179 results about "IPsec" patented technology

A system and associated methods provide solutions for end-to-end privacy and per-hop routing and policy decision in multi-hop and Software-Defined Wide Area Networks (SD-WANs) by leveraging unique SDWAN edge identities of edge devices. The system enables end-to-end encryption between traffic source and destination sites using IPsec ESP tunnel mode, with System IPs as the outer IP addresses. The system further enables per-hop integrity protection using IPsec AH transport mode, with WAN IPs as the outer IP addresses. By having some information encrypted between a source device and a destination device and other information encapsulated between hops (e.g., between source device and an intermediate device), the system enables route and policy lookup based on destination site System-IP, along with integrity protection based on SLA-class in packet metadata for independent path selection at intermediate hops.

The invention discloses a quantum key fused block encryption method, a communication system and an evaluation method thereof, and the method comprises the steps: fusing a quantum key generated by quantum key division into an Internet key exchange protocol of IPsec to form a mixed key; the sender and the receiver carry out message transmission through the mixed key, the authentication head and the packaging security load, so that the quantum key is integrated into the IPsec framework; and meanwhile, different quantum keys are used in each VPN channel, so that one-time pad is realized. In addition, the invention further provides a method for evaluating the performances such as the key consumption rate, the maximum supportable VPN tunnel number and the total throughput. According to the invention, the security and stability of data transmission in the quantum computer era can be improved.

The invention discloses an IPSec (Internet Protocol Security) VPN (Virtual Private Network) security gateway communication method fused with a post quantum cryptography technology, which comprises the following steps of: S1, in a first-stage main mode of IKE (Internet Key Exchange) key agreement, replacing a traditional single SM2 algorithm and a digital certificate based on an SM2 cryptographic algorithm with an SM2 and PQC mixed algorithm and a mixed PQC digital certificate; s2, the initiator and the responder respectively use the PQC encryption key pair and the PQC signature key pair to carry out key exchange and data signature, and simultaneously use the SM2 encryption key pair and the SM2 signature key pair to carry out key exchange and data signature; s3, in the message 1, the initiator sends a security alliance load containing the attribute of the fused SM2 and PQC algorithm to the responder; s4, in the message 2, the responder feeds back a PQC series hybrid certificate and an SA proposal; and S5, in the message 3 and the message 4, the initiator and the responder complete key exchange and verification. According to the invention, the security of the IPSec VPN security gateway can be improved, and quantum computing attacks can be resisted.

Techniques and architecture are described for reauthentication of two IPsec peers, during a key refresh process. The peers may reauthenticate each other based upon a shared secret, which in configurations, is a PPK. In configurations the PPKs are stirred (mixed with DH / ECDH) during key derivation while refreshing the session keys during IKE_v2 and IPsec rekey. This may involve communicating the PPK-ID from a rekey initiator to a rekey responder by adding a PPK_ID payload in the rekey message exchange. This enables stronger quantum safe session keys, when dynamic PPK is used or when the manual PPK is rotated frequently. In configurations, the knowledge of the shared PPK is proved by having both peers exchange authentication payloads signed with a PPK. This involves exchanging a IKEv2 NOTIFY payload “AUTH_PPK” to carry PPK-signed authentication data. This serves the purpose of frequent re-authentication of the peers as part of the key refreshes.

The invention discloses an IPSec VPN security gateway communication method based on a post quantum cryptography technology, and the method comprises the following steps: S1, replacing a conventional SM2 algorithm and a certificate with a PQC algorithm and a digital certificate in a first-stage main mode of IKE key negotiation; s2, the initiator and the responder respectively use the PQC key pair to complete key exchange and signature; s3, in the message 1, the initiator sends a security alliance load containing a PQC public key algorithm attribute to the responder; s4, in the message 2, the responder sends an SA load containing a PQC signature certificate and an encryption certificate, and a received SA proposal sent by the initiator is marked; s5, in the message 3 and the message 4, the initiator and the responder complete key exchange and verification; and S6, in the message 5 and the message 6, the initiator and the responder encrypt the transmitted information by using a symmetric cryptographic algorithm, and identify the previous exchange process. According to the invention, the security of the IPSec VPN security gateway is improved, and quantum computing attacks can be resisted.

