协议_IPSec.pptVIP

Internet安全协议与标准 第六章 IPsec协议 张保稳 * 本次课程教学安排 Ipsec 概念 IPsec机理 IPsec 应用 What is IPSec? IP Security :一个框架，一套协议和标准，支撑IP层的安全。 传输中的认证和加密. 认证包的发起者. 防止传输中的拦截和篡改. Necessity 和IP有关的安全设施 广泛的业界支持e.g. Cisco, Microsoft, Network Associates, CheckPoint Software, Bay Networks, etc. IETF standard – Will网络 be mandatory in IPv6 TCP/IP原理图 IPv4 header IPv4 security 无连接的不可靠的 IP地址容易被假冒 路由器和网关容易被嗅探 IPSec 数据源认证 (IP address) 完整性保护 重放攻击保护 机密性和隐私 DOS预防 (Clogging, DOS) Support for IPv4, IPv6 (mandatory in IPv6) IPv6 header IPsec资料 IPSec documents: RFC 2401: An overview of security architecture RFC 2402: Description of a packet encryption extension to IPv4 and IPv6 RFC 2406: Description of a packet encryption extension to IPv4 and IPv6 RFC 2408: Specification of key managament capabilities IPsec 文档体系 IPsec 两个分离的层 IKE – Internet Key Exchange IP-Sec record sub-layer: traffic encapsulation protection IPsec Security Associations Security Association (SA). 见 RFC 1825. SAs 由Security Parameter Index (SPI) 和 目标地址组成. 单个IPsec连接至少需要2个SA。 Security Associations SA的参数: 认证算法和模式 加密算法和模式 相关密钥 密钥生命周期 SA生命周期 SA源地址 敏感水平(秘密还是未分类) Security Association Data (SAD) contains all the active Security Associations (SAs) Incoming: access via SPI in packet SPI in each direction selected by recipient (for efficiency) Outgoing: access via `selectors` in packet IP addresses, TCP/UDP ports and more 手工创建或者经由IKE Security Policy Data (SPD) 含有用户定义的策略.：每个报文的安全服务及其水平。 contains a list of rules: TrafficSelector, action Traffic Selectors:IP addresses and/or ports (specific or range), protocol (TCP/UDP/?); Actions: Discard; Bypass IPsec；Apply IPsec AH – Authentication Header AH Defined in RFC 1826 完整性: Yes, including IP header 认证: Yes Non-repudiation: Depends on cryptography algorithm. 加密: No 重放保护: Yes AH Outbound Inbound processing Outbound processing (senders end): Security Association Lookup Sequence Number Generation ICV computation Padding Fragmentation Inbound processing (receivers end): Re