基于IPSec的虚拟专用网络密钥交换实现及其安全分析

Key exchange implementation and security analysis for IPSec based virtual private network

本文研究了基于IPSec结构的虚拟专用网密钥交换的基本概念和原理 ,详细地阐述了通过一系列参数的协商在非安全的公共IP网络中建立安全通信的密钥交换机制 ,给出了基于Linux系统的客户机 /服务器VPN密钥交换的软件实现 ,对其安全特性作出了分析 ,指出其具有抗服务拒绝攻击、抗中间人攻击、抗连接插入攻击和防止窃听等安全性能 。

IPSec (IP security) is the de facto standard of implementing virtual private network on network layer, while key exchange and management mechanism is crucial for IPSec protocols. A through study on fundamental concepts and principles of key exchange for IPSec based VPN (virtual private network) is conducted and the details of the security key exchange mechanism on non-secure public IP based network through a set of parameters negotiation is illustrated. A software implementation of Client/Server model VPN key exchange upon Linux operating system is presented and its security performance such as anti-denial-of-service, anti-connection lijacking, anti-the man-in-the-middle attack and anti-eavesdropping etc. are analyzed. Finally the paper gives a prospective view of IKE (Internet key exchange) research.