03-安全配置指导-keychain配置.pdfVIP

目 录 1 keychain ····················································································································· · 1-1  1.1 keychain简介 ············································································································· 1-1  1.2 配置keychain ············································································································· 1-1  1.3 keychain显示和维护 ···································································································· 1-2  1.4 典型配置举例············································································································· 1-2  1.4.1 Keychain基本组网配置举例 ·················································································· 1-2  i 1 keychain 1.1 keychain简介 keychain 是加密规则（key）的集合，用来为应用程序提供动态认证功能。keychain 在不中断业务 的前提下，通过定期更改用于认证的密钥和算法来提升网络数据传输的安全性。 一个 keychain 中的不同 key 可配置各自的认证密钥、认证算法和生命周期。key 由认证密钥、认证 算法和生命周期三部分组成。当系统时间处于 key 的生命周期内时，应用程序可以利用它对发送和 接收的报文进行校验。当 keychain 内各个 key 的生命周期具有连续性时，随着系统时间的推移， 各个 key 能够依次生效，从而实现动态地更改应用程序使用的认证算法和认证密钥。 keychain 支持绝对时间模式，该模式的 keychain 中，key 的生命周期是 UTC （UTC，Coordinated Universal Time，国际协调时间）绝对时间，不受系统的时区和夏令时的影响。 1.2 配置keychain 配置时需要注意以下几点： • 同一个keychain 内的各个key 使用 send-lifetime utc 指定的生命周期不可重叠，以确保在同 一时刻，应用程序只使用一个 key 对发送的报文进行校验。 • 认证双方在同一时间内所使用的 key 的认证算法和认证密钥必须一致。 表1-1 配置keychain 操作 命令 说明 进入系统视图 system-view - 创建keychain，并进入 keychain keychain-name [ mode 缺省情况下，不存在keychain keychain视图 absolute ] 创建一个key，并进入key视