一种基于IPSec的宽带无线IP网络匿名方案与实现

Anonymity scheme and implementation based on IPSec for broadband wireless IP networks

宽带无线IP(BroadbandWirelessIP,BWIP)是结合无线通信和Internet的新技术,其安全性研究已成为全球关注的焦点,目前提出的许多安全解决方案对用户匿名性考虑较少。文中结合IPSec的ESP和AH协议,利用MobileIP中FA与HA的代理功能,提出一种基于IPSec的BWIP网络匿名方案,该方案可以提供双向、实时的宽带无线Internet匿名通信,可以有效地阻止宽带无线Internet中流量分析攻击。文中先给出匿名方案的实现原理和匿名通道建立协议,然后给出实现本匿名方案的数据封装格式。分析表明,该匿名方案在支持IPSec的IP路由器和IP网关上容易实现,可以作为BWIP网络匿名基础设施。

Broadband wireless IP(BWIP) is a new technique connecting wireless communications and Internet. Its security researches have become a global problem. Unfortunately, many security schemes do not consider the user's anonymity. An anonymity scheme based on the IPSec protocol was given, which combined the agent functions of HA and FA in mobile IP and the ESP and AH in IPSec. This scheme provided bi-directional, real-time anonymous broadband wireless Internet communication that resisted traffic analysis for any broadband wireless IP applications. The principle and the created protocol of this scheme were first presented. Then the IP datagram format and the implementation of this scheme were described. This scheme was easily implemented in security gateways or IP router which supported IPSec, and could be implemented as an anonymous infrastructure for BWIP networks.