METHODS FOR ESTABLISHING A SECURITY SESSION IN A COMMUNICATIONS SYSTEM
A security gateway and an initiating device perform methods for establishing a security session. The methods includes the security gateway: receiving a first message from an initiating device, the first message including a first message authentication code; validating the first message using the message authentication code; and responsive to the validating, sending a second message to the initiating device, the second message including a timestamp and further including a second message authentication code for authenticating of the timestamp by the initiating device, wherein the first and second messages are used to establish the security session, and the authenticated timestamp is used for subsequent replay protection of messages between the security gateway and the initiating device. The method further includes the security gateway validating a dynamically assigned IP address for the initiating device to use in authorizing VPN traffic between the two devices.
1 . A method for establishing a security session in a communication system, the method comprising:
a security gateway performing:
receiving a first message from an initiating device, the first message including a first message authentication code;
validating the first message using the message authentication code;
responsive to the validating, sending a second message to the initiating device, the second message including a timestamp and further including a second message authentication code for authenticating of the timestamp by the initiating device.
2 . The method of claim 1 , wherein the second message further includes a random or pseudo-random number, the method further comprising receiving a third message from the initiating device, the third message including the same random or pseudo-random number as in the second message, and the third message further including a third message authentication code for validating of the third message by the security gateway.
3 . The method of claim 2 , wherein the third message completes an establishment of a security session between the security gateway and the initiating device.
4 . The method of claim 1 , wherein the second message completes an establishment of a security session between the security gateway and the initiating device.
5 . The method of claim 1 , wherein the first and second messages each include a header having a format of an Internet Key Exchange header.
6 . The method of claim 1 , wherein the timestamp is for replay protection of messages sent between the initiating device and security gateway after the second message.
7 . The method of claim 6 , wherein the timestamp is for replay protection of Internet Protocol Security (IPsec) messages sent between the initiating device and security gateway after the second message.
8 . The method of claim 1 , wherein the first message further includes a first identifier for the initiating device and an Internet Protocol (IP) address for the initiating device, the method further comprising:
verifying that the first identifier matches a second stored identifier for the initiating device;
upon establishing a security session between the initiating device and the security gateway using the first and second messages, associating the IP address with the second identifier, and storing the IP address.
9 . The method of claim 8 , wherein the IP address is a dynamically assigned IP address.
10 . The method of claim 8 , wherein the IP address authorizes Virtual Private Network traffic between the initiating device and the security gateway.
11 . A method for establishing a security session in a communication system, the method comprising:
an initiating device performing:
sending a first message to a security gateway, the first message including a first message authentication code for validating of the first message by the security gateway;
after the validating, receiving a second message from the security gateway, the second message including a timestamp and a second message authentication code;
authenticating the timestamp using the second message authentication code, wherein the authenticated timestamp is for replay protection of messages sent between the initiating device and the security gateway.
12 . The method of claim 11 , wherein the second message further includes a random or pseudo-random number, the method further comprising sending a third message to the security gateway, the third message comprising the same random or pseudo-random number as in the second message, and the third message further including a third message authentication code for validating of the third message by the security gateway.
13 . The method of claim 12 , wherein the third message completes an establishment of a security session between the security gateway and the initiating device.
14 . The method of claim 12 , wherein the first, second, and third messages each include a header having a format of an Internet Key Exchange header.
15 . The method of claim 11 , wherein the second message completes an establishment of a security session between the security gateway and the initiating device.
16 . The method of claim 11 , wherein the first and second messages each include a header having a format of an Internet Key Exchange header.
17 . The method of claim 11 further comprising inserting, into a security processed message, a current timestamp that is derived from the authenticated timestamp.
18 . The method of claim 17 , wherein the security processed message comprises an Internet Protocol Security (IPsec) message, and the current timestamp is inserted into a sequence number field of an Encapsulating Security Payload header or into a sequence number field of an Authentication Header protocol header within the IPsec message.
19 . The method of claim 18 further comprising inserting the current timestamp into an unencrypted portion of a payload in the IPsec message.
20 . The method of claim 11 further comprising:
receiving an Internet Protocol Security (IPsec) message from the security gateway, the IPsec message having a timestamp included in a sequence number field of an Encapsulating Security Payload header or in an Authentication Header protocol header of the IPsec message;
verifying the timestamp in the sequence number field against the authenticated timestamp to evaluate the IPsec message for replay attack.