Method and system for establishing ESP security alliance in communication system

Abstract

To create an ESP security association in a communication system, three methods are provided. I. A AAA server directly creates a security key and a mobile node MN for the ESP security association to obtain a security key from the AAA server or independently work out a safety security key, a preset a cryptographic algorithm and a SPI configured in advance. II. ESP security association parameters and MN are coordinated between a home agent HA and the mobile node MN to obtain a security key from the AAA server or independently calculate a same security key. III. The MN accesses to a shared key for bound updating of the current MN and the HA created during authentication as a preset key in the process of key interaction protocol, thus completing mutual authentication in the key protocol authentication and creating an ESP security association based on negotiation of the key interaction protocol. A security association is created between a HA and a MN with three methods above to ensure safety of service between consequent HA and MN.

Description

technical field [0001] The present invention relates to a method and a system for establishing a security association in a communication system in the field of communication, in particular to establishing an ESP (Encapsulating Security Payload, security load encapsulation) security between a mobile node (Mobile Node, MN) and a home agent (Home Agent, HA). Methods and systems for alliances. Background technique [0002] Among existing mobile IP technologies, Mobile IPv6 is one of the most effective mobile proposals today. As shown in FIG. 1 , it is a schematic diagram of a basic mobile IPv6 composition. Mobile IPv6 includes three entities: mobile node MN, home agent HA and communication node CN. An IPv6 mobile node is a node with multiple host addresses. It has a care-of address and a home address at the same time, where the care-of address is used to route IP packets, and its prefix is ​​the prefix of the visited link network. The care-of address is temporary, and it can...

AI Technical Summary

Problems solved by technology

[0006] In the PPR process, the two messages HoTI and HoT are transmitted in plain text, which cannot guarantee the privacy of the return routable process between the mobile node MN and the home agent HA, so it is easy to be monitored

After the malicious attacker obtains the H-Token and C-Token in the HoT and CoT messages, he can calculate the key information kbm of the subsequent BU process between the MN and the CN, so it cannot be guaranteed that the subsequent communication will occur in the mobile node as expected Between MN and related node CN

Eventually, wireless networks such as WiMax will not be able to support routing optimization R0 normally, reducing the efficiency of WiMax networks

Images