IKE协议安全隐患分析与验证  

Analyses of security flaws of IKE and test

作　　者：张卫乐[1] 余洋[1] 汤隽[1] 郭玉东[1] 

机构地区：[1]信息工程大学信息工程学院,河南郑州450002

出　　处：《计算机工程与设计》2007年第12期2811-2813,共3页Computer Engineering and Design

摘　　要：介绍了IKE的实现,论述它的几个主要认证方式,然后分析预共享密钥认证可能产生的安全隐患和可能的导致的就结果。研究重点是采用野蛮模式和预共享密钥认证的IKE第1阶段协商的安全隐患,利用Linux内核在Netfilter框架的基础上提供了IP Queue机制或者ARP欺骗实施中间人攻击对隐患进行验证。最后对验证结果总结,提出一些合理的建议。The realization of IKE is introduced, and several main authenticated modes of IKE are dissertated, then the security flaws of authentication with pre-shared key and wrong results are analysed by those flaws leading to. The main content is the security flaws of IKE adopting aggressive mode with pre-shared key, and tests its security flaw using of man-in-middle attack through IP queue mechanism which Netfilter framework provides in Linux kernel or ARP cache poisoning. At last according to testing results, some reasonable proposals are put forward.

关 键 词：IPSEC协议 INTERNET密钥交换协议 虚拟专用网 ARP欺骗 身份认证 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]