VPN Implementation Based on IPSec in Linux

周立峰,周昕,金志权

DOI: https://doi.org/10.3969/j.issn.1001-3695.2002.05.021

2002-01-01

Abstract:In this article, we present some rationale and key technology relevant to the im plementation of VPN based on IPSec, then two kinds of typical implementation are described.

What problem does this paper attempt to address?

VPN Test System Based on IPSec Network Protocol

陆敏锋,平玲娣,李卓

DOI: https://doi.org/10.3969/j.issn.1000-3428.2010.03.051

2010-01-01

Abstract:Aiming at the problem that the IPSec-based VPN product, this paper designs and achieves a IPSec-based VPN test system running on the Linux platform. This paper introduces the IPSec protocol and its architecture, and presents the design and achievement of the test system through analyzing the principle of the IPSec protocol. Experiment result shows that this test system is feasible and effective.
Solution to VPN and Authentication System

LI Jian-jun,XU Duan-qing,GUO Wei-qing

DOI: https://doi.org/10.3969/j.issn.1000-7024.2005.09.068

2005-01-01

Abstract:Combining with living examples and based on IPSEC,the realization of the VPN system was approached in many internet circumstances of remote access(such as gateway,broadband,xDSL etc.),and in view of the deficiency and the hidden troubles of the traditional static password,introduces a working mechanism was introduced which took into consideration both the tokencard two factor authentication and Windows AD,and proveds to be flexible and liable for the single-sign on clients.
A VPN Solution Based on IPSec and MPLS

郑刚,周源远,张福炎

DOI: https://doi.org/10.3969/j.issn.1001-3695.2003.10.030

2003-01-01

Abstract:This paper explores the advantages and disadvantages of IPSec VPN and MPLS VPN according to VPN requirements, and puts forward a VPN solution integrated with IPSec and MPLS, which is aimed to get the advantages of the two techniques.
Implementation of IPSec IKE

杜全文,潘雪增,平玲娣

DOI: https://doi.org/10.3969/j.issn.1000-3428.2002.09.039

2002-01-01

Abstract:It is necessary to implement IKE protocol when using IPSec protocol to ensure IP security.This paper describes how to implement a typical IKE message exchange by multithread in detail.
Fastpath-based VPN Gateway over Network Processor

Bo Ji,Jinfang Zhou,Junda Zhu,Liping Qian

DOI: https://doi.org/10.1049/cp:20061251

2006-01-01

Abstract:Networks, along with the explosive growth of the Internet, developed quickly and make our lives more convenient and efficient. However, at the same time, people will face much more network security problems such as illegal observation, modification, IP Spoofing, etc. This article proposes a novel type of universal software architecture named Fastpath which is purposely designed and optimized for Network Element (NE) in the Next Generation Networks (NGN), under Linux. Furthermore, it illustrates the experience in developing IPSec-based VPN gateway over IXP425, and offloading IPSec processing to NPEs and coprocessors by using APIs of software AccessLibrary through Open Crypto Framework (OCF). Finally, we investigate the performance issues both internally and externally. Through the benchmarks, we analyze the performance of the system and identify that Fastpath and network processor together can construct a universal and high-functional platform for NE which focuses on network processing.
IPsec Security Policy Oriented VPN Performance Evaluation Model

顾文婷,潘雪增,楼学庆,郑斯琦

DOI: https://doi.org/10.3778/j.issn.1002-8331.2009.36.023

2009-01-01

Computer Engineering and Applications Journal

Abstract:The complex semantics of IPsec policies increase the difficulty of VPN performance evaluation,lack of framework in performance analysis of IPsec VPN cannot guarantee the effectiveness of evaluation,to solve this issue,a model of VPN performance evaluation based on IPsec security policy is presented.The model constructs a flexible VPN environment,maintains a volume of IPsec security policies which set the measure to VPN performance,compiles statistics in parallel based on concurrency control of multi-thread.At last,experiment is carried on to verify the reliability and the feasibility of this model.
Virtual Private Networks Constructed by the Combination of IPSec & L2TP

朱昌盛,余冬梅,王庆梅,谢鹏寿,包仲贤

DOI: https://doi.org/10.3969/j.issn.1000-3428.2002.11.041

2002-01-01

Abstract:The advent of VPN makes it possible for enterprises to transform private confidential massage securely and economically through the Internet. Security tunneling technology is the core technology of VPN, while L2TP IPSec are two tunneling technologies most widely used at present. As the two main accesses to IP network, the combination of L2TP IPSec can share the advantage of L2TP's low cost, initiative, mutual-communication and IPSec's high security, reliability，learn from others' strong points to offset one's weakness, to a great extent, to construct a secure, reliable and low-cost VPN.
IPSec:Fundamental of Network Security and VPN

Huafeng Lu,Qiufeng Wu

DOI: https://doi.org/10.3321/j.issn:1002-8331.2001.02.013

2001-01-01

Abstract:This paper introduces basic concepts and major components of IPSec protocol suite,the security extensions to the existing TCP/IP protocol suite,discusses the method of constructing VPN by using IPSec,and shows FreeS/WAN,an IPSec-based VPN implementation,as an example.
Hybrid-mode IPv6 IPSec-VPN Implementation Toward Linux Netfilter Scheme

沈燕然,张青山,王新,薛向阳

2008-01-01

Abstract:Development of IPv6 networks brought the need of secure communication between private networks and different kind of personal devices.Secure and scalable communication protection scheme is required.While IPSec-VPN is a popular solution,it has several drawbacks such as forced requirement of accessor's knowledge about VPN gateways.In this paper,we proposed a new IPSec-VPN packaging mode-hybrid mode,and gave the implementation of it using Linux kernel netfiltering scheme.Applications show that the hybrid-mode IPSec-VPN works well for different VPN topologies and makes VPN gateways transparent to users.
A Multi-tunnel VPN Concurrent System for New Generation Network Based on User Space

