|Publication number||US8085797 B2|
|Application number||US 12/279,958|
|Publication date||Dec 27, 2011|
|Filing date||Sep 3, 2007|
|Priority date||Sep 14, 2006|
|Also published as||CN101517986A, CN101517986B, DE102007001831A1, EP2062400A1, EP2062400B1, US20090097416|
|Publication number||12279958, 279958, PCT/2007/7675, PCT/EP/2007/007675, PCT/EP/2007/07675, PCT/EP/7/007675, PCT/EP/7/07675, PCT/EP2007/007675, PCT/EP2007/07675, PCT/EP2007007675, PCT/EP200707675, PCT/EP7/007675, PCT/EP7/07675, PCT/EP7007675, PCT/EP707675, US 8085797 B2, US 8085797B2, US-B2-8085797, US8085797 B2, US8085797B2|
|Inventors||Ingo Gruber, Torsten Langguth, Henrik Schober|
|Original Assignee||Rohde & Schwarz Gmbh & Co. Kg|
|Export Citation||BiBTeX, EndNote, RefMan|
|Patent Citations (12), Non-Patent Citations (2), Referenced by (3), Classifications (10), Legal Events (2)|
|External Links: USPTO, USPTO Assignment, Espacenet|
Future generations of radio equipment will have significantly more flexible applications opportunities than existing radio devices. This flexibility will be achieved through the concept of “software defined radios” (SDR). SDRs create the possibility of loading radio technologies (waveforms) as software and of changing the configuration of the waveforms and the radio equipment in a flexible manner via software control. The modelling of radio-transmission methods in this context can also support the transmission of data packets according to the Internet Protocol (IP) standard. This allows the use of standard IP applications and known concepts, which are also used for the internet.
Dependent upon the security requirements, sensitive information must be capable of being transmitted in coded manner (communications security, COMSEC). This can be achieved, for example, through the use of the IPsec standard, which is described in S. Kent, K. Seo, “Security Architecture for the Internet Protocol”, IETF RFC 4301, December 2005.
This standard allows two different transmission methods for the coded information: the transport mode and the tunnel mode, as presented in
The tunnel mode is used for security-relevant and confidential communication. In the tunnel mode, two network levels, which are completely separate from one another, are formed. The red level is the confidential level. Only authorised persons have access to a red network. By contrast, the black network represents a publicly-accessible network and can therefore be classified as non-secure. Confidential information can be transmitted from a red network via a black network only in a coded manner. These networks initially have no information about one another as a result of the strict use of the tunnel mode. From the point of view of the red network level, the tunnel mode represents a transparent tunnel through to another red network and conceals the black network level existing behind it.
However, this complete separation also has a disadvantageous effect on the overall network architecture. Information must be available in the coding devices regarding which red networks are connected to a black decoding device. This is necessary so that the appropriate black target address can be entered in the newly-generated IP headers in the tunnel mode.
Several network users are combined in a communications network. As shown in
The black addresses of the coding devices in a network are determined automatically by a protocol with address auto-configuration. A conventional routing protocol is used for routing within the black network hierarchy. The exchange of signalling information ensures consistency of the topology within the black network. However, to allow a connection of terminal devices, it must also be possible to exchange data between the red network and the black network. This, once again, presupposes knowledge of the address mapping between the black and red addresses of the coding device. However, the IPsec channel mode used prevents a direct mapping of the known black addresses onto the red addresses. Accordingly, a simultaneous routing in both networks is no longer possible. The IPsec discovery protocol, for example, can be used for an automatic exchange of red-network routing information between coding devices.
A brief introduction to the addressing of IP networks is provided below by way of explanation of the solution presented according to the invention and the problems of the existing, prior-art solution.
An unambiguous identification of the final users is required in order to transmit data between two users in the global internet. The routing nodes can then determine the optimum route between transmitter and receiver with reference to the target address, without a need for the transmitter to know the precise route. In order to identify a user unambiguously, an address consists of a network identifier and a device identifier. The network identifier identifies the network, in which the user is disposed, while the device identifier determines the individual user within a network. In this context, the overall address is formed by combining the two address components, as illustrated in
All the devices within a network use the same network identifier, while the device identifier is different in each case. Accordingly, it is necessary for final users to change their network identifier, as soon as they implement a change of network. This is necessary so that the new connection of the terminal device does not need to be signalled to every routing node in the internet and so that a direct connection to the network can be made with reference to the network identifier. The network identifier of a terminal device is required for routing within the global network.
