CN101325804B - Method, device and system for acquiring cryptographic key - Google Patents

Abstract

A method, device and system for obtaining keys, which are used to obtain key information for network devices that need to obtain key information after an authenticator is migrated. And it includes: firstly, after the network device that needs to obtain the key information receives the indication information indicating that the authenticator has migrated, it sends a key request to the migrated authenticator, and receives the key information returned by the authenticator. Therefore, the implementation of the present invention can ensure that the mobile user's network device that needs to obtain the key information can obtain the corresponding key information after the authenticator is migrated, so that the subsequent communication process can be carried out smoothly, thereby effectively improving the wireless communication system. communication performance.

Description

Method, device and system for obtaining keys

technical field

The invention relates to the technical field of network communication, in particular to an implementation scheme for obtaining a key when an authenticator is migrated. the

Background technique

With the rapid development of Internet services and the wide application of wireless networks, the security of mobile users has put forward higher requirements for wireless systems, that is, in addition to the corresponding equipment authentication, user authentication and service authorization, it also needs Establish corresponding secure channel between AP (wireless user and access point) or BS (base station), realize corresponding confidential information exchange, and between BS and Authenticator (authenticator), authenticator and authentication server Establish confidential channels to realize confidential information exchange and so on. the

In a wireless network, a mobile user needs to initiate authentication to an authenticator such as NAS (Network Access Server), and after the authentication is passed, the FA (Foreign Agent) of the mobile user obtains the corresponding key information through communication with the NAS, so that Applied during subsequent communications. the

After the re-authentication operation of the mobile user MS, the processing process of the FA to obtain the key is shown in Figure 1, and the corresponding processing process includes the following steps:

Step 1, MS succeeds in access authentication through NAS1;

Specifically, the corresponding authentication process can be initiated to the AAA server through NAS1, and the corresponding authentication operation is completed to determine that the MS authentication is passed;

Step 2, FA sends a request to NAS1 when it needs the MN-FA key or FA-HA key, to request to obtain the corresponding MN-FA key or FA-HA key;

Step 3, MS re-authentication occurs through NAS1;

Similar to the authentication process, specifically, NAS1 can initiate a re-authentication operation to the AAA server to complete the corresponding re-authentication process;

Step 4, the MS sends a MIP-RRQ (MIP registration) message to the FA, carrying the authentication extension calculated by the new key, and the SPI (Security Parameter Index) is also calculated by the FA-RK generated after re-authentication, or generated by other methods;

Step 5: After receiving the registration message, the FA compares the SPI carried in the MIP-RRQ message, determines that the SPI has changed, that is, re-authentication occurs, and requests key update information from NAS1;

That is, due to re-authentication in step 3, the key information on NAS1 and MS has been updated, but FA does not know the re-authentication and updated key information, so FA needs to request the updated key from NAS1 information;

In step 6, after the FA obtains the key, it can continue to process the MIP-RRQ message to complete the subsequent processing process. the

It should be noted that, in the above process, regardless of whether re-authentication occurs, as long as FA migrates, after receiving the MIP-RRQ message, FA will also perform step 5 to request the key from NAS1 in order to obtain the current The key used to complete the subsequent processing. the

In the process of realizing the present invention, the inventor finds that there are at least the following problems in the prior art:

In the above process, if the NAS relocation occurs during the re-authentication process of the MS, the FA cannot obtain the key information from the relocated NAS, so that after the NAS relocation occurs, the FA cannot verify the received MIP-RRQ The message is processed. the

Contents of the invention

Embodiments of the present invention provide a method, device, and system for obtaining keys, so that in the case of authenticator migration, it can still ensure that network devices that need to obtain key information can obtain corresponding key information, so as to Ensure the smooth progress of the follow-up communication process. the

The embodiment of the present invention provides a method for obtaining a key, including:

The network device that needs to obtain the key information receives the indication information indicating that authenticator migration occurs, receives the key information sent by the authenticator, and obtains the key information of the corresponding terminal. the

The present invention also provides a method for obtaining a key, including:

The network device that needs to obtain the key information receives the key information of the corresponding terminal sent by the authenticator after receiving the indication information indicating that re-authentication occurs. the

An embodiment of the present invention provides a network device, including:

The authenticator migration determination unit is configured to determine that the authenticator to which the corresponding terminal belongs has migrated according to the received indication information indicating that the authenticator migration has occurred;

The key request acquisition unit is configured to receive key information sent by the authenticator after the authenticator migration determination unit determines that the authenticator to which the terminal belongs has migrated, and acquire key information corresponding to the terminal. the

