, carries out the real-time evaluation of the cost of a current routing path, and carries out the optimization of the current routing path. Performing dynamic decision and optimization to obtain an optimal cloud edge / edge routing path; and the tunnel Agent module is deployed on each edge node and the cloud node so as to establish a network communication tunnel between the edge nodes, and the tunnel Agent module realizes network communication by using an IPSec or WireGuard network protocol suite in combination with other edge node information acquired from the control management module and the optimal cloud edge / edge routing path. According to the method, the cloud edge / edge routing can be efficiently decided and established in real time, so that edge containers in different regions and different network environments are communicated, and the bandwidth consumption on the cloud is reduced while the communication efficiency is fully improved.

This application provides a method for secure message transmission, a method for negotiating IPsec SAs, and related apparatus, applicable to wide area networks (WANs). In scenarios spanning multiple tunnel segments, by extending BGP routing and based on VRF granularity, an IPsec SA for end-to-end security protection is negotiated between a first edge and a second edge. After the first edge securely protects VPN service messages based on the IPsec SA, it sends the messages through the overlay end-to-end tunnel between the first and second edges. The second edge processes the messages based on the IPsec SA to obtain the VPN service messages. In this application, security protection only needs to be performed once at the first edge; intermediate nodes do not require encryption / decryption processing, thus ensuring secure message transmission while improving transmission efficiency and reducing transmission latency.

Disclosed are an IPsec tunnel sharing method, device and system, which relate to the technical field of communications, and can improve the specification of an IPsec tunnel in a data transmission process, ensure the transmission efficiency of service data, and improve the transmission efficiency of the IPsec tunnel in a manner of sharing the same IPsec tunnel by a plurality of operators or service instances under the condition that the total amount of the IPsec tunnel is not changed. And the business can be operated more reliably and efficiently. According to the method and the device, the sharing of the IPsec tunnel among different operators or service instances is realized by carrying out routing transmission and flow selection on the service data, and the service isolation can still be realized and the stability of data transmission can be ensured under the condition that the IPsec tunnel is shared by a plurality of operators, so that the data transmission resources among network equipment can be saved, and the data transmission efficiency is improved. Under the condition that physical hardware is not changed, the data transmission efficiency of a plurality of service instances among network equipment is improved.

The invention relates to an IPSEC (Internet Protocol Security) key exchange method resistant to quantum computing. According to the invention, based on a lattice cryptographic algorithm and improved SM4-256 symmetric encryption, secure communication between a master mode and a fast mode is realized; in the main mode, an initiator sends an IKE first message through a UDP (User Datagram Protocol), negotiates SA parameters with a responder and exchanges a lattice password certificate; the two parties encapsulate a temporary 32-byte secret key by using the public key of the opposite party, generate a 512-bit random number through SM4-256 encryption, and sign and transmit the 512-bit random number to realize secure random number exchange and certificate verification; and the two parties calculate a first session key based on a PRF (Pseudo Random Function), and encrypt an exchange data HASH value to complete main mode key consistency confirmation. And after entering the fast mode, taking the main mode session key as an SM4-256 symmetric key to continue communication, sending an SA message carrying a 512-bit random number by the two parties, calculating to obtain a second session key, and establishing an ESP tunnel. According to the method, the security of IPSEC under the threat of quantum computing is improved through the lattice password.

The invention discloses a cryptographic algorithm adaptation and hardware encryption and decryption acceleration method suitable for a gateway protocol, deep integration of a cryptographic algorithm is realized through protocol stack-level native transformation, software and hardware collaborative design is adopted, and through innovative mechanisms such as multi-thread concurrent encryption, asynchronous interrupt processing and DMA data interaction, the hardware encryption and decryption acceleration of the cryptographic algorithm is realized. The processing capability in a high throughput scene is improved; an intelligent strategy engine is introduced to realize data packet dynamic classification and encrypted resource optimization scheduling, and the system performance is maximized while the security is ensured; according to the technical scheme, key full-life-cycle management and control are achieved through the HSM, the requirement for equal insurance 2.0 is met, multi-platform deployment is supported by adopting modular design, and compared with the prior art, the method can be flexibly adapted to various application scenes such as various domestic chip architectures, embedded devices, security gateways and industrial controllers, and the method is suitable for large-scale popularization and application. The problems of high platform dependence, difficulty in transplantation and the like existing in national secret IPSec implementation are solved, and a better secure communication solution is provided for a localized environment.

