基于IPv6的IPSec与防火墙协同策略的研究与设计

发布时间：2018-05-17 07:41

本文选题：网络安全 + 防火墙　；参考：《华南理工大学》2015年硕士论文

【摘要】：IPsec是目前最易于扩展、最完整的网络安全方案。由于IPSec对数据包进行了加密,防火墙无法根据IP地址和端口号等信息对数据包进行过滤,由此产生IPSec协议和防火墙存在兼容性问题的原因所在。针对流量、效率、篡改、漏洞隐患等的问题,本文提出了一种解决方案。在对防火墙技术、IPSec原理、两者冲突机制以及其协同机制研究的基础上,设计了一个防火墙和IPSec能协同工作实现保护网络通信和访问安全的系统。在该系统中,IPSec的SPD(Security Policy Database,安全策略数据库)在安全网关配置,而IPSec的其它部分(如AH,ESP等)则由内部网络主机实现,方便网络之间SPD的一致和判断,使得安全网关在边界防火墙访问控制的基础上增强了IPSec安全策略的判断处理,更加有效地对网络通信数据进行了保护,主机按照防火墙规定的SPD而实现IPSec处理。这样的设计方法实现了端到端通信的加密和认证等安全服务,而且防火墙有能力根据已规定的SPD实现了过滤数据报文。越南现在开始渐进地研究、试验、开展建立IPv6网络系统的阶段,所以本课题的选题对越南开展IPv6协议的研究与实现有一定的用处,可以有效地对越南的网络安全研究提供一定的参考意义。实验测试的结果证明,本系统能使IPSec与防火墙可以协同工作、实现比较简单,共同实现保护网络安全达到预期目标。
[Abstract]:IPsec is the most extensible and complete network security scheme. Because IPSec encrypts the data packet, the firewall can not filter the packet according to the IP address and port number, which causes the compatibility problem between the IPSec protocol and the firewall. Aiming at the problems of flow, efficiency, tampering, vulnerability and so on, this paper proposes a solution. Based on the research of the firewall technology, the principle of IPSec, the conflict mechanism and the cooperative mechanism of IPSec, a system is designed in which firewall and IPSec can work together to protect network communication and access security. In this system, SPD(Security Policy Database (Security Policy Database) of IPSec is configured in the security gateway, while other parts of IPSec (such as AHN ESP, etc.) are implemented by the internal network host, which facilitates the consistency and judgment of SPD between networks. Based on the access control of the boundary firewall, the security gateway enhances the judging and processing of the IPSec security policy, and more effectively protects the network communication data. The host implements IPSec processing according to the SPD stipulated by the firewall. This design method realizes the security services of end-to-end communication such as encryption and authentication, and the firewall has the ability to filter data packets according to the prescribed SPD. Vietnam is now gradually studying, experimenting and developing the stage of establishing IPv6 network system, so the topic of this topic is useful for Vietnam to carry out the research and implementation of IPv6 protocol. It can provide a certain reference for the study of network security in Vietnam. The experimental results show that the system can make IPSec and firewall work together and achieve the desired goal of protecting network security.
【学位授予单位】：华南理工大学
【学位级别】：硕士
【学位授予年份】：2015
【分类号】：TP393.08

【参考文献】