An embodiment of the present invention provides a system for obtaining a key, including an authenticator and a network device that needs to obtain key information, wherein,

The authenticator is used to receive the key request sent by the network device that needs to obtain the key information, and send the generated key information corresponding to the terminal to the network device that needs to obtain the key information;

A network device that needs to obtain key information receives indication information indicating that authenticator migration occurs, and receives key information sent by the authenticator. the

The example of the present invention also provides a system for obtaining a key, including an authenticator and a network device that needs to obtain key information, wherein,

The authenticator is used to send the generated key information corresponding to the terminal to the network device that needs to obtain the key information;

The network device that needs to obtain the key information is configured to receive the key information corresponding to the terminal sent by the authenticator after receiving the indication information indicating that re-authentication occurs. the

It can be seen from the technical solutions provided by the above-mentioned embodiments of the present invention that after the authenticator is migrated, it can ensure that the network equipment that needs to obtain the key information can obtain the corresponding key information, so that the subsequent communication process can proceed smoothly . Therefore, the implementation of the embodiments of the present invention can effectively improve the communication performance of the wireless communication system. the

Description of drawings

Fig. 1 is a schematic diagram of the process of obtaining key information by FA in the prior art;

Fig. 2 is a schematic diagram of the processing process of FA acquiring key information in the embodiment of the present invention;

FIG. 3 is a second schematic diagram of the processing process for FA to obtain key information in an embodiment of the present invention;

Fig. 4 is the third schematic diagram of the processing process of FA acquiring key information in the embodiment of the present invention;

Fig. 5 is a schematic diagram of the processing state machine of the FA acquiring key information in the embodiment of the present invention;

Fig. 6 is the schematic diagram of the complete processing procedure of the embodiment of the present invention;

Fig. 7 is a schematic structural diagram of a system provided by an embodiment of the present invention. the

Detailed ways

The embodiment of the present invention is used to obtain the key information for the network device that needs to obtain the key information after the authenticator of the terminal is migrated, that is, the network device that needs to obtain the key information receives the indication information indicating that the authenticator migration occurs Afterwards, it is determined that the authenticator corresponding to the terminal has migrated, and a key request is sent to the migrated authenticator, so as to receive the key information returned by the authenticator, and obtain the key information corresponding to the terminal. the

In the embodiment of the present invention, the network devices that need to obtain key information include but are not limited to FA (foreign agent), BS (base station) or GW (gateway) and other equipment, and the key information includes but not limited to: At least one of key, SPI (Security Parameter Index) and life cycle. the

In the implementation process of the embodiment of the present invention, the indication information used to indicate that authenticator migration occurs can be specifically provided by the migrated authenticator or by the original authenticator (authenticator before migration) or by the terminal or by the HA (home agent) or The AAA (authentication, authentication, accounting) server and other devices send it to the network device that needs to obtain the key information, so that the corresponding network device that needs to obtain the key information can learn the indication information. Optionally, the migrated authenticator or the original authenticator or terminal or HA or AAA server and other devices may also send the address of the migrated authenticator to the network device that needs to obtain key information; wherein, if the original The authenticator sends the address of the migrated authenticator to the network device that needs to obtain the key information, then the authenticator also maintains the correspondence between the terminal and the address of the migrated authenticator, and optionally for the corresponding A corresponding life cycle is set for the relationship, so that the maintained corresponding relationship information can be deleted after a predetermined period of time, thereby releasing occupied storage and management resources. the

In the above process, if the terminal sends the indication information to the network device that needs to obtain the key information, the terminal needs to determine in advance that authenticator migration occurs. The process for the terminal to determine that authenticator migration has occurred may specifically include: first, during the authentication process, the authenticator sends its own identification information to the terminal, so that the terminal can compare the current identification information received from the authenticator with the previously received identification information. Based on the comparison result of the identification information of the received authenticator, it is determined whether the authenticator has migrated; for example, the identification information may include: the address information of the authenticator and/or the number of hops from the authenticator to the gateway. the

In the embodiment of the present invention, after the migrated authenticator generates the key information corresponding to the terminal, it can actively send the key information to the corresponding network device that needs to obtain the key information; or, optionally, the migrated authenticator The subsequent authenticator sends the generated key information corresponding to the terminal to the original authenticator, and the original authenticator sends it to the network device that needs to obtain the key information. the

