Snmpv3 Protocol Security Mechanisms

With the rapid development of the computer network, security issues have become the focus of the computer society and the researchers. The high-performance router is the core part of backbone network. Security management is one of the basic functions of router network management system. This dissertation is devoted to researches into the theory and implementation of the security mechanism of the Simple Network Management Protocol version 3 (SNMPv3) according to the requirements of the Tenth Five-year Plan 863 "T bit High-Performance IPv4/v6 Router Basic Platform and Experimental System" .The main contribution and innovation of this thesis come as follows:Firstly, we point out the problem of the security mechanism of SNMPv3 in existence. After a deep analysis of the protocol, we have found that if we use the SNMPv3 protocol directly in the terabit router system, some problems like simplex user category, not having much encrypt category and faulty key management would occur and can' t satisfy the requirement of the security policy.Secondly, in order to improve the security performance, based the RFC 3826, we put forward the application of the AES arithmetic to replace the DES arithmetic of the USM module and implement it in the terabit router system. The special condition of the military purpose requires the terabit router system to have more security than others. Based on the study of all kinds of encrypt arithmetic and the trend of current encrypt technology, we put forward the use of the AES arithmetic to replace the DES arithmetic, then we analyze the difficulties of the program and list the whole process of the design within the net-snmp software packet. From the theoretic analysis and experimentation, we can conclude that the AES arithmetic can satisfy the requirement of terabit router system perfectly.Thirdly, we propose and implement the Key-lifetime-limited betterment scheme based on the USM module. This scheme reminds the administrator to change the use key in time with the Trap mechanism once the key expires. This scheme enables the system to have the capability of security test in time and avoid the danger of using the same key for too much time. This improvement has greatly enhanced the security of the terabit router system.