The Construction of VPN Based on IXP4 ××

Wen-hua NIE,Zi-qiang WANG

DOI: https://doi.org/10.3969/j.issn.1002-2279.2005.02.019

2005-01-01

Microprocessors

Abstract:This page introduce the structure and function of IXP4××,which is intel company's new net processor,and then focus on the ways of how to construct the VPN on it.It resolves the problem that how to build a secure network for companys and homes.

What problem does this paper attempt to address?

Fastpath-based VPN Gateway over Network Processor

Bo Ji,Jinfang Zhou,Junda Zhu,Liping Qian

DOI: https://doi.org/10.1049/cp:20061251

2006-01-01

Abstract:Networks, along with the explosive growth of the Internet, developed quickly and make our lives more convenient and efficient. However, at the same time, people will face much more network security problems such as illegal observation, modification, IP Spoofing, etc. This article proposes a novel type of universal software architecture named Fastpath which is purposely designed and optimized for Network Element (NE) in the Next Generation Networks (NGN), under Linux. Furthermore, it illustrates the experience in developing IPSec-based VPN gateway over IXP425, and offloading IPSec processing to NPEs and coprocessors by using APIs of software AccessLibrary through Open Crypto Framework (OCF). Finally, we investigate the performance issues both internally and externally. Through the benchmarks, we analyze the performance of the system and identify that Fastpath and network processor together can construct a universal and high-functional platform for NE which focuses on network processing.
Solution to VPN and Authentication System

LI Jian-jun,XU Duan-qing,GUO Wei-qing

DOI: https://doi.org/10.3969/j.issn.1000-7024.2005.09.068

2005-01-01

Abstract:Combining with living examples and based on IPSEC,the realization of the VPN system was approached in many internet circumstances of remote access(such as gateway,broadband,xDSL etc.),and in view of the deficiency and the hidden troubles of the traditional static password,introduces a working mechanism was introduced which took into consideration both the tokencard two factor authentication and Windows AD,and proveds to be flexible and liable for the single-sign on clients.
Design and Implementation of the IP-CATV Gateway Driver under Vx Works

李芸,易志强,朱小富,王匡

DOI: https://doi.org/10.3969/j.issn.1007-7022.2003.11.015

2003-01-01

Abstract:This article introduces a new type of IP-CATV gateway model , presents the basic design idea , and gives the detailed implementation of the IP-CATV gateway driver under VxWorks.
Implementation of Network Processor-Based Content Filtering

CHEN Hong-tao,CHEN De-ren,GU Xue-fei

2005-01-01

Abstract:Content filtering is an indispensable important part in the network security field.It analyses the information transported in application layer content protocol and controls the forwarding of the information based on the filtering rules.Network Processor is a new generation programmable processor of high speed for carrying out data processing and transmitting.With its obvious advantages in network data processing,the network processor becomes the essential component in high-speed network equipment which supports network functions,such as operation management、security and network monitoring,etc.Based on the advantage of network processor,this paper presented an implementation of an Intel IXP2400 network processor-based content filtering system.
VPN Test System Based on IPSec Network Protocol

陆敏锋,平玲娣,李卓

DOI: https://doi.org/10.3969/j.issn.1000-3428.2010.03.051

2010-01-01

Abstract:Aiming at the problem that the IPSec-based VPN product, this paper designs and achieves a IPSec-based VPN test system running on the Linux platform. This paper introduces the IPSec protocol and its architecture, and presents the design and achievement of the test system through analyzing the principle of the IPSec protocol. Experiment result shows that this test system is feasible and effective.
A Multi-tunnel VPN Concurrent System for New Generation Network Based on User Space

