【作者】 吴静；

【导师】 王德民；

【作者基本信息】 吉林大学 ， 计算机软件与理论， 2004， 硕士

【摘要】 随着Internet技术的飞速发展，个人通信技术的人性化设计要求人们可以随时随地访问网络，移动IP技术恰好满足了人们的这一愿望。进入二十一世纪，IPv4地址空间不足的问题逐渐暴露出来，主要表现在：IP地址资源紧缺、路由表急剧膨胀、无法提供QoS服务和安全性服务。为此IPv6在解决地址资源问题的同时针对移动性和安全保障提出了新的解决方案。用户移动过程中，移动IPv6在不中断正在进行通信的同时，带来了一些需要解决的问题，例如：当移动节点移动到外地链路时，外地代理如何对其进行认证和授权；如何确定所收到的绑定、注册请求是合法节点发出的，以防止恶意节点的侵扰；如何记录移动节点连接在外地链路上的时间；如何计算它所消耗的资源；如何计费等。AAA技术正是为解决这些问题而引入的。AAA技术是认证（Authentication）、授权（Authorization）和记账（Accounting）技术的结合。从最初的Kerberos到广为应用的RADIUS，AAA的最初应用是为电话接入服务提供的，随着网络规模的增加，原有的AAA技术已不能适应现代网络的技术发展需求。伴随着移动IP的出现，IETF工作组制定了相应的AAA标准和需求，目前的AAA草案主要讨论的是移动IPv4环境下的认证、授权和计费问题。从移动IPv4到移动IPv6，由于路由和地址配置等一系列新技术的应用，使得IPv6更适合移动性的要求，而将IPSec应用到AAA也是移动IPv6为解决AAA的安全问题的基本思路。Diameter就是基于移动IP的新要求提出的。它的提出并不是摒弃原有的AAA应用，尤其是使用最为广泛的RADIUS，所以Diameter是兼容RADIUS的，并且Diamter可以直接发出RADIUS的消息包。在基于移动IPv4的环境中，Diameter不但有Diameter客户端和Diameter服务器，还包括多种类型的Diameter节点：Diameter中继、Diameter代理、Diameter重定向器和Diameter协议转换器等。这些节点通过配置建立一对一的网络连接，组成一个Diameter网络，实现Diameter节点的对等连接。Diameter节点的对等连接是在Diameter节点启动过程中动态建立的<WP=74>基于TCP或者SCTP传输协议上的套接字连接。对于一个Diameter节点，其对端节点，或者基于静态配置，或者基于动态发现，当Diameter协议栈启动时，Diameter节点会尝试与每一个它所得知的对端节点建立套接字连接。对等连接允许任一Diameter节点发起一个请求，包括任一Diameter节点可以主动发起对等连接中止请求消息，对端接收此消息，回答对等连接中止应答消息后，先行中止底层连接。对于除此之外的对等连接的中止情况，在发现这类连接异常中止的一端时，要按照定时器设置，不断尝试恢复建立对等连接。Diameter到目前为止只是在IETF中有关于移动IPv4扩展的讨论草案，对于移动IPv6，由于其路由方式和地址的自动配置等的不同，不能简单的将Diameter草案中的关于移动IPv4的讨论直接移植到移动IPv6中。需要对其进行适应性模型的改造。本文在适应移动IPv6的前提下提出了一个基于Ticket分发的AAA认证模型，并采用Linux操作系统做为实验环境，以及MIPL作为移动IP的实现模块。Linux是一个源码开放的操作系统，具有很好的稳定性，安全性和可扩展性。Linux内核从2.2.X之后就开始支持IPv6，MIPL经过不断的优化，使得在Linux下可以方便的实现移动性。Ticket的引入使得移动节点在多次进出一个管理域的情况下，不再每次都提交AAA认证信息进行验证，也不需要向家乡代理求证。简化了AAA的认证过程，同时也降低了网络因为数据传递带来的时延。但是，应用Ticket并不是抛弃了家乡代理和家乡的AAA服务器AAAH，AAAH的工作也决不仅限于对移动节点的认证工作。在后续的消息传递的过程中，尤其是实时记账的过程中，还需要AAAH的参与。而这一过程按照本文提出的模型是无法省略的。进一步实现了一个基于Linux下的MIPL的移动IPv6模式下的AAA模型，并参照AAA的评估协议对此进行了测试和讨论。重点在于简化移动节点在外地域边界移动的认证过程。由于移动节点在边界的晃动，使得移动节点可能在两个管理域中都需要认证和授权。在无线通信的情况下，这种情况是会经常发生的，这时只需要在两个管理域中都提交Ticket并获得授权进行正常的切换和通信，只要所分配的Ticket是有效的，就可以不必通过每次向家乡代理发送认证请求，以减少认证请求的消息数量。不能否认，对AAA认证信息的这一简化处理可能带来其它的负面的<WP=75>影响。但是总的来说，这一简化处理的过程对提高认证速度，降低网络时延是非常有效的。更多还原

