一体化标识网络网关自配置及流量监测的设计与实现

发布时间：2018-04-11 01:17

本文选题：一体化标识网络 + 身份和位置分离　；参考：《湖北工业大学》2017年硕士论文

【摘要】：面对当前高速发展的互联网技术,持续扩大的网络规模,路由扩展性、安全性和移动性问题日渐严重。一体化标识网络中采用身份和位置分离,来实现IP地址双重属性分离目的,是下一代互联网的主要研究方向。一体化标识网络中的通信机密和完整,依赖于IPSec协议的大规模部署。与此同时,为较好地解决IPSec协议规模化部署实施中遇到的网关配置困难问题,需要提供一种IPSec网关自配置技术。研究发现,高负载、差灵活性及单点失效等,是当前自配置技术存在的问题。并且,借助接入标识保持不变的特性,能够追踪用户的位置信息及移动轨迹;采用从流量分布角度监测的基于信息熵的监测,流量深层分布能得到充分挖掘。为解决上述问题,本文设计并实现一种触发式的自配置技术;同时,本文设计并实现流量监测技术,提供了更好的适应性。本文主要工作包括以下两个方面:首先,实现能够直接在IPSec网关上部署,以触发方式启动网关之间的交互的IPSec网关自配置技术,并采用超时重传机制以提升交互可靠性,实现了多策略配置以保护接入网,实现对IPv4和IPv6的兼容以提升过渡时期的系统适应性。其次,在流量监测方面,设计并实现先分布式采集后集中处理的方案。通过研究上述工作,本文概述了一体化标识网络;阐述了IPSec协议体系,概述了必要性和可行性,并讨论了部署方案;引入了网络流量监测和信息熵的概念。在理论基础上,对一体化标识网络中的自配置和流量监测技术进行需求分析,完成系统设计。其中,在网关自配置技术方面,设计了触发子系统和交互子系统;在流量监测技术方面,设计了控制台子系统和引擎子系统。采用模块化的思想,对系统各功能模块进行良好的设计和实现,完成IPSec网关自配置和流量监测的技术实现。最后,针对技术实现,设计并完成系统功能性测试。测试结果表明,本文所设计的系统各基本功能得到实现,能够很好地解决现有网关配置及网络流量监测当中存在的问题,并对后续研究和改进工作做出了展望。
[Abstract]:Facing the rapid development of Internet technology, the problems of network scale, routing expansibility, security and mobility are becoming more and more serious.It is the main research direction of next generation Internet to separate identity and location to realize the double attribute separation of IP address in the integrated identification network.The communication confidentiality and integrity in the integrated identification network depend on the large-scale deployment of the IPSec protocol.At the same time, in order to solve the problem of gateway configuration in large-scale deployment of IPSec protocol, it is necessary to provide a self-configuration technology for IPSec gateway.It is found that high load, differential flexibility and single point failure are the problems of current self-configuration technology.With the help of the invariant access identification, the user's location information and mobile trajectory can be traced, and the deep traffic distribution can be fully excavated by using the information entropy based monitoring from the point of view of traffic distribution.In order to solve the above problems, a trigger self-configuration technology is designed and implemented in this paper. At the same time, the flow monitoring technology is designed and implemented in this paper, which provides a better adaptability.The main work of this paper includes the following two aspects: firstly, the self-configuration technology of IPSec gateway which can be deployed directly on IPSec gateway and initiate the interaction between gateways by triggering mode is realized, and the mechanism of time-out retransmission is adopted to improve the reliability of interaction.The multi-policy configuration is implemented to protect the access network, and the compatibility of IPv4 and IPv6 is realized to enhance the system adaptability during the transition period.Secondly, in the aspect of flow monitoring, the scheme of distributed collection and centralized processing is designed and implemented.By studying the above work, this paper outlines the integrated identification network, expounds the IPSec protocol system, outlines the necessity and feasibility, and discusses the deployment scheme, and introduces the concepts of network traffic monitoring and information entropy.On the basis of the theory, the self-configuration and flow monitoring technology in the integrated marking network are analyzed and the system design is completed.In the aspect of gateway self-configuration, trigger subsystem and interactive subsystem are designed, and console subsystem and engine subsystem are designed in traffic monitoring technology.With the idea of modularization, the function modules of the system are well designed and implemented, and the technology of self-configuration and flow monitoring of IPSec gateway is completed.Finally, for the technical implementation, design and complete the system functional testing.The test results show that the basic functions of the system designed in this paper have been realized, which can solve the problems in the existing gateway configuration and network traffic monitoring, and the future research and improvement work is prospected.
【学位授予单位】：湖北工业大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.0

【相似文献】