This application provides a method for secure message transmission, a method for negotiating IPsec SAs, and related apparatus, applicable to wide area networks (WANs). In scenarios spanning multiple tunnel segments, by extending BGP routing and based on VRF granularity, an IPsec SA for end-to-end security protection is negotiated between a first edge and a second edge. After the first edge securely protects VPN service messages based on the IPsec SA, it sends the messages through the overlay end-to-end tunnel between the first and second edges. The second edge processes the messages based on the IPsec SA to obtain the VPN service messages. In this application, security protection only needs to be performed once at the first edge; intermediate nodes do not require encryption / decryption processing, thus ensuring secure message transmission while improving transmission efficiency and reducing transmission latency.

Disclosed are an IPsec tunnel sharing method, device and system, which relate to the technical field of communications, and can improve the specification of an IPsec tunnel in a data transmission process, ensure the transmission efficiency of service data, and improve the transmission efficiency of the IPsec tunnel in a manner of sharing the same IPsec tunnel by a plurality of operators or service instances under the condition that the total amount of the IPsec tunnel is not changed. And the business can be operated more reliably and efficiently. According to the method and the device, the sharing of the IPsec tunnel among different operators or service instances is realized by carrying out routing transmission and flow selection on the service data, and the service isolation can still be realized and the stability of data transmission can be ensured under the condition that the IPsec tunnel is shared by a plurality of operators, so that the data transmission resources among network equipment can be saved, and the data transmission efficiency is improved. Under the condition that physical hardware is not changed, the data transmission efficiency of a plurality of service instances among network equipment is improved.

The invention relates to an IPSEC (Internet Protocol Security) key exchange method resistant to quantum computing. According to the invention, based on a lattice cryptographic algorithm and improved SM4-256 symmetric encryption, secure communication between a master mode and a fast mode is realized; in the main mode, an initiator sends an IKE first message through a UDP (User Datagram Protocol), negotiates SA parameters with a responder and exchanges a lattice password certificate; the two parties encapsulate a temporary 32-byte secret key by using the public key of the opposite party, generate a 512-bit random number through SM4-256 encryption, and sign and transmit the 512-bit random number to realize secure random number exchange and certificate verification; and the two parties calculate a first session key based on a PRF (Pseudo Random Function), and encrypt an exchange data HASH value to complete main mode key consistency confirmation. And after entering the fast mode, taking the main mode session key as an SM4-256 symmetric key to continue communication, sending an SA message carrying a 512-bit random number by the two parties, calculating to obtain a second session key, and establishing an ESP tunnel. According to the method, the security of IPSEC under the threat of quantum computing is improved through the lattice password.

The invention discloses a cryptographic algorithm adaptation and hardware encryption and decryption acceleration method suitable for a gateway protocol, deep integration of a cryptographic algorithm is realized through protocol stack-level native transformation, software and hardware collaborative design is adopted, and through innovative mechanisms such as multi-thread concurrent encryption, asynchronous interrupt processing and DMA data interaction, the hardware encryption and decryption acceleration of the cryptographic algorithm is realized. The processing capability in a high throughput scene is improved; an intelligent strategy engine is introduced to realize data packet dynamic classification and encrypted resource optimization scheduling, and the system performance is maximized while the security is ensured; according to the technical scheme, key full-life-cycle management and control are achieved through the HSM, the requirement for equal insurance 2.0 is met, multi-platform deployment is supported by adopting modular design, and compared with the prior art, the method can be flexibly adapted to various application scenes such as various domestic chip architectures, embedded devices, security gateways and industrial controllers, and the method is suitable for large-scale popularization and application. The problems of high platform dependence, difficulty in transplantation and the like existing in national secret IPSec implementation are solved, and a better secure communication solution is provided for a localized environment.

Provided in the present application is a double-encryption method based on IPsec and a quantum key. The method comprises: an encryption gateway registering to a quantum key distribution center by means of a unique identifier, and after the registration is successful, the quantum key distribution center charging a quantum key to the encryption gateway; the encryption gateway receiving a pushed data message, and labeling a data packet of the pushed data message with an encryption tag or a decryption tag; by means of creating the encryption tag and the decryption tag, setting a rule in a POSTROUTING chain of a mangel table, creating a hook node by using the encryption tag or the decryption tag, and sending the data packet labeled with the encryption tag or the decryption tag; and encrypting data to convert same into popped message data, sending the popped message data from the encryption gateway, or decrypting the data to obtain original text of ciphertext. In the present application, no additional load encapsulation is required for data encapsulation, and the original structure of a data packet is not changed, and the present application is applicable to more network environments.

