Abstract: The digital certificate has a very important influence on the security and efficiency of IKEv2 initial exchanges.An authentication technique based on the ECC certificate is proposed，the mutual authentication of IKEv2 initial exchanges based on ECC certificate under IPSec VPN system is implied.With the same test system and the same security，the efficiency of IKEv2 initial exchanges using ECC certificate is higher than using RSA certificate.The authentication based on ECC，X.509 certificate can effectually imporve the efficiency and security of IKEv2 initial exchanges.

Key words: Internet Key Exchange version 2（IKEv2）, ECC, X.509 digital certificate, digital signature

摘要： 数字证书对因特网密钥交换协议版本2IKEv2（Internet Key Exchange version 2）的初始化交互协商的安全及效率有很大的影响。提出了一种基于ECC数字证书的身份认证机制，并在IPSec VPN系统的IKEv2初始化过程中应用ECC数字证书实现了通信双方的身份认证。在同等测试条件下，相同安全等级的ECC证书与RSA证书对IKEv2协商效率的对比结果表明，采用基于ECC的X.509证书进行身份认证，能够有效地提高IKEv2初始化过程的效率和安全强度。

关键词: 因特网密钥交换协议版本2, 椭圆曲线密码, X.509数字证书, 数字签名