CN1529531A - A method for mobile users to access security gateway - Google Patents

Abstract

The method includes configuring mode of access authentication, configuring and managing security policy as well as contents of generating and managing security alliance. The invention provides safety communication between remote side and private dedicated network in order to meet requirement of mobile communication and office work in current. Based on access mode of sharing secret key in advance, the invention provides secure authenticated access technique for mobile user, and configures own sharing secret key in advance for each mobile user.

Description

A method for mobile users to access security gateway

technical field

The present invention belongs to the information security technology in the field of information technology, and in particular relates to how to realize security protection by using the IPSEC/IKE protocol when a mobile user accesses a security gateway using the IKE protocol.

Background technique

The IKE (Internet Key Exchange protocol) protocol is a protocol commonly used to complete the key negotiation function on the Internet. It mainly cooperates with IPSEC (IP Security) to protect the data packets at the IP layer. The IKE protocol is suitable for the communication parties to directly negotiate the session key, which requires both parties to have the other party's identity information and secret information in advance to authenticate the other party's identity. With the rapid development of wireless networks, people pay more and more attention to the secure data communication of mobile users. Because mobile users often change physical locations, there is no guarantee that data communications will always take place within an enterprise or dedicated secure network. When they access the private network through the Internet, they must consider the security of data transmission on the Internet. The commonly used security gateway technology for mobile users to access private networks is the IPSEC/IKE protocol, which supports the negotiation of session keys between mobile users and the security gateway, establishes IPSEC security associations, and provides security protection for data at the IP layer.

There are four access authentication methods in the IKEv1 protocol. Since public key encryption requires a large amount of calculations, only two access authentication methods based on pre-shared keys and digital signatures are used in common IKEv1 implementations. However, due to the imperfect construction of the current public key infrastructure (PKI, Public Key Infrastructure), the use of digital signature access authentication methods has great limitations. Most mobile users use the IKE protocol to access security gateways. The authentication methods are all based on the pre-shared key.

Usually, when a mobile user uses IKE to connect to the security gateway, the user's identity is required. In IKEv1, there are many kinds of user identities, such as user domain name (user_fqdn), full domain name (fqdn), and IP address (ip_addr). When connecting with the user, the security gateway determines the corresponding security data through the user's identity and performs identity authentication. When a mobile user provides identity information in the form of a digital signature, the corresponding security data is also provided at the same time; and when a mobile user uses a pre-shared key for identity authentication, he must specify his identity by sending ID information, so that the security gateway Ability to look up matching credentials to authenticate it. However, when using the main mode of the first stage of IKEv1 for identity protection, the security gateway can only match the pre-shared key through the IP address of the mobile user, so due to the uncertainty of the IP address of the mobile user, access will not be realized certified. If the aggressive mode of the first phase of IKEv1 is adopted, the access authentication can be quickly completed because the ID information of the mobile user is not encrypted. There are currently some similar implementation methods, which use the main mode to realize the information exchange in the first phase of IKE, and require all mobile users to use the same default pre-shared key. The security of such access authentication will be greatly affected. Impact.

The security policy database provides security information for IKE to automatically carry out the second phase of negotiation. Due to the uncertainty of the IP address of mobile users, it is impossible to configure fixed security policies for them. It is necessary to dynamically generate temporary security policies for negotiating security associations.

Contents of the invention

The present invention mainly proposes a complete set of safe and efficient implementation methods for mobile users to access the security gateway, mainly aiming at the implementation methods when mobile users use pre-shared keys to achieve access authentication, including access authentication methods. Configuration, configuration and management of security policies, and creation and maintenance of security associations.

