Conversation control method and control device

Abstract

A method for controlling conversation distributes corresponding system resource to IKE consultation process from pre-reserved system resource corresponding to trustful P2P body and returns response message back to IKE consultation initiator when pre-reserved system resource corresponding to trustful P2P body corresponding to group of IKE consultation initiator is not fully occupied after the first request message of IKE consultation process sent by IKE consultation initiator is received. The control device used for realizing said method is also disclosed.

Description

technical field [0001] The invention relates to information security technology, in particular to a session control method and a control device, belonging to the communication field. Background technique [0002] The Internet Key Exchange Protocol (Internet Key Exchange, referred to as IKE) is the general name of the authentication and key protocol family, which includes the Internet Security Association and Key Management Protocol (abbreviated ISAKMP), Key Determination Protocol (referred to as Oakley) and general Internet Secure Key Exchange Protocol (SKEME for short). [0003] The ISAKMP protocol is the core component of IKE. It defines the whole process and message format including negotiation, establishment, modification and deletion of security associations, and defines the payload format for exchanging key generation and identity authentication data. The definition of these formats provides a fixed framework for key transmission and authentication that is independent...

AI Technical Summary

Problems solved by technology

Therefore, when an attacker frequently sends IKE requests including different cookies in a short period of time, the maximum number of connections limited by the IKE mechanism can be completely occupied within the timeout aging period stipulated in the IKE protocol, causing other IKE negotiation initiators to be unable to Establishes an IKE connection with the system, resulting in an increased denial of service attack

In particular, if an attacker pretends to be a legitimate IKE negotiation initiator and frequently sends IKE requests including different cookies in a short period of time, the maximum number of IKE connections will be quickly occupied, causing other IKE negotiation initiators to be unable to communicate with the system. Establish IKE connection

[0009] Take the application scenario above as an example. When an attacker frequently sends attack packets with changing cookies, the cookie mechanism can be quickly overridden in a short time. The total number of limited IKE sessions is full, so that other gateways with addresses other than gateway A cannot perform normal IKE negotiations with gateway B

[0010] In addition, in addition to DoS attacks, there are other attacks that may exhaust system resources, causing other IKE negotiation initiators to fail to perform normal IKE negotiations with the system.

Images