Yan Shen,Qi-fei Zhang,Ling-di Ping,Yan-Fei Wang,Wen-juan Li

DOI: https://doi.org/10.1109/trustcom.2012.41

2012-01-01

Abstract:In the existing large-scale performance test of IPsec tunnel, it often needs special software and hardware. To solve the problem, this article proposed a new method, in which packet was encapsulated in user space, and a multi-tunnel controller was designed and implemented with the method of FSM(finite state machine), which controlled the negotiation and establishment of multiple tunnel, including L2tp, IKEv1, IKEv2, IKEv2+EAP and L2tp Over IPsec. Libpcap was used as the bottom layer driver of package, and the application of zero copy technique had reduced system cost immensely. At last, the result of the experiment verified the performance of the IKEv1 tunnel on Tunnel-mode and Transport-mode.
Network Processor IXP425 and Its Application

许军宁,都思丹,高敦堂

DOI: https://doi.org/10.3969/j.issn.2095-347X.2004.01.006

2004-01-01

Abstract:A new type of network processor, Intel IXP425, is presented in the paper. Its structure of modules and characteristic of performance are described. Application of the processor is illustrated by an example in smart building. The excellent broadband capability of the processor is utilize sufficiently in this precept. It enhances network performance and control ability of smart building.
Design of Multi-access Residential Gateway Based on Intel IXP425

ZHAO Shengying,JIN Xinyu

DOI: https://doi.org/10.3969/j.issn.1000-3428.2007.12.088

2007-01-01

Abstract:This paper researches and discusses the home network and residential gateway, and analyzes the requirement from operator A multi-access residential gateway, Intel network processor IXP425 based system, is designed for telecom operator to spread. Complete solution and hardware/software architecture of system are described and the key module design is presented.
Network Safeguard System Based on IDXP

WANG Xiaodong,ZHU Miaoliang

DOI: https://doi.org/10.3969/j.issn.1000-3428.2005.07.055

2005-01-01

Abstract:This paper puts forward an intellective network safe guard system based on a multi-agent system structure. The purpose of the system is to defend the intrusion of campus-wide network. It is based on IDXP and the focus is blackboard. This system can deal with multi-levels and many ways of anti-intrusions, which has self-determination. It is proved to have a good performance by spot tests.
Design of RPR Integrated Service Access System Based on IXP2400

DENG Zhou,SU Li,JIN De-peng,ZENG Lie-guang

DOI: https://doi.org/10.3969/j.issn.1002-8692.2007.08.024

2007-01-01

Abstract:The architecture of IXP2400 network processor is introduced and a design scheme of RPR integrated service access system based on IXP2400 is presented to support different wideband services of gigabit Ethernet and RPR. Additionally, a construction scheme of RPR node and experimental network using the access system is explained.
Virtual Private Networks Constructed by the Combination of IPSec & L2TP

朱昌盛,余冬梅,王庆梅,谢鹏寿,包仲贤

DOI: https://doi.org/10.3969/j.issn.1000-3428.2002.11.041

2002-01-01

Abstract:The advent of VPN makes it possible for enterprises to transform private confidential massage securely and economically through the Internet. Security tunneling technology is the core technology of VPN, while L2TP IPSec are two tunneling technologies most widely used at present. As the two main accesses to IP network, the combination of L2TP IPSec can share the advantage of L2TP's low cost, initiative, mutual-communication and IPSec's high security, reliability，learn from others' strong points to offset one's weakness, to a great extent, to construct a secure, reliable and low-cost VPN.
Construction of Security Wireless LAN Based on VPN

吴丽华,史烈

DOI: https://doi.org/10.3969/j.issn.1000-3428.2005.04.061

2005-01-01

Abstract:Security is a crucial problem in design and deployment of wireless LAN. The security technology used in nowadays 802.11 equipment WEP and 802.11x, has security flaws in design and can't protect the security of WLAN. This paper presents a network deployment scenario using VPN technology in WLAN, and discusses the design of VPN gateway in it.
WiMAX-VPON: A Framework of Layer-2 VPNs for Next-Generation Access Networks

