IKEv2协议对DoS攻击的防范  

Defending Denial of Service Attack in the IKEv2 Protocol

作　　者：赵华峰[1] 

机构地区：[1]渭南师范学院,陕西渭南714000

出　　处：《现代电子技术》2007年第24期147-149,152,共4页Modern Electronics Technique

基　　金：渭南师范学院引进人才专项科研基金(07YKZ026)

摘　　要：对IKEv2协议的交换过程和主要工作原理进行分析,得出其存在着内存耗尽型和基于分片的DoS攻击的安全缺陷,针对内存耗尽型DoS攻击通过改进初始交换过程,增加Cookie信息来认证发起方杜绝IP欺骗引起的耗尽型DoS攻击,针对基于分片的DoS攻击采用增加IP地址分片重组列表的方案来进行抵御,这些针对DoS攻击的防范进一步增强了IKEv2的安全性。The principal of Internet Key Exchange protocol（IKEv2） is analyzed and its exchange process is introduced. The security defect ,which is the memory resource exhaustion DoS attack and based data fragment DoS attack is found. Then the way of using Cookie information to authenticate the initiator is given to defend the memory resource exhaustion DoS attack with IP deceiving. And the way of using IP list of recombining data fragment is put forward to defend the DoS attack based data fragment. All these can enhance the security of IKEv2.

关 键 词：IKEV2 DOS攻击 安全联盟 IP欺骗 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]