Methods and systems for securely sending user plane data from a base station to an Artificial Intelligence (AI) server via a mobile telecommunication network are disclosed herein. A method performed by the base station located in a Radio Access Network (RAN) includes: sending an interface setup request to the (AI) server, receiving an interface setup response from the AI server, establishing, by exchanging cryptographic keys using an Internet Key Exchange (IKE) protocol, a data transport tunnel between the base station and the AI server based on an Internet Protocol Security (IPSec) network protocol, and sending the user plane data from the base station to the AI server for training artificial intelligence based models.

The invention discloses a red and black isolated IPSEC message processing method, which relates to the technical field of network communication, and comprises the following steps: constructing a red area and a black area, and arranging an isolation unit between the red area and the black area; based on a netfilter mechanism of a LINUX kernel, registering a plurality of hook points in a message processing flow to realize message passing; and sending and receiving the message through the constructed message processing flow. The technical problem that logic isolation between the red area and the black area is not thorough in the prior art is solved, and the technical effect of improving the safety and reliability of data transmission between the red area and the black area is achieved by ensuring strict logic isolation between the red area and the black area.

In an embodiment, a method includes transmitting an initiation request from a first electronic device to a second electronic device, the initiation request being associated with a notification that the first electronic device is capable of early detection of duplicate security associations (SAs), receiving an initiation request from the second electronic device at the first electronic device, the initiation request being associated with a capability notification that the second electronic device is capable of early detection of duplicate SAs, determining a possibility of duplicate SAs by the first electronic device, transmitting responses configured to prevent duplicate SAs from the first electronic device to the second electronic device, receiving responses at the first electronic device from the second electronic device, wherein the responses indicate no duplicate SAs created by the second electronic device, and establishing a non-duplicate SA for the first and second electronic devices.

The invention discloses a main-standby switching function implementation method for a cloud platform IPsec VPN gateway, and relates to the technical field of cloud computing. The method comprises the following steps of: establishing a main / standby switching system, automatically deploying an IPsec VPN server group in a VPC (Virtual Private Controller) needing to use an IPsec VPN service through a server deployment module according to a service specification required by a user, configuring a public network IP (Internet Protocol) for the IPsec VPN server group, and configuring main / standby switching parameters of the IPsec VPN server group after establishing the IPsec VPN server group through a main / standby switching initialization module; iPsec VPN gateway service configuration is issued to an IPsec VPN gateway server group through a configuration issuing module; the IPsec VPN servers in the IPsec VPN server group are polled through the configuration maintenance module, it is guaranteed that service configuration in the IPsec VPN servers is consistent with that of the IPsec VPN main server, and when the IPsec VPN main server breaks down, the main server and the standby server are switched through the main and standby switching module, so that the service configuration of the IPsec VPN servers in the IPsec VPN server group is ensured to be consistent with that of the IPsec VPN main server. The IPsec VPN server recovered from the fault is added into the IPsec VPN server group again through a fault recovery module; and the log alarm module is responsible for log recording and alarm work during IPsec VPN main / standby switching.

In an embodiment, a method includes transmitting an initiation request from a first electronic device to a second electronic device, the initiation request being associated with a notification that the first electronic device is capable of early detection of duplicate security associations (SAs), receiving an initiation request from the second electronic device at the first electronic device, the initiation request being associated with a capability notification that the second electronic device is capable of early detection of duplicate SAs, determining a possibility of duplicate SAs by the first electronic device, transmitting responses configured to prevent duplicate SAs from the first electronic device to the second electronic device, receiving responses at the first electronic device from the second electronic device, wherein the responses indicate no duplicate SAs created by the second electronic device, and establishing a non-duplicate SA for the first and second electronic devices.

The application provides a high-performance IPSEC cache management device and method. The device comprises an input queue management module, a cache pool module, an IPSEC core module and an output queue management module. The method comprises: adding a first Cell containing a message header and message parsing information into a message header queue to be encrypted or decrypted by the input queue management module, and storing the remaining message content into a shared cache space of the cache pool module; performing encryption and decryption and hash operation on the message to be encrypted or decrypted by the IPSEC core module, and backfilling the encrypted and decrypted data into the shared cache of the cache pool module; and outputting the message data processed by the IPSEC core module from the cache pool module based on an output queue by the output queue management module. The technical scheme of the application realizes flexible scalability of IPSEC cache performance.

