基于IPsec的IPv6安全邻居发现协议.pdf

计算机工程与设计 Computer Engineering and Design 刘华春，戴庆光，蒋志平：基于IPsec 的IPv6 安全邻居发现协议 2011, Vol.32, No.2 513 基于IPsec 的IPv6 安全邻居发现协议 刘华春， 戴庆光， 蒋志平 (成都理工大学工程技术学院，四川 乐山614007) 摘 要：为了保证邻居发现协议的安全，通过在邻居发现协议中引入IPSec 协议，提出了基于IPSec 的安全邻居发现协议模型 结构；设计了在邻居组播状态下的密钥交换和管理协议MIKE ，并给出了密钥管理的星型结构算法；在AH 验证数据中将IP 地 址与链路层地址绑定，有效的防御IP 地址的伪造。该方案与现行的安全邻居发现算法的比较结果表明，该安全模型能够有 效地保证邻居发现的安全，并能与IPv6 协议无缝连接，进一步提高下一代互联网的安全。 关键词：邻居发现协议; IPSec; 密钥管理; 安全邻居发现; 认证头协议AH 中图法分类号：TP393.08 文献标识码：A 文章编号：1000-7024 (2011) 02-0513-04 IPv6 secure neighbor discovery protocol based on IPSec LIU Hua-chun, DAI Qing-guang, JIANG Zhi-ping (College of Engineering and Technology, Chengdu Technical University, Leshan 614007, China) Abstract ：In order to ensure the safety of a neighbor discovery protocol, through the introduction of IPSec protocol to the neighbor dis- covery protocol, a secure neighbor discovery protocol model based on IPSec is proposed. Key exchange and management protocol in multicast state is designed, and a star schema key management algorithm is proposed. IP address and link-layer address binding in the AH is to defend against forged IP addresses. By comparing the scheme with the current secure neighbor discovery algorithm, The results show that the scheme can effectively ensure the security of neighbor discovery, and seamlessly connect with the IPv6, and improve security of the next generation Internet. Key words ：neighbor discovery protocol; IPSec; key management; secure neighbor discovery; AH authentication header protocol 邻居发现的安全问题，但是在IPv6 环境中要确定一个公认的 0 引 言 [