基于加密接入令牌的IGMP安全机制

Secure IGMP Mechanism Based on Encrypted Access Token

在 IP组播中当前使用的组管理协议 IGMP不提供接入控制 ,任何端点用户可自由地加入组播组 ;此外 ,IGMP报文在传输时没有加密措施 ,无法保证其安全性 .因此 ,对 IGMP报文的认证和接入控制策略便成为亟待解决的重要课题 .在 IGMP报文后附加接入令牌的方法虽然可以解决 IGMP协议存在的一些安全问题 ,但其仍存在一些缺陷 .在此基础上 ,提出了一种加密接入令牌的方法 ,阐述了如何申请、产生、传输和使用令牌 .加密接入令牌可以安全的传输认证和接入控制信息 ,并且可以多次使用 ,不需要在用户和组播路由器之间建立安全关联 SA。

IGMP, the multicast management protocol, provides no access control of join members, thus any host can join a certain multicast group. Moreover, due to lack of encryption measures, IGMP messages cannot ensure their confidentiality in the communication process. Thus Authentication of IGMP messages and policy of access control are indicated as the key problems. The Access Token attached to the IGMP messages can solve some problems, but it still has some limitations. Presented a solution utilizing the Encrypted Access Token (EAT) and introduced a way to request, issue, transport and apply the token. The EAT can securely transport authentication and access control information, and can be applied several times without the establishment of security association (SA) between user and multicast router, so that its efficiency is enhanced.