The application relates to the field of network security, in particular to an IPSec anti-replay detection method based on multiple caches. The latest window information which has not been stored in DDR is cached by means of the cache space of FPGA. When the sn window information of the previous message is not updated in the algorithm decryption stage, the un-updated sn window information is stored in the cache space of FPGA, the anti-replay detection of the next message is not affected, the processing time of two messages is shortened to the algorithm processing time, the preparation time before the algorithm decryption is greatly compressed, the method has the characteristics of fast speed, less resource occupation and the like, and is suitable for devices which have strict performance requirements and need to perform anti-replay detection.

A communication method and a communication apparatus, which are used for implementing communication between a terminal and a core network by means of a unified non-3GPP access gateway, thereby reducing the complexity of network deployment. The method comprises: receiving a first message from a terminal, the first message being used for requesting authentication, connection establishment or connection release, and the first message being an internet protocol security (IPSec) message, or the first message being a quick user datagram protocol internet connection (QUIC) protocol message; and sending a second message to a control plane network element, the second message being a non-access stratum (NAS) message determined on the basis of the first message.

The present invention discloses a method, device, storage medium and electronic device for setting an anti-replay window. The method includes: receiving a target data packet; determining a target traffic throughput corresponding to the target data packet; obtaining a target window value from an analysis result table based on the target traffic throughput and a packet loss rate threshold, wherein the packet loss rate threshold is used to characterize the maximum packet loss rate corresponding to the first data packet discarded by the anti-replay window during verification of the target data packet, wherein the sequence number of the first data packet is less than the sequence number corresponding to the left boundary of the anti-replay window, and the anti-replay window is an IPsec VPN anti-replay window. The analysis result table includes at least multiple traffic throughputs, multiple window values, and the packet loss rate corresponding to each window value at each traffic throughput; and setting a target anti-replay window based on the target window value. The present invention solves the technical problem in the prior art of high network failure rate caused by the inability of the anti-replay window to adapt to changes in communication traffic.

Encryption operations are securely offloaded to a network interface controller (NIC). Encryption keys are securely transferred from a virtual machine (VM) to the NIC and data is securely transferred from encrypted VM memory to secure buffers in the NIC. The NIC handles the encryption and decryption operations in hardware, greatly increasing encryption performance while not reducing security. This is especially useful in cloud server environments, so the cloud service provider does not have access to the encryption keys or the unencrypted data. The offloaded operations are performed with numerous different communication protocols, including RDMA, QUIC, IPsec underlay and WireGuard.

A node of a network communicating via mobile ad hoc network (MANET) waveforms and incorporating internet protocol (IP) security (IPSec) measures includes a plaintext (PT) user system or host, ciphertext (CT) communications module including a radio system for transmission and reception via MANET waveforms, IPSec cryptographic units, and PT and CT convergence modules. IPSec units provide encryption and decryption of data traffic as well as cross-layer exchange between PT and CT convergence modules. PT convergence modules map output traffic and decrypted input traffic to CT capabilities and exchange reachability information (e.g., addresses of reachable nodes or systems) with counterpart PT convergence modules of peer nodes of the MANET. CT convergence modules converge encrypted input and output traffic based on CT capabilities.

The application provides a base station activation method, a communication device and a storage medium, and relates to the technical field of communication. The method comprises the following steps: when a base station starts base station activation, an access platform sends a first parameter to the base station; the first parameter comprises a first verification parameter and an authentication parameter; the access platform performs authentication and authentication operations based on the first parameter, and sends a second parameter to the base station; the second parameter comprises a second verification parameter, and the second parameter is used for base station registration; the access platform performs base station registration operations based on the second parameter through an Internet Protocol Security (IPsec) tunnel, and sends a third parameter to the base station; the third parameter comprises a third verification parameter and a cell configuration parameter, and the third parameter is used for base station activation; and the access platform performs base station activation operations based on the third parameter through the IPsec tunnel, so that the base station is activated in a core network device, and the security of the network is improved.

