Method and system for negotiation based on IKE messages

Patent metadata

Field	Value
Publication number	US-9438566-B2
Application number	US-201314052470-A
Country	US
Kind code	B2
Filing date	Oct 11, 2013
Priority date	Oct 12, 2012
Publication date	Sep 6, 2016
Grant date	Sep 6, 2016

Abstract

The present invention provides a method and a system for negotiation based on IKE messages. A standby device updates a value of a stored third identity according to an update notification of an active device. The update notification of the active device is sent by the active device after updating a value of a stored second identity. When the standby device switches to a new active device, the new active device sends a second message for negotiating IPSec information to a peer device according to the updated third identity. The third identity is an identity that is stored in the standby device and used to acquire state information of the active device.

First claim

What is claimed is:

1. A method for negotiation based on internet key exchange (IKE) messages, the method comprising:
sending, by an active device, a first message for negotiating IPSec information to a peer device, wherein the first message carries a first identity;
updating, by a standby device, a value of a stored third identity according to an update notification of the active device, wherein the update notification of the active device is sent by the active device after the active device updates a value of a stored second identity during negotiating Internet Protocol Security (IPSec) information with the peer device;
sending, by a new active device according to the updated third identity, a second message for negotiating IPSec information to the peer device when the standby device switches to a new active device; and
sending a third message for negotiating IPSec information to the peer device, wherein a value of a first identity carried in the second message is different than a value of the first identity carried in the third message;
wherein the third identity is an identity that is stored in the standby device and used to acquire state information of the active device; and
wherein the state comprises an intermediate state and a stable state;
wherein the first identity of the first message is message_id;
wherein the second identity is next_sendmsg_id;
wherein the third identity is next_sendmsg_id;
wherein an initial value of the first identity of the first message, an initial value of the second identity, and an initial value of the third identity are the same and are all N;
wherein the updating of the value of the stored second identity comprises updating, by the active device, the value of the stored second identity to N+1; and
wherein the updating of the value of the stored third identity comprises updating, by the standby device, the value of the stored third identity to N+1.

2. The method according to claim 1 , wherein before updating the value of a stored third identity, the method further comprises:
updating, by the active device, the value of the stored second identity;
wherein the second identity is an identity that is stored in the active device and used to acquire state information of the active device.

3. The method according to claim 2 , wherein sending the second message for negotiating IPSec information to a peer device comprises sending, by the new active device, the second message for negotiating IPSec information to a peer device, wherein the value of the first identity carried in the second message is N+1.

4. A method for negotiation based on internet key exchange (IKE) messages, the method comprising:
receiving, by an active device, a first message for negotiating Internet Protocol Security (IPSec) information, wherein the first message is sent by a peer device and carries a first identity;
updating, by the active device, a value of a second identity stored in the active device during negotiating IPSec information with the peer device, and instructing a standby device to back up the value of the second identity;
updating, by the standby device, a value of a stored third identity according to an update notification of an active device, wherein the update notification of the active device is sent by the active device after the active device updates the value of the stored second identity; and
sending, by a new active device, a second message to the peer device when the standby device switches to the new active device, the second message being generated according to the updated third identity, wherein the second message is a response message of the first message;
wherein the third identity is an identity that is stored in the standby device and used to acquire state information of the active device, the state comprising an intermediate state and a stable state, the third identity comprising a flag that is set to 0 or 1;
wherein the first identity is message_id;
wherein the second identity is recv_message_id;
wherein the third identity is msgid_bk_flag;
wherein initial values of the first identity and the second identity are N, and an initial value of the third identity is 0;
wherein the updating, by the active device, of the value of the stored second identity comprises updating, by the active device, the value of the stored second identity to N+1; and
wherein the updating, by the standby device, of the value of the stored third identity comprises updating, by the standby device, the value of the stored third identity to 1.

5. The method according to claim 4 , wherein the value of the third identity is 1 and wherein sending, the second message to a peer device comprises:
resetting, by the new active device, the value of the third identity to 0;
updating the value of the second identity to N; and
generating a third message, wherein a value of the first identity carried in the third message is N, and the third message carries a second security association (SA).

6. The method according to claim 4 , wherein, before the standby device switches to the new active device, the method further comprises:
sending, by the active device, the second message to the peer device, wherein a value of the first identity carried in the second message is N and the second message carries a first security association SA; and
updating, by the standby device, the value of the stored third identity to 0 according to the update notification of the active device; and
wherein sending, by the new active device according to the updated third identity, the second message to a peer device comprises, if the value of the third identity is 0, re-sending the second message to the peer device.

7. The method according to claim 4 , wherein sending, by the new active device, the second message for negotiating IPSec information to a peer device comprises:
if the value of the third identity is 0, re-sending a second message for negotiating IPSec information to the peer device, wherein a value of the first identity carried in the second message is N and the second message carries a first security association SA; and
if the value of the third identity is 1, resetting the value of the third identity to 0, updating the value of the second identity to N, and re-sending a second message for negotiating IPSec information to the peer device, wherein a value of the first identity carried in the second message is N and the second message carries a second SA.

8. A system for negotiation based on internet key exchange (IKE) messages, comprising:
an active device comprising a first processor and a first memory; and
a standby device comprising a second processor and a second memory;
wherein the first processor is configured to send a first message for negotiating IPSec information to a peer device, wherein the first message carries a first identity;
wherein the second processor is configured to update, according to an update notification of the first processor, a value of a third identity stored in the second memory, wherein the update notification of the first processor is sent by the first processor after updating a value of a second identity stored in the first memory during negotiating Internet Protocol Security (IPSec) information with the peer device;
wherein the second processor is configured to send, according to the updated third identity in the second memory, a second message for negotiating IPSec information to the peer device when the standby device switches to a new active device; and
wherein the second processor is configured to send a third message for negotiating IPSec information to the peer device, wherein a value of a first identity carried in the second message is different than a value of the first identity carried in the thi

Assignees

• Huawei Tech Co Ltd

Inventors

• Zhang Wei
• Liu Ruirui
• Xie Wenhui
• Gao Guolu

Classifications

• H04L63/061 Primary

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title

• H04L63/164

  at the network layer · CPC title

• H04L63/04 Primary

  for providing a confidential data exchange among entities communicating through data packet networks · CPC title