CN100358326C - Wide-band wireless IP network safety system structure and realizing method - Google Patents

Abstract

The invention discloses a broadband wireless IP network safety system structure and a method for realizing safety. The safety system is realized at the network layer, including a BWIP safety system, a BWIP safety execution system, a BWIP network management system and an external support system. The BWIP network management system sets policies, presets shared symmetric keys, charging rates and monitors system resources for the BWIP security system; the BWIP security execution system invokes components of the BWIP security system to review incoming and outgoing network data packets and connection requests Filtering; the BWIP security system obtains user public key certificates and credit information from the external security support system, and cooperates with the external security support system to provide decision-making for the BWIP security execution system. Based on cryptographic operations, the network's confidentiality, integrity, authentication, authorization, and accounting and non-repudiation services are realized through the control of incoming and outgoing network data packets. The invention has the characteristics of complete functions, good openness, good transparency and strong versatility, and is suitable for the future broadband wireless IP technical field.

Description

Broadband Wireless IP Network Security Architecture and Its Security Realization Method

technical field

The present invention relates to the technical field of communication security, specifically a broadband wireless IP (Broadband Wireless Internet Protocol, referred to as BWIP) network security system structure and a method for realizing security, which are used to realize the overall security of the BWIP network, and are beneficial to future mobile e-commerce, mobile electronic Government affairs provide security technical guarantees.

Background technique

Existing security architecture solutions include: OSI (Open Systems Interconnection) security architecture standard (ISO/IEC7498-2); IPsec (IP security, secure IP) security proposed by IETF (Internet Engineering Task Force) in November 1998 Architecture (RFC2401, No. 2401 Request for Comments); WAP Architecture Specification (Document No. WAP-100-WAPArch-19980430-a) proposed by the WAP (Wireless Application Protocol, Wireless Application Protocol) Forum in April 1998; 3GPP (3G Security, Security architecture, Release 5) proposed in December 2002 by the 3rd Generation Mobile Communication Project Partnership Project. The common problems of these security systems are as follows:

1. The OSI security architecture standard (ISO/IEC7498-2) is a general security architecture framework provided by ISO (International Organization for Standardization) in 1989, called "Information Processing System Open System Interconnection Basic Reference Model Part 2—— Security Architecture", which provides a general description of security services and related security mechanisms, and identifies where these services and mechanisms can be provided within the reference model. According to the security threats that may exist in the network, the standard divides security into four levels, namely, link-level security, network-level security, end-to-end level security, and application-level security. Users can choose one according to their own security requirements during specific implementation. or implement security functions at multiple levels. The security framework is instructive, but does not give a specific implementation method, so it cannot be directly adopted.

2. The IPsec security architecture is a security architecture solution for a symmetrical application environment in a fixed network. It mainly considers the confidentiality and authentication functions in the wired network. It does not have the accounting function in the wireless network and cannot be directly used in the mobile environment. Special applications with low power consumption, small memory, weak processing capability, relatively low bandwidth and high error rate.

3. The WAP wireless application protocol is based on a new architecture, and its security mechanism is realized through the WTLS (Wireless Transport Layer Security) layer of the WAP1.X protocol stack. IP (Transmission Control Protocol/Internet Protocol) protocol stack compatibility issues, and there are many security holes in WTLS. WAP2.X changed the security mechanism of WAP to SSL/TLS (Secure Socket Layer/Transport Layer Security), and proposed to cooperate with PKI (Public Key Infrastructure, public key infrastructure) to provide the security guarantee of WAP protocol. This solution is mainly to solve the security problem of WAP at the transport layer. It is a wireless mobile IP protocol proposed by manufacturers such as mobile phones. It has compatibility problems with other mainstream wireless IP technologies such as IEEE802.11 (wireless local area network standard). , and thus is not a general broadband wireless IP security architecture.

3. The security architecture of 3GPP is based on the third generation of mobile communication. In terms of classification, the versatility is poor, and it cannot meet all the security requirements of future mobile IP and the AAA under wireless mobile PC (Personal Computer, personal computer) such as IEEE802.11.

It can be seen that none of the above security architectures can meet the security requirements of the future BWIP network. It is necessary to design a new security architecture and security implementation method, not only to meet the needs of BWIP network security performance, the system should also have good authentication, authorization and Accounting function, and can well take into account the relatively weak processing capability of mobile devices in the BWIP network in realizing these functions.

Contents of the invention

The purpose of the present invention is to overcome the deficiencies of the prior art, according to the security needs of broadband wireless IP networks, combined with security implementation technologies such as network management functions, cryptographic calculations, public key infrastructure, security IP, authentication, authorization and accounting AAA, using The idea of component reuse in software engineering organically integrates various functions in the security system, provides a broadband wireless IP network security architecture and security implementation method, and solves the future BWIP network security issues as a whole to meet the needs of broadband wireless IP networks. The need for IP network communication.