The device identifier must be individual and unambiguous for every device participating in the global network. For example, it can be based on the MAC address of the network card, but may also be generated from another parameter. Accordingly, a device can already be identified unambiguously with reference to the device identifier. It is constant and does not change over time.
Through the routing protocol of the black network, the coding devices only have knowledge of the black addresses of all users participating in the network. In order to establish a secure connection between final users, each of which are disposed within a red network, the unambiguous and confidential allocation between the black addresses of the de-coding device and the red network connected to it must first be implemented. This allocation of the red and black addresses can be determined using the IPsec discovery protocol. A flow chart for this protocol is illustrated in
In order to obtain the confidential mapping between a black address and a red address of a coding device, the coding device A transmits a “hello probe” message to a specially-provided multi-cast address. Every user participating in the network therefore receives this message. The message contains the security certificate of the coding device A with a valid signature from the certification authority. The certificate also contains the key of the coding device A. After the receipt of the message, the coding device B checks the authenticity of the certificate using the root certificate from the certification authority and authenticates it using the signature or the key of the coding device A. After a successful authentication, the coding device B transmits a “hello reply” message back to the coding device A. This contains the same information from coding device B. After this information has been checked by coding device A, the security-association negotiations (SA negotiations), which, inter alia, specify the cryptoalgorithm and the duration of validity for the authentication and the key, are initiated. Since the mutual red addresses are so far not known to the communicating partners, the SA negotiations cannot be implemented in the IPsec tunnel mode, but must be implemented in the IPsec transport mode. Accordingly, the IP header of the data packets is transmitted between the coding devices in an un-coded manner, and only the actual content of the data packet is coded. After successful negotiations by the SA, the coding devices can transmit their red addresses in coded manner in the IPsec transport mode. Only after this procedure is it possible to set up a tunnel connection between the coding devices.
In order to communicate with a special user of another red network, a hacker-proof tunnel must first be set up between these two red networks. This requires knowledge of the responsible coding device for the respective terminal device and the red networks connected to it. Since the IPsec discovery protocol supports only a sequential exchange of mapping information with each individual coding device, tunnels must be set up in pairs between all coding devices, in order to obtain a complete knowledge of the address allocations of every coding device in the network. Accordingly, in the worst-case, in order to establish a connection to a previously-unknown red user, the IPsec discovery protocol must be used with all possible coding devices. The cost for the coding device of the source therefore increases in a linear manner with the number of coding devices N: cost ˜O(N). If new coding devices and their connected networks are to be included in the overall network, the IPsec discovery protocol must therefore be executed with every other coding device. As a result, the potential signalling cost for the overall network increases according to O(N2).
In addition to the cost for the identification of the red terminal devices within its own network, the IPsec discovery protocol must also be executed in the event of a change of network. As already described, a change of network requires a change of the network identifier, so that the overall address of the coding device is also changed. Terminal devices connected to the coding device are therefore no longer identifiable within the new network. Accordingly, the IPsec discovery protocol must again be executed with every further coding device in the new network, so that every device knows the secret address allocation of every other device.
This behavior is particularly critical in radio networks. In an environment with limited radio resources, increased stabilization costs resulting from the IPsec discovery protocol are critical, especially where the environment is highly dynamic and the topology changes frequently. Moreover, a frequent change of network by individual devices, that is to say, by coding devices together with terminal devices, can occur especially in radio environments. The number of passes of the IPsec discovery protocol required can burden radio resources even further in this context, so that a meaningful communication of applications may no longer be possible in radio environments using the tunnel-coding mode, because the signalling-data traffic has increased to such an extent.
The invention therefore provides a method and a system for secure communication, which allows good data security and system availability with low signalling costs.
Accordingly, the invention provides a method for addressing and routing in coded communications relationships in at least two different network levels with different routing levels, which are separated from one another within a network, wherein, in each case, a first network level with the associated first routing level is demarcated from a second network level with a second routing level via at least one coding device, wherein a network topology of both network levels is determined and stored independently from one another in respective routing tables in the at least two routing levels, and wherein an interface with an unambiguous allocation of addresses of the second routing level to addresses of the first routing level is provided in the at least one coding device.
