文档介绍：重庆大学硕士学位论文中文摘要 I 摘要虚拟专用网(VPNVirtual work)技术是指在公共网络中建立专用网络,数据通过安全的“加密通道”在公共网络中传播的技术。IPSec(IP Security) 协议是目前构建VPN的主流协议之一,两台IPSec VPN计算机在交换数据之前, 必须首先建立安全关联(SA Secruity Association),就双方需要如何保护信息、如何交换信息等公用的安全设置达成一致。因特网密钥交换(IKE Key Exchange)协议是IPSec协议簇的重要组成部分,负责动态协商和管理安全关联。但是IKE协议有很多的缺陷,导致它在安全性、效率和实现方面都存在很多问题。所以提出IKEv2协议和JFK(Just Fast Keying)协议作为IKE协议的替代协议,目的在于简化协议,并尽量解决IKE中存在的问题。论文从实用和简便的角度出发,选择JFK协议作为研究对象。相比较IKE协议,JFK协议更加安全、高效和简单。但是JFK协议也有自身的一些缺陷,比如没有实现PFS(Perfect Forward Secrecy),不能做到完全无状态交互等等。本文在对JFK协议详细分析的基础之上,对JFK协议存在的不足提出了改进方案,在不削弱JFK协议优点的同时使JFK协议更加完善。根据对JFK的分析,并且参考当前流行的IKE协议实现方案,论文提出一种改进后的JFK协议的实现方案,给出了方案中各部分的主要功能和实现方法,并通过实验验证了改进的有效性和实现方案的可行性。论文的最后介绍了JFK协议的一些扩展功能,这些扩展功能是为了满足不同环境下的使用要求而提出来的,论文中对扩展功能的基本原理及如何在JFK中的实现做了简单的介绍。关健词:IKE协议,JFK协议,完美向前保密,拒绝服务攻击重庆大学硕士学位论文英文摘要 II ABSTRACT VPN(Virtual work)is such a kind of technic that a work is built in the work, thus the data can transmit in work through secure densification channel. IPSec(IP Security)is currently one of the main protocols constructing (SecurityAssociation)must be established and an agreement should be reached on how to protect and exchange information and other public security settings before exchange data between two IPSec puters. IKE( Key Exchange)protocol is the major part of IPSec, responsible for the dynamic negotiation and managing SA. however, many disadvantages are still exist in IKE, which will cause many problems in its security , efficiency and plishment. Thus IKEv2 protocol and JFK(Just Fast Keying)protocol are brought forward as the substitute for IKE to simplify protocol and resolve the problems of the view of practical and simple and convenient, JFK protocol is chosen as the research object of this thesis, which is safer , higher efficient and simpler than IKE protocol. However JFK itself has some defects such as it hasn't realized PFS(Perfect Forward Secrecy), and cannot plete non-state interaction etc. Based on the detail analysis of JFK protocol, the thesis proposes some