基于国密标准的IPSec VPN服务器设计与实现

发布时间：2019-02-14 09:35

【摘要】：互联网已经成为国家经济和商业发展的重要组成部分，并不断渗透到国民生活的方方面面，这已是不争的事实。使用公共网络进行通信的互联网，刚开始设计时并没有考虑到网络安全问题，在无数的网络安全事件之后，人们逐渐认识到网络安全的重要性。在认识到铺设专用物理网络昂贵的建设和维护代价之后，人们提出了基于密码学使用公共网络建立的虚拟私有网络（VPN），我国国家密码管理局参考RFC标准也制定了相应的IPSecVPN技术规范。本文根据最新IPSecVPN技术规范2010版，实现了国密标准的IPSecVPN服务器。本文的主要工作在两个方面：应用层和内核层。应用层IKE管理部分基于开源项目OpenSwan，在算法添加、IKE流程、消息格式、检测标准等四个方面进行修改。根据国密标准采用SM1作为对称分组加密算法，随机数采用物理噪声产生机制，，对RFC标准中相异于国密标准的IKE流程，特别是密钥交换过程没有采用DH算法等进行修改，同时完成用户层和内核层通讯中载荷的格式封装和内容指定等。内核层在Linux内核IPSec实现NETKEY的基础上，使用了三款硬件加密卡提供的加解密功能，在内核加解密框架中实现普通加解密算法和同步块加解密算法，在内核IPSec协议中添加国密标准中规定的新算法和标识符。同时对内核IPSec协议相异于国密标准部分进行修改。本文在选定通用服务器架构的基础上，使用硬件加密卡提供的算法功能实现国密标准的IPSecVPN服务器，在经过多种加密卡和多种加解密算法机制的测试后，能够使服务器的吞吐率达到加密卡极限速率的一半以上。
[Abstract]:It is an indisputable fact that the Internet has become an important part of the economic and commercial development of our country and permeated every aspect of national life. The Internet, which uses public network to communicate, was not designed to take network security into account at first. After numerous network security events, people gradually realized the importance of network security. After recognizing the high cost of building and maintaining a private network based on cryptography, a virtual private network (VPN),) based on cryptography is proposed. Referring to the RFC standard, the National Cryptography Administration of our country has also formulated the corresponding IPSecVPN technical specification. In this paper, according to the latest IPSecVPN technical specification 2010 edition, the implementation of the national secret standard IPSecVPN server. The main work of this paper is in two aspects: application layer and kernel layer. The application layer IKE management part is based on the open source project OpenSwan, in four aspects: algorithm addition, IKE process, message format, detection standard, etc. According to the national secret standard, SM1 is used as the symmetric block encryption algorithm, and the random number uses physical noise generation mechanism. The IKE process in the RFC standard is different from the national secret standard, especially the key exchange process is not modified by the DH algorithm, etc. Simultaneously completes the user layer and the kernel layer communication load format encapsulation and the content assignment and so on. On the basis of the implementation of NETKEY in Linux kernel IPSec, the kernel layer uses the encryption and decryption function provided by three hardware encryption cards, and implements the common encryption and decryption algorithm and synchronous block encryption and decryption algorithm in the kernel encryption and decryption framework. Add new algorithms and identifiers specified in the country secret standard to the kernel IPSec protocol. At the same time, the kernel IPSec protocol is different from the national secret standard part. On the basis of selecting the universal server architecture, this paper uses the arithmetic function provided by the hardware encryption card to realize the IPSecVPN server of national secret standard. After the testing of various encryption cards and various encryption and decryption algorithms, Can make the server throughput to the encryption card limit rate of more than half.
【学位授予单位】：西安电子科技大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.05

【共引文献】