The invention further provides a system for addressing and routing in coded communications relationships within a network with at least two different, mutually-separate network levels and the associated routing levels, wherein, in each case, a first network level with the associated first routing level is demarcated from a second network level with a second routing level via at least one coding device, wherein the network topology of both network levels is stored in separate domains of the system, and wherein an intermediate domain, which is disposed between the separate domains as a protocol instance with two bi-directional communication routes, is provided.
The invention proposes an efficient method for obtaining current routing information on the basis of unambiguous allocations between red network addresses and black device identifiers. These allocations can be described, for example, by unambiguous functions or via a look-up table. The method avoids the laborious and resource-intensive exchange of signalling and routing messages in order to obtain the current red network topology and the corresponding routing information. This information can be derived directly using the unambiguous allocation of black device identifiers to red network addresses. If a device is known in the black network with its black device identifier, it is possible to infer the red network connected to this user immediately via the allocation.
The concept of the look-up tables makes use of a table initially configured in advance and stored in the coding device for the allocation between black device identifiers and red networks. The use of the method according to the invention means that the IPsec discovery protocol is not required, and the signalling traffic necessary for an exchange of routing information between the users' red networks can be avoided. In particular, in radio environments with limited radio resources, the availability of the radio network can be significantly increased by not using the IPsec discovery protocol.
An exemplary embodiment of the invention is explained below with reference to the drawings. The drawings are as follows:
In view of the separation of the confidential, red network level (abbreviated below as the red-network level) from the black, public-network level (abbreviated below as the black-network level) by means of the coding device 4, the network topology in the routing tables 17 of the corresponding routers must first be mapped in both network levels independently of one another. Since the black routing tables 17 always contain all of the information about the users in the black, public network 2, it is possible to reduce the signalling messages by also exploiting this information on the red, confidential side. This can be achieved by introducing an unambiguous allocation, which describes a relationship between the black, public device identifier and red, confidential network addresses 8. This mapping describes which red networks are connected via a coding device to the black side with a given black device identifier. Knowledge regarding the accessibility of devices with an individual black device identifier therefore provides information regarding the red networks connected to them.
This concept can be realized, for example, through pre-configured tables in all participating coding devices 4 or through an unambiguous mapping, such as a mathematical function. An unambiguous black device identifier is used as a basis for the mapping specification. Examples of device identifiers of this kind are MAC addresses or host IDs corresponding to the IPv6 protocol.
A different picture emerges in the case of black, public addresses. Within a black, public network 2, all users must use the same network identifier. This network identifier is changed by a change of network. Accordingly, the black, public network identifier is not suitable for an identification of a coding device 4. However, an unambiguous device identifier, for example, the IPv6-interface ID based on the 48 bit MAC address, does allow an identification of the coding device 4 in any required network environment.
Accordingly, the connected network on the red side 3 can be identified using the black device identifier.
Accordingly, the information for setting up the table in every coding device 4 must be pre-configured before putting into operation. The number of table entries can become large in view of the mobility of the coding devices 4 together with their connected networks, for example, within a radio network, as well as their inclusion in different regional networks. Accordingly, sufficient memory must be provided in the coding device 4 to accommodate the tables.
Further red, confidential networks 3 connected to a coding device 4 can be marked and made known with an additional entry in the look-up table 6. In
Further networks can normally be reached via network interfaces NÜ within the home network. In this context, the addresses of the network interfaces are known within the network via a protocol. Accordingly, each user can identify the network interfaces directly with reference to their black, non-confidential addresses. However, a simple signalling of the address is not possible if a network interface is positioned within the red, confidential network 3 of a coding device 4. This problem is resolved by an additional item of information within the look-up table 6 regarding the responsible coding device 4 of the network interface. Additional signalling is therefore not required in order to detect the network interface. The establishment of a tunnel to these important network users is therefore possible without difficulty.
In addition to avoiding heavy signalling traffic within the network, the concept for the exploitation of look-up tables 6 allows an updatable consistency of the black, public and red-confidential networks 2, 3. As soon as the black routing protocol recognises the non-accessibility of a user in the black network 2, this can be signalled to the coding device 4. Once again, the coding device can infer the red, confidential address 8 of the non-accessible user from the table. The routing table 17 of the red terminal device can therefore be updated directly. Accordingly, data packets can be rejected directly within the router. An exchange of routing information between the red networks connected to the different coding devices is therefore completely unnecessary. The red, confidential network 3 rapidly and automatically identifies the basic topology of the black public network 2.