In the embodiment of the present invention, if the network device that needs to obtain the key information obtains the key information through the above-mentioned process, optionally, after the network device that needs to obtain the key information determines that the authenticator corresponding to the terminal has migrated , you can also judge whether you have received the key information sent by the migrated authenticator. If you have not obtained the key information corresponding to the terminal generated by the migrated Obtain the key information by means of a key request. the

In the specific implementation process of the embodiment of the present invention, before the network device that needs to obtain key information sends a key request to the migrated authenticator, it may also include the operation of obtaining the address information of the migrated authenticator, so that it is necessary to obtain the key The information network device can obtain the address of the migrated authenticator, so as to send a key request message to it. The specific methods that can be used to obtain the address information of the migrated authenticator include: one is to request the address information of the migrated authenticator from the original authenticator before migration; the other is to receive the migrated authenticator or Address information of the migrated authenticator actively sent by the original authenticator. the

During the authenticator migration process, if the network devices that need to obtain key information such as FA, BS, or GW also migrate, the migrated authenticator can first send the key information to the original network that needs to obtain key information before the migration. device, and the network device that originally needed to obtain the key information sends the key information to the migrated network device that needs to obtain the key information; or, the network device that originally needed to obtain the key information can also send the key information to The migrated authenticator sends the migration instruction of the network device that needs to obtain the key information or information such as the address of the migrated network device that needs to obtain the key information, or, the migrated network device needs to obtain the key information to the migrated The relocated authenticator sends the migration instruction of the network device that needs to obtain key information or the address of the relocated network device that needs to obtain key information, so that the relocated authenticator can send the key information to the relocated network device that needs to obtain key information. Network device for key information. the

The following will take FA as an example of a network device that needs to obtain key information, and describe the specific implementation process of the corresponding process of obtaining key information in different situations:

(1) The FA completed the migration before the NAS, and the new FA obtained the address of the original authenticator

In this case, using the migrated new FA as the current FA of the terminal, and adopting the above process can ensure that the network device that needs to obtain the key information can obtain the corresponding key information;

(2) NAS completed the migration before FA, and the original FA obtained the address of the new NAS

In this case, the new FA after migration can obtain the new NAS address during the migration process, which makes it easy for network devices that need to obtain the key information to obtain the corresponding key information; for example, from the migrated FA to the new The NAS sends the FA migration instruction or the address of the migrated FA, or the original FA sends the FA migration instruction or the address of the new FA to the new NAS, and then the new NAS sends the key information to the migrated FA , so that the new NAS can send the key information to the new FA;

(3) During the FA migration process, the original NAS is currently migrating to the NAS

In this case, the new FA needs to request a key from the original NAS, and the process of sending the key information to the new FA by the original NAS can specifically include:

If the original NAS notifies the new FA of the NAS migration process, it also informs the new FA of the address of the new NAS, and the new FA sends a key request to the new NAS. If the new NAS has completed re-authentication, it will reply with the new key information; An instruction to make the new FA wait or wait for the re-authentication to complete before sending the new key information to the new FA;

If the original NAS only informs the new FA that it is currently migrating the NAS, but does not inform it of the address of the new NAS after migration, the new FA can request the address of the new NAS from the original NAS (that is, the migrated authenticator can first send the key information to The original FA then sends the key information to the migrated FA by the original FA, or waits for the new NAS to actively update the key. the

In the embodiment of the present invention, before determining that the authenticator corresponding to the terminal has been migrated, the network device that needs to obtain the key information also needs to determine whether the terminal has re-authentication, so as to further determine the terminal's corresponding Whether the authenticator is migrated, and then the embodiment of the present invention is used to solve the problem of obtaining key information in the case of authenticator migration. Among them, the network device that needs to obtain the key information determines whether the re-authentication of the terminal occurs may specifically include: saving the SPI (Security Parameter Index) between the terminal and the home agent in the network device that needs to obtain the key information, if received If the SPI in the registration request sent by the terminal or other device is different from the saved SPI between the terminal and the home agent, it is determined that re-authentication for the terminal has occurred, otherwise, it is determined that no re-authentication has occurred; or, the key needs to be obtained The information network device may also determine whether a re-authentication operation occurs on the terminal according to the explicit re-authentication indication or the implicit re-authentication indication information in the received message. the

Taking FA as an example of a network device that needs to obtain key information, the key information that FA needs to obtain may be MIP key information. The embodiment of the present invention can specifically solve the problem that the FA cannot obtain the MIP key due to the migration of the NAS in the process of updating the MIP key by the FA, and reduce the competition scene and the time for obtaining the key, and provide the method for the FA to obtain a valid MIP key. In an implementation solution, the MIP key may include an MN-FA key and an FA-HA key. It should be noted that the embodiment of the present invention is not limited to the specific application example. the

