支持隧道代理的主動防御型防火墻——基于IPSec的VPN安全網(wǎng)關(guān)及其LINUX實現(xiàn)研究.pdf

1、湖北工業(yè)大學碩士學位論文支持隧道代理的主動防御型防火墻——基于IPSec的VPN安全網(wǎng)關(guān)及其LINUX實現(xiàn)研究姓名：蘭義華申請學位級別：碩士專業(yè)：計算機應(yīng)用技術(shù)指導教師：張穎江20060501湖北工業(yè)大學碩士學位論文AbstractThepopularizationofIntemetbringshugeeconomicbeneftforthesocietyHoweverthesafeproblemofinformationisalsoi

2、ncreasinglyoutstandingthenetworksafetyhasalreadybecomethecoreproblemwhichpeopleincreasinglypayattentiontoVarioussafetyguardtechnologiesemergeisthetimesrequireandVirtualPrivateNetwork(VPN)；withitspracticabilitysecuritysim

3、pleandlowcostacquiredextensiveapplicationAtfirst，ThisthesiscarriesonthekeytechnologiesofIPSecVPNgatewayinLinuxsystem‘simplementthekeytechnologiesincludethetechniqueofVPN、IPSecandNetfiltermechanismofLinuxThetechniqueofVPN

4、CallbuildtheremoteprivatenetworkofCheenterprisebyusingtheoppositeinsecurepublicnetworkMakinguseofspecialsoftwareandhardwarefacilitiesandestablishingthe109icaltunnelinshareIPnetitcarryoutasafepointto—pointconnectionbetwee

5、nremotenetworksThecoreofthetechniqueofVPNistunneltechniquethatincludeIPSecGREL2TPPPTPetcVPNbasedontheIPSecprotocolisthemostprevalentIPSecprotocal、asetofrelatedprotocolsthatIETFprovidesthesafetyserviceforIPlayerAsthenetwo

6、rklayersafetyprotocol，itachievesIPdatasafetyprotection，andcanprovidethetransparentsafetyservicefortheupper1ayersLinuxsystemkeneladoptstheNetfiltermechanism，whichisastructuralbottomframeforexpandingvariousnetworkserviceaf

7、ter24versionUsingitshookfunctionwecancarryouttheextensionofnewnetworkcharacteristicInordertoimplementaVPNsecuritygatewav‘thefirstthingistochooseaproperandreasonableapproachForthisIdeterminetoemploythesecurityin1Playerbyi

8、mplementingtheIPSecprotoc01Basedonthisthought，IfirstconceptuallydesigntheVPNsecuritygatewayThemaincontentofmisdesignincludeshowtoconstructthehardwarehowtoorganizethesoftware，howtoimplementtheSecurityAssociation，howtodeal

9、withtheincomingIPpacketsandsoonAt1astwetakeadvantageofLinux‘sopensourcecodesandHOOKmechanismofNetfilterfirewallandimplementseamlessconformityofTCP／IPandIPSecafterhookingIPSecmodelwithLinuxsystemkernelbyregisteredfunetion

10、Atierthat，Irecompilethenewsystemkemelandproduceatrulysafekernel，thenweachieveasafeVPNgatewaybasedontheIPSec：UsinghookofNetfiltermechanismasentranceofcalledprocessfunctiontointegrateIPwithIPSecprotocolisrealizatedbycallin

11、gIPSectoprocessmoduleintheIPprocessingprocedureofdataTheentrystrategyprocessmoduleofIPSecdataisaddedinthe6ntryprocessingpositionofIPdatatomakesureofdroporaccept；theentryprocessingmoduleofIPSecdataisaddedintheacceptpositi

12、onofIPdatatodencapsulateandrevertthedata；theoutgoingprocessingmoduleofIPSecdataisaddedintheoutgoingandforwardpositronofIPdatatoencrypt，anttlenticateandencapsulatethedataBecausetheIPSecProtocolisusedingateway，thetunnelmod