Method and system for establishing security connection between switch equipments

A method for establishing security connection between switch equipment by calculating and saving a switch key between a first switch equipment and a second switch equipment, comprising:

• 1) sending, by a first switch equipment, a switch key negotiation activation packet to a second switch equipment, the switch key negotiation activation packet comprising an NSW1 field;
• wherein
• the NSW1 field indicates a switch key negotiation identifier, a value of which is a random number generated by the first switch equipment during a first-time switch key negotiation process between the first switch equipment and the second switch equipment, and is equal to the value of a switch key negotiation identifier calculated during a last-time switch key negotiation process during a switch key negotiation updating process;
• 2) constructing, by the second switch equipment, a switch key negotiation request packet and sending the switch key negotiation request packet to the first switch equipment, after receiving the switch key negotiation activation packet sent by the first switch equipment, the switch key negotiation request packet comprising an NSW2 field, an NSW1 field and a MIC5 field,
• wherein
• the NSW2 field indicates an inquiry of the second switch equipment, and is a random number generated by the second switch equipment;
• the NSW1 field in the switch key negotiation request packet indicates the switch key negotiation identifier, the value of which directly depends on the value of the NSW1 field in the switch key negotiation activation packet in the case of the first-time switch key negotiation process between the first switch equipment and the second switch equipment, and is the value of the switch key negotiation identifier that is calculated during the last-time switch key negotiation process in the case of the switch key negotiation updating process;
• and
• the MIC5 field indicates a message identification code, and is a hash value obtained by the second switch equipment performing hash function calculation on the fields in the switch key negotiation request packet other than the MIC5 field by using a switch protocol data key SW-PDK1-2 in the calculated switch key;
• 3) constructing, by the first switch equipment, a switch key negotiation response packet and sending the switch key negotiation response packet to the second switch equipment, after receiving the switch key negotiation request packet sent by the second switch equipment;
• and
• 4) confirming, by the second switch equipment, that the switch key obtained by the first switch equipment is consistent with that of the second switch equipment, after receiving the switch key negotiation response packet sent by the first switch equipment.