The technical solution of the present invention is to realize the overall security mechanism of the broadband wireless IP network on the network layer, and the security system structure of the broadband wireless IP network includes a BWIP security system, a BWIP security execution system, a BWIP network management system, and an external security support system; wherein, the BWIP security The system is the core system of the security architecture. It undertakes encryption and decryption, secure computing, authentication, authorization, accounting and security data management in the network. It consists of encryption engine CE, security environment database SEDB, security environment manager SEM, authentication, authorization and Accounting engine AAAE, policy database PDB, policy manager PM, log database ADB, log manager AM, credit database CDB, and credit manager CM; the functions of each component are:

Encryption engine CE, used to provide different cryptographic algorithms;

The security environment database SEDB is used to store various encryption keys;

Security Environment Manager SEM, which manages keys in SEDB;

Authentication, authorization and accounting engine AAAE, which authenticates mobile users, authorizes access and accounting operations according to different roles, and AAAE relies on CE and SEDB for necessary cryptographic operations;

The policy database PDB is used to store data and control the operation behavior of different roles on the BWIP network;

Policy Manager PM, used to manage PDB;

Credit database CDB, used to store user credit data;

Credit Manager CM for managing CDB;

The log database ADB is used to store log records related to security activities;

Log Manager AM for processing logs of security functional components;

The BWIP security execution system is the main system of the security architecture, which is the security processing interface between the security architecture and the internal and external networks, and is composed of the mandatory policy control engine PEE, the authentication, verification and integrity check engine AVIE, and the resource control framework RCF ;The role of each component is:

Mandatory policy control engine PEE, used to control all incoming requests from the Internet, make a decision to receive or intercept; filter data packets flowing from the intranet to the Internet, and make discard, bypass or encapsulation processing;

Authentication, Verification and Integrity Checking Engine AVIE, which checks the digital signature, data source authentication, and integrity check of the incoming data packets from the Internet, and securely encapsulates the outgoing data packets;

The resource control framework RCF controls, manages and monitors system resources, provides various environment variables, and provides time basis for the log database ADB;

The external security support system is an integral part of the public key infrastructure PKI, which is composed of a certificate authority CA, an authorization authority AA and a public credit database CP; wherein:

The certificate authority CA is used to accept online certificate requests, issue, review and produce certificates, issue certificates, archive and revoke certificates, update certificates, backup and restore keys, cross-certify, and provide users for AAAE authentication components Proof of the authenticity of CA, independent of the security architecture, is a recognized security and trustworthy institution;

Authorization agency AA, used to grant legal users the right to use system resources;

The public credit database CP is used to store relevant information proving the user's real right to use resources;

The data call relationship between the various systems is: BWIP network management system sets policies for the BWIP security system, presets shared symmetric keys, sets charging rates, preferential time periods, user credit information and resource control for the BWIP security execution system The BWIP security execution system calls the components in the BWIP security system to review and filter all data packets and connection requests flowing into and out of the BWIP network to decide whether to allow or prohibit them; the BWIP security system accesses the external security support system, Obtain the public key certificate and credit information of mobile users, and temporarily store the data in the security environment database SEDB and the credit database CDB for backup, so as to improve the operating efficiency of the system; the BWIP security system and the external security support system jointly provide decision-making for the BWIP security execution system in accordance with;

A method for realizing broadband wireless IP network security by utilizing the BWIP network security architecture, using cryptographic algorithms to process outgoing and incoming data, and realizing confidentiality services, integrity services, and AAA services for authentication, authorization, and accounting of the network. The nature service is to encrypt the outflow data and decrypt the inflow data; the integrity service is to encapsulate the outflow data in the AVIE, and the inflow data is checked by the AVIE for integrity; the AAA service is to outflow and inflow data packets Perform two-way authentication, authorization and accounting.

The above-mentioned security implementation method includes the security processing of outflowing network data, the security encapsulation process, the security processing process of inflowing network data and the authentication, authorization and accounting AAA processing process of outflowing and inflowing data. Through the above security processing process, the realization of Confidentiality service, integrity service, authentication, authorization, accounting AAA service of broadband wireless IP network including non-repudiation service.

Compared with the prior art, the present invention has the following characteristics:

1. Strong versatility, the present invention fully considers the security requirements and security functions of the broadband wireless IP network, realizes a network-level security solution, and incorporates them into the security system structure under the premise of maintaining all current wireless Internet technologies , improving the security and practicability of broadband wireless IP network;

2. Full-featured, the current security system structure all realizes security technology and security needs from different aspects. The present invention focuses on the development of future broadband wireless IP network security system, organically integrates the functions it should have, and Analyze and provide the implementation process of each main function in detail;

3. Good openness, adopting modular design ideas, which facilitates software reuse among system components, and good system flexibility, which is convenient for future expansion of new technologies and new algorithms;

4. Good transparency, the present invention realizes the security of broadband wireless IP network at network level, designs according to network infrastructure, provides corresponding security service by network provider, and security system structure is transparent to user; To application layer and transmission The security mechanism of the upper layer is directly applied and is transparent to the upper layer;

5. The present invention can meet standard requirements, and can provide confidentiality service, integrity service, authentication, authorization and accounting AAA service and non-repudiation service to broadband wireless IP network;

The invention integrates AAA and PKI functions, and takes into account the requirements of mobile users, mobile operators and Internet providers. Once it is put into use, it will have good economic benefits for the future BWIP.

