IPSEC加密（国外英文资料）.doc

IPSEC加密（国外英文资料） IPSec base - IPSec protocol type classification: IT motley IPSec base - IPSec protocol type IPSec provides two security mechanisms: authentication and encryption. The authentication mechanism enables the data recipient of IP communication to confirm the true identity of the sender and whether the data was tampered with during transmission. The encryption mechanism ensures data confidentiality by encoding the data in case the data is intercepted during transmission. IPSec protocol group contains the Authentication Header (AH) protocol, Encapsulating Security Payload (ESP) protocol and the Internet Key Exchange (IKE) protocol. The AH protocol defines the authentication application method, providing data source authentication and integrity assurance; The ESP protocol defines the application of encryption and optional authentication, providing reliability assurance. When you actually do IP communication, you can use either protocol or choose one of these protocols based on actual security requirements. Both AH and ESP provide authentication services, but AH provides more authentication services than ESP. IKE is used for key exchange (which will be discussed in the future). The Authentication Header (AH) protocol structure AH protocol for IP communications provide data authentication, data integrity, and replay that it can protect communications from tampering, but it cant prevent eavesdropping, suitable for transmission of confidential data. AH works by adding an authentication header on each packet. This header contains a hash with a key hash (it can be used as a digital signature, but it does not use a certificate), the hash hash calculation in the packet, so any changes will cause the hash of the data is invalid, thus provide the integrity protection. The AH header is located between the IP header and the transport layer protocol header, as shown in figure 1. AH is identified by the IP protocol 51, which is included in the protocol header before the