VPN中间人攻击与防护关键技术研究

发布时间：2017-12-27 21:49

本文关键词：VPN中间人攻击与防护关键技术研究　出处：《浙江理工大学》2017年硕士论文　论文类型：学位论文

更多相关文章： PPTP VPN 降级攻击 安全防护

【摘要】：随着Internet的快速发展,人们对网络安全的要求越来越高。虚拟专用网(VPN)技术作为一种低成本、易部署、易维护的通信技术,得到许多公司的青睐。目前市场上的VPN技术主要有三类:PPTP、L2TP和IPSec。此外,各个通信设备厂商又在公共协议的基础上定义了自己私有的VPN协议。但是无论哪种VPN协议,本质原理都是利用公共网络的基础设施,创建一个安全隧道来实现虚拟点对点链接。事实证明:没有哪一种VPN协议是绝对安全的,尤其是在当今计算能力飞速增长、计算机性能过剩的时代背景下,整个网络中任何一个薄弱的环节都可能成为信息安全的致命要害。存在协议漏洞,或者代码设计不良的VPN软件所提供的信息加密能力并不比普通公网传输数据更强。因此对于保密要求较高的企业,在部署VPN网络时,必须从所有可能的方面测试这个网络是否足够安全。因此研究VPN网络的安全性有着非常现实的意义。本文详细分析了PPTP VPN的原理。通过抓包详细讨论了PPTP VPN链接的过程,介绍了PPTP链接中所使用到的一系列协议,研究了Linux平台上PPTP VPN降级攻击的可能性及协议中存在的漏洞,发现在PPTP链接的LCP协商阶段,存在一个非加密的选项协商过程,这个过程作为一个攻击窗口可以很容易的被黑客利用,来对整个PPTP链接进行降级攻击。然后根据这个思路详细讨论了Linux的网络协议栈,并分析了实施中间人攻击的基本手段和原理,讨论了降级攻击程序设计时需要注意的若干问题,然后介绍了基于Tilera多核设备进行数据拦截、数据转发和降级攻击的方案,并在Linux平台使用Python设计原型程序进行了攻击实验验证。针对上述降级攻击的漏洞,本文详细探讨了PPTP VPN降级攻击的根本原因,并给出了三种防护策略:通过对客户端LCP报文配置选项进行监测,来发现强制重协商行为,进而可以避免PPTP VPN在用户不知道的情况下使用低级别认证协议;通过为LCP协商过程引入确认机制,保证LCP协商过程的报文不能被中间人篡改,可以从根本上防止降级攻击的成功;第三种是通过IPSec技术对LCP协商过程进行加密来保护协商过程的报文,可以从根本上避免对PPTP VPN的降级攻击。此外,通过分析CHAP认证过程,提出了基于互认证的防护策略,来进一步提高VPN的安全性。
[Abstract]:With the rapid development of Internet, the demand for network security is becoming more and more high. Virtual private network (VPN) technology, as a low-cost, easy to deploy, easy to maintain communication technology, has been favored by many companies. At present, there are three main types of VPN technologies in the market: PPTP, L2TP and IPSec. In addition, each communication device vendor defines its own private VPN protocol on the basis of a public protocol. However, no matter which VPN protocol is, the essential principle is to use the infrastructure of the public network to create a secure tunnel to link the virtual point to point. Facts have proved that no VPN protocol is absolutely safe, especially in today's era of rapid growth of computing power and computer performance. Any weak link in the whole network may become a fatal threat to information security. A protocol vulnerability, or a poorly designed VPN software, is not more capable of encrypting information than ordinary public networks. Therefore, for enterprises with higher security requirements, it is necessary to test the security of the network from all possible aspects when deploying the VPN network. Therefore, it is of great practical significance to study the security of VPN network. In this paper, the principle of PPTP VPN is analyzed in detail. Through the capture discussed the PPTP VPN link, introduced a series of protocols used by PPTP in the link, research the possibility and protocol on the Linux platform PPTP VPN downgrade attack vulnerabilities in LCP PPTP link found in the negotiation stage, there is a non encryption option negotiation process, as the process an attack window can easily be used by hackers to attack the PPTP link to downgrade. According to the ideas discussed in detail the Linux network protocol stack, and analyzes the basic principle and means of implementation of the man in the middle attack, discusses some problems needing attention when designing the downgrade attack program, then introduces Tilera nuclear equipment for data interception, data forwarding and downgrade attack scheme based on Python design and use the prototype program in the Linux platform to carry out the attack experiment. The downgrade attack vulnerability, this paper discusses the main reason for the PPTP VPN downgrade attack, and gives three kinds of protection strategy: by monitoring the LCP message client configuration options, to find the mandatory re negotiation behavior, which can avoid the PPTP VPN using low-level authentication protocol in the user does not know the circumstances; for by the introduction of LCP negotiation process confirmation mechanism to ensure the negotiation process of LCP message cannot be tampered with the middle, can fundamentally prevent relegation attack success; the third is through the IPSec technology on the LCP negotiation process to encrypt messages to protect the negotiation process, can fundamentally avoid the attack on PPTP VPN. In addition, through the analysis of the CHAP authentication process, a mutual authentication based protection strategy is proposed to further improve the security of VPN.
【学位授予单位】：浙江理工大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08

【相似文献】