During the re-authentication process for the terminal, it can be accompanied by the migration of the authenticator, or it can be performed directly on the original authenticator. When the authenticator is migrated, the FA needs to be notified of the address information of the new authenticator so that the FA can subsequently request key information. The migration of the FA and the migration of the authenticator are independent of each other, that is, the migration may or may not occur at the same time. the

The specific implementation process of the embodiment of the present invention will be described below by taking the application scenario where the NAS as the authenticator is migrated and the key information that the FA needs to obtain includes the MN-FA key as an example. In this scenario, the corresponding processing process is shown in Figure 2, Figure 3 and Figure 4, which specifically includes the following steps:

Step 1, MS succeeds in access authentication through NAS1;

Step 2, FA sends a request to NAS1 when it needs the MN-FA key, specifically, it can request to obtain the corresponding key by sending a context request to NAS1;

Step 3, the re-authentication for MS is performed through NAS2, that is, NAS migration has occurred;

During the re-authentication process, the key information on NAS2 and MS is updated, but FA does not know that a re-authentication event has occurred, nor does it know the updated key information;

Step 4, after re-authentication, MS or HA (home agent) and other devices (only MS is drawn as an example in the figure) send a MIP-RRQ message to FA, which carries the authentication extension of the new key calculation, The SPI is also calculated by the FA-RK generated after re-authentication, or it can be other indication information that can be used to determine whether re-authentication occurs;

Step 5, after the FA receives the message, compare whether the SPI carried in the MIP-RRQ message is the same as the locally maintained SPI, and if it is determined that a change occurs (re-authentication is confirmed), or it is confirmed that the re-authentication occurs according to the indication information, then To obtain the updated key information, you can still request to obtain the corresponding key by sending a context request to NAS2;

In this step, if the FA is migrated, after the FA obtains the address of the original NAS, the new FA is also in the same state, that is, it knows the address information of the original NAS and needs to obtain the MIP key information;

In this step, the specific implementation process of requesting the NAS to obtain the updated key can be but not limited to three types, as shown in Figure 2, Figure 3 and Figure 4, each implementation process is as follows:

(1) As shown in Figure 2, during the migration process of NAS2, if the message notified by NAS2 to FA has not reached FA, FA requests key update information from NAS1; and NAS1 returns NAS migration instruction and/or new NAS address (i.e. NAS2 address); then, FA sends a key request message to NAS2 to request the corresponding MIP key information;

(2) As shown in Figure 3, during the migration process of NAS2, if the message notified by NAS2 to FA has not reached FA, FA requests key update information from NAS1; and NAS1 returns NAS migration instruction and/or new key update information to FA. NAS address (i.e. NAS2 address); before FA sends a key request message to NAS2, the notification message of NAS2 migration reaches FA, if the message carries the updated key and context information, FA no longer sends the key request; Otherwise, FA continues to send a key request to NAS2 to request the corresponding MIP key information;

(3) As shown in Figure 4, during the migration process of NAS2, the message that NAS2 notifies FA has arrived at FA, if the message carries the updated key and context information, FA will no longer send a key request to NAS2 ; Otherwise, the FA continues to send a key request to NAS2 to request to obtain the corresponding MIP key information. the

It should be noted that if the FA also migrates, and the update message of NAS2 is sent to the original FA, the original FA needs to forward the update message to the new FA, so that the new FA can still obtain the corresponding MIP key conveniently information, or return an indication of FA migration or the address of the new FA to NAS2, and then NAS2 sends key information to the new FA. the

Through the processing process of the above steps 1 to 5, after the FA obtains the updated key information, it can continue to process the MIP-RRQ message. the

Based on the fact that the MIP-RRQ message only carries the information of whether to re-authenticate in the above application scenario, the embodiment of the present invention also provides another specific implementation solution. In this solution, it is considered to choose whether to carry NAS migration in the MIP-RRQ message. Instruction information, the corresponding processing process is shown in Figure 5, which may specifically include the following process:

Step 1, the first authentication, NAS1 sends its own address or the number of hops from the NAS to the serving GW (gateway) to the MS during the EAP process and records it;

Step 2, re-authentication, the MS also obtains the NAS1 address or the hop number from the NAS to the serving GW, and compares it with the previously recorded address or hop number information (that is, the information recorded in step 1), and if it is found to be the same, then confirm that the NAS does not Migration occurs;

