网络层身份验证机制的设计与实现  

Design and Implementation of Authentication Mechanism in IP Networks

作　　者：毛燕琴[1] 沈苏彬[1] 

机构地区：[1]南京邮电大学网络技术研究中心,江苏南京210003

出　　处：《南京邮电大学学报（自然科学版）》2006年第4期79-85,共7页Journal of Nanjing University of Posts and Telecommunications：Natural Science Edition

基　　金：国家自然科学基金(60273091);江苏省自然科学基金重点项目(BK2001205);信息产业部十进制网络工作组研究资助项目

摘　　要：网络层安全体系框架IPSec(IP Security)在报文信息安全模型基础上提供了基于密钥的报文源验证服务。针对该服务存在的一些不足,在面向网络基础设施的安全模型基础上,提出一种网络层身份验证机制,利用机制中设计的身份标识协议和报文源身份验证机制,可保证通信实体的合法性,提供可靠的基于IP地址的报文源验证服务和基于通信实体特征信息的密钥协商机制。最后通过测试实验,阐述新机制具有的功能和性能。Existing network security framework IP Security （IPSec） proposed for information security model offers data origin authentication service based on common keys in IP layer. To tackle the deficiency of the service,a kind of authentication mechanism is proposed on the basis of network security model facing to network infrastructure. Making use of the identity label protocol and message origin authentication mechanism designed in the authentication mechanism,they can guarantee the legitimacy of the communication entities ,offer a credible data origin authentication service based on IP addresses and provide key agreement mechanism based on the characteristic information of the entities. Finally,The functions and the performance of the new mechanism are illustrated bv results.

关 键 词：网络安全 安全攻击 IPSEC 身份验证 IP假冒 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]