Provided in the present application is a double-encryption method based on IPsec and a quantum key. The method comprises: an encryption gateway registering to a quantum key distribution center by means of a unique identifier, and after the registration is successful, the quantum key distribution center charging a quantum key to the encryption gateway; the encryption gateway receiving a pushed data message, and labeling a data packet of the pushed data message with an encryption tag or a decryption tag; by means of creating the encryption tag and the decryption tag, setting a rule in a POSTROUTING chain of a mangel table, creating a hook node by using the encryption tag or the decryption tag, and sending the data packet labeled with the encryption tag or the decryption tag; and encrypting data to convert same into popped message data, sending the popped message data from the encryption gateway, or decrypting the data to obtain original text of ciphertext. In the present application, no additional load encapsulation is required for data encapsulation, and the original structure of a data packet is not changed, and the present application is applicable to more network environments.

The invention particularly relates to an enhanced application method of a quantum key in nuclear power industrial network encryption transmission, which is characterized in that session key negotiation is enhanced through quantum key XOR based on a comprehensive security gateway in a network. According to the method, the quantum cryptography technology and the IPSEC cryptography protocol are deeply fused, and a layer of quantum key is introduced to perform XOR enhancement on the session key, so that the security of nuclear power industrial network encryption transmission is remarkably improved, the purpose of resisting quantum computing attack is achieved, and the network security transmission of key data is guaranteed.

The invention discloses a high-speed IPSec gateway optimization method and device based on combination of a VPP and an FPGA, and the method comprises the steps: receiving a data packet from a network card drive program through a VPP processing module in a CPU, and carrying out the primary processing; the VPP processing module identifies the data stream processed by the IPSec to form a target data packet; the VPP processing module triggers an IKE daemon process according to a security policy matching result, performs IKE negotiation and creates data transmission security association; the VPP processing module preprocesses a target data packet needing to be encrypted and decrypted and transmits the target data packet to the FPGA through the 10-gigabit network card chip / PCIe channel; the FPGA carries out encryption and decryption processing by setting an encryption and decryption algorithm according to the type of the target data packet, and returns the processed target data packet to the CPU; and the CPU performs recombination processing according to the fragmentation state of the target data packet, and forwards the target data packet to the application program for subsequent processing. According to the invention, the problems of performance bottleneck and security of the existing IPSec gateway equipment are solved, and an efficient and safe data encryption and decryption solution is provided.

Methods and systems for securely sending user plane data from a base station to an Artificial Intelligence (AI) server via a mobile telecommunication network are disclosed herein. A method performed by the base station located in a Radio Access Network (RAN) includes: sending an interface setup request to the (AI) server, receiving an interface setup response from the AI server, establishing, by exchanging cryptographic keys using an Internet Key Exchange (IKE) protocol, a data transport tunnel between the base station and the AI server based on an Internet Protocol Security (IPSec) network protocol, and sending the user plane data from the base station to the AI server for training artificial intelligence based models.

The embodiment of the invention relates to the technical field of communication, and discloses an IPSec VPN (Internet Protocol Security Virtual Private Network)-based encryption communication method, equipment and a medium. The encryption communication method based on the IPSec VPN comprises the following steps: performing quantum key negotiation with an opposite terminal in quantum keys pre-stored at a home terminal; exchanging data with an opposite terminal; key derivation is carried out according to the negotiated quantum key and key derivation parameters in the exchange data, a target key is obtained, and the target key is a key needed by IPSec VPN encryption communication; and carrying out negotiation verification with the opposite terminal, so as to carry out encrypted communication with the opposite terminal according to the target key after the verification is passed. The method at least facilitates more stable and effective combination of the quantum key to establish the IPSec VPN tunnel, and can realize more stable, effective and secure IPSec VPN encryption communication.