Description of drawings

Figure 1 is the implementation location of the BWIP security architecture;

Figure 2 is the BWIP network security architecture model;

Fig. 3 is the flow chart of outgoing packet processing of BWIP security architecture;

Figure 4 is the BWIP security architecture outflow data encapsulation processing flow;

Fig. 5 is the flow chart of the incoming packet processing of the BWIP security architecture;

Fig. 6 is the AAA processing flow in the BWIP security architecture;

Detailed ways

Referring to Fig. 1, the transmission control protocol/Internet protocol stack TCP/IP includes an application layer, a transport layer, a network layer, and a link layer. The location of the broadband wireless IP network security architecture in the TCP/IP protocol stack is the network layer in Figure 1, that is, the network-level security implementation technology. The top two layers are the application layer and the transport layer of the TCP/IP protocol stack. This security architecture directly applies the security mechanisms of these two layers, that is, it is transparent to the upper layer. The bottom layer in Figure 1 corresponds to the link-to-host layer in the TCP/IP protocol, supporting existing or future broadband wireless access technologies, and its representative technologies include: wireless personal network WPAN, wireless local area network WLAN, wireless metropolitan area network WMAN 1. Wireless wide area network WWAN, the present invention transparently processes the above-mentioned broadband wireless access link security technologies, incorporates them into the security architecture, and maintains the characteristics of the respective access technologies. The standard IPsec protocol is adopted, which is not only applicable to IPv4 (version 4 IP address scheme), but also applicable to the future IPv6 (version 6 IP address scheme) environment, so that the present invention has good scalability and compatibility, and is also equivalent to network security infrastructure.

Referring to Fig. 2, the security architecture of the present invention consists of a BWIP security system, a BWIP security execution system, a BWIP network management system and an external security support system. Among them, the BWIP security system is the core system of the BWIP security architecture, responsible for encryption and decryption in the broadband wireless IP network, message authentication code MAC security calculation operation, authentication, authorization, accounting, and also encryption key, trust relationship, security policy management response The system consists of encryption engine CE, security environment database SEDB, security environment manager SEM, authentication authorization and accounting engine AAAE, policy database PDB, policy manager PM, log database ADB, log manager AM, credit database CDB, credit management The device CM is composed; the functions of each component are:

Encryption engine CE (Crypto Engine,) provides different cryptographic algorithms, such as symmetric encryption/decryption, asymmetric encryption/decryption, hash operation, etc., and provides encryption/decryption operation services for other components in the system;

The security environment database SEDB (Security Environment Database,) stores various encryption keys, such as the public-private key pair of the mobile node MN, the keys negotiated by the key exchange protocol IKE between the MN and all communication entities (MN-FA, MN- HA, etc.) and security association SA negotiated by different nodes for use by CE;

Security Environment Manager SEM (Security Environment Manager,) manages the keys in SEDB, provides the functions of manually configuring encryption keys and automatically managing keys, enables IKE negotiation keys and SA, and saves them in SEDB;

Authentication, Authorization, and Accounting Engine AAAE (Authentication, Authorization, and Accounting Engine,) authenticates mobile users, authorizes access and performs accounting operations according to different roles, and AAAE relies on CE and SEDB for necessary cryptographic operations. According to the current trend that AAA (authentication, authorization, and accounting) will be used as the wireless network infrastructure, the BWIP security architecture implements AAAE as an engine. It is quite a proxy component and can interact with other AAAs in the network regularly to form Hierarchical AAA management system instead of online bookkeeping, which is conducive to reducing the load on the BWIP network and improving network efficiency. Putting authentication and authorization into the BWIP security architecture facilitates fine-grained control of authentication and access, improving the flexibility of the BWIP security management system;

Policy database PDB (Policy Database) stores policy data and is used to control the behavior of different roles on the BWIP network operation;

Policy Manager PM (Policy Manager) manages PDB, and provides authorized users with manual or automatic mode to realize the editing function of policy database, such as downloading policy data through central policy server;

The credit database CDB (Credential Database) stores user credit data, such as public key certificates and attribute certificates;

Credential Manager CM (Credential Manager) manages CDB, and provides authorized users with manual and automatic editing functions for credit databases, such as searching or downloading credit data from external credit databases;

The log database ADB (Audit Database) stores log records of security-related activities;

The log manager AM (Audit Manager) processes the logs of security function components to provide a basis for analyzing problems and making decisions.

The BWIP security execution system is the main system, which is the security processing interface between the security architecture and the internal and external networks. It is composed of the mandatory policy control engine PEE, the authentication, verification and integrity check engine AVIE, and the resource control framework RCF; the functions of each component are:

Enforcement policy control engine PEE (Policy Enforcement Engine) is the main component of the security execution system, its role is to control all incoming requests from the Internet, and make a decision to receive or intercept; the data packets flowing from the intranet to the Internet are filtered by PEE Filter, discard, bypass or encapsulate processing;

Authentication, Verification and Integrity Inspection Engine AVIE (Authentication Verification IntegrityEngine) performs digital signature inspection, data source authentication, and integrity inspection on incoming data packets from the Internet, and securely encapsulates outgoing data packets;

Resource Control Frame RCF (Resource Control Frame) controls, manages and monitors system resources, provides various environment variables, such as system clock, and provides time basis for log database ADB;

The BWIP network management system is the man-machine interface of the internal security management personnel, and is composed of configuration management, security management, fault tolerance management, accounting management and performance management components; the present invention expands the security management, accounting management and performance management components, The above five management components are equivalent to user interface interfaces. Through these management interfaces, users can easily and effectively manage the network by adopting a visualized method. This management mode separates the network management system from the security system layer, which is convenient for modular implementation, and also makes the implementation of BWIP security architecture more flexible and easy to update new algorithms.

