Background technology
Current internet faces serious route scalability problem.The bgp routing table clauses and subclauses of IPv4 kept rapid growth always in recent years, had surpassed at present 400,000 clauses and subclauses, and this disposal ability and storage capacity to core router all is very large challenge.Along with applying gradually of IPv6, the address space that IPv6 is huge will cause more massive bgp routing table.In order to solve the problems such as route extensibility, the various countries researcher has proposed such as ILNP, LISP, GLI-Split, Ivip, many schemes such as integrated identification network.In general, these schemes all based on network identity separate (Locator/Identifier Separation) system with the position.
Identity and position separation system are separated into terminal iidentification (EID, Endpoint Identifier) and station location marker (LOC, Locator) with the Traditional IP address.Terminal iidentification represents terminal identity information, is used for transport layer and application layer marking terminal, has uniqueness, does not change with terminal location; Station location marker represents that terminal is connected to the topology location in the network, changes with fast mobile terminal.Simultaneously, identity and position separation system separate core net (Core Network) and Access Network (AN, Access Network), reduce the variation of Access Network routing iinformation to the impact of core net routing table.Packet use location sign in core net is carried out pathfinding and is transmitted.The communication mode of terminal room is identical with current network in the Access Network, and the tunnel router of the packets need source and destination end of two terminals is finished respectively packet tunnel encapsulation reconciliation encapsulation process according to map information (EID-to-LOC) between Access Network.Tunnel router inquiry mapped system obtains corresponding map information, and in the mapping buffer memory buffer memory most recently used map information.The map information of terminal comes storage and maintenance by mapped system, present more existing mapped system schemes, LISP-ALT for example, DHT-MAP, FIRM, LISP-TREE.
Along with popularizing of mobile device and increasing rapidly of mobile subscriber, people are increasing to the demand of mobile communication.In order under identity and position separation system, to support mobility, need to define safely and effectively mobility management protocol.Present correlative study mainly concentrates on mobility management scheme design basic under identity and the position separation system, concentrates to be absorbed in and reduces handover delay and packet loss, does not consider its fail safe.
The LISP-MN technical scheme of one of prior art:
The LISP-MN technical scheme is based on the mobility management scheme of main frame, and mobile node is carried out the function of tunnel router, finishes packet encapsulation and decapsulation.Mobile node uses mapping server (MS, Map Server) as its mobile anchor point, when mobile node moves, (EID) is constant for terminal iidentification, network distributes new station location marker (LOC) for it, new map information after mobile node directly upgrades it and moves to mapping server (MS, Map Server).Simultaneously, its map information of the renewal of the tunnel router of mobile node proactive notification opposite end.Along with increasing of mobile node, the map updating message that mapping server is received also just increases thereupon, and this has just increased the burden of mapped system.
The shortcoming of one of prior art LISP-MN technical scheme:
1. need to revise the protocol stack of mobile node, make its function that has tunnel router, and run counter to the original intention that LISP does not revise host protocol;
2. there are the problems such as handover delay, packet loss, signaling consumption;
3. along with mobile node increases, the burden of mapping server increases the weight of gradually, affects the extensibility of mapped system;
4. do not consider that mobile node moves the fail safe of switching.
Two IM technical scheme of prior art:
The IM technical scheme is based on the mobility solution of network.IM is divided in interregional movement and the zone mobile according to the large young pathbreaker's mobile node of moving range.Interregional movement refers to the movement of mobile node between the mobile management zone, moves in the zone and refers to that mobile node is in the movement of mobile management intra-zone.In IM, the tunnel router as convergent point (Rendezvous Point) in the zone is mobile anchor point.When mobile node was mobile in the zone, tunnel router sent agent binding update messages to convergent point, the positional information of announcement mobile node, and set up the transfer of data that mobile node is finished in the tunnel; Mobile node is interregional when mobile, and then interregional convergent point tunnel router model tunnel transmission mobile node data are upgraded the map information of opposite end tunnel router by the convergent point tunnel router, finish routing optimality.
