一种基于签密的改进IKEv2协议  

Improved IKEv2 protocol based on signcryption

作　　者：莫天庆[1] 张龙军[1] 赵李懿[2] 

机构地区：[1]武警工程学院通信工程系,西安710086 [2]武警工程学院电子技术系网络与信息安全武警部队重点实验室,西安710086

出　　处：《计算机应用研究》2011年第12期4657-4659,4662,共4页Application Research of Computers

基　　金：国家自然科学基金资助项目(60842006);武警部队科研基金课题(wjy201111);武警工程学院基础基金研究项目(wxk2010-04);陕西省自然科学基金资助项目(2007F50)

摘　　要：针对IKEv2协议存在的对通信实体的身份保护不足和系统开销大等问题,提出了一种安全高效的改进的IKEv2协议。新协议采用了基于签密的可认证密钥协商来代替D-H密钥交换,在交换秘密信息的同时实现了对协议的发起者与响应者之间的双向认证;并且协议的响应者先主动证明自己的身份,确保了对发起者进行主动身份保护。基于认证测试方法对该协议进行形式化分析表明:新协议具有很好的秘密性和双向认证性;同时,该协议只需三条消息,具有简单、高效的特点。IKEv2 protocol can＇ t achieve mutual authentication between the correspondents, and ＇,it have flaw of system requirement. This paper presented an improved IKEv2 protocol to avoid these flaws. In the new protocol, adopted the authentiCated key agreement algorithm based on signcryption to replace the D-H key exchange algorithm to realize mutual authentication between the endpoints and the responder, it first authenticated to actively protect the initiator＇ s identity. Then＇ formally verified the new protocol＇ s security properties based on authentication tests. The results show that it has a better performance in security. In addition, the new protocol is very simple and efficient.

关 键 词：签密 密钥交换 认证测试 IKEV2 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]