LSQ-IKE:一种轻量级空间网络密钥交换协议

LSQ-IKE: A Lightweight Space Key Exchange Protocol

为解决基于TCP连接分段的传输层性能增强技术与IPSec协议冲突的问题,提出了多层IPSec技术,传统的IKE协议不能满足多层IPSec对密钥交换协议的需求。以IKEv2协议为基础,提出了一种适用于多层IPSec的轻量级空间网络密钥交换协议(LSQ-IKE)。该协议为通信双方和两个可信的中间结点实现四方会话密钥的协商,保护完整的通信过程,满足多层IPSec对于密钥交换协议的要求,并且实现了对密钥交换发起者身份安全的重点保护。分析表明,该密钥交换协议符合安全性要求,且具有相对同类型协议计算量、交换消息数量少的特点。

To solve the conflict between TCP segment-based transport layer performance enhancement technology and IPSec protocol, the multi-layer IPSec technology has been proposed. But traditional IKE protocols can not meet the needs of Multi-layer IPSec key exchange. Based on the IKEv2, a lightweight space Quadri-party Internet Key Exchange Protocol （LSQ-IKE） is presented which can operate in multi-layer IPSec. LSQ-IKE makes a key agreement for the four parties, including two communication sides and two trusted middle nodes. It creates two security associations （SA） and the corresponding session keys to protect the communication process. One of the SA protects the IP packet header and the other protects the payload field, which meets the requirements of multi-layer IPSec key exchange. The analysis shows that LSQ-IKE uses fewer steps to achieve a Quadri-party key exchange than protocols that already exists. So LSQ-IKE has the low-cost and lightweight features.