Creation method of end-to-end shared key and system

Abstract

The invention relates to a creation method of an end-to-end shared key, which comprises the following steps that: 1) a transmission source node NSource ransmits a firs key negotiation request packet to a core switch device SWCenter; 2) after receiving the first key negotiation request packet, the core switch device SWCenter creates a second key negotiation request packet to a destination node NDestination; 3) after receiving the second key negotiation request packet, the destination node NDestination creates a second key negotiation response packet to be transmitted to the core switch device SWCenter; 4) after receiving the second key negotiation response packet, the core switch device SWCenter creates a first key negotiation response packet to be transmitted to the transmission source node NSource; 5) and after receiving the first key negotiation response packet, the transmistion source node NSource creates an end-to-end shared key. The creation method and the system have better security performance.

Description

technical field [0001] The invention relates to the application field of communication network security, in particular to a method and system for establishing an end-to-end shared key. Background technique [0002] The wired LAN is generally a broadcast network, and the data sent by one node can be received by other nodes. All nodes on the network share the channel, which brings great security risks to the network. As long as the attacker accesses the network to monitor, he can capture all the data packets on the network. [0003] The local area network LAN defined by the existing national standard GB / T 15629.3 (corresponding to IEEE 802.3 or ISO / IEC 8802-3) does not provide data security methods, which makes it easy for attackers to steal key information. In the field of international research, the IEEE 802.1AE standard developed by IEEE provides a data encryption protocol for protecting Ethernet, and adopts hop-by-hop encryption security measures to realize the safe tran...

AI Technical Summary

Problems solved by technology

This security measure brings a huge computational burden to the switching devices in the LAN, which is easy to cause attackers to attack the switching devices; and the delay of data packets from the sending node to the destination node will also increase, reducing network transmission. efficiency

[0004] The topology of wired LAN is relatively complex, and the number of nodes involved (here, terminals and switching devices are collectively referred to as nodes) is also relatively large, so the data communication in the network is relatively complicated.

If a static key pair is distributed between LAN nodes to establish an end-to-end shared key, the distribution and update process is extremely complicated

Therefore, the static key pair method is not suitable for establishing an end-to-end shared key in the LAN

Images