基于PKI身份认证和访问控制的IKE协议研究和实现-计算机应用技术专业论文.docxVIP

Abstract’IHs Abstract ’IHs thesis has focused on the嘲earch of the IKE protocol in IPsec protocol suite． and proposed to combine the techniques ofECC，PKI，and RBAC for access control with the IKE protocol，SO as to design an enhanced IKE protocol based on authentication and access control with PⅪ．111e thesis has designed and implemented an IPsec VPN security gateway prototype．Its specific research and implementation includes： 夺 Examine current IKE-related techniques；analyze their pro and cons，so as to find the starting point ofthe research． ◆Research PKI and ECC techniques and analyze their advantages．Employ ECC technique to get higher efficiency and better seeurity．Apply PKI-based authentication technique to improve the security level of IKE and system’S extensibility．Apply RBAC aC．脱SS control technique based 0n the attribute certificate to gain finer grandarity,aIl with support to DER and PEM fo肌at of (1igital cemfic如． ◆Study DPD protocol，design and implement it．Resolve the problems of how to diSCOVer the dead distant peers efficiently when they’re offiine，then to 咒-negotiate to improve system’S robustness and efficiency． ◆Analyze prototype for security．Against the fact that MD5，SHAl message digest algorithms have been erneked recently,analyze the possible potential security threat to the project and propose appropriate mcasures． ．6-Test the prototype system and analyze with the results that the prototype system could work with IPsec modules in Linux kernel v2．6 smoothly,and has got its initial design ta：rgets． The research of this thesis has sponsored by the natural science foundation of Jiangsu Province for the project“Research Off the Hi曲Intensity VPN Security Gateway Techniques and Core System Based PKI and ECC’(Project Number：BK2004039)· Keywords：VPN，Network Security,IKE，PKI Written by：Huang Xian Supervi sed by：Lu Ji an—de II 苏州大学学位论文独创性声明及使用授权声明学位论文独创性声明 苏州大学学位论文独创性声明及使用授权声明 学位论文独创性声明 本人郑重声明；所提交的学位论文是本人在导师的指导下，独立进行研究工作所 取得的成果。除文中已经注明引用的内容外，本论文不含其他个人或集体已经发表或 撰写