Analysis and improvement of IKEv2 against denial of service attack

IKEv2 is the new version of Internet Key Exchange protocol. Despite of its several advantages, it is still vulnerable to denial of service attack. In this paper, we propose an improvement of IKEv2, which is based on the shared secret and asymmetric distribution of calculations. By analyzing the improved IKEv2 with a cost-based framework, we conclude that the improvement is secure against DoS attack. Furthermore, associated with cookie mechanism, the improvement can prevent flooding attack from spoofed IP addresses. And the improvement can also achieve the identity authentication in advance, resist man-in-the-middle attack and replay attack.