Linux环境网关中IPSec VPN的设计与实现

发布时间：2018-05-27 08:23

本文选题：VPN + IPsec　；参考：《电子科技大学》2014年硕士论文

【摘要】：虚拟专用网是互联网技术与通信技术结合的产物,同时客观需求也促使VPN技术的理论和实现技术突发猛进地发展。IPsec VPN技术主要应用于远程接入内网,从而便于实现移动办公,VPN技术还能对通信内容提供保护,以防被窃取和篡改,还可以对资源服务器保障安全。随着安全技术发展VPN技术受到各界的青睐,其中I Psec VPN技术因为提供的机密性与完整性得而到了普遍的应用,能提供节俭、安全和可靠的电信业务。在对IPsec VPN国内外现状和关键技术阐述的基础上,本文对Linux环境网关中的I Psec VPN的需求进行了系统分析。设计了针对经过网关的IP包进行IPSec处理提供保护或对经过IPSec的数据包解析转发。在构造IPSec安全系统中,针对IP协议存在的安全问题,采用AH与ESP协议相关的技术,同时结合对称加解密算法DES、公钥加解密算法RSA、消息摘要技术以及数字签名技术对IP数据包提供完整性服务与机密性服务,以弥补IP协议的安全缺陷。同时针对网络中密钥交换过程的容易遭受攻击的问题,采用I KE相关技术以及Diffie-Hellman密钥交换算法为因特网的密钥交换提供安全保障措施。最后根据系统架构设计及实现情况对所做的系统进行了测试,主要是测试结构模块间IPsec VPN协作完整性,测试结果表明设计与实现的正确性,而且系统运行稳定,符合实际的需求。但是本文实现系统在后台控制方面以及算法效率方面仍存在研究提高的空间。
[Abstract]:Virtual private network is the result of the combination of Internet technology and communication technology. At the same time, the objective demand also promotes the theory and realization of VPN technology to develop suddenly. IPsec VPN technology is mainly used in remote access intranet. Thus the mobile office VPN technology can also protect the communication content from being stolen and tampered with, and can also guarantee the security of the resource server. With the development of security technology, VPN technology is favored by all walks of life. Among them, I Psec VPN technology is widely used because of its confidentiality and integrity, and it can provide thrifty, secure and reliable telecommunication services. Based on the current situation and key technologies of IPsec VPN, this paper systematically analyzes the requirements of I Psec VPN in Linux environment gateway. This paper designs IPSec protection for IP packets that pass through gateway or parses and forwards packets passing through IPSec. In the construction of IPSec security system, aiming at the security problems of IP protocol, we adopt the AH and ESP protocol related technology. At the same time, it combines symmetric encryption and decryption algorithm des, public key encryption and decryption algorithm RSA, message digest technology and digital signature technology to provide integrity and confidentiality services for IP packets, so as to make up for the security defects of IP protocol. At the same time, aiming at the problem that the key exchange process in the network is vulnerable to attack, the key exchange algorithm based on Ike and Diffie-Hellman is used to provide security measures for the key exchange in the Internet. Finally, according to the design and implementation of the system architecture, the system is tested, which mainly tests the IPsec VPN cooperation integrity between the structure modules. The test results show that the design and implementation are correct, and the system runs stably. Meet the actual needs. However, there is still room for improvement in background control and algorithm efficiency.
【学位授予单位】：电子科技大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【共引文献】