企業網路安全新技術IEEE 802.1X-Rev金鑰協議管理

A Novel Technology for Enterprise Network Security-IEEE 802.1X-Rev Authenticated Key Agreement

黃博彥(Bo-Yan Huang)

《電腦與通訊》 125期 (2008/09) Pp. 81-86

https://doi.org/10.29917/CCLTJ.200809.0012

摘要

網路技術的蓬勃發展至今，在安全性上面的議題越來越受到重視。因而也發展出了各式各樣的安全機制，然而目前的安全機制只是在Layer-3 IP層以上，而Layer-2其實有許多的安全性漏洞。依照網路分層的概念，各層是互相獨立的，上層會去用到下層提供的服務，然而如果下層本身就不安全了，上層再安全也是枉然。因此近來IEEE 802.1AE的MACsec漸漸受到大家重視，在Layer-2保護第二層的封包。而要保護加密Layer-2的封包勢必牽扯到key的交換問題，這也是本文的重點所在，闡述IEEE 802.1X-Rev的Key Agreement 機制，說明其交換key的流程與理念。目前IEEE 802.1X-Rev還在草稿階段，最新的為2.5 Draft版本。

關鍵字

網路鏈結層安全 ； 金鑰交換

並列摘要

With the advancement of network technology, the topic of network security becomes more and more important. Therefore many security mechanisms are proposed; however, the mechanisms protect only those above layer-3. Unfortunately, there are many weakness issues within layer-2. Due to the design of OSI model, each layer works independently, the upper layer will use the service of lower layers. Thus, no matter how secure the upper layer is, the effort for the whole network security is in vain if the lower layer is insecure.
That's why people research IEEE STD 802.1AE, MACsec, which protects layer-2 packet. Since we want to encrypt Layer-2 packet, the issue for key agreement is required, and that is exactly what this article concerns. We will explain the system flow and concepts for the key agreement mechanism for IEEE STD 802.1X-Rev. The IEEE STD 802.1X-Rev is still a draft, and now the newest version is draft 2.5.

並列關鍵字

MACsec ； Key Agreement