The external security support system is an integral part of the public key infrastructure PKI, which is composed of the certificate authority CA, the authorization authority AA and the public credit database CP; among them:

CA (Certification Authority) is the core component of the PKI system, accepting online certificate requests, issuing, reviewing and making certificates, issuing certificates, archiving and revoking certificates, updating certificates, backing up and restoring keys, and interleaving Authentication, which provides user authenticity proof for the authentication components in AAAE, CA is independent of the security architecture and is a recognized security and trustworthy institution;

Authorization Authority AA (Authorization Authority) grants legal users the right to use system resources, usually in the form of attribute certificates;

The public credit database CP (Credentialre Posory,) stores relevant information that proves the user's authenticity in using resource rights, and can store public key certificates, attribute certificates, and certificate revocation lists (CRL).

The dotted boxes in Figure 2 indicate the service relationship of each system for data call through the interface. The BWIP security execution system is the window for the external service of the entire security architecture, and is responsible for all data packets and connection requests flowing into and out of the BWIP network. Review and filter to decide whether to allow or prohibit; the BWIP security execution system invokes various components in the BWIP security system to provide security services for the BWIP security execution system; When the cryptographic system provides services such as confidentiality and authentication, the BWIP security system also needs to access the external security support system, which provides the mobile user's public key certificate and credit information, and provides this information to AAAE, and temporarily stores these data in In the security environment database SEDB and the credit database CDB, the purpose is that when the BWIP security architecture provides services for mobile users again within the effective time, there is no need to visit the external security support system again, so as to improve the operating efficiency of the system; through the BWIP security system and the external The cooperation of the safety support system provides a reliable decision-making basis for the BWIP safety execution system.

The BWIP network management system is a human-machine interface set up to improve the flexibility of the BWIP security system structure. Through the BWIP network management system, security managers can easily set policies for the security system, preset shared symmetric keys, and set charging fees Rates and discounts, setting user credit information and monitoring system resources.

The present invention realizes the confidentiality service of the broadband wireless IP network, the integrity service, and the AAA (authentication, authorization, accounting) service through the mutual cooperation of the BWIP network management system, the BWIP security system, the BWIP security execution system and the external security support system. Various security services such as non-repudiation services.

The security service of the BWIP network is realized by processing the incoming and outgoing data packets in the network system. The components in the security architecture are also organized together reasonably according to the needs of security functions. The method of structure realization security is described. In each drawing of FIG. 3 to FIG. 6 , the control flow in the BWIP security architecture is represented by a solid line, and the data call and data interaction relationship between different system components are represented by a dotted line.

Referring to Figure 3, when the data packets forwarded by the transport layer of the system node or the Intranet network are transmitted to the external network, the BWIP network security architecture processes the data packets flowing out from the network as follows:

1. The filter in the mandatory policy control engine PEE filters the database packet, and its operation process is that the filter requests the policy manager PM to query the policy database PDB according to the IP address and port of the packet to obtain the processing strategy;

2. Perform strategy processing: if the security policy is discarded, the mandatory policy control engine PEE only needs to simply discard the packet, and pass the processing information to the log manager AM, and record it in the log database ADB through AM; if it is safe If the policy is bypass, it indicates that this type of data packet does not require security processing, such as management signaling in some BWIP networks, etc., then PEE only needs to directly hand over the data packet to the IP layer for IP encapsulation, and the The IP layer can perform IP forwarding operations; if the security policy is encapsulation processing, PEE will hand over the data packet to the authentication, verification and integrity checking engine AVIE;

3. AVIE performs security encapsulation processing. AVIE first requests the security environment manager SEM to query whether there is a corresponding security association SA for the communication entity in the security environment database SEDB. If there is no SA or the SA is invalid, the key negotiation is enabled through the SEM The protocol IKE negotiates the corresponding SA, encryption and decryption key, Hash key, encryption algorithm, authentication algorithm, etc.; if the security negotiation fails, the data packet is discarded, and the negotiation result information is sent to the log manager AM, which is recorded in the log through AM In the database ADB; when the negotiation is successful, the negotiated data is first saved to the security environment database SEDB, and the processing result is returned to the authentication, verification and integrity checking engine AVIE;

4. AVIE requests authentication, authorization and accounting engine AAAE to perform corresponding authentication, authorization and accounting AAA operation, and AAAE returns the operation result information to AVIE. Since the AAA operation is a complex process, it is represented by shading in Figure 3. After receiving the return result of the AAAE operation of the authentication, authorization and accounting engine, AVIE first sends the AAAE return result to the log manager AM, and records it into the log database ADB through AM, so that the system security management personnel can view the log and improve security Strategy;

5. The authentication, verification and integrity checking engine AVIE processes the return result of the authentication, authorization and accounting engine AAAE: if the AAA operation fails, the AVIE only needs to discard the data packet and record it in the log database ADB; The operation is successful, indicating that the system allows the data packet to flow out of the network;

6. AVIE requests the security environment manager SEM to call the encryption engine CE, and CE performs corresponding security encapsulation processing operations according to the security association SA parameters in the security environment database SEDB. CE operation is also a complex process, which is represented by shading in Figure 3. After CE completes data encapsulation, it returns the result to the authentication, verification and integrity checking engine AVIE;

7. AVIE directly delivers the encapsulated data packet to the IP layer, and the IP layer adds a new IP header and adds it to the IP forwarding queue, or sends it directly to the Internet network.

