若干互联网安全协议的攻防技术地研究.pdf

摘 要 端和服务器交换的数字证书，客户端向服务器传送的预主密钥就完全被 “中间人”所窃取，从而可以计算出主密钥和会话密钥，经实验证明“中 间人”能够窃取相关密钥。对于 IPSec 协议也存在同样的问题，在 IKE 阶段，由于 Diffie-Hellman 算法无法防止中间人攻击，需要使用数字证 书进行身份认证，也存在数字证书替换的攻击。同时针对每种攻击手段 提出相应的防御方法。 DNSSEC 的认证基本原理是每级域名系统的公钥都会经过上一级 域名系统的私钥签名，“父区”确保“子区”的安全，形成一条从上而 下的认证链，本文根据基于身份加密的原理，提出一个基于身份加密的 DNSSEC 认证模型，从另一个角度来确保 DNS 的安全性；同时根据 DNSSEC 和 SSL 协议协商加密算法和密钥的相近性，提出了基于 DNSSEC 密钥参数的 SSL，提高了 SSL 的安全性和效率。最后指出加 强用户安全意识以及法律意识在信息安全的意义。 关键字：SSL，IPSec，DESSEC ，中间人攻击，证书替换，协议攻击， 算法攻击 II ABSTRACT ATTACK AND DEFENCE STUDY OF SEVERAL INTERNET SECURITY PROTOCOLS ABSTRACT With the development of information technology and popularization of Internet, Internet has become the infrastructure of information times, WWW, Email, network telephone and network TV service has gone deep into people’s daily life. Internet has the characteristic of globality, openness and sharing, it brings great convenience to information exchange. But at the same time, network protocols have also disadvantages, the increasing security events let us recognize the importance of network security, especially for the rapid developing e-commerce which needs great security, so how to make sure the security of the communication is becoming the focus and the research priorities. In this thesis we research several kinds of popular attack methods, such as protocol attack, loophole attack and encryption algorithm attack, select several protocols which are most used or will be popular in the near future as the simulation