基于增强型IKEv2的IPSec VPN网关设计  

DESIGN OF IPSec VPN GATEWAY BASED ON ENHANCED IKEv2

作　　者：杜春燕[1] 王明[1] 陆建德[2] 

机构地区：[1]宁波大红鹰学院电子信息分院,浙江宁波315175 [2]江苏省计算机信息处理技术重点实验室,江苏苏州215006

出　　处：《计算机应用与软件》2010年第5期105-108,共4页Computer Applications and Software

基　　金：江苏省自然科学基金项目(BK2004039)

摘　　要：IKE(Internet Key Exchange)协议是IPsec协议簇的重要组成部分,用来动态地建立和维护安全关联SA,是IPsec VPN安全传输的先决条件和保证。在研究IKEv2协议的基础上,将公钥基础设施PKI体系引入其中,对在IKEv2中使用PKI身份认证进行研究。并针对IKEv2中数据通信的特点,将在线证书状态协议OCSP(Online Certificate Status Protocol)与IKEv2协议结合起来,设计了一个基于PKI身份认证的增强型IKEv2协议,从而有效提高系统的效率和部署的可扩展性。最后给出了一个基于Linux2.6内核的IPSec-VPN设计方案。Internet Key Exchange（IKE） protocol is one of the important protocols in IPSec protocol suite.As used to dynamically establish and maintain security associations（SAs）,IKE is the prerequisite and guarantee for secure transmission of IPSec VPN.In this paper we introduced public key infrastructure to IKEv2 based on studying its protocol,and combined the techniques of OCSP with IKEv2 protocol to have designed an enhanced IKEv2 protocol based on PKI authentication according to the characteristic of IKEv2 data communication,so as to improve the efficiency and extensibility of the security gateway.At the end,the paper has given out an implementing scheme of IPSec-VPN based on Linux 2.6.

关 键 词：IKEV2 PKI OCSP IPSe cVPN 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]