Techniques and architecture are described for reauthentication of two IPsec peers,, during a key refresh process. The peers may reauthenticate each other based upon a shared secret, which in configurations, is a PPK. In configurations the PPKs are stirred (mixed with DH / ECDH) during key derivation while refreshing the session keys during IKE_v2 and IPsec rekey. This may involve communicating the PPK-ID from a rekey initiator to a rekey responder by adding a PPK_ID payload in the rekey message exchange. This enables stronger quantum safe session keys, when dynamic PPK is used or when the manual PPK is rotated frequently. In configurations, the knowledge of the shared PPK is proved by having both peers exchange authentication payloads signed with a PPK. This involves exchanging a IKEv2 NOTIFY payload "AUTH_PPK" to carry PPK-signed authentication data. This serves the purpose of frequent re-authentication of the peers as part of the key refreshes.

Encryption operations are securely offloaded to a network interface controller (NIC). Encryption keys are securely transferred from a virtual machine (VM) to the NIC and data is securely transferred from encrypted VM memory to secure buffers in the NIC. The NIC handles the encryption and decryption operations in hardware, greatly increasing encryption performance while not reducing security. This is especially useful in cloud server environments, so the cloud service provider does not have access to the encryption keys or the unencrypted data. The offloaded operations are performed with numerous different communication protocols, including RDMA, QUIC, IPsec underlay and WireGuard.

Generally, Software-Defined Wide Area Networks (SD-WAN) generally do not support network segmentation. The concepts disclosed herein connects IPSec SD-WAN fabric to a Virtual Routing and Forwarding (VRF) router and make use of a Software Defined Cloud Interconnect (SDCI) Router to route traffic from IPSec SD-WAN to various cloud services from the SDCI Router in the fabric. The concepts disclosed herein also provides for tunnel multi-plexing that takes incoming and outgoing traffic and maps VPNs to any service VRF associated with the cloud based services.

This invention proposes a hybrid quantum-resistant security enhancement method for IPSec VPNs. The method includes: intercepting Internet Key Exchange (ITE) packets and adding a proxy header between the transport layer header and the ISE payload of the packets; obtaining a quantum key from a key pool using quantum key distribution technology and generating a first-stage session key based on the quantum key; protecting the ISE key negotiation process using a quantum-resistant cryptographic algorithm to generate a second-stage session key; and using the first-stage and second-stage session keys as input parameters for a key derivation function to generate a final session key for encrypted data transmission. This invention, without modifying the original IPSec negotiation process, supports dynamic key combinations of different security levels, enhancing the quantum security protection capability of VPN data transmission while maintaining system flexibility and performance.

The present disclosure provides technical solutions related to distributed IPSec gateway. A control plane and a data plane of the IPSec gateway are divided, a plurality of gateway processing nodes may be run in the data plane to process data packets of incoming ESP / AH traffic and / or data packets of outgoing IP traffic. IKE information interaction may be handled in the control plane and the traffic may be steered on each gateway processing node in the data plane.

Embodiments of the present disclosure relate to systems and methods of selecting internet protocol security tunnels during a key exchange. In some implementations, a first endpoint device can assign a first metric to a first internet protocol security (IPsec) tunnel and a second metric to a second IPsec tunnel. The first IPsec tunnel can be a first communication channel for transmitting data between the first endpoint device and a second endpoint device, and the second IPsec tunnel can be a second communication channel for transmitting data between the first endpoint device and the second endpoint device. The first endpoint device can select the first IPsec tunnel or the second IPsec tunnel as a selected IPsec tunnel for transmitting data toward the second endpoint device based on the first metric and the second metric. The first endpoint device can transmit data toward the second endpoint device via the selected IPsec tunnel.

This application discloses a message processing method, communication device, storage medium, and program product, relating to the field of communications. The method includes: the communication device acquiring the sequence number of an IPsec packet to be processed; and then performing anti-replay processing on the IPsec packet based on a comparison between the sequence number of the IPsec packet to be processed and the sequence numbers recorded in a preset cache and within a sliding window. The preset cache is used to record sequence numbers that are not consecutive with the sequence numbers within the sliding window. This method allows the communication device to store the sequence numbers of out-of-order packets in the preset cache during anti-replay processing, avoiding sudden large-scale window expansion and thus preventing the accidental discarding of IPsec packets.

The embodiment of the invention provides a data transmission method, a data transmission device, electronic equipment, a chip, a storage medium and a computer program product, the data transmission method is applied to a first function, and comprises the following steps: establishing a secure communication protocol IPSec tunnel with a second function; and based on the IPSec tunnel, performing data encryption transmission with the second function through a first IPSec module deployed in the first function.