基于IP的VPN安全网关的设计实现-计算机应用技术专业论文.docxVIP

了?岁7；、9∥7／,／7／卜o_J— 了?岁7；、9∥ 7／,／7／卜o_J— Abstract Since the Intemet iS not secure．many organizations now begin develop and deploy the Virtual Private Network technology for their secure internal communication on this global，yet insecure network．In this Paper’I first briefly introduce the basics ofVPN．and then concentrate on the security requirements oftlle VPN gateway,the critical part of VPN．In order to implement a VPN security gateway, the first thing is to choose a proper and reasonable approach．For this．I determine to employ the security in IP layer by implementing the IPSee protoc01．Based on this thought．I first conceptually design the VPN security gateway．111e main content of this design includes how to construct the hardware，how to organize the software，how to implement the Security Association．how to deal witll the incoming IP packets and how tO automatically negotiate the Security Association and keys．From this conceptual删砌SCdesign，I implement two concrete projects．0ne is based on the Linux and chips，while the other is totally build from the board by myself．At last．I analyze and compare the performance of these two approaches，and present my prospect for future improvement． Keywords：Virtual Private Network(vPN)，IP Security,Security Gateway 摘要 由于lmtemet的不安全性，许多的团体和组织为了在这个全球性的开放网络 上进行安全的内部通信，开发并采用了虚拟私用网络技术。本文先简单介绍了虚 拟私用网络的基本知识，然后集中讨论了VPN核心部件——-vPN网关的安全需 求。为了实现一个VPN安全网关，要选用一个合适的实现思路，为此，笔者选 择了在IP层实现安全性，即实现IPSec协议。基于这种思路，笔者先从概念上 提出了VPN安全网关的设计，包括如何架构硬件，如何架构软件，如何实现安 全关联，如何处理收到的口包以及如何进行安全关联和密钥的自动协商。然后， 笔者选择了两种具体的实现方案，一种基于Linux和ARM芯片平台，另一种完 全自建平台，并分析了这两种方案各自的性能，给出了今后的改进和展望。 关键字：虚拟私用网络m安全安全网关 蒸予Ip辩VPN安全两荧舶设计实现1引言 蒸予Ip辩VPN安全两荧舶设计实现 1引言 随着Internet鲢邋猛发璇与蓠及，程现在螅簿一天，公霸鞭个入酃在利用 Intemet束完藏在线交荔，瘫烫稍通过迤予都佟鞠计冀梳灏络来萦攀文粹和信意， 入钓在自己襄里瓣诗簿撬。奠燹耧毽{|、j豹锻学户头。程Intemet上，几乎派寿筑憋 象褥到形状与功熬的豹菇郝霹以透过夜线方式采定魏葶昼支付。炙疑，在我镪即将 步入的信息社会中，计算机网络将成为信息获取、信息处理和信息发布的关键工 粪。 Intemet躲历变霹以逮溯裂70年代中糕荚黧ARPA(Advanced Research Project Agency)为实现不阑耱计冀枫鼹络豹曩联髓邂行的磷究。扶1980警开始，由予 A。R．PA随络上开始使糟毅豹TCP／IP协议终为网络层，雨弼对许多英翘大型的礴 络氇歼始都馨氍