支持隧道代理的主動(dòng)防御型防火墻——基于IPSec的VPN安全網(wǎng)關(guān)及其LINUX實(shí)現(xiàn)研究.pdf

1、湖北工業(yè)大學(xué)碩士學(xué)位論文支持隧道代理的主動(dòng)防御型防火墻——基于IPSec的VPN安全網(wǎng)關(guān)及其LINUX實(shí)現(xiàn)研究姓名：蘭義華申請(qǐng)學(xué)位級(jí)別：碩士專業(yè)：計(jì)算機(jī)應(yīng)用技術(shù)指導(dǎo)教師：張穎江20060501湖北工業(yè)大學(xué)碩士學(xué)位論文AbstractThepopularizationofIntemetbringshugeeconomicbeneftforthesocietyHoweverthesafeproblemofinformationisalsoi

2、ncreasinglyoutstandingthenetworksafetyhasalreadybecomethecoreproblemwhichpeopleincreasinglypayattentiontoVarioussafetyguardtechnologiesemergeisthetimesrequireandVirtualPrivateNetwork(VPN)；withitspracticabilitysecuritysim

3、pleandlowcostacquiredextensiveapplicationAtfirst，ThisthesiscarriesonthekeytechnologiesofIPSecVPNgatewayinLinuxsystem‘simplementthekeytechnologiesincludethetechniqueofVPN、IPSecandNetfiltermechanismofLinuxThetechniqueofVPN

4、CallbuildtheremoteprivatenetworkofCheenterprisebyusingtheoppositeinsecurepublicnetworkMakinguseofspecialsoftwareandhardwarefacilitiesandestablishingthe109icaltunnelinshareIPnetitcarryoutasafepointto—pointconnectionbetwee

5、nremotenetworksThecoreofthetechniqueofVPNistunneltechniquethatincludeIPSecGREL2TPPPTPetcVPNbasedontheIPSecprotocolisthemostprevalentIPSecprotocal、asetofrelatedprotocolsthatIETFprovidesthesafetyserviceforIPlayerAsthenetwo

6、rklayersafetyprotocol，itachievesIPdatasafetyprotection，andcanprovidethetransparentsafetyservicefortheupper1ayersLinuxsystemkeneladoptstheNetfiltermechanism，whichisastructuralbottomframeforexpandingvariousnetworkserviceaf

7、ter24versionUsingitshookfunctionwecancarryouttheextensionofnewnetworkcharacteristicInordertoimplementaVPNsecuritygatewav‘thefirstthingistochooseaproperandreasonableapproachForthisIdeterminetoemploythesecurityin1Playerbyi

8、mplementingtheIPSecprotoc01Basedonthisthought，IfirstconceptuallydesigntheVPNsecuritygatewayThemaincontentofmisdesignincludeshowtoconstructthehardwarehowtoorganizethesoftware，howtoimplementtheSecurityAssociation，howtodeal

9、withtheincomingIPpacketsandsoonAt1astwetakeadvantageofLinux‘sopensourcecodesandHOOKmechanismofNetfilterfirewallandimplementseamlessconformityofTCP／IPandIPSecafterhookingIPSecmodelwithLinuxsystemkernelbyregisteredfunetion

10、Atierthat，Irecompilethenewsystemkemelandproduceatrulysafekernel，thenweachieveasafeVPNgatewaybasedontheIPSec：UsinghookofNetfiltermechanismasentranceofcalledprocessfunctiontointegrateIPwithIPSecprotocolisrealizatedbycallin

11、gIPSectoprocessmoduleintheIPprocessingprocedureofdataTheentrystrategyprocessmoduleofIPSecdataisaddedinthe6ntryprocessingpositionofIPdatatomakesureofdroporaccept；theentryprocessingmoduleofIPSecdataisaddedintheacceptpositi

12、onofIPdatatodencapsulateandrevertthedata；theoutgoingprocessingmoduleofIPSecdataisaddedintheoutgoingandforwardpositronofIPdatatoencrypt，anttlenticateandencapsulatethedataBecausetheIPSecProtocolisusedingateway，thetunnelmod