The shortcoming of two IM technical schemes of prior art:
1. when mobile node moved, the node in the identical mobile management zone mail to that the data of mobile node have larger packet loss in the one's respective area;
2. do not consider that mobile node moves the fail safe of switching.
For prior art scheme above shortcomings, the present invention is proposed.
Embodiment
Embodiment 1:
Mobile node at the initial safe access procedure in territory, local as shown in Figure 1, step is as follows:
Step 1, MN are attached to ATR
1
Step 2, ATR
1Send identity request and challenging value CV (Challenge Value) to MN;
Step 3, MN generate random number R
1, the key P that uses MN and HAAA to share in advance encrypts CV and R
1, calculate E
P(CV||R
1), calculate message cryptographic Hash H (EID
2|| CV||E
P(CV||R
1)), then to ATR
1Send the access authentication request, message comprises: the terminal iidentification EID of MN
2, challenging value CV, enciphered message E
P(CV||R
1) and cryptographic Hash H (EID
2|| CV||E
P(CV||R
1)).E wherein
k(m) ciphertext behind the expression use key k enciphered message m, H () is hash function, " || " is the character string connector;
Step 4, ATR
1The access authentication request message is sent to HAAA;
Step 5, HAAA at first check cryptographic Hash H (EID
2|| CV||E
P(CV||R
1)), the integrality of acknowledge message.Then the key P deciphering of using MN and HAAA to share in advance obtains CV, and with message in unencrypted CV relatively.If cryptographic Hash or CV matching error are then refused the MN access, stop initial access process.If the match is successful for two values, then can confirm the MN identity.Then, HAAA uses handover key value GK=H (S||EID between the hash function computational fields
2) and the territory in switch key value LK=H (G||EID
2), wherein S is the wildcard of HAAA and other VAAA, G is the HAAA group key shared with the interior ATR in zone.Then HAAA uses wildcard P to encrypt GK, LK and R
1, calculate E
P(GK||LK||R
1) and cryptographic Hash H (Au||EID
2|| E
P(GK||LK||R
1)), wherein Au is the authentication success sign of MN;
Step 6, HAAA send to ATR with access confirmation message
1, content comprises authentication success sign A u, the terminal iidentification EID of MN
2, enciphered message E
P(GK||LK||R
1) and cryptographic Hash H (Au||EID
2|| E
P(GK||LK||R
1));
Step 7, ATR
1According to authentication success sign A u, confirm the MN authentication success, allow the MN access;
Step 8, ATR
1To TR
2Send position registration (Location-Register) message, the positional information EID of registration MN
2-LLOC
1
Step 9, TR
2Send mapping registration message (Map-Register) to mapping server MS, the map information EID of registration MN
2-to-LOC
2
Step 10, MS return mapping notice (Map-Notify) message, and the registration of affirmation MN map information is finished;
Step 11, TR
2To ATR
1Home position is confirmed (Location-Acknowledgement) message, confirms that the position information registration of MN is finished;
Step 12, ATR
1Access confirmation message is sent to MN, and content comprises authentication success sign A u, the terminal iidentification EID of MN
2, enciphered message E
P(GK||LK||R
1) and cryptographic Hash H (Au||EID
2|| E
P(GK||LK||R
1));
Step 13, MN check cryptographic Hash H (Au||EID
2|| E
P(GK||LK||R
1)), check the R that deciphering obtains
1With the R that had before sent
1Whether identical, check that Au confirms the authenticity of network, deciphering obtains GK and LK and storage, finishes two-way authentication;
Step 14, CN are to TR
1Send the general data bag, source data packet and destination address are respectively EID
1And EID
2
Step 15, TR
1Send map locating (Map-Request) message to MS, the map information of inquiry MN;
Step 16, MS are to TR
1Return mapping and reply (Map-Reply) message, comprise the map information EID of MN
2-to-LOC
2
Step 17, TR
1According to the map information encapsulated data packet of MN, for raw data packets adds new outside packet header, this source and destination address, packet header is respectively LOC
1And LOC
2Core net is carried out the pathfinding forwarding according to the Route Distinguisher of tunneling data bag to it;
Step 18, TR
2Decapsulation tunneling data bag removes TR
1The outside packet header of encapsulation, then TR
2Positional information EID according to MN
2-LLOC
1Packet is sent to ATR by the tunnel
1, concrete operations are TR
2For raw data packets increases new outside packet header, this packet header destination address is LLOC
1
Step 19, ATR
1After receiving the tunneling data bag, remove outside packet header, raw data packets is transmitted to MN.
