GET VPN group member registration

Patent metadata

Field	Value
Publication number	US-9344434-B2
Application number	US-201314372732-A
Country	US
Kind code	B2
Filing date	Jul 9, 2013
Priority date	Jul 9, 2012
Publication date	May 17, 2016
Grant date	May 17, 2016

Abstract

An example of the present disclosure includes a Group Member (GM) registering on a Key Server (KS) in a Group Encrypted Transport Virtual Private Network (GET VPN). The KS is to manage at least one group, and GMs belonging to the same group have the same group ID. The KS receives a group ID and a Security Association, SA, policy list supported by a GM sent by the GM. The KS, according to the group ID, determines a KS SA policy list corresponding to the group, and matches the SA policy list supported by the GM with the KS SA policy list according to a priority. A group SA policy with the highest priority is sent the GM.

First claim

The invention claimed is:

1. A method for a Group Member, GM, to register on a Key Server (KS) in a Group Encrypted Transport Virtual Private Network (GET VPN) in which the KS is to manage at least one group, and GMs belonging to the same group have the same group ID; the method comprising:
receiving, by the KS from the GM, a group ID and a GM Security Association (SA) policy list of SA policies supported by the GM;
determining, by the KS, a KS SA policy list of SA policies corresponding to the group ID;
determining, by the KS, SA policies which are in both the GM SA policy list and the KS SA policy list; and
obtaining, by the KS, a group SA policy which is a SA policy with the highest priority among said SA policies which are in both the GM SA policy list and KS SA policy list;
after storing the group SA policy, sending, by the KS, the group SA policy to the GM;
after receiving a confirmation message of the GM, sending, by the KS, key information to the GM.

2. The method according to claim 1 , comprising:
when the KS determines a group SA policy cannot be identified for the GM, sending, by the KS, a notification message that the KS does not obtain a group SA policy to the GM, wherein the GM deletes an internet key exchange, IKE, SA for protecting a second stage negotiation generated in a first stage negotiation, and terminates the second stage negotiation.

3. The method according to claim 1 , the method further comprising:
storing, by the KS, the GM SA policy list sent by the GM.

4. The method according to claim 3 , the method further comprising:
when at least one GM in a group has registered on the KS, for a current GM in the group which want to register on the KS, determining, by the KS, whether the current GM supports a group SA policy stored in the KS according to a GM SA policy list supported by the current GM.

5. The method according to claim 4 , further comprising:
when the current GM supports the group SA policy, sending, by the KS, the group SA policy to the current GM; and
when the current GM does not support the group SA policy, performing, by the KS, a match among the GM SA policy list supported by the current GM, a KS SA policy list corresponding to the group ID, and at least one GM SA policy list supported by other GM in the group which has registered on the KS, and obtaining, by the KS, a group SA policy supported by all GMs in the group, and sending, by the KS, the group SA policy supported by all GMs in the group to the current GM.

6. The method according to claim 5 , the method further comprising:
when the KS determines a group SA policy supported by all GMs in the group cannot be identified, sending, by the KS, a notification message that the KS does not obtain a group SA policy supported by all GMs in the group to the current GM.

7. The method according to claim 5 , the method further comprising:
when obtaining, by the KS, the group SA policy supported by all GMs in the group, updating, by the KS, the group SA policy stored in the KS, and notifying, by the KS, other GMs which have registered on the KS of the group SA policy, wherein other GMs in the group which have registered on the KS update the group SA policy stored in locally after receiving the notification for updating the group SA policy.

8. A Group Member, GM to register on a Key Server, KS, in a Group Encrypted Transport Virtual Private Network, GET VPN, and the KS is to manage at least one group, and GMs belonging to the same group have the same group ID, the GM comprising: a processor; and a memory, wherein the memory has a communication connection with the processor, and is to store a group ID of a group to which the GM belongs, a GM SA policy list supported by the GM, and a group SA policy sent by a KS, and
the processor is to send the group ID of the group to which the GM belongs and the GM SA policy list supported by the GM stored in the memory to the KS; perform a confirmation according to the group SA policy sent by the KS, and send a confirmation message to the KS.

9. The GM according to claim 8 , wherein the processor is further to:
after receiving a notification message, sent by the KS, that no group SA policy is obtained, delete an IKE SA generated in a first stage negotiation for protecting a second stage negotiation, and terminate the second stage negotiation; and
after receiving a notification message, sent by the KS, for updating the group SA policy, update the group SA policy stored in the memory.

10. A Key Server, KS to register a Group Member, GM, on the KS in a Group Encrypted Transport Virtual Private Network, GET VPN, and the KS is to manage at least one group, and GMs belonging to the same group have the same group ID; the KS comprising: a processor; and a memory, wherein the memory has a communication connection with the processor, and is to store a KS SA policy list corresponding to each group, a GM SA policy list supported by a GM, and a group SA policy with the highest priority obtained from a match, and wherein
the processor is to receive a group ID of a group to which a GM belongs and a GM SA policy list supported by the GM sent by the GM,
according to the group ID of the group to which the GM belongs, determine a KS SA policy list corresponding to the group,
match the SA policy list supported by the GM with the KS SA policy list corresponding to the group for determining SA policies which are in both the SA policy list supported by the GM and the KS SA policy list corresponding to the group,
obtain a group SA policy which is a SA policy with the highest priority among said SA policies which are in both the SA policy list supported by the GM and the KS SA policy list corresponding to the group, store the group SA policy in the memory, and
send the group SA policy to the GM, and
after receiving a confirmation message sent by the GM, send key information to the GM.

11. The KS according to claim 10 , wherein the processor is to:
when at least one GM in the group has registered on the KS, for a current GM in the group wanting to register on the KS, determine whether the current GM supports the group SA policy stored in the memory according to the GM SA policy list supported by the current GM,
when the current GM supports the group SA policy, send the group SA policy to the current GM,
when the current GM does not support the group SA policy, perform a match among the GM SA policy list supported by the current GM, a KS SA policy list corresponding to the group, and at least one GM SA policy list supported by other GM in the group which has registered on the KS according to the priority, and obtain a group SA policy supported by all GMs in the group, and send the group SA policy supported by all GMs in the group to the current GM, and update the group SA policy stored in the memory.

12. The KS according to claim 11 , wherein the processor is to:
when no group SA policy supported by all GMs is obtained, notify the current GM that no group SA policy supported by all GMs is obtained, and
when the group SA policy supported by all GMs is obtained, notify other GMs which have registered on the KS that the group SA policy needs to be updated.

Assignees

• Hangzhou H3C Tech Co Ltd

Inventors

• Wang Zhanqun

Classifications

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/065

  for group communications (cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833) · CPC title

• H04L63/205 Primary

  involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24) · CPC title

• H04L63/105 Primary

  Multiple levels of security · CPC title

• H04L63/102

  Entity profiles · CPC title