The method for the mobile user of the present invention to access the security gateway is as follows:

1. In IKE protocol configuration, when mobile users use pre-shared keys to achieve access authentication, set their ID configuration information to non-IP address types, such as user domain name (user_fqdn), complete domain name (fqdn ) or other forms supported in IKEv1; the access authentication mode of the mobile user is set to aggressive mode;

2. In the security policy database of the security gateway and the client of the mobile user, a general security policy template is specially set for the mobile user, which is used to dynamically generate a temporary security policy for the mobile user;

3. In the second phase of IKE negotiation, the security gateway and the mobile user follow their respective temporary security policies to negotiate security associations and generate the security associations needed for a session; when the session lasts for a long time, the security associations can be updated. However, the security policy does not need to be updated;

4. The temporary security policy of the mobile user will be automatically deleted after a session ends; the criterion for deleting the temporary security policy is when the status of the security association belonging to the temporary security policy is DEAD.

5. Use the IKE process to set time scheduling, and regularly check whether the lifetime of the security association generated by the temporary security policy expires; when the lifetime of the security association expires, check whether the temporary security policy records that the security association is being negotiated If the new one is being negotiated, it will not be processed. If it is not in the negotiating state, set the state of the security association to DEAD, and then delete the security association and the temporary security policy.

In the first step above, the identity ID of the mobile user does not need to be applied for on the security gateway, but it must be ensured that the user name on the security gateway corresponds to the pre-shared key. The storage of the user's key can be determined locally, as long as the security requirements can be met.

In the first step above, the aggressive mode can be set for all mobile users, and can also be configured for a single mobile user. Because some mobile users may use the digital signature authentication method, the main mode of IKE can be used for the first phase of information exchange.

The above-mentioned second step mainly includes the following aspects:

1. The security policy template must include the following content: security policy selector, data packet processing method (application, pass, discard), transcoding type (including protocol and algorithm), etc.;

2. A security policy template is a special type of security policy record, which is stored in the security policy database like other types of security policies. When the mobile user initiates the second phase of negotiation, since the source address of the template policy is zero, when the exact matching security policy cannot be found, the template policy will be adopted. (wherein the search principle mainly adopts the realization technology of Radix tree according to the security policy database. Refer to G.R.Wright and W.R.Stevens in "TCP/IP Illustrated, vol.2," of Addison-Wesley Publishing Company in 1995, introducing a special Radix trees, already used in Net/3, FreeBSD, and most high-end routers to organize routing tables.)

The third step above mainly includes the following steps:

1. How to apply the security policy template as a mobile user. When initiating the second phase of IKE negotiation, the source address in the selector in the security policy template is all zeros, and the user will find the template policy only when searching in the security policy database based on the destination address. Then generate a temporary security policy for mobile users according to the template policy, where it is only necessary to modify the source address in the selector to be the current IP address of the machine;

2. The application method of the security policy template when it is used as a security gateway. When receiving the first negotiation message in the second phase, the SPD is searched according to the source address, destination address, and port number carried in the identity payload in the message. Since it is a mobile user, there is no temporarily obtained IP in the SPD as the source The security policy of the address, so the security policy template will be found. The security gateway generates a temporary security policy in the security policy database according to the template policy, in which the initiator's IP address is used to replace all zero addresses in the template policy.

3. The security association record generated by the temporary security policy is the same as the normal security association record, but it must take time as the lifetime, which can be specified in the security policy template. Security association records belonging to the temporary security policy can still be automatically updated when the lifetime soft expires. In the above-mentioned fourth step, the temporary security policy is temporarily set up for a single mobile user. Due to the uncertainty of the IP address of the mobile user, after a session ends, there is no value of preservation. The end of a session means that the lifetime of the security association belonging to the security policy has expired and has not been automatically updated, which means that the security association is no longer used and its status is DEAD. When it is found that the state of the security association is DEAD, the security association and the temporary security policy to which it belongs are deleted.

By adopting the present invention, current mobile office users can be provided with safe communication with private private networks in different places, meeting the needs of current mobile communication and office work. Due to the imperfect construction of the current public key infrastructure (PKI, Public Key Infrastructure), the use of digital signatures to implement the access technology of the IKE protocol has great limitations. Based on the access form of the pre-shared key, the present invention provides safe authentication access technology for mobile users, and configures respective pre-shared keys for each mobile user.

