An Intelligent Internet Key Exchange Protocol Resistant to Denial-of-Service Attacks

Ming-Yang Su

《網際網路技術學刊》 11卷5期 (2010/09) Pp. 681-690

https://doi.org/10.6138/JIT.2010.11.5.11

並列摘要

IPsec provides encryption and authentication for data packets, and protects them from eavesdropping and falsification. Prior to performing IPsec functions, authentication must be mutually assured between the two parties in communication, usually two security gateways, and shared session keys between them must be safely generated. Internet Key Exchange (IKE) protocol is the most common mechanism for two security gateways to negotiate. Haddad et al. proposed a simplified DoS-resistant protocol for such negotiation. Besides, the new version of IKE, named IKEv2 as defined in RFC 4306, can also achieve limited DoS prevention. This paper proposes a simplified, but intelligent design for an internet key exchange protocol, which has greater DoS-resistant than the protocol by Haddad et al. or IKEv2, while maintaining important security properties.

並列關鍵字

IPsec IP Security ； Internet Key Exchange IKE protocol ； Denial-of-Service DoS attacks ； Network security