摘要： 网络边界是提供访问服务的主要通道，而IPSec VPN作为网络边界防护中的关键技术，对于保障网络整体安全至关重要。分析IPSec VPN中IKE协议激进模式和OSPF路由选择协议的安全性漏洞，研究三种常规OSPF路由欺骗方式在IPSec VPN中间人攻击中的性能表现，构建IPSec VPN流量劫持模型及攻击数据包，设计IPSec VPN流量劫持算法与KEYMAT密钥获取算法。通过搭建仿真环境并选取双LSA注入路由欺骗攻击方式，实现跨网段IPSec VPN中间人攻击并验证了IPSec VPN协议的脆弱性，该结论对于网络边界设备防护、骨干网络流量保护具有重要作用。

关键词: IPSec VPN技术, IKE协议, 中间人攻击, OSPF协议, 路由欺骗攻击

Abstract: Network boundary is the necessary channel for providing access services. As a key technique widely used in network boundary protection, IPSec VPN has a significant influence on the overall security of network. This paper analyzes the security vulnerabilities of the radical mode of the IKE protocol and the OSPF routing protocol in IPSec VPN. Then three commonly used OSPF routing deception methods are studied for their performance in the man-in-the-middle attacks on IPSec VPN. On this basis, the traffic hijacking model for IPSec VPN and the attack data packet are constructed. The traffic hijacking algorithm for IPSec VPN and KEYMAT key acquisition algorithm are also designed. Finally, a simulation environment is built to verify the security vulnerabilities of IPSec VPN. By employing the dual LSA injection route spoofing attack method, the experiment realizes the cross-network-segment man-in-the-middle attacks on IPSec VPN. The result of the study is of great importance to the protection of network boundary devices and backbone network traffic.

Key words: IPSec VPN technology, IKE protocol, man-in-the-middle attack, OSPF protocol, routing spoofing attack

中图分类号: 

• TP309.2