Embodiment 2:
When mobile node switches in the zone, do not need aaa server to participate in, as shown in Figure 2.The handoff-security step of mobile node in the territory is as follows:
Step 1, MN and ATR
1Disconnect, be attached to ATR
2
Step 2, ATR
2Send identity request and challenging value CV (Challenge Value) to MN;
Step 3, MN generate random number R
1, handover key LK, encryption CV and R in the territory that obtains when using access
1, calculate E
LK(CV||R
1), calculate cryptographic Hash H (EID
2|| CV||E
LK(CV||R
1)), then to ATR
2Send and switch access request message, content comprises: the terminal iidentification EID of MN
2, challenging value CV, enciphered message E
LK(CV||R
1) and cryptographic Hash H (EID
2|| CV||E
LK(CV||R
1));
Step 4, ATR
2Check H (EID
2|| CV||E
LK(CV||R
1)), handover key LK=H (G||EID in the territory of the group key G calculating MN that use and HAAA share in advance
2).Deciphering E
LK(CV||R
1) obtain CV, and with message in unencrypted CV relatively, if the match is successful, ATR then
2Allow the MN access network, then calculate H (Au||EID
2|| R
1);
Step 5, ATR
2To ATR
1Send building tunnel request (AR-Tunne1-REQ) message, upgrade ATR
1The positional information of middle MN is EID
2-LLOC
2
Step 6, ATR
1To ATR
2Return building tunnel and reply (AR-Tunne1-Reply) message, finish and ATR
2Building tunnel, after this, ATR
1To ATR
2Transmitting the destination by the tunnel is EID
2Data;
Step 7, ATR
2Send switch acknowledgment message to MN, content comprises: authentication success sign A u, the terminal iidentification EID of MN
2With cryptographic Hash H (Au||EID
2|| R
1);
Step 8, MN check cryptographic Hash H (Au||EID
2|| R
1), check the random number R that deciphering obtains
1Random number R with previous generation
1Whether identical, confirm to finish handoff procedure;
Step 9, CN are to TR
1Send the general data bag, source data packet and destination address are respectively EID
1And EID
2
Step 10, TR
1According to map information EID
2-to-LOC
2Be the outside packet header of packet encapsulation, outside packet header source address and destination address are respectively LOC
1And LOC
2Core net is carried out the pathfinding forwarding according to the Route Distinguisher of tunneling data bag to it;
Step 11, TR
2Decapsulation tunneling data bag removes TR
1The outside packet header of encapsulation, then TR
2Positional information EID according to MN
2-LLOC
1Packet is sent to ATR by the tunnel
1, concrete operations are TR
2For raw data packets increases new outside packet header, this packet header destination address is LLOC
1
Step 12, ATR
1After receiving the tunneling data bag, remove its outside packet header, and be that the raw data packets of MN is transmitted to ATR by the tunnel with the destination
2, concrete operations are ATR
1For raw data packets increases new outside packet header, this packet header destination address is LLOC
2
Step 13, ATR
2After receiving the tunneling data bag, remove outside packet header, raw data packets is transmitted to MN;
Step 14, ATR
2Send the position and upgrade (Location Update) message, upgrade TR
2The positional information EID of middle MN
2-LLOC
2
Step 15, TR
2Home position is confirmed (Location Acknowledgement) message, confirms that the position renewal of MN is finished;
Step 16, CN are to TR
1Send the general data bag, source data packet and destination address are respectively EID
1And EID
2
Step 17, TR
1According to map information EID
2-to-LOC
2Be the outside packet header of packet encapsulation, outside packet header source address and destination address are respectively LOC
1And LOC
2Core net is carried out the pathfinding forwarding according to the Route Distinguisher of tunneling data bag to it;
Step 18, TR
2Decapsulation tunneling data bag removes TR
1The outside packet header of encapsulation, then TR
2Positional information EID according to MN
2-LLOC
2Packet is sent to ATR by the tunnel
2, concrete operations are TR
2For raw data packets increases new outside packet header, this packet header destination address is LLOC
2
Step 19, the data that mail to MN are no longer passed through ATR
1, directly arrive ATR
2, ATR
2After receiving the tunneling data bag, remove its outside packet header, raw data packets is transmitted to MN.