Step 3, the MS sends MIP-RRQ carrying indication information to indicate re-authentication but no NAS migration, the indication information can be: different SPI algorithms, or a separate extension header;

In the specific implementation process: the singular number of SPI can indicate that the NAS has migrated, and the double number can indicate that the NAS has not migrated; if it is the extension header method, you can directly include a type in the extension header to indicate the migration status of the NAS, or just Directly contain the address information of the current NAS;

Step 4, re-authentication, the MS also obtains the NAS2 address or the hop number from the NAS to the serving GW, and compares it with the previously recorded address or hop number information (that is, the information recorded in step 1), and if it is found to be different, then it is confirmed that the NAS has occurred migrated;

In step 5, the MS sends MIP-RRQ carrying indication information to indicate that re-authentication of the MS occurs and occurs with NAS relocation. the

Based on the above processing process, the processing process adopted by the FA after receiving the corresponding MIP-RRQ message can be as follows:

(1) After the FA receives the MIP-RRQ message, if the message does not carry NAS address information, it will process it according to the instruction information of the MIP-RRQ message: if there is no re-authentication, continue processing; if there is re-authentication but no NAS migration , request the key from the original NAS; if re-authentication is accompanied by NAS migration, wait for the new NAS to actively send notification information, if the notification information sent by the new NAS does not carry the key information required by FA, you need to request the corresponding key information from the new NAS Key information, or, you can also request new NAS information or updated key information from the original NAS;

(2) After the FA receives the MIP-RRQ message, if the MIP-RRQ message directly carries NAS address information, the FA can directly request key information from the indicated NAS. the

In order to further understand the implementation process of FA obtaining the MIP key, the following will further describe the corresponding processing process by taking the acquisition of the MN-FA key in the MIP key as an example in conjunction with the accompanying drawings. the

As shown in Figure 6, the implementation process of the FA state machine includes the following steps:

Step 1, FA receives the MIP-RRQ message;

Step 2, determine whether there is an MN-FA key locally, if so, perform step 3, otherwise, perform step 7;

Step 3, compare whether the SPI in the received MIP-RRQ message is the same as the locally saved SPI, if they are the same, that is, the two SPIs are consistent, then it means that re-authentication has not occurred, and step 15 is performed; otherwise, it means that re-authentication occurs, Execute step 4;

Step 4, determine whether NAS migration occurs, if so, perform step 5, otherwise, perform step 6, specifically, but not limited to, indicate whether the NAS is migrated according to the received Context-Rpt (context report) sent by SPI or new NAS Instructions to determine whether NAS migration occurs;

In this step, if it is temporarily impossible to determine whether the NAS migration has occurred, perform step 7;

It should be noted that, in this step, if it is determined that migration occurs, it can be further determined whether the new NAS key has been received, and if so, perform step 15, otherwise, perform step 5; The key of the new NAS may be sent directly by the new NAS, or it may be the key of the new NAS received from the new NAS sent from the original NAS;

Step 5, determine whether the FA already knows the address of the new NAS after migration, if so, go to step 8, otherwise, go to step 9;

In step 6, the FA requests the original NAS to obtain the MN-FA, and performs step 15. the

Step 7, FA requests the original NAS to obtain the MN-FA, or directly sets the clock and waits to receive information from the authenticator (authenticator for re-authentication). If the NAS feedback information is received from the original NAS, then step 10 is performed. After receiving the instruction message from the new NAS, go to step 12;

After receiving the information, terminate the set clock; if the clock expires and has not received information from the authenticator, then discard the MIP-RRQ message;

In step 8, the FA requests the new NAS after migration to obtain the MN-FA, and performs step 15. the

In step 9, the FA waits for an instruction from the new NAS, or queries the original NAS for the address of the new NAS or the MN-FA, and after receiving an instruction from the new NAS or a feedback from the original NAS, executes step 12; wherein, the received The instruction of the new NAS or the feedback of the original NAS can be the MN-FA of the new NAS, or the address of the new NAS;

Step 10, FA judges whether NAS migration occurs according to the feedback information returned by the original NAS, if so, execute step 12, otherwise, execute step 11;

Similarly, in this step, it is still possible, but not limited to, to determine whether NAS migration occurs according to indications received such as SPI or Context-Rpt (context report) indicating whether NAS migration occurs;

Step 11, if the feedback information sent by the original NAS does not carry the MN-FA, send a request to the original NAS to request to obtain the corresponding MN-FA, and perform step 15 after obtaining the MN-FA, if the original NAS is already in If the MN-FA is carried in the feedback information, step 15 is performed directly. the