Ahmad R. Dhaini,Pin-Han Ho,Xiaohong Jiang

DOI: https://doi.org/10.1364/jocn.2.000400

IF: 4.508

2010-01-01

Journal of Optical Communications and Networking

Abstract:This paper proposes WiMAX-VPON, a novel framework for establishing layer-2 virtual private networks (VPNs) over the integration of WiMAX and Ethernet passive optical networks, which has lately been considered as a promising candidate for next-generation fiber-wireless backhaul-access networks. With WiMAX-VPON, layer-2 VPNs support a bundle of service requirements to the respective registered wireless/wired users. These requirements are stipulated in the service level agreement and should be fulfilled by a suite of effective bandwidth management solutions. To achieve this, we propose a novel VPN-based admission control and bandwidth allocation scheme that provides per-stream quality-of-service protection and bandwidth guarantee for real-time flows. The bandwidth allocation is performed via a common medium access control protocol working in both the optical and wireless domains. An event-driven simulation model is implemented to study the effectiveness of the proposed framework.
Hybrid-mode IPv6 IPSec-VPN Implementation Toward Linux Netfilter Scheme

沈燕然,张青山,王新,薛向阳

2008-01-01

Abstract:Development of IPv6 networks brought the need of secure communication between private networks and different kind of personal devices.Secure and scalable communication protection scheme is required.While IPSec-VPN is a popular solution,it has several drawbacks such as forced requirement of accessor's knowledge about VPN gateways.In this paper,we proposed a new IPSec-VPN packaging mode-hybrid mode,and gave the implementation of it using Linux kernel netfiltering scheme.Applications show that the hybrid-mode IPSec-VPN works well for different VPN topologies and makes VPN gateways transparent to users.
Connecting IPvX Networks Over IPvY with a P2P Method

Xiaoxiang Leng,Jun Bi,Miao Zhang,Jianping Wu

DOI: https://doi.org/10.1007/s10922-007-9071-z

2007-01-01

Journal of Network and Systems Management

Abstract:During the transition from IPv4 to IPv6, the IPv6 islands inside the IPv4 networks need to communicate with each other and with the native IPv6 network. The drawback of existing IPv6 transition methods is that relay gateways become potential communication bottlenecks. In this paper, a new method—PS64—is presented to connect IPv6 islands together over IPv4 network and reduce the reliance on these relays by shifting the burden to edge gateways on each island. In this method, direct tunnels are set up between the IPv6 islands, and a P2P network is maintained between edge gateways of these islands to propagate information of tunnel end points. After describing the algorithm, we analyze the connectivity of the P2P network, the scalability of this algorithm, and present the prototype and experiments. The results of our analysis and experiments show that the proposed method is reliable, scalable and effective. Obviously, this technique works for all IPvX over IPvY situations.
BSP Development in IP-CATV Gateway

李芸,傅一恭,王匡,张明

DOI: https://doi.org/10.3969/j.issn.1002-8692.2004.02.008

2004-01-01

Abstract:This article introduces a new type of IP-CATV gateway model, presents the basic design idea and the system structure, and gives the detailed implementation of the IP-CATV gateway BSP driver under VxWorks.
IVIT(IVI+Tunnel)

Yong Cui,Jianping Wu,Chunmei Xia,Mingwei Xu,Xing Li

2009-01-01

Abstract:This document proposes a mechanism, IVIT (IVI+Tunnel), to support non- IVI IPv6 hosts to communicate with IPv4 hosts, and vice versa. IVIT combines IVI translation and Tunnel methods with the IVI translation at the core and the tunnel at the edge. In this document, IVIT provides two modes. One is the dual-stack host mode, which supports the communication between a dual-stack host in an IPv4 network and a non-IVI IPv6 host, especially the communication scenario between a dual-stack server in an IPv4 network and a non-IVI IPv6 host. The other is the CPE mode, which supports the communication between an IPv4-only host and a non-IVI IPv6 host, especially the bidirectional communication scenario between a private IPv4 network and a non-IVI IPv6 network. Combined with IVI, IVIT can support the communication between IPv4 networks and IPv6 networks statelessly at the core.
IPSec:Fundamental of Network Security and VPN