Having described the structure of the look-up table 6 in principle, the following section explains in outline the procedure for data-processing and acquisition of information using the look-up table 6.
The red, confidential routers 17 are therefore immediately able to identify all potentially-accessible red networks 3. The topology of the black, public level 2 is mapped in an on-going manner onto the topology of the red network 3. Accordingly, on the one hand, large signalling costs can be saved. On the other hand, a non-accessibility of a special coding device and its connected terminal devices can be identified immediately, and, if required, an appropriate response can be made. A coding process 20 within the coding device ensures that the data packets travelling towards the red, confidential layer 3 are decoded and those travelling towards the black level are coded.
The second advantage of this method is obtained with regard to the coding of red, confidential data from the red, confidential level. The coding process 20 can immediately infer the responsible decoding device of the target terminal device using the look-up table 6. A cost-intensive pass through the IPsec discovery protocol is not required. Provided the decoding device is indexed in the look-up table 6 and connected to the network, the data stream can be coded and routed practically without delay.
In order to keep the size of the look-up tables 6 to a minimum, the red, confidential networks 3 connected to the coding device 4 can use hierarchical addressing. This means that the addresses of all terminal devices originate from the same address domain, even if additional routers separate the individual networks. This avoids the need for several table entries for one coding device, as presented in
A periodic exchange of the look-up tables 6 between coding devices 4 is also possible. For this purpose, one coding device 4 must establish a hacker-proof tunnel with another coding device 4. The table 6 can then be adjusted via this tunnel. This has the advantage that changes to the configuration of the table 6 can still be implemented during the delay time of the coding devices 4. Accordingly, the coding device 4 at gateway 21, for example, can distribute additional red, confidential network addresses within the network. Moreover, the configuration costs necessary prior to putting into operation can be minimised, because the information in the look-up table 6 can also be made accessible even during operation.
The signalling necessary during the course of the IPsec discovery protocol is a significant factor. Especially in radio environments with limited data rates, this factor additionally reduces the available transmission capacity. The use of the IPsec discovery protocol can be dispensed with completely in the coding devices 4. The connected red, confidential networks 3 can be derived from the topology of the black, non-confidential network 2 after a short time using the lookup table 6. This additionally reduces the waste of network resources, because the non-accessibility of the coding devices and connected red networks is already identified in the transmission device or in the coding device 4.
If a hierarchical addressing of the red, confidential networks 10 continues to be used, the parameters of the necessary look-up tables 6 can be further reduced. Additional adjustment during operation is possible with the exchange of the tables 6 between individual coding devices 4. Accordingly, the configuration costs prior to putting into operation can be significantly reduced, because all entries need not be preconfigured.
A current network topology is determined in each of the two routing levels, wherein the determination of the network topology of the first network level 2, 3 is implemented independently of the determination of the network topology of the second network level 3, 2, which is used for confidential communication, screened relative to the outside, and stored in the corresponding routing tables 17. In this context, an interface 7 is provided within the coding devices 4 present within the overall network with an unambiguous allocation of addresses 8 of the second routing level to addresses 8 of the first routing level, so that routing is also possible beyond the limits of the two network levels 2, 3. This is also illustrated in
The first network level 2 is a public domain, such as the fixed network, or a part of a global mobile-telephone network, for example, the UMTS network or the GSM network, and the second network level 3 is a confidential domain, such as a company network screened relative to the outside, or similar, wherein the respective addresses 8 in the routing levels are also subdivided into public addresses 8 and confidential addresses 8.
During network operation, a preconfigured, updatable look-up table 6 is provided in the coding device 4 itself. The interface 7 functions as a controlled interface between public and confidential network levels 2, 3 and therefore also as a limit between public and confidential routing levels.
A protocol instance 14 is provided between these two domains 12, 13 as an intermediate domain 15, wherein the protocol instance 14 provides one bi-directional communications route 16 to each of the two domains 12, 13 and, is implemented, for example, according to the IPsec standard. The first network level 2 is defined within an overall network as a public domain 2 and corresponds to a publicly-accessible network 2 such as a landline network or a mobile telephone network. The second network level 3 within an overall network is provided as a confidential domain and corresponds, for example, to a non-public, screened network 3, for example, a company network or a logistics network. The addresses in the respective network levels 2, 3 or respectively the associated routing levels are distinguishable from one another as public addresses and confidential addresses 8.