Description of drawings

Figure 1 is a schematic diagram of an application scenario in which a mobile user accesses a security gateway using the IPSEC/IKE protocol.

Figure 2 is a schematic diagram of storing security policy templates in SPDB.

FIG. 3 is a schematic diagram of a temporary security policy generation process.

FIG. 4 is a flow chart of the SA state generated by the temporary SP using time scheduling polling by IKE.

Detailed ways

Below in conjunction with accompanying drawing, the implementation of technical scheme is described in further detail:

Figure 1 introduces a common scenario where mobile office users need to securely communicate with the company headquarters. Mobile users can access the local ISP at their location to obtain a network communication channel. Due to the open network of the Internet, the transmitted information may be maliciously attacked or intentionally eavesdropped. In order to protect the security of the communication data, it is necessary to use IPSEC/IKE to establish a security protection channel between the mobile user and the security gateway of the enterprise headquarters to encrypt and protect the data. Behind the security gateway is the internal network of the enterprise, which is generally considered to be a secure network, and no further security protection is required.

In Fig. 2, the structure of an SPDB based on Radix tree organization is simplified. According to the construction principle of the Radix tree, the storage location of the template type SP in the SPDB is the same as that of other types of SP.

The source IP address in the selector of the template SP must be set to all zeros, when the source address and the destination address (this destination address should be the IP address of the security gateway) in the IP packet of the mobile user are used as the selector of the SP to search the SPDB, It will not be possible to find the exact SP entry corresponding to it in the SPDB. According to the principle of the Radix tree and the principle of the SPDB, the template SP will be used to match it. In Figure 2, in the template policy of the security gateway, the address of the security gateway is 10.52.33.1, and the source address in the selector is the address of the mobile user, and its value is all zeros. The selector of the security policy is simplified, ignoring the upper layer protocol and port number. According to the construction principle of the Radix tree, Figure 2 is an example of a scenario where a template-type security policy is stored in the SPDB.

In Fig. 3, the generation process of the temporary SP is described in detail. When a request for an IP packet comes, it is necessary to search for the matching security policy in the SPDB, which requires constructing an SP selector first. The construction of the SP selector needs to obtain the source and destination addresses, upper-layer protocol and port number, etc. from the IP packet that caused the security policy search. If there is no upper layer protocol number or port number, all zeros will be filled in the selector. Then perform a matching search in the SPDB according to the selector. As a mobile user, it must match a security policy of the template type. When it is judged to be an SP of the template type, a new security policy is generated according to the content of the selector and inserted into the SPDB. Finally, modify the type of this newly generated security policy to be temporary. This process is the same on both the security gateway and the mobile client. The difference is that the operation of obtaining the template SP at the mobile client end is triggered by the user sending an IP packet. After the template SP is obtained, the temporary SP required by IPSEC will be generated according to the process in Figure 3; The gateway is activated according to the negotiation message of the second phase of IKE. After obtaining the template SP, it also adopts the same process to generate the required temporary SP, and continues to complete the negotiation of the second phase of IKE.

Figure 4 describes the flow of the time scheduling mechanism used in IKE to maintain the lifetime of the SA generated by the ephemeral SP. When the IKE process enters the time scheduling queue for processing, since the time scheduling queue is arranged in descending order of scheduling time, it first obtains the lifetime of the SA of the current scheduling task, and then determines whether it is hard to expire. If the lifetime of SA has not expired hard, it will exit the processing of the time scheduling queue; if the lifetime of SA has expired hard, it will turn to the processing task of SA. The process of processing the task is to find the SA record from the SADB, set the state of the SA record to DEAD, and obtain the selector of the temporary SP to which it belongs. Then, the IKE process sends an instruction to delete the SA record to the SADB, and then sends an instruction to the SPDB to delete the temporary SP to which the SA record belongs. After executing a scheduling task, the IKE process judges whether it is the end of the task queue. If not, it will process the next scheduling task, and if it is, it will exit the processing of the time scheduling queue.