Step 12, judging whether the new NAS has sent the corresponding MN-FA to the FA, that is, judging whether the FA has received the MN-FA, if so, go to step 13, otherwise, go to the received new NAS instruction Or obtain the address of the new NAS from the feedback information of the original NAS, and perform step 14;

Step 13, FA obtains MN-FA from the information sent by the new NAS, and executes step 15;

Step 14, according to the address of the new NAS, the FA requests to obtain the corresponding MA-FA from the new NAS, and executes step 15 after obtaining the MN-FA;

Step 15, the FA processes the received MIP-RRQ message according to the acquired key information. the

The embodiment of the present invention also provides a system for a network device to obtain a key, its specific implementation structure is shown in Figure 7, and may specifically include the following processing units:

(1) Authenticator

It is used to receive the key request from the network device that needs to obtain the key information, and send the generated key information corresponding to the terminal to the network device that needs to obtain the key information, which can specifically include:

(1) The key request receiving unit is used to receive the key request sent by the network device that needs to obtain the key information;

(2) A key information sending unit, configured to send the generated key information corresponding to the terminal to the network device that needs to obtain the key information after the key request receiving unit receives the key request. the

Optionally, the authenticator may further include a migration indication sending unit, configured to send indication information indicating that authenticator migration occurs to the network device that needs to obtain key information; the authenticator may specifically be a migration The post-migration authenticator may also be the original authenticator before migration; if the migration instruction sending unit is set in the original authenticator, and needs to send the address of the post-migration authenticator to the network device that needs to obtain key information, then The authenticator also includes a terminal information maintenance unit, configured to maintain the correspondence between the terminal and the address of the migrated authenticator, and optionally set a corresponding lifetime for the correspondence. the

Any of the following units may be included in this authenticator:

The key information direct sending unit is used to directly and proactively send the key information generated by the migrated authenticator to the network device that needs to obtain the key information;

The key information indirect transmission unit is used to send the key information generated by the migrated authenticator to the original authenticator, and the original authenticator sends the key information to the network device that needs to obtain the key information. the

In order for the terminal to determine whether the authenticator has migrated, the authenticator may further include an identification information sending unit for sending the address information of the authenticator or the hop number from the authenticator to the gateway as the identification information to the terminal. the

(2) Network equipment

The network device is a network device that needs to obtain key information. After receiving the indication information indicating that the authenticator has migrated, it sends a key request to the migrated authenticator, and receives the key information returned by the authenticator. . the

Specifically, the network devices that need to obtain key information can include:

(1) an authenticator migration determining unit, configured to determine that the authenticator corresponding to the terminal has migrated according to the received indication information indicating that the authenticator migration occurs;

(2) A key request acquisition unit, configured to send a key request to the migrated authenticator after the authenticator migration determining unit determines that the authenticator corresponding to the terminal has migrated, and to receive the key returned by the authenticator key information to obtain the key corresponding to the terminal. the

Optionally, the network device that needs to obtain key information may also include a judging processing unit, configured to determine that the key generated by the migrated authenticator has not been obtained after the authenticator migration determination unit determines that the authenticator migration has occurred. information, then notify the key request acquisition unit. the

Optionally, the network device that needs to obtain key information may also include an authenticator address obtaining unit, configured to receive and obtain address information of the migrated authenticator sent by the migrated authenticator or the original authenticator, and notify all The key request obtaining unit is configured so as to send the key request according to the address information. the

Optionally, the network device that needs to obtain key information may also include any of the following units:

The key information forwarding unit is used to receive the key information sent by the migrated authenticator, and send the key information to the migrated network device that needs to obtain the key information;

The network device migration notification unit is used to return to the migrated authenticator an indication of the migration of the network device that needs to obtain the key information or the need to obtain the key information after the migration after receiving the key information sent by the migrated authenticator The address information of the network device; or, actively send to the migrated authenticator the indication of the migration of the network device that needs to obtain the key information or the address information of the migrated network device that needs to obtain the key information; in order to facilitate the authentication after migration The device can send the key information to the migrated network device that needs to obtain the key information. the

(3) Terminal

In some application scenarios, the terminal may also send indication information indicating that the authenticator corresponding to the terminal has migrated to the network device that needs to obtain key information, so the terminal may also include a processing unit for determining whether the authenticator has migrated , which can specifically include:

The migration determination unit is used to receive the identification information sent by the authenticator during the authentication process, and compare the currently received identification information of the authenticator with the previously received identification information of the authenticator to determine whether the authenticator has migration;