Referring to Fig. 4, the process of encapsulating the data packets allowed to flow out of the network or security system in Fig. 3 is carried out as follows: the authentication, verification and integrity check engine AVIE sends the transport layer data packets of required encapsulation to the security environment manager SEM, SEM invokes the encryption engine CE to securely encapsulate the data packet;

1. The encryption engine CE preprocesses the data first. This is because the encryption technology is carried out in groups. It is necessary to add the initial vector IV and padding characters to form an integer multiple of the encrypted block. The preprocessed message is represented by M (Message )express;

2. CE retrieves the security processing parameters corresponding to the security association SA from the security environment database SEDB, including encryption key K1, hash key K2, signature key K3, serial number SN, and security parameter index SPI;

3. CE encrypts the message M, uses f(M, K1) to represent the encrypted encapsulated payload, and fills the serial number SN and security parameter index SPI into the header format of the encapsulation protocol to form the encapsulation header. By splicing the encapsulation header and the encapsulation payload, the confidentiality service of the BWIP security architecture is realized;

4. In Fig. 4, the encryption engine CE continues to carry out the hash operation to the encapsulated data with the hash algorithm specified in the hash key K2 and the security association SA, so as to realize the integrity service, use MAC=h (encapsulation header, encapsulation load, K2) means;

5. Considering that some protocols need to digitally sign the message, the encryption engine CE also needs to use the signature key K3 to sign the generated message authentication code MAC value; since the signature service is optional, it is represented by S(MAC, K3) The signature of the MAC value realizes non-repudiation;

6. After the encryption engine CE completes the above security encapsulation, it will generate the encapsulation header, encapsulation payload and signed MAC together, and hand it over to the IP layer for corresponding IP encapsulation, that is, add a new IP header to form IP data The packet is added to the IP forwarding queue and waits for the data forwarding operation.

So far, the BWIP security architecture has completed the security processing of outgoing data packets.

In the BWIP network security architecture, after the sender of the message performs security processing on the data packet, the receiver also needs to perform corresponding security operations.

Referring to Figure 5, the data inflow processing steps of the BWIP network security architecture at the receiver are as follows:

1. The authentication, verification and integrity check engine AVIE receives an IP packet from the Internet, and requests the security environment manager SEM to query the security environment database SEDB according to the security parameter index SPI in the IP packet encapsulation header;

2. Determine whether the SPI is valid: if the security parameter index SPI does not exist or has expired, the AVIE will directly discard the data packet and record the processing information in the log database ADB;

3. If the SPI is valid, the AVIE requests the SEM to call the encryption engine CE to perform an integrity check to determine whether the data packet has been actively attacked during transmission. AVIE's integrity check of data packets consists of three steps:

The first step is to request the encryption engine CE to perform password calculation and decrypt the mark used for message authentication code MAC protection. In order to complete this operation, CE needs to obtain the decryption key from the security environment database SEDB, and the decryption result is returned to the sender to send HASH value; if the protocol stipulates that the MAC is digitally signed, the security environment manager SEM also needs to call the external security support system to obtain the valid certificate of the mobile user from the certificate authority CA, and use the public key in the certificate to authenticate the message Signature verification with code MAC, if the verification fails, the authentication, verification and integrity check engine AVIE will be notified, and the failure reason will be given; if the verification is successful, the decrypted MAC will be returned to AVIE;

The second step is that AVIE requests CE to calculate the HASH value of the data packet according to the negotiated HASH function and return it to AVIE;

The third step is that the AVIE compares the decrypted HASH value with the recalculated HASH value. If they are equal, it indicates that the integrity check of the data packet is successful, otherwise it is a failure.

If the integrity check fails, the authentication, verification and integrity check engine AVIE will automatically discard the incoming data packet, and record the corresponding integrity check information into the log database ADB;

4. If the integrity check is successful, AVIE will request to call the authentication, authorization and accounting engine AAAE to perform corresponding AAA operations, and AVIE will receive the return result of the authentication, authorization and accounting engine AAAE operation;

5. Pass the return result of AAAE to the log manager AM, and record it into the log database ADB through AM, so that the system security management personnel can view the log and improve the security strategy;

6. AVIE processes the results returned by the authentication, authorization, and accounting engine AAAE. If the AAA operation fails, AVIE only needs to discard the data packet and record it in ADB; if the AAA operation is successful, it indicates that the system allows the data packet.

According to the packet access network, AVIE requests the security environment manager SEM to call the encryption engine CE;

7. CE performs a corresponding decryption operation on the encapsulated payload according to the security association SA parameters in the security environment database SEDB (put the decryption behind the process, because the decryption message is relatively large and takes up a lot of time, the purpose is to improve the processing efficiency of the system) , AVIE passes the decrypted message plaintext to the enforcement policy control engine PEE;

8. The PEE requests to call the policy manager PM to query the policy database PDB, and the PEE checks the queried security processing policy with the access method;

9. If it conforms to the local policy, forward it to the internal intranet network or to the upper layer of the network protocol; otherwise, discard the plain text of the message and record the processing information in the log database ADB. So far, confidentiality and integrity services for incoming data have also been realized.

The mandatory policy control engine PEE of the present invention checks the policy of the plain text of the message, which is beneficial to filter the content of the data packet and improve the security of the BWIP network system.

The present invention performs AAA operation on both the inflow and outflow data packets, aiming at the requirement of two-way traffic statistics in the BWIP network, and at the same time can better realize access control, and is beneficial to improving the usability of the BWIP security system structure.

