【作者】 李新；

【导师】 王枞；

【作者基本信息】 北京邮电大学 ， 模式识别与智能系统， 2010， 硕士

【摘要】 由于网络本身存在的脆弱性以及可能遭受的来自各方面的威胁和攻击,信息的安全保密在网络环境下具有特别重要的意义。近年来,人们利用IPSec协议通过使用合理的密钥协商方式,灵活运用各种加密／验证算法,对网络数据提供完整性、机密性和合法性保护,对IP层数据进行加密和验证,来保证网络通信的安全性。互联网密钥交换协议(IKE)是IPSec的重要组成部分,用于在IPSec对数据进行加密之前,对通信双方的共享密钥等安全参数进行协商、交换和管理。随着IKE协议的不断完善,在其它许多需要进行自动密钥协商和管理的安全协议中,它都会有广泛的应用。本论文主要研究IKE协议实现过程中所涉及到的技术问题,最大的亮点不仅仅在于对IKEv2协议的分析和编码实现,而是在完成了软件系统的实现之后,通过对IKEv2协议本身和实现方案的安全性分析,在通信双方采取预共享密钥的条件下,设计了中间人攻击的实施方案。本论文的主要工作包括以下几部分：分析IPSec协议体系和IKE协议在整个IPSec协议中的地位和作用。研究IKEvl协议的缺陷和IKEv2协议的安全性优点。设计了IKEv2在Linux操作系统下的实现方案,具体包括软件系统的框架设计、各个模块的划分,以及主要数据结构和接口的实现。设计了针对本IKEv2软件系统的中间人攻击方案,并实现了原型系统。对IKEv2的实现方案和中间人攻击方案的有效性进行了全面的测试和验证,对已经完成的工作进行了深入的总结,为今后进一步的工作打下了良好基础。更多还原

【Abstract】 Owing to inherently frailty of network, attacks and threats coming from many aspects, the security and privacy of information in network environment is especialy important. In recent years, people use the IPSec proptcol by using of reasonable methods of key negotiation and feasible encrypt or verify algorithms to encrypt and authenticate the IP packet and ensure the information security of the communication. Meanwhile, with the IKE protocol of continuous improvement, it is not just limited to the IPSec application, in many other auto needs of the security key negotiation and management agreement, will have a wide range of applications.In this thesis, we focus on the implementation of the IKE protocol. The biggest highlight of the papers is not only on the IKEv2 protocol Coding, more importantly, after the completion of the software system implementation and security analysis, when both sides to take pre-shared key Premise, implementing a man in the middle attack.The main work of this paper includes the following contents:Analyzed the IPSec protocol and the role of the IKE protocol. Analyzed the IKEvl protocol’s security weaknesses and deficiencies, IKEv2 protocol’s security. Designed the implementation of IKEv2 protocol in the Linux operating system, specifically including the framework of the software system design, the division of each module, the main data structure and interfaces. Designed a Man In The Middle attack program and implemented a prototype system. Test the effectiveness of the IKEv2 software system and Man In The Middle attack program, concluded the work and prospect for the future work.更多还原