IKEv2协议的分析与改进  

Analysis and Improvement on IKEv2 Protocol

作　　者：邱司川[1] 潘进[1] 刘丽明[1] 

机构地区：[1]西安通信学院通信装备管理系,西安710106

出　　处：《计算机工程》2009年第15期126-128,共3页Computer Engineering

基　　金：国家"863"计划基金资助项目(2007AA01Z472)

摘　　要：IKEv2协议中的预共享密钥认证方式容易受到中间人攻击和离线字典攻击,从而泄漏发起方的身份信息和通信双方的预共享密钥。针对上述2种攻击,提出将数字签名认证方式与预共享密钥认证方式相结合的防御措施,引入公钥口令的思想,避免建立公钥基础设施带来的额外负担。分析结果表明,改进后的协议能够避免中间人攻击和离线字典攻击,防止通信双方身份的泄漏和预共享密钥的破解。The pre-shared key authentication in IKEv2 protocol is susceptible to man-in-the-middle attack and off-line dictionary attack, which makes the identity of the initiator and the pre-shared key leak out. Focusing on the two attacks, this paper proposes a measure combining digital signature authentication and pre-shared key authentication, and introduces time public key to reduce the burden of building public key infrastructure. Analysis result indicates that the improved protocol can avoid man in the middle attack and off-line dictionary attack, and avoide the leak of identities and cracking of pre-shared key.

关 键 词：IKEV2协议 中间人攻击 离线字典攻击 预共享密钥 口令 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]