Referring to Figure 6, the authentication, authorization and accounting AAA processing of the BWIP security architecture is implemented in the following steps:

1. Certification

1. The authentication, verification and integrity check engine AVIE requests the authentication, authorization and accounting engine AAAE to perform authentication, authorization and accounting AAA operations;

2. After the AAAE receives the request, the authentication component performs the source authentication of the data packet and the user identity verification operation on the security parameter index SPI contained in the request packet through the encryption engine CE. The following implementation methods can be used for authentication:

Authentication implementation mode 1. An authentication method using a preset shared symmetric key

The encryption engine CE takes out the pre-negotiated symmetric key and algorithm from the security environment database SEDB according to the security association SA, and performs corresponding cryptographic operations to determine the authenticity of the user identity and the source of the message;

Authentication implementation mode 2. Authentication method using public key system

The encryption engine CE first queries the security environment database SEDB. When there is no relevant public key and other information, CE accesses the external security support system through the security environment manager SEM. From the external security support system, the certificate authority CA, public credit database CP and The authority AA obtains the mobile user's public key certificate, the mobile user's credit data and the user's authorization information. While saving these data to the security environment database SEDB, the security environment manager SEM also requests the credit manager CM to transfer the mobile user's The credit information is stored in the credit database CDB for the purpose of accelerating the subsequent authorization process or accelerating the process of BWIP security architecture providing AAA service for mobile users again within the effective time. After the encryption engine CE obtains the user's public key information, it performs cryptographic calculation on the signature information according to the user's public key, and returns the calculation result to the authentication component of the authentication, authorization and accounting engine AAAE, which verifies the digital signature Compared, the authentication of the user or the authentication of the data source is realized.

3. If the authentication fails, the authentication component terminates the AAA operation process, and returns the authentication failure information to the authentication, verification, and integrity check engine AVIE through the authentication, authorization, and accounting engine AAAE;

4. If the authentication is successful and the authorization operation needs to be continued, the authorization component performs the authorization operation. The purpose of the authorization service is to prevent unauthorized use of resources, including that network entities cannot send confidential information to other network entities without permission; and unauthorized users cannot obtain confidential information and network resources inside the network.

2. Authorization

1. The authorization component makes an authorization decision based on the name of the mobile request object and the information provided by the AVIE, and extracts the corresponding policies and policies from the policy database PDB, credit database CDB or public credit database CP in the form of "index codes" respectively. Credits, the authorization component also requests the mobile facility to provide environment variables, including the system clock and resource monitoring components within the Resource Control Framework RCF;

2. After collecting all the required information, the authorization component processes the data authorization operation according to the internal rules, and takes the concise form of "request authorization success" or "authorization rejection" as the authorization result;

3. If the authorization fails, the authorization component returns the "authorization rejection" information to the authentication, verification and integrity checking engine AVIE through the authentication, authorization and accounting engine AAAE, and the AVIE records the "authorization rejection" information into ADB and discards it the packet;

4. If the authorization is successful and the bookkeeping operation is to be performed, the control right of the system is handed over to the bookkeeping module, and the corresponding bookkeeping process is continued.

3. Bookkeeping

1. Accounting operation According to the identity of the requester ID, a record with user ID, access time, access destination, access information volume and other information is generated, and stored in the accounting database of the authentication, authorization and accounting engine AAAE In the process, the bookkeeping service in the AAA service is completed;

2. After the accounting component completes the accounting tasks for users, the authentication, authorization and accounting engine AAAE returns the processing result information to the authentication, verification and integrity checking engine AVIE, and AVIE also records the operation information to the log database ADB Among them, the advantage of adopting double records is that it is beneficial to resolve billing disputes.

Through the above-mentioned inflow and outflow security processing methods, the BWIP network security architecture can well realize various security service purposes required by the current BWIP network.

Claims (6)

1. wide-band wireless IP network B WIP Security Architecture, it is characterized in that realizing on network layer the general safety mechanism of broadband wireless IP network, it comprises BWIP safety system, BWIP safety executive system, BWIP network management system, external security support system;

Described BWIP safety system is carried out encryption and decryption in network, safety is calculated, authentication, mandate, book keeping operation and secure data management are made up of crypto engine CE, security context database SEDB, security context manager SEM, Certificate Authority and book keeping operation engine AAAE, policy database PDB, policy manager PM, log database ADB, log manager AM, credit database CDB, credit management device CM; Acting as of each assembly:

Crypto engine CE is used to the cryptographic algorithm that provides different;

Security context database SEDB is used to store various encryption keys;

Security context manager SEM, the key among the management SEDB;

Authentication, authorization and accounting engine AAAE carry out authentication to the mobile subscriber, granted access and book keeping operation operation, and AAAE depends on CE and SEDB carries out necessary crypto-operation;

Policy database PDB is used for store data, and the control mobile subscriber is to the operation behavior of BWIP network;

Policy manager PM is used to manage PDB;

Credit database CDB is used to deposit user's credit data;

Credit management device CM is used to manage CDB;

Log database ADB is used to deposit the log record relevant with security activity;

Log manager AM is used to handle the daily record of safety function assembly;

Described BWIP safety executive system is the secure processing interface between Security Architecture and the internal-external network, and by force policy Control Engine PEE, authentication, checking and integrity checking engine AVIE and resource control framework RCF form; Acting as of each assembly:

Force policy Control Engine PEE is used for all are controlled from the inflow request of Internet, makes the decision that receives or tackle; The packet that flows out to Internet from Intranet is filtered, make abandoning, detouring or encapsulation process;