In the present invention, it is required that the lifetime of the SA generated by the temporary SP must be counted by time. A scheduling queue is maintained in IKE to manage the lifetime of SAs generated by temporary SPs. Its scheduling interval can be adjusted as needed, generally not too frequently, and the interval can be in hours. This scheduling starts when IKE starts and does not exit until IKE ends.

The element unit of the dispatch queue is composed as follows:

1) SAID;

2) time lifetime;

Since there is no need to visit the SADB each time the scheduling queue is traversed, only when an expired SA appears, the corresponding SA and SP will be processed. See Figure 4 for the detailed process.

Claims (6)

1. A method for a mobile user to access a security gateway, characterized in that the method comprises the following processing steps: 1) In IKE protocol configuration, when mobile users use pre-shared keys to achieve access authentication, set their ID configuration information to non-IP address type, and set the access authentication mode of mobile users to active mode ; 2) In the security policy database of the security gateway and the client of the mobile user, a general security policy template is specially set for the mobile user, which is used to dynamically generate a temporary security policy for the mobile user; 3) In the second phase of IKE negotiation, the security gateway and the mobile user follow their respective temporary security policies to negotiate security associations and generate security associations needed for a session; when the session lasts for a long time, the security associations can be updated. However, the security policy does not need to be updated; 4) The temporary security policy of a mobile user will be automatically deleted after a session ends: 5) Use the IKE process to set time scheduling, and regularly check whether the lifetime of the security association generated by the temporary security policy expires; when the lifetime of the security association expires, check whether the temporary security policy records that the security association is being negotiated If the new one is being negotiated, it will not be processed. If it is not in the negotiating state, set the state of the security association to DEAD, and then delete the security association and the temporary security policy. 2. The method for a mobile user to access a security gateway according to claim 1, wherein the identity information type of the non-IP address type of the mobile user in the step 1) can be a user domain name, a complete domain name or other in IKEv1 supported form, and ensure that the username on the security gateway corresponds to the pre-shared key. 3. The method for mobile users to access the security gateway according to claim 1 or 2, characterized in that the aggressive mode in step 1) can be set for all mobile users, or can be configured for a single mobile user. 4. the method for mobile user access security gateway according to claim 1, is characterized in that, described step 2) also comprises: a. The security policy template includes the following contents: the selector of the security policy, the processing method of the data packet, and the type of transcoding; b. The security policy template is a special type of security policy record, which is stored in the security policy database like other types of security policies; when the mobile user initiates the second phase of negotiation, since the source address of the template policy is zero, when Template policies are used when an exact matching security policy cannot be found. 5. The method for mobile user access security gateway according to claim 1, characterized in that, said step 3) includes the following processing steps: a. When the security policy template is used as a mobile user, when the second phase of IKE negotiation is initiated, the source address in the selector in the security policy template is all zeros, and the user only searches the security policy database based on the target address , you will find the template policy; then generate a temporary security policy for mobile users according to the template policy, where you only need to modify the source address in the selector to the current IP address of the machine; b. When the security policy template is used as a security gateway, when receiving the first negotiation message in the second phase, the SPD is searched according to the source address, destination address, and port number carried in the identity payload in the message. For mobile users, there is no security policy for the temporarily obtained IP as the source address in the SPD, so the security policy template will be found; the security gateway generates a temporary security policy in the security policy database according to the template policy, and the IP address of the initiator is used Replace the all-zero address of the template policy; c. The security association record generated by the temporary security policy is the same as the normal security association record, but it must be timed as the lifetime, which can be implemented in the security policy template; the security association record belonging to the temporary security policy It is still possible to automatically renew when the lifetime soft expires. 6. The method for a mobile user to access a security gateway according to claim 1, characterized in that in step 4), the criterion for deleting the temporary security policy is that when the status of the security association belonging to the temporary security policy is for DEAD.

Images