【Abstract】 With the rapid development of Internet， the design for technology of personal communication makes people touch Internet everywhere. Mobile IP can provide this kind of service. In 21 century，the problems of IPv4 occurs more and more. There are many disadvantages about IPv4， such as the shortage of IP address， the inflation of router tables， providing little QoS and service of security. To solve the shortage of IP address and the mobility of computer，IETF puts forward Mobile IPv6. Mobile IPv6 can solve such a question as , when user moving, it can keep its normal communication. But at the same time it can bring some new questions such as when mobile node is moving in foreign link，how to authentication and authorization the mobile node, and how to ensure the request of binding and registration is legal. To prevent the currish node’s attack, it is need to authentication this package. When it comes to the services provided by the commercial network for the public， how to record the range of online time ,when mobile node in foreign link, and how to collect resource consumption data for billing, and how to account it ,and so on. AAA is the solution to all these kinds of questions.AAA is the combination of Authentication， Authorization and Accounting functionality. From the first application, Kerberos, to the most widely application ,RADIUS， AAA application is used to provide the dial service. With the overwhelmingly increasing scale of the network， the old technology of AAA can not be fit for modern network. With the mobile IP， IETF working group published a new standard and requirement of AAA. By now the main discuss of AAA in IETF draft is the authentication， authorization and accounting of mobile IPv4.Mobile IPv6 is different from mobile IPv4， the application of routing and the auto configuration of address is changed. So IPv6 is fitter than IPv4 for mobility support. Applied IPSec in AAA is the base requirement to solve the security of AAA.Diameter is the new AAA protocol based on mobile IP. It is based on the <WP=77>RADIUS protocol. It is designed to be used as the AAA protocol between two peers. Diameter is backward compatible with RADIUS and can send RADIUS information package. In mobile IP， Diameter has many types of nodes， that is Diameter agent， Diamter proxy， Diameter redirection， and Diameter protocol switch.All these nodes connect with peer to peer， combine a Diameter network.Diameter node is peer to peer connection， that is to say, when Diameter node starts， it can dynamically set up a socket, which is based on TCP or SCTP transport protocol. For a Diameter node， its peers attempt to set up sockets with every node he knows， when starting its protocol stack.Peer to Peer makes any node initiate Disconnect-Peer-Request message. When the Peer received this message， it replied Disconnect-Peer- Answer message. Then it stops this connection. Any kind of disconnection, except system failure， must wait till timeout and attempt to rebuild another peer connection.Nowadays， Diameter is still a draft which is extension for mobile IPv4. Because of the difference between mobile IPv6 and mobile IPv4，we can’t simply apply the mobile IPv4 model in mobile IPv6. We must change some applications.In this paper, a new authentication model based on the distribution of Ticket is put forward. Linux OS and MIPL module are chosen to implement the model. Source code of Linux kernel is free. Linux OS has stability， safety， high performance and extensionable. Linux kernel begin to support IPv6 in version 2.2.X. MIPL is free software base on Linux. The newest version implement in Linux easily. In this circumstance， we bring forward a new model base on the distribution of Ticket and implement a Diameter software in mobile IPv6.When mobile node move to visit realm frequently， it must send an authentication request each time. If AAAv haven’t save its information， it must send an Authentication-Mobile-Request message to authenticate this node. When we use Ticket， it can not send this messag更多还原