Embodiment 3:
Mobile node is in interregional handoff-security process, and the mobile node authentication does not need VAAA and HAAA mutual, as shown in Figure 3.Mobile node is as follows in interregional handoff-security step:
Step 1, MN and ATR
2Disconnect, be attached to ATR
3
Step 2, ATR
3Send identity request and challenging value CV (Challenge Value) to MN;
Step 3, MN generate random number R
1, handover key GK, encryption CV and R between the territory that obtains when using access
1, calculate E
GK(CV||R
1), calculate message cryptographic Hash H (EID
2|| CV||E
GK(CV||R
1)), then to ATR
3Send the mobile access request message of switching, content comprises: the terminal iidentification EID of MN
2, challenging value CV, enciphered message E
GK(CV||R
1) and cryptographic Hash H (EID
2|| CV||E
GK(CV||R
1));
Step 4, ATR
3To move switching access request message and be forwarded to VAAA;
Step 5, VAAA check cryptographic Hash H (EID
2|| CV||E
GK(CV||R
1)), the integrality of acknowledge message.Use the wildcard S of VAAA and HAAA to calculate GK=H (S||EID
2), unencrypted CV checks in the CV that deciphering is obtained and the message, if check successfully, then the MN identity is confirmed, otherwise refusal MN access network.Switch key value LK=H (G||EID in the territory of the group key G calculating MN that VAAA uses and the interior ATR in zone shares in advance
2), use GK to calculate E
GK(LK||R
1), encrypt LK and R
1, calculate cryptographic Hash H (Au||EID
2|| E
GK(LK||R
1));
Step 6, VAAA send to ATR with switch acknowledgment message
3, content comprises: authentication success sign A u, the terminal iidentification EID of MN
2, enciphered message E
GK(LK||R
1) and cryptographic Hash H (Au||EID
2|| E
GK(LK||R
1));
Step 7, ATR
3Confirm the MN authentication success according to Au, allow the MN access network;
Step 8, ATR
3To TR
3Send position registration (Location Register) message, the positional information EID of registration MN
2-LLOC
3
Step 9, TR
3To TR
2Send building tunnel request (TR-Tunne1-REQ) message, content comprises the positional information TR that MN is new
3(LOC
3) etc., inform the map information EID that its MN is new
2-to-LOC
3
Step 10, TR
2To TR
3Return building tunnel and reply (TR-Tunne1-Reply) message, finish and TR
3Building tunnel, and to TR
3The data of MN are mail in transmission;
Step 11, TR
3To ATR
3Home position is confirmed (Location Acknowledgement) message, confirms that the position registration of MN is finished;
Step 12, TR
3Send switch acknowledgment message to MN, message content comprises: the terminal iidentification EID of authentication success sign A u, MN
2, enciphered message E
GK(LK||R
1) and cryptographic Hash H (Au||EID
2|| E
GK(LK||R
1));
Step 13, MN check cryptographic Hash H (Au||EID
2|| E
GK(LK||R
1)), check the R that deciphering obtains
1Random number R with previous generation
1Whether identical, check and confirm to finish handoff procedure, and switch key value LK in the storage territory;
Step 14, CN are to TR
1Send the general data bag, source data packet and destination address are respectively EID
1And EID
2
Step 15, TR
1According to the map information encapsulated data packet of MN, for raw data packets adds new outside packet header, this source and destination address, packet header is respectively LOC
1And LOC
2
Step 16, TR
2After receiving tunnel packet, remove its outside packet header and obtain raw data packets.Because by the 9th step TR
2Known that MN moves to new zone, so TR
2Raw data packets is arrived TR by tunnel transmission
3, concrete operations are TR
2For adding new outside packet header in the raw data packets, its source and destination address is respectively LOC
2And LOC
3
Step 17, TR
