IPV6安全机制

[e-mail]@mimi.cnc.ac.cnIPv6IPIPv6IPv6IPv6IPv6SecurityandItsImpacttoToday’sNetworkSecurityArchitectureLingWangandHualinQian(ComputerNetworkInformationCenter,ChineseAcademyofSciences,Beijing100080)[e-mail]@mimi.cnc.ac.cnAbstract:IPv6(InternetProtocolversion6)isthesuccessortoIPv4,whichisthecurrentIPprotocolversionusedontheInternet.IPv6notonlyeliminatetheaddressexhaustionproblem,butalsoimproveIPlayersecuritybecauseitsupportstwosecuritymechanisms,AuthenticationHeader(AH)andEncapsulatingSecurityPayload(ESP).ButthesecuritymechanismsofIPv6alsomakegreatimpacttotoday’snetworksecurityarchitecture.Manyoftoday’snetworksecuritytoolssuchasfilterfirewall,NATfirewallandnetworkbasedintrudedetectionsystemcannotworkwithIPv6.ThesecurityexpertshavetofindnewwaytoprotectthesecurityofthenextgenerationInternet.Keyword:computernetworkIPv6security1IPv4Internet,2005IP[1]18632001AA112130194019732IETF19921994IPng1995IETFIPv6IPv6128IPv4IPv6AuthenticationHeaderAHEncapsulatingSecurityPayloadESPIPv4IPsecIPv6IPsec[2]IPIPsecIPv62IP[2]IPIPsec[2]EmailIP,3IP3IPv6IPInternetIPv4InternetE-mailSNMPv2HTTPSSLIPv6IPv6IPAHAuthenticationHeaderESPEncapsulatingSecurityPayloadRFC1826(IP)AHESPRFC1827IPESP3.1IPv6AHMD5Sunv6.0IPv6PrototypeMD5AH[2]IPAHIPIPAHAHIPAHAHIPIPAHIPIPIPIPIP3.2snifferIPv6--ESPESPAH[2]4AHESPDES-CBCRSAAHESPESPIPIPESPTCPUDPICMPESPAHESPAHESPAHIPAHESP,ESPESPESPESPESPIPv6IPv6IPv64IPv6IPv6IPv6IPv6IPv4IPv6IPv4TTLIPv4IPv6IPv6CPUCPUIPv4WebIPv64.1IPv65IPNATIPsecIPsec[3]AHIPESP/IPIPESPTCPUDPUDPESP500IPv4IPTCP/UDPIPv4IPTCPIPv6TCP/UDPIPTCP/UDPAH/ESPTCP/UDP[4]IPv6IPsecTCP/UDP4.2IDSIDSIDS(NIDS)IDS(HIDS)NIDS[5]NIDSIPv6NIDS[4]NIDSHIDS(OS)[5]HIDSHIDSHIDS4.36IPv6HIDS4.4IPv6IPv4IETFInternetIPv4IPv6IPv6IPv4InternetIPv4IPv6[6]2000IPv6IPv4IPv6[6]5IPv6IPAHESPIPv6IPv6IPv6[1].ChristianHuitemaIPv6()199941298-116[2].PeteLdshinIPv620004169-79[3].Internet20013[4]._20012200126[5].2002[6].Jun-ichiroitojunHaginoPossibleabuseagainstIPv6transitiontechnologiesdraft-itojun-ipv6-transition-abuse-01.txt2001