A router 17 is connected to the protocol instance 14 both on the un-coded side 12 and also on the coded side 13, in the exemplary embodiment, according to the IPv6 standard, wherein the router 17 also comprises a routing table.
The router 17 on the coded side 12 of the system 11 according to the invention is connected via a defined transmission method to a public network 2, so that a communications connection can be provided with the latter, because the implemented transmission method is compatible with the transmission method of the public network 2.
Furthermore, in the exemplary embodiment, a MANET protocol is implemented on the coded side 13, and an IGP protocol for updating the associated routing tables 6 is implemented on the un-coded side 12, wherein an OSPF algorithm is provided as the IGP. An un-coded transmission of IP user data, such as digitised speech or images, to a confidential, non-publicly-accessible network 3 is provided via the IPv6 router 17 on the un-coded side of the system 11 according to the invention.
The invention is not restricted to the exemplary embodiment described. All of the features described or illustrated can be combined as required within the framework of the invention.
|Cited Patent||Filing date||Publication date||Applicant||Title|
|US6751729 *||Jul 22, 1999||Jun 15, 2004||Spatial Adventures, Inc.||Automated operation and security system for virtual private networks|
|US20020083344||Jun 27, 2001||Jun 27, 2002||Vairavan Kannan P.||Integrated intelligent inter/intra networking device|
|US20020186698||Jun 12, 2001||Dec 12, 2002||Glen Ceniza||System to map remote lan hosts to local IP addresses|
|US20030093563||Oct 9, 2002||May 15, 2003||Young Bruce Fitzgerald||Method and system for implementing and managing a multimedia access network device|
|US20030135616 *||Jan 11, 2002||Jul 17, 2003||Carrico Sandra Lynn||IPSec Through L2TP|
|US20030147403 *||Jan 28, 2003||Aug 7, 2003||John Border||Method and system for communicating over a segmented virtual private network (VPN)|
|US20040203797 *||Sep 5, 2002||Oct 14, 2004||Jeremy Burr||Method and apparatus for communications using distributed services in a mobile ad hoc network (MANET)|
|US20050091482||May 14, 2004||Apr 28, 2005||West Ridge Networks||Systems and methods for inferring services on a network|
|US20050157730||Oct 31, 2003||Jul 21, 2005||Grant Robert H.||Configuration management for transparent gateways in heterogeneous storage networks|
|US20060140136 *||Dec 29, 2004||Jun 29, 2006||Clarence Filsfils||Automatic route tagging of BGP next-hop routes in IGP|
|US20070214359 *||Mar 13, 2006||Sep 13, 2007||Cisco Technology, Inc.||System and method for providing secure multicasting across virtual private networks|
|EP1591862A1||Jun 28, 2004||Nov 2, 2005||Hitachi, Ltd.||Storage system access requiring user and user host authentication|
|1||International Search Report for PCT/EP2007/007675 dated Jul. 12, 2007.|
|2||Kent, "Security Architecture for the Internet Protocol," IETF RFC, 4301:1-101 (2005).|
|Citing Patent||Filing date||Publication date||Applicant||Title|
|US8768964 *||Mar 14, 2011||Jul 1, 2014||Salesforce.Com, Inc.||Security monitoring|
|US8850219||Jan 12, 2011||Sep 30, 2014||Salesforce.Com, Inc.||Secure communications|
|US20110282908 *||Nov 17, 2011||Salesforce.Com, Inc.||Security Monitoring|
|Cooperative Classification||H04L45/52, H04L45/00, H04L63/105, H04L63/0428, H04L63/164|
|European Classification||H04L45/00, H04L63/04B, H04L45/52|
|Oct 9, 2008||AS||Assignment|
Owner name: ROHDE & SCHWARZ GMBH & CO. KG, GERMANY
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:GRUBER, INGO;LANGGUTH, TORSTEN;SCHOBER, HENRIK;REEL/FRAME:021660/0379
Effective date: 20080912
|Jun 22, 2015||FPAY||Fee payment|
Year of fee payment: 4