The invention discloses a red and black isolated IPSEC message processing method, which relates to the technical field of network communication, and comprises the following steps: constructing a red area and a black area, and arranging an isolation unit between the red area and the black area; based on a netfilter mechanism of a LINUX kernel, registering a plurality of hook points in a message processing flow to realize message passing; and sending and receiving the message through the constructed message processing flow. The technical problem that logic isolation between the red area and the black area is not thorough in the prior art is solved, and the technical effect of improving the safety and reliability of data transmission between the red area and the black area is achieved by ensuring strict logic isolation between the red area and the black area.

The invention provides a high-performance IPSEC cache management device and management method. The device comprises an input queue management module, a cache pool module, an IPSEC core module and an output queue management module. The method comprises the following steps of: adding a first Cell containing a message header and message analysis information into a message header queue to be encrypted and decrypted by an input queue management module, and storing other message contents into a shared cache space of a cache pool module; the IPSEC core module performs encryption, decryption and Hash operation on a message to be encrypted and decrypted, and backfills the encrypted and decrypted data into a shared cache of the cache pool module; and the output queue management module outputs the message data processed by the IPSEC core module from the cache pool module based on the output queue. According to the technical scheme, flexible expansibility of IPSEC cache performance is achieved.

The invention discloses an IPSEC (Internet Protocol Security) VPN (Virtual Private Network) remote access method and system supporting a post-quantum algorithm and computer equipment, the method comprises the following steps: establishing a first secure channel and a second secure channel with a VPN server, the first secure channel outputting a first session key by using the post-quantum algorithm, the second secure channel outputting a second session key by using a classical algorithm, and the second session key outputting a second session key by using a classical algorithm; information transmission in the second secure channel establishment process is encrypted through the first session key; encrypting the original data by using the second session key, and sending the encrypted data to the VPN server; and decrypting the encrypted data by the VPN server by using the negotiated second session key, and sending the decrypted data to the target server. Compared with the prior art, the method has the advantages that the data is protected from being read or tampered by an unauthorized third party, so that the quantum computer attack can be protected, and the security of the key exchange process is ensured.

In an embodiment, a method includes transmitting an initiation request from a first electronic device to a second electronic device, the initiation request being associated with a notification that the first electronic device is capable of early detection of duplicate security associations (SAs), receiving an initiation request from the second electronic device at the first electronic device, the initiation request being associated with a capability notification that the second electronic device is capable of early detection of duplicate SAs, determining a possibility of duplicate SAs by the first electronic device, transmitting responses configured to prevent duplicate SAs from the first electronic device to the second electronic device, receiving responses at the first electronic device from the second electronic device, wherein the responses indicate no duplicate SAs created by the second electronic device, and establishing a non-duplicate SA for the first and second electronic devices.

The invention discloses a main-standby switching function implementation method for a cloud platform IPsec VPN gateway, and relates to the technical field of cloud computing. The method comprises the following steps of: establishing a main / standby switching system, automatically deploying an IPsec VPN server group in a VPC (Virtual Private Controller) needing to use an IPsec VPN service through a server deployment module according to a service specification required by a user, configuring a public network IP (Internet Protocol) for the IPsec VPN server group, and configuring main / standby switching parameters of the IPsec VPN server group after establishing the IPsec VPN server group through a main / standby switching initialization module; iPsec VPN gateway service configuration is issued to an IPsec VPN gateway server group through a configuration issuing module; the IPsec VPN servers in the IPsec VPN server group are polled through the configuration maintenance module, it is guaranteed that service configuration in the IPsec VPN servers is consistent with that of the IPsec VPN main server, and when the IPsec VPN main server breaks down, the main server and the standby server are switched through the main and standby switching module, so that the service configuration of the IPsec VPN servers in the IPsec VPN server group is ensured to be consistent with that of the IPsec VPN main server. The IPsec VPN server recovered from the fault is added into the IPsec VPN server group again through a fault recovery module; and the log alarm module is responsible for log recording and alarm work during IPsec VPN main / standby switching.