3The outside packet header of removing the tunneling data bag obtains raw data packets.TR
3Positional information according to MN arrives ATR with Packet Generation
3, concrete operations are TR
3For raw data packets increases new data external packet header, its destination address is LLOC
3
Step 18, ATR
3Remove the outside packet header of tunneling data bag, raw data packets is transmitted to MN;
Step 19, TR
3Send map updating (Map-Update) message of MN to MS, upgrade the map information EID of MN
2-to-LOC
3
Step 20, MS are to TR
3Return mapping announcement (Map-Notifiy) message, confirm to finish map information and upgrade;
Step 21, TR
3To Correspondent Node TR
1Send map updating (MN-Map-Update) message of MN, to TR
1The map information of announcement MN is updated to EID
2-to-RLOC
3
Step 22, TR
1To TR
3Return map updating and answer (MN-Map-Reply) message, confirm that the map information of finishing MN upgrades, and finishes and mails to MN data transfer path optimization;
Step 23, CN are to TR
1Send the general data bag, source data packet and destination address are respectively EID
1And EID
2
Step 24, TR
1According to map information EID
2-to-LOC
3Be the outside packet header of packet encapsulation, outside packet header source address and destination address are respectively LOC
1And LOC
3Core net is carried out the pathfinding forwarding according to the Route Distinguisher of tunneling data bag to it;
Step 25, TR
3Decapsulation tunneling data bag removes TR
1The outside packet header of encapsulation, then TR
3Positional information EID according to MN
2-LLOC
3Packet is sent to ATR by the tunnel
3, concrete operations are TR
3For raw data packets increases new outside packet header, this packet header destination address is LLOC
3
Step 26, ATR
3After receiving the tunneling data bag, remove its outside packet header, raw data packets is transmitted to MN.
Embodiment 4:
Handover key and interregional handover key generation method in the zone of mobile node.The present invention uses the shared key of identity information and the aaa server of mobile node, when aaa server generates the handover key of mobile node in addition, can also increase extra information, such as Access Network coded message or aaa server sign etc.
Such as Fig. 4, have an aaa server in the Access Network at least, CN is in Access Network AN1, and MN moves to AN3 from Access Network AN2.MN is at ATR
1Finish initial access, then the mobile ATR that is attached to
2, move to again AN3 and be attached to ATR
3MN is at ATR
1Initial access process switches to ATR in AN2
2Process, and move to AN3 from AN2 and be attached to ATR
3Handoff procedure respectively with the present invention in mobile node initial safe access procedure, in the territory between mobile security handoff procedure and territory the mobile security handoff procedure corresponding.
Abbreviation and Key Term definition
Internet Engineering Task Force (IETF) Internet Engineering task groups
Locator/Identifier Separation identity is separated with the position
Proxy Mobile IPv6 (PMIPv6) proxy mobile IPv 6
Endpoint Identifier (EID) terminal iidentification
Locator (LOC) station location marker
Local Locator (LLOC) local position sign
Mobile Access Gateway (MAG) Mobile Access Gateway
The local mobile agent of Local Mobility Anchor (LMA)
Mobile Node (MN) mobile node
Map Server (MS) mapping server
Tunnel Router (TR) tunnel router
Access Tunnel Router (ATR) incoming tunnel router
Authentication, Authorization and Accounting (AAA) aaa server
Home AAA (HAAA) territory, local aaa server
Visited AAA (VAAA) access domain aaa server
Security Association (SA) Security Association
Access Network (AN) Access Network
Mobile Domain (MD) mobile management zone.