The indication information transmitting unit is configured to send indication information indicating that authenticator migration occurs to the network device that needs to obtain key information after the migration determination unit determines that migration occurs. the

To sum up, the embodiment of the present invention solves the problem that the updated MIP key cannot be obtained when the NAS existing in the process of updating the MIP key by the FA is migrated, so that the competition scenario can be eliminated as much as possible, and the time for obtaining the key can be minimized Therefore, the embodiment of the present invention provides an implementation solution enabling the FA to obtain a valid MIP key, which overcomes the problems existing in the prior art. the

The above is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed in the present invention can easily think of changes or Replacement should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be determined by the protection scope of the claims. the

Claims (25)

1. A method for obtaining a key, characterized in that it is used to obtain key information for a network device that needs to obtain key information after the authenticator is migrated, including: The network device that needs to obtain the key information receives the indication information indicating that the authenticator migration occurs, receives the key information sent by the migrated authenticator, and obtains the key information of the corresponding terminal. 2. The method according to claim 1, wherein the network device that needs to obtain the key information receives it, and the migrated authenticator or the original authenticator or the terminal or home agent or authentication, authentication, The indication information sent by the accounting AAA server to indicate that the authenticator migration has occurred; or, The network device that needs to obtain the key information receives the indication information and the address of the migrated authenticator sent by the migrated authenticator or the original authenticator or the terminal, home agent or AAA server. 3. The method according to claim 2, wherein when the terminal sends the indication information, the method further comprises: During the authentication process, the terminal receives identification information of the authenticator sent by the network side; The terminal compares the currently received identification information of the authenticator with the previously received identification information of the authenticator to determine whether the authenticator has migrated. 4. The method according to claim 3, wherein the identification information includes: at least one item of address information of the authenticator, identification information of the authenticator, and hop counts from the authenticator to the gateway. 5. The method according to any one of claims 1 to 4, further comprising: The network device that needs to obtain the key information receives the key information actively sent by the migrated authenticator after generating the key information of the corresponding terminal; or, The network device that needs to obtain the key information receives the key information sent by the original authenticator after the migrated authenticator generates the key information of the corresponding terminal. 6. The method according to claim 5, characterized in that, after the network device that needs to obtain the key information determines that the authenticator corresponding to the terminal has migrated, the method further comprises: The network device that needs to obtain key information sends a key request to the migrated authenticator after determining that the key information of the corresponding terminal generated by the migrated authenticator has not been obtained. 7. The method according to any one of claims 1 to 4, wherein the network device that needs to obtain key information further includes obtaining the migrated authenticator before sending a key request to the migrated authenticator The steps of address information, and the steps include: Request to obtain the address information of the migrated authenticator from the original authenticator; or receive the address information of the migrated authenticator actively sent by the migrated authenticator or the original authenticator or terminal or home agent or AAA server. 8. The method according to any one of claims 1 to 4, wherein, during the authenticator migration process, if the network device that needs to obtain key information is also migrated, the method further includes any of the following steps: The migrated network device that needs to obtain the key information obtains the key information sent by the migrated authenticator through the original network device that needs to obtain the key information; The migrated network device that needs to obtain the key information sends the migration instruction of the network device that needs to obtain the key information or the address of the migrated network device that needs to obtain the key information to the migrated authenticator, and the migrated network device needs to obtain the key information. The authenticator sends the key information to the migrated network device that needs to obtain the key information; Received by the migrated network device that needs to obtain the key information, the migration instruction of the network device that needs to obtain the key information sent by the migrated authenticator after obtaining the original network device that needs to obtain the key information or the need to obtain the key information after migration The key information is sent after the address of the network device of the key information. 9. The method according to any one of claims 1 to 4, characterized in that before determining that the authenticator to which the terminal belongs has migrated, the network device that needs to obtain key information determines that the terminal has re-authenticated , and this step specifically includes: The security parameter index SPI between the terminal and the home agent is saved in the network device that needs to obtain the key information. If the SPI between the terminal and the home agent in the received registration request is different from the saved SPI, then it is determined that a duplicate occurs. certified. 10. A method for obtaining a key, which is used to obtain key information for a network device that needs to obtain key information after re-authentication, characterized in that it includes: The network device that needs to obtain the key information receives the key information of the corresponding terminal sent by the authenticator after receiving the indication information indicating that re-authentication occurs. 11. The method according to claim 10, wherein the authenticator is an authenticator performing re-authentication. 12. The method according to claim 11, wherein the network device that needs to obtain the key information starts a timer after receiving the indication information indicating that re-authentication occurs, and receives the terminal's key information within the validity period of the timer. key information. 