Authentication, checking and integrity checking engine AVIE carry out inspection, Data Source authentication, the integrity checking of digital signature to the packet that flows into from Internet, and the packet that flows out is carried out secure package;

Resource control framework RCF controls, manages and monitor system resource, and various environmental variances are provided, and ADB provides basis of time for log database;

Described external security support system is the part of PKIX PKI, is made up of certificate agency CA, the AA of authorized organization and public credit database CP; Wherein:

Certificate agency CA, be used to accept online certificate request, the the signing and issuing, examine and make of certificate, certificate issuance, the filing of certificate and cancelling, the renewal of certificate, the backup of key and recovery, cross-certification is for the certified component of AAAE provides user's authenticity to prove, CA is independent of outside the Security Architecture, is the secure and trusted mechanism that generally acknowledges;

The AA of authorized organization is used for validated user is authorized the power of using system resource;

Public credit database CP is used to deposit the relevant information that the proof user truly uses resource right;

Data call between each system is closed: the BWIP network management system is carried out strategy setting, preset shared symmetric key, toll rate and preferential period and user's credit information is set and BWIP safety executive system resource is monitored the BWIP safety system; BWIP safety executive system is called each assembly in the BWIP safety system, to all inflows with flow out the BWIP output packet and connection request is examined, filtered, allows or forbids with decision; The BWIP safety system is visited the external security support system, obtains mobile subscriber's public key certificate and credit information, and cooperates with the external security support system, for BWIP safety executive system provides decision-making foundation; Said system is worked in coordination, for the broadband wireless IP network provides confidentiality services, and integrity service, authentication, authorize, keep accounts AAA service and undeniable sex service.

2. method of utilizing the described wide-band wireless IP network security architecture of claim 1 to realize the wide-band wireless IP network security, the utilization cryptographic algorithm is handled flowing out and flowing into data, realization is to confidentiality services, integrity service and authentication, the authorization and accounting AAA service of network, described confidentiality services is to encrypt flowing out data, is decrypted flowing into data; Described integrity service is to encapsulate at AVIE flowing out data, carries out integrity checking to flowing into data by AVIE; Described AAA service is to carry out two-way authentication, authorization and accounting to flowing out and flowing into packet.

3. the method for realization wide-band wireless IP network security according to claim 2 is characterized in that the processing of flowing out packet from the BWIP network is implemented according to the following steps:

1) delivers next data message to the outer net transmission from the transport layer or the Intranet network of system node, filter through force policy Control Engine PEE filters earlier, PEE filter request policy manager PM obtains security strategy according to the IP address and the interface querying policy database PDB of this packet;

2) security strategy is handled, if security strategy is defined as and abandons, then PEE abandons this packet, and process information is passed to log manager AM, records log database ADB by AM; If security strategy is defined as and detours, then PEE hands over the IP layer to carry out the IP encapsulation this packet, and carries out IP by the IP layer and transmit operation; If security strategy is defined as encapsulation process, then PEE gives authentication, checking and integrity checking engine AVIE with this packet and carries out secure package and handle;

3) authentication, checking and integrity checking engine AVIE request security context manager SEM, the security association SA of this communication entity of inquiry if security association SA is arranged, directly enters next program in security context database SEDB; If no SA exists or SA lost efficacy, then enable key agreement protocol IKE by SEM, consult corresponding SA, encryption and decryption key, Hash key, cryptographic algorithm, identifying algorithm, consult to fail then packet discard, negotiation information is recorded log database ADB; Consult successfully, just preserve the data of consulting and arrive SEDB, and result is returned to AVIE;

4) authentication, checking and integrity checking engine AVIE request authentication, authorization and accounting engine AAAE carry out the AAA operation, and AAAE returns object information to AVIE;

5) authentication, checking and integrity checking engine AVIE will authenticate, the return results of authorization and accounting engine AAAE is passed to log manager AM, record log database ADB by AM;

6) AVIE handles the return results of authentication, authorization and accounting engine AAAE; If the AAA operation failure, then AVIE abandons this packet, and records log database ADB;

7) if AAA operates successfully, authentication, checking and integrity checking engine AVIE request security context manager SEM call crypto engine CE and carry out the secure package operation;

8) crypto engine CE finishes the data security encapsulation, the result is returned to authentication, checking and integrity checking engine AVIE, directly give the IP layer with the packet of encapsulation, the IP layer adds new IP head again, and join among the IP forwarding queue, or directly send in the Internet network.

4. according to the method for claim 2 or 3 described realization wide-band wireless IP network securitys, it is characterized in that the secure package that allows to flow out output packet is carried out according to the following steps:

1) data that authentication, checking and integrity checking engine AVIE will need to encapsulate are delivered to security context manager SEM, call crypto engine CE by SEM these data are carried out secure package;

2) crypto engine CE carries out preprocessing process with data, adds initial vector IV and fills character, and forms the integral multiple of fixing group, represents with M through pretreated message;

3) crypto engine CE takes out the safe handling parameter of this security association SA correspondence from security context database SEDB, comprises encryption key K1, Hash key K2, signature key K3, sequence number SN, Security Parameter Index SPI;

4) crypto engine CE is to message M cryptographic operation, and (M, the encapsulation load after K1) expression is encrypted, and sequence number SN and Security Parameter Index SPI inserted in the header format of tunneling form capsule header, realize flowing out the confidentiality services of data with f;

5) crypto engine CE carries out the operation of Hash with the hash algorithm of appointment among Hash key K2 and the SA to encapsulation of data, and (K2) expression realizes flowing out the integrity service of data for capsule header, encapsulation load with MAC=h;

6) need message carry out digital signature person according to protocol requirement, crypto engine CE is with the message authentication code MAC value signature of signature key K3 to generating, with S (MAC, K3) signature of expression MAC value;

7) crypto engine CE finishes above-mentioned secure package, and the MAC behind the capsule header, encapsulation load and the signature that generate is spliced, and hands over the IP layer to carry out corresponding IP encapsulation, promptly add new IP head, form the IP packet, join again among the IP forwarding queue, wait for the data forwarding operation.