Huafeng Lu,Qiufeng Wu

DOI: https://doi.org/10.3321/j.issn:1002-8331.2001.02.013

2001-01-01

Abstract:This paper introduces basic concepts and major components of IPSec protocol suite,the security extensions to the existing TCP/IP protocol suite,discusses the method of constructing VPN by using IPSec,and shows FreeS/WAN,an IPSec-based VPN implementation,as an example.
A QoS-Based IP VPN Architecture Research

李振东,谢立

DOI: https://doi.org/10.3969/j.issn.1002-137X.2003.04.010

2003-01-01

Computer Science

Abstract:Constructing Virtual Private Network (VPN) over public network infrastructure (Internet) is becoming the foundation of the next generation network service. At present, VPN mainly focuses on the security property, while it is lack of consideration of QoS. On the basis of analyzing the Differentiated Services (Diffserv) and IPsec, we put forward a QoS-based IP VPN Architecture Model which is a tri-tier model that is composed of ESN, ISN and VPN node. It combines encrypted channel mechanism of IPsec and the edge-and-core-model of Diffserv. It provides end-to-end QoS while assures security.
On the Design and Implementation of Structured P2P VPNs

David Isaac Wolinsky,Linton Abraham,Kyungyong Lee,Yonggang Liu,Jiangyan Xu,P. Oscar Boykin,Renato Figueiredo

DOI: https://doi.org/10.48550/arXiv.1001.2575

2010-01-15

Abstract:Centralized Virtual Private Networks (VPNs) when used in distributed systems have performance constraints as all traffic must traverse through a central server. In recent years, there has been a paradigm shift towards the use of P2P in VPNs to alleviate pressure placed upon the central server by allowing participants to communicate directly with each other, relegating the server to handling session management and supporting NAT traversal using relays when necessary. Another, less common, approach uses unstructured P2P systems to remove all centralization from the VPN. These approaches currently lack the depth in security options provided by other VPN solutions, and their scalability constraints have not been well studied. In this paper, we propose and implement a novel VPN architecture, which uses a structured P2P system for peer discovery, session management, NAT traversal, and autonomic relay selection and a central server as a partially-automated public key infrastructure (PKI) via a user-friendly web interface. Our model also provides the first design and implementation of a P2P VPN with full tunneling support, whereby all non-P2P based Internet traffic routes through a trusted third party and does so in a way that is more secure than existing full tunnel techniques. To verify our model, we evaluate our reference implementation by comparing it quantitatively to other VPN technologies focusing on latency, bandwidth, and memory usage. We also discuss some of our experiences with developing, maintaining, and deploying a P2P VPN.

Networking and Internet Architecture,Distributed, Parallel, and Cluster Computing

The Construction of VPN Based on IXP4 ××

Fastpath-based VPN Gateway over Network Processor

Solution to VPN and Authentication System

Design and Implementation of the IP-CATV Gateway Driver under Vx Works

Implementation of Network Processor-Based Content Filtering

VPN Test System Based on IPSec Network Protocol

A Multi-tunnel VPN Concurrent System for New Generation Network Based on User Space

Network Processor IXP425 and Its Application

Design of Multi-access Residential Gateway Based on Intel IXP425

Network Safeguard System Based on IDXP

Design of RPR Integrated Service Access System Based on IXP2400

Virtual Private Networks Constructed by the Combination of IPSec & L2TP

Construction of Security Wireless LAN Based on VPN

WiMAX-VPON: A Framework of Layer-2 VPNs for Next-Generation Access Networks

Hybrid-mode IPv6 IPSec-VPN Implementation Toward Linux Netfilter Scheme

Connecting IPvX Networks Over IPvY with a P2P Method

BSP Development in IP-CATV Gateway

IVIT(IVI+Tunnel)

IPSec:Fundamental of Network Security and VPN

A QoS-Based IP VPN Architecture Research

On the Design and Implementation of Structured P2P VPNs