IPSEC+VPN+基础知识概要.ppt

IPSEC VPN 基础知识 作者:locke Email:locke_peng@ Security RS CCIE#12197 Based on collins version 必备知识 课程内容 加密历史和技术 对称加密算法的特点 不对称算法的特点 身份验证和完整性 对数据流的密钥化散列 对数据流的数字签名 提前的身份验证:RSA签名 提前的身份验证:DSA签名 密钥交换(1) 密钥交换(2) 密钥交换(3) 完美向前保密 INTERNET面临的威胁 IPSEC基本概念 IPSec is a defined encryption standard that encrypts the upper layers of the OSI model by adding a new predefined set of headers. A number of RFCs defined IPSec. IPSec is a mandatory requirement for IP version 6. (IPV6 is not covered in the examination.) IPSec ensures that the network layer of the OSI model is secured. In TCP/IP’s case, this would be the IP network layer. IPSEC的两种保护模式 Transport mode—Protects payload of the original IP datagram; typically used for end-to-end sessions Tunnel mode—Protects the entire IP datagram by encapsulating the entire IP datagram in a new IP datagram 两个概念(1) 两个概念(2) 两个概念(3) 怎么选取IPSEC保护模式? 两种保护模式的包结构 SA-安全联盟 SPD-安全策略数据库 选择符－应用SPD的依据 IPSEC的组成部分 ESP（负载安全封装）协议 认证头（AH）协议 Internet密钥交换（IKE）协议 Encapsulation Security Payload (ESP) The ESP security service is defined in RFC 2406. ESP provides a service to the IP data (payload),including upper-layer protocols such as TCP. The destination IP port number is 50. The ESP header is located between the user data and original IP header。ESP does not encrypt the original IP header, and encrypts only the IP data by placing a header in between the original IP header and data. ESP provides data confidentiality, data integrity, and data origin authentication. ESP also prevents replay attacks. ESP包结构(1) ESP包结构(2) ESP包字段解释 防重放攻击的实现 ESP数据包的外出处理 ESP数据包的进入处理 ESP对分片包的处理 Authentication Header (AH) AH is described in RFC 2402. The IP protocol destination port is 51. The fields in the IP datagram that are encrypted and authenticated. AH provides data origin authentication and optional replay-detection services. AH doesn’t provide data confidentiality (or encryption). AH包结构(1)-传输模式 AH包结构(2)－隧道模式 AH的处理－输出处理 AH的处理－输出处理 AH的处理－输入处理 AH和ESP共同作用（1） AH和ESP共同作用（2） IKE介绍 IKE