5. the method for realization wide-band wireless IP network security according to claim 2 is characterized in that the BWIP Security Architecture flows into processing enforcement according to the following steps to recipient's data:

1) authentication, checking and integrity checking engine AVIE receive an IP bag from Internet, seal Security Parameter Index SPI in the mounted head portion according to IP, request security context manager SEM query safe environment data base SEDB, judge the validity of this SPI, if this SPI does not exist or surpassed the term of validity, then AVIE directly abandons this packet, and this process information is recorded among the log database ADB; If SPI is effective, then AVIE request SEM calls crypto engine CE and carries out integrity checking;

2) crypto engine CE carries out integrity checking to flowing into packet, if the integrity checking failure, AVIE abandons this stream packets automatically, and inspection message is recorded log database ADB;

3) if integrity checking is successful, the authentication of AVIE request call, authorization and accounting engine AAAE authenticate, authorization and accounting AAA operation;

4) authentication, checking and integrity checking engine AVIE receive the operating result of authentication, authorization and accounting engine AAAE, and outcome record is arrived log database ADB;

5) authentication, checking and integrity checking engine AVIE to the authentication, authorization and accounting engine AAAE return results handle, if the authentication, the authorization and accounting operation failure, then AVIE abandons this packet, and records log database ADB; If operate successfully, show that system allows this packet accesses network;

6) AVIE request security context database SEM calls crypto engine CE, according to the security association SA parameter among the SEDB corresponding decryption oprerations is carried out in the encapsulation load;

7) message after authentication, checking and integrity checking engine AVIE will decipher expressly passes to force policy Control Engine PEE, request query strategy database PDB;

8) force policy Control Engine PEE checks the safe handling strategy and the access mode of inquiry, if meet local policy, then transmits to inner Intranet network or to the procotol high level; Otherwise abandon this message, and process information is recorded among the log database ADB.

6. according to the method for claim 2 or 3 or 5 described realization wide-band wireless IP network securitys, it is characterized in that authentication, authorization and accounting AAA handle by following flow implementation:

1) authentication, checking and integrity checking engine AVIE request authentication, authorization and accounting engine AAAE carry out the AAA operation;

2) after authentication, authorization and accounting engine AAAE received this request, certified component carried out source authentication, the subscriber authentication of packet to the Security Parameter Index SPI that comprises in the request package by crypto engine CE;

1. adopt the authentication method of preset shared symmetric key, CE calls key and the algorithm consulted in advance according to security association SA from security context database SEDB and carries out corresponding crypto-operation, to determine the authenticity of user identity and informed source;

2. verify data adopts the authentication method of public key system, crypto engine CE elder generation query safe environment data base SEDB then, when there not being relevant public key information, then by security context manager SEM visit external security support system, from certificate agency CA, public credit database CP and authorized organization AA place obtain mobile subscriber's public key certificate, mobile subscriber's credit information and user's authorization message, SEM also asks credit management device CM that mobile subscriber's credit information is saved among the credit database CDB when these data of preservation arrive security context database SEDB; After CE obtains user's public key information, PKI according to the user carries out cryptography calculating to signing messages, and result of calculation is returned to the certified component of authentication, authorization and accounting engine AAAE, carry out the checking of digital signature by certified component and compare, to realize user's the authentication or the authentication of data source;

3) as if authentification failure, then certified component stops the AAA operation, and by AAAE authentification failure is returned to authentication, checking and integrity checking engine AVIE;

4) if authentication success, the then Authorized operation that is undertaken by authorized component;

5) aaa authorization process determines according to following data message: authorized component is carried out authorization decision according to the information that the title and the AVIE of mobile request object provides, and these information are extracted corresponding strategy and credit with the form of " index code " from policy database PDB and credit database CDB or public credit database CP respectively, authorized component also asks MOVING STRUCTURE that environmental variance is provided, and comprises system clock and monitoring resource assembly in the resource control framework RCF;

6) authorized component is collected the information that all need, and carries out Authorized operation according to internal rule, if authorization failure, then authorized component will " be authorized refusal " information is returned AVIE by AAAE, records among the log database ADB and abandons this packet;

7) if the operation of authorizing successfully and will keep accounts, then by the AAA assembly operation of keeping accounts of keeping accounts;

8) the book keeping operation assembly is according to the identity of requestor ID, generate a band destination of user ID, access time, visit and the information record of visit information amount are arranged, and deposit the book keeping operation database of authentication, authorization and accounting engine AAAE in, finish the billed services in the AAA service;

9) after the book keeping operation assembly is finished book keeping operation, the processing result information of authentication, authorization and accounting engine AAAE is returned to authentication, checking and integrity checking engine AVIE, AVIE also records log database ADB with this information simultaneously, adopts this dual logging to help solving the dispute of note expense.

Images