【作者】 曹春杰； 杨超； 马建峰；

【机构】 西安电子科技大学计算机网络与信息安全教育部重点实验室；

【摘要】 <正>1 引言 IPSec保护一个数据包之前,必须建立一个安全关联(SA),而SA的建立则是通过IKE实现的。但是IKE协议轮数太多、太复杂并且不能有效地防止DoS攻击。因此,IETF工作组征集了新的协议IKEv2E、JFK和SIGMA来代替IKE。最更多还原

【Abstract】 The new Internet key exchange protocol (IKEv2) can not achieve active identity protection to initiator in initial exchange. And it has the security flaw of authentication failure which can also be called a "denial of service attack". A novel key exchange protocol based on IKEv2 is presented. By using "alias" and involving the peer’s identity in signature, the new protocol can realize active identity protection to the initiator and successful authentication. Additionally, non-repudiation of the peers for their interactions is also achieved. Through the logic analysis and simulation, our protocol shows a more robust security and a better performance than other protocols.更多还原