基于IPSec的虚拟专用网络密钥交换实现及其安全分析  

Key exchange implementation and security analysis for IPSec based virtual private network

作　　者：吴越[1] 疏朝明[1] 卜勇华[1] 胡爱群[1] 毕光国[1] 

机构地区：[1]东南大学无线电工程系,南京210096

出　　处：《东南大学学报（自然科学版）》2002年第4期551-557,共7页Journal of Southeast University：Natural Science Edition

基　　金：国家"九五"科技攻关重点资助项目 (2 0 0 0 A3 2 12 )

摘　　要：本文研究了基于IPSec结构的虚拟专用网密钥交换的基本概念和原理 ,详细地阐述了通过一系列参数的协商在非安全的公共IP网络中建立安全通信的密钥交换机制 ,给出了基于Linux系统的客户机 /服务器VPN密钥交换的软件实现 ,对其安全特性作出了分析 ,指出其具有抗服务拒绝攻击、抗中间人攻击、抗连接插入攻击和防止窃听等安全性能 。IPSec (IP security) is the de facto standard of implementing virtual private network on network layer, while key exchange and management mechanism is crucial for IPSec protocols. A through study on fundamental concepts and principles of key exchange for IPSec based VPN (virtual private network) is conducted and the details of the security key exchange mechanism on non-secure public IP based network through a set of parameters negotiation is illustrated. A software implementation of Client/Server model VPN key exchange upon Linux operating system is presented and its security performance such as anti-denial-of-service, anti-connection lijacking, anti-the man-in-the-middle attack and anti-eavesdropping etc. are analyzed. Finally the paper gives a prospective view of IKE (Internet key exchange) research.

关 键 词：IPSEC 虚拟专用网 IP安全协议 密钥交换 网络安全 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术] TP391.9[自动化与计算机技术—计算机科学与技术]