In an embodiment, a method includes transmitting an initiation request from a first electronic device to a second electronic device, the initiation request being associated with a notification that the first electronic device is capable of early detection of duplicate security associations (SAs), receiving an initiation request from the second electronic device at the first electronic device, the initiation request being associated with a capability notification that the second electronic device is capable of early detection of duplicate SAs, determining a possibility of duplicate SAs by the first electronic device, transmitting responses configured to prevent duplicate SAs from the first electronic device to the second electronic device, receiving responses at the first electronic device from the second electronic device, wherein the responses indicate no duplicate SAs created by the second electronic device, and establishing a non-duplicate SA for the first and second electronic devices.

The application provides a high-performance IPSEC cache management device and method. The device comprises an input queue management module, a cache pool module, an IPSEC core module and an output queue management module. The method comprises: adding a first Cell containing a message header and message parsing information into a message header queue to be encrypted or decrypted by the input queue management module, and storing the remaining message content into a shared cache space of the cache pool module; performing encryption and decryption and hash operation on the message to be encrypted or decrypted by the IPSEC core module, and backfilling the encrypted and decrypted data into the shared cache of the cache pool module; and outputting the message data processed by the IPSEC core module from the cache pool module based on an output queue by the output queue management module. The technical scheme of the application realizes flexible scalability of IPSEC cache performance.

The application relates to the field of network security, in particular to an IPSec anti-replay detection method based on multiple caches. The latest window information which has not been stored in DDR is cached by means of the cache space of FPGA. When the sn window information of the previous message is not updated in the algorithm decryption stage, the un-updated sn window information is stored in the cache space of FPGA, the anti-replay detection of the next message is not affected, the processing time of two messages is shortened to the algorithm processing time, the preparation time before the algorithm decryption is greatly compressed, the method has the characteristics of fast speed, less resource occupation and the like, and is suitable for devices which have strict performance requirements and need to perform anti-replay detection.

A communication method and a communication apparatus, which are used for implementing communication between a terminal and a core network by means of a unified non-3GPP access gateway, thereby reducing the complexity of network deployment. The method comprises: receiving a first message from a terminal, the first message being used for requesting authentication, connection establishment or connection release, and the first message being an internet protocol security (IPSec) message, or the first message being a quick user datagram protocol internet connection (QUIC) protocol message; and sending a second message to a control plane network element, the second message being a non-access stratum (NAS) message determined on the basis of the first message.

The present invention discloses a method, device, storage medium and electronic device for setting an anti-replay window. The method includes: receiving a target data packet; determining a target traffic throughput corresponding to the target data packet; obtaining a target window value from an analysis result table based on the target traffic throughput and a packet loss rate threshold, wherein the packet loss rate threshold is used to characterize the maximum packet loss rate corresponding to the first data packet discarded by the anti-replay window during verification of the target data packet, wherein the sequence number of the first data packet is less than the sequence number corresponding to the left boundary of the anti-replay window, and the anti-replay window is an IPsec VPN anti-replay window. The analysis result table includes at least multiple traffic throughputs, multiple window values, and the packet loss rate corresponding to each window value at each traffic throughput; and setting a target anti-replay window based on the target window value. The present invention solves the technical problem in the prior art of high network failure rate caused by the inability of the anti-replay window to adapt to changes in communication traffic.

According to some embodiments, a method is performed by a software defined wide area network (SD-WAN) edge router in a hierarchical SD-WAN network comprising a plurality of edge routers and a plurality of border routers. The method comprises: originating a SD-WAN system route for advertising reachability to the edge router, the system route comprising an encryption key associated with the edge router; and transmitting the system route to one or more SD-WAN border routers. The method may further comprise: receiving a packet destined for the edge router from one of the one or more SD-WAN border routers, wherein the packet is at least partially encrypted with the encryption key associated with the edge router; and decrypting the received packet.

Encryption operations are securely offloaded to a network interface controller (NIC). Encryption keys are securely transferred from a virtual machine (VM) to the NIC and data is securely transferred from encrypted VM memory to secure buffers in the NIC. The NIC handles the encryption and decryption operations in hardware, greatly increasing encryption performance while not reducing security. This is especially useful in cloud server environments, so the cloud service provider does not have access to the encryption keys or the unencrypted data. The offloaded operations are performed with numerous different communication protocols, including RDMA, QUIC, IPsec underlay and WireGuard.