IPv6环境下校园网接入认证系统的设计与实现

发布时间：2018-05-29 12:35

本文选题：IPv6 + 安全接入　；参考：《电子科技大学》2015年硕士论文

【摘要】：网络接入方面的安全控制对于网络系统安全而言是首要考虑的问题。网络运营商在广域网接入方面的安全和控制技术都比较成熟,但是对于园区网内部而言,一些内部的需要保护或者需要涉及到资费的信息资源在网络资源的保护措施还是显得颇为薄弱。一是因为园区网本身与点对点的广域网相比而言,由于群体相对固定,而最初的以太网的设计就把这些固定的群体纳入到可控的范围而不予过多考虑安全性问题,因此赋予它足够的开放性;二是因为实现局域网安全控制会产生额外通信和网络建设成本的负担;三是因为现有的技术还需要改进和设计;四是因为新的网络技术标准IPv6将带来更大的安全方面的挑战。如何将用户安全有效的进行联网,将会直接影响到IPv6在园区网中的普及和应用。本论文正是针对上述因素,以IPv6环境的局域网的安全接入为主要的研究对象,在深入分析现有的IPv6网络安全接入技术的基础上,对安全接入中技术实现问题作了探索性的研究和实践。主要内容为:1.详细研究了目前主要的身份认证技术的原理。对身份认证的各种技术实现方法进行了深入的分析,归纳出在接入安全方面可行的认证方法和技术。2.设计了一个校园网安全接入计费管理系统。基于应用层的介入控制实现手段灵活,方法多样。软件从应用层的角度采用C/S架构来实现对计算机用户的管理和控制,能有效防止非法用户进入计算机系统及访问网络资源,同时应消防的要求附带了计费功能,减轻了公共计算机网络资源的管理负担。3.详细研究和分析了基于数据链路层的802.1x协议,针对现有的可控数据链路层接入技术,在控制硬件成本和管理成本的前提下,利用802.1x协议并结合PVLAN技术设计并实现了对于不同类型用户的接入可控、可交互认证,并给出了完整的解决方案的实例。
[Abstract]:The security control of network access is the most important problem for network system security. Network operators have mature security and control technologies in WAN access, but within the campus network, Some internal information resources which need to be protected or need to involve in tariff are still weak in the protection of network resources. One is that compared with point-to-point WAN, because the group is relatively fixed, the original Ethernet design brought these fixed groups into a controllable range without too much consideration for security issues. Therefore, it is given enough openness; the second is that the realization of LAN security control will create additional burden of communication and network construction costs, and the third is that the existing technology still needs to be improved and designed. Fourth, because the new network technology standard IPv6 will bring greater security challenges. How to connect users safely and effectively will directly affect the popularity and application of IPv6 in campus network. Aiming at the above factors, this paper takes the secure access of LAN in IPv6 environment as the main research object, based on the in-depth analysis of the existing IPv6 network security access technology. The research and practice of technology realization in secure access are discussed. The main content is: 1. The principle of the main authentication technology is studied in detail. In this paper, the implementation methods of identity authentication are deeply analyzed, and the feasible authentication methods and techniques in access security are summarized. A campus network security access billing management system is designed. The implementation of interventional control based on application layer is flexible and diverse. From the perspective of application layer, the software uses C / S architecture to manage and control computer users. It can effectively prevent illegal users from entering computer systems and accessing network resources. Reduce the public computer network resources management burden. 3. The 802.1x protocol based on data link layer is studied and analyzed in detail. Aiming at the existing controllable data link layer access technology, under the premise of controlling hardware cost and management cost, Using 802.1x protocol and PVLAN technology, we design and implement the controllable and interactive authentication for different types of users, and give an example of the complete solution.
【学位授予单位】：电子科技大学
【学位级别】：硕士
【学位授予年份】：2015
【分类号】：TP311.52

【相似文献】