Method, system and apparatus for establishing communication
View Patent ↗A method, a system, and an apparatus for establishing communication are disclosed. The method is invented to establish communication between at least two communication parties including a first communication party and a second communication party. The method includes: sending a Cryptographically Generated Address (CGA) request to the first communication party; receiving CGA parameters and a CGA signature returned by the first communication party; and authenticating the CGA parameters and the CGA signature, and establishing communication with the first communication party if the authentication succeeds. By using the method disclosed herein, in the process of establishing communication, the communication party authenticates the CGA parameters and CGA signature carried in the CGA extension header to determine authenticity of the CGA, thus preventing the IP address spoofing and preventing or mitigating the network security problems caused by the IP address spoofing.
1. A method for establishing communication between at least two communication parties comprising a first communication party and a second communication party, comprising:
sending, by the second communication party, a first Cryptographically Generated Address (CGA) request to the first communication party;
receiving, by the second communication party, CGA parameters and a CGA signature of the first communication party which sent from the first communication party as a response to the first CGA request, wherein the CGA parameters and CGA signature are carried in a Destination Options header of an IPv6 extension header of the response; and
authenticating, by the second communication party, the CGA parameters and the CGA signature, and establishing communication with the first communication party if the authentication succeeds.
2. The method for establishing communication according to claim 1 , wherein:
before the sending the first CGA request to the first communication party, the method further comprises:
receiving, by the second communication party, a session request sent by the first communication party, and sending the CGA request to the first communication party when the IPv6 extension header in the session request comprises no Destination Options header.
3. The method for establishing communication according to claim 1 , wherein:
before the sending the first CGA request to the first communication party, the method further comprises:
receiving, by the second communication party, a session request sent by the first communication party, and sending the CGA request to the first communication party when the Destination Options header of the Internet Protocol version 6 (IPv6) extension header in the session request comprises no CGA-related information.
4. The method for establishing communication according to claim 1 , comprising:
receiving, by the second communication party, a second CGA request sent by the first communication party when receiving the CGA parameters and the CGA signature of the first communication party;
returning, by the second communication party, CGA parameters and CGA signature of the second communication party to the first communication party after authenticating the CGA parameters and CGA signature of the first communication party successfully; and
establishing communication between the second communication party and the first communication party after the first communication party authenticates the CGA parameters and CGA signature of the second communication party successfully.
5. A communication device, comprising:
a sending module, configured to send a first Cryptographically Generated Address (CGA) request to a second communication device;
a receiving module, configured to receive CGA parameters and a CGA signature of the second communication device which sent from the second communication party as a response to the first CGA request, wherein the CGA parameters and CGA signature are carried in a Destination Options header of an IPv6 extension header of the response;
an authenticating module, configured to authenticate the CGA parameters and CGA signature received by the receiving module; and
a communication establishing module, configured to establish communication with the second communication device if the authenticating module succeeds in the authentication.
6. The communication device according to claim 5 , wherein the sending module comprises:
a session request receiving submodule, configured to receive a session request sent by the second communication device; and
a CGA request sending submodule, configured to send the CGA request to the second communication device when the IPv6 extension header of the session request comprises no Destination Options header, or when the Destination Options header in the IPv6 extension header of the session request comprises no CGA-related information.
7. The communication device according to claim 5 , further comprising:
a CGA request receiving module, configured to receive a second CGA request sent by the second communication device when the receiving module receives the CGA parameters and CGA signature of the second communication device; and
a CGA returning module, configured to return the CGA parameters and CGA signature of the communication device to the second communication device after the CGA request receiving module receives the second CGA request sent by the second communication device and the authenticating module authenticates the CGA parameters and CGA signature successfully.
8. A system for establishing communication, comprising a first communication party and a second communication party, wherein the second communication party being the communication device according to claim 5 :
the first communication party, configured to receive a Cryptographically Generated Address (CGA) request and return CGA parameters and a CGA signature; and
the second communication party, configured to: receive a session request sent by the first communication party, send the CGA request to the first communication party when the IPv6 extension header of the session request comprises no Destination Options header, or when the Destination Options header in the IPv6 extension header of the session request comprises no CGA-related information, receive the CGA parameters and CGA signature returned by the first communication party, authenticate the CGA parameters and CGA signature, and establish communication with the first communication party if the authentication succeeds.
9. A method for establishing communication between at least two communication parties comprising a first communication party and a second communication party, comprising:
sending, by the second communication party, a first Cryptographically Generated Address (CGA) request to the first communication party;
receiving, by the second communication party, CGA parameters and a CGA signature of the first communication party which sent from the first communication party as a response to the first CGA request;
authenticating, by the second communication party, the CGA parameters and the CGA signature, and establishing communication with the first communication party if the authentication succeeds;
receiving, by the second communication party, a second CGA request sent by the first communication party when receiving the CGA parameters and the CGA signature of the first communication party;
returning, by the second communication party, CGA parameters and CGA signature of the second communication party to the first communication party after authenticating the CGA parameters and CGA signature of the first communication party successfully; and
establishing communication between the second communication party and the first communication party after the first communication party authenticates the CGA parameters and CGA signature of the second communication party successfully.
10. A communication device, comprising:
a sending module, configured to send a first Cryptographically Generated Address (CGA) request to a second communication device;
a receiving module, configured to receive CGA parameters and a CGA signature of the second communication device which sent from the second communication party as a response to the first CGA request;
an authenticating module, configured to authenticate the CGA parameters and CGA signature received by the receiving module; and
a communication establishing module, configured to establish communication with the second communication device if the authenticating module succeeds in the authentication;
a CGA request receiving module, configured to receive a second CGA request sent by the second communication device when the receiving module receives the CGA parameters and CGA signature of the second communication device; and
a CGA returning module, configured to return the CGA parameters and CGA signature of the communication device to the second communication device after the CGA request receiving module receives the second CGA request sent by the second communication device and the authenticating module authenticates the CGA parameters and CGA signature successfully.