13. The method according to claim 12, wherein if the key information is not received within the validity period of the timer, the mobile IP registration request sent by the terminal is discarded. 14. A network device, characterized in that it is used to obtain key information after the authenticator is migrated, the network device comprising: An authenticator migration determination unit, configured to determine that the authenticator to which the corresponding terminal belongs has migrated according to the received indication information indicating that the authenticator migration has occurred; The key request acquisition unit is configured to receive key information sent by the migrated authenticator after the authenticator migration determining unit determines that the authenticator to which the terminal belongs has migrated, and acquire key information corresponding to the terminal. 15. The device according to claim 14, characterized in that the device further comprises a judging processing unit, configured to, after the authenticator migration determining unit determines that authenticator migration occurs, if it is determined that the migrated authenticator has not been obtained the generated key information, then notify the key request acquisition unit; And the key request obtaining unit is further configured to send a key request to the migrated authenticator after obtaining the notification from the judging processing unit. 16. The device according to claim 14 or 15, characterized in that the device further comprises an authenticator address acquisition unit, configured to receive and acquire the address of the migrated authenticator or the migrated authenticator sent by the original authenticator. Address information, and notify the key request acquisition unit. 17. A system for obtaining keys, characterized in that it is used to obtain key information for network devices that need to obtain key information after the authenticator is migrated, and the system includes the authenticator and the network that needs to obtain key information equipment, among which, The authenticator is used to receive the key request sent by the network device that needs to obtain the key information, and send the generated key information corresponding to the terminal to the network device that needs to obtain the key information; A network device that needs to obtain key information receives indication information indicating that authenticator migration occurs, and receives key information sent by the migrated authenticator. 18. The system according to claim 17, wherein the system further comprises a terminal, and the terminal comprises: The migration determination unit is used to receive the identification information sent by the authenticator during the authentication process, and compare the currently received identification information of the authenticator with the previously received identification information of the authenticator to determine whether the authenticator has migrate; The indication information transmitting unit is configured to send indication information indicating that authenticator migration occurs to the network device that needs to obtain key information after the migration determination unit determines that migration occurs. 19. The system according to claim 18, wherein the authenticator further comprises an identification information sending unit, configured to send the address information of the authenticator or the hop count from the authenticator to the gateway as identification information to the terminal . 20. The system according to claim 17, 18 or 19, wherein the authenticator includes a key request receiving unit and a key information sending unit, wherein, A key request receiving unit, configured to receive a key request from a network device that needs to obtain key information; A key information sending unit, configured to send the generated key information corresponding to the terminal to the network device that needs to obtain the key information after the key request receiving unit receives the key request; 21. The system according to claim 17, 18 or 19, wherein the authenticator further comprises: A key information direct sending unit, configured to directly send the key information generated by the migrated authenticator to the network device that needs to obtain the key information; or, The key information indirect transfer unit is configured to send the key information generated by the migrated authenticator to the original authenticator, and the original authenticator sends the key information to the network device that needs to obtain the key information. 22. The system according to claim 17, 18 or 19, wherein the authenticator further includes a migration instruction sending unit, configured to send a message indicating that authenticator migration occurs to a network device that needs to obtain key information and/or the address of the migrated authenticator. 23. The system according to claim 22, wherein if the migration instruction sending unit sends the address of the migrated authenticator to the network device that needs to obtain key information, the authenticator further includes terminal information The maintenance unit is configured to maintain the corresponding relationship between the terminal and the address of the authenticator after migration. 24. The system according to claim 17, 18 or 19, wherein the network device that needs to obtain key information further includes: A key information forwarding unit, configured to receive the key information sent by the migrated authenticator, and send it to the migrated network device that needs to obtain the key information; or, The network device migration notification unit is used to return to the migrated authenticator an indication of the migration of the network device that needs to obtain the key information or the need to obtain the key information after the migration after receiving the key information sent by the migrated authenticator or actively send to the migrated authenticator an indication of the migration of the network device that needs to obtain the key information or the address information of the migrated network device that needs to obtain the key information. 25. A system for obtaining a key, characterized in that it is used to obtain key information for a network device that needs to obtain key information after re-authentication, and the system includes an authenticator and a network device that needs to obtain key information, in, The authenticator is used to send the generated key information corresponding to the terminal to the network device that needs to obtain the key information; The network device that needs to obtain the key information is configured to receive the key information corresponding to the terminal sent by the authenticator after receiving the indication information indicating that re-authentication occurs.

Images