Yan Shen,Qi-fei Zhang,Ling-di Ping,Yan-Fei Wang,Wen-juan Li

DOI: https://doi.org/10.1109/trustcom.2012.41

2012-01-01

Abstract:In the existing large-scale performance test of IPsec tunnel, it often needs special software and hardware. To solve the problem, this article proposed a new method, in which packet was encapsulated in user space, and a multi-tunnel controller was designed and implemented with the method of FSM(finite state machine), which controlled the negotiation and establishment of multiple tunnel, including L2tp, IKEv1, IKEv2, IKEv2+EAP and L2tp Over IPsec. Libpcap was used as the bottom layer driver of package, and the application of zero copy technique had reduced system cost immensely. At last, the result of the experiment verified the performance of the IKEv1 tunnel on Tunnel-mode and Transport-mode.
Implementation and Performance Evaluation of IPSec VPN Based on Netfilter

Zhao Da-yuan,Jiang Yi-xin,Lin Chuang,Li Yan-xi

DOI: https://doi.org/10.1007/bf02828626

2005-01-01

Wuhan University Journal of Natural Sciences

Abstract:We mainly explore two problems when combining IPSec module into TCP/IP stack by porting the famous IPSec software (FreeS/WAN) into a security gateway. One is how to implement the IPSec module based on Netfilter in Linux 2.4. x kernel. The other problem is the performance evaluation. We test the throughput of our security gateway before and after applying IPSec with different encryption/decryption algorithms, including the software-based and hardware-based method. With these testing data, we analyze further system performance bottleneck. In the end, we also infer the quantitative relation between the system throughput and the speed of encryption/decryption algorithm and propose some valuable conclusions for improving performance.
The research of VPN security gateway based on IPSec

Zhao Ling

Abstract:This paper is the research of security gateway that can set up a Virtual Private Network(VPN),the gateway adopts IPSec protocol as the security protocol of the network layer.Firstly,introduces the concept of VPN and its critical techniques;Secondly,describes the key technique to implement VPN security gateway—IPSec and its architecture,working mode and implement structure; Finally,analyzes the important role of security gateway in VPN system in detail.

Engineering,Computer Science
Implementation of Provider Edge Router in MPLS VPN

朱斌,陈文正,张朝阳

DOI: https://doi.org/10.3969/j.issn.1000-3428.2003.11.049

2003-01-01

Abstract:This article introduces the architecture and working theory of MPLS VPN. Specially, it emphasizes the implementation of provider edge router in MPLS VPN.
Dynamic hub-and-spoke VPN system based on IPSec

Shi Lie

2006-01-01

Abstract:To resolve the problem that it is hard to configure and manage a lager-scale VPN based on IPSec,a dynamic hub-and-spoke VPN system was defined,in which VPN hub exchanges messages with subnet gateways to support gateways to join/quit VPN dynamically.And notion of group was introduced to provide access-control for all subnets.Furthermore,the way to implement it in Linux OS was given.
Solution of VPN on MPLS Backbone Networks

赵鹏,罗平,刘蓓洁

DOI: https://doi.org/10.3321/j.issn:0372-2112.2002.z1.027

2002-01-01

Abstract:Currently, most VPNs are based on Internet Protocol which has disadvantages in speed, expansibility and quality of service etc. Accordingly, we bring forward a solution of VPN on Multiprotocol Label Switching (MPLS) backbone network. We introduce Certificate Authority (CA) in this solution because both MPLS and IPSec haven't made a clear definition of authorizing identity. Taking advantages of MPLS in transporting efficiency, authorizing identity by CA, exchanging keys by Internet Key Exchange Protocol (IKE) and encrypting data by IPSec protocol, we construct a secure and efficient VPN on MPLS backbone network. Furthermore, we describe the realization of every component of MPLS VPN in detail.
Design and Implementation of IPsec VPN IoT Gateway System in National Secret Algorithm

Yan Jiang,Jing Huang,Yunsong Fan,Xiaobin Zhu

DOI: https://doi.org/10.13052/jcsm2245-1439.1345

2024-06-14

Journal of Cyber Security and Mobility

Abstract:With the development of Internet of Things technology, the security threats faced by the industrial control field are increasing, and strengthening the security protection capabilities of intelligent systems on IoT highways is becoming increasingly important. IPSec VPN tunneling technology can achieve identity authentication and encrypted data transmission, and is an important means to achieve secure data transmission in intelligent systems on Expressway intelligent tunnel system. The commonly used IPSec VPN gateway uses a traditional Linux protocol stack-based approach for data capture, which requires multiple data copies and context switching, resulting in low efficiency of IPSec services. In addition, the commonly used IPSec VPN security gateway is implemented on the basis of the open-source IPSec framework, using internationally recognized algorithms for encryption and decryption, which poses security risks. This article is based on the IPSec protocol, and studies the high-speed network packet capture framework PFRING technology, the fusion technology of national secret algorithm and IPSec protocol. It designs and implements an IPSec VPN IoT security gateway based on national secret algorithm. After experimental verification, the IPSec VPN gateway system constructed in this article has complete functions and better performance than the common open-source IPSec frameworks OpenSwan and strongSwan, and can meet the application requirements of IoT data encryption transmission.
A Distributed Object-Based IPSec Multi-Tunnels Concurrent Architecture

Song Wang,Hongbing Lv

DOI: https://doi.org/10.1109/iccps.2011.6089933

2011-01-01

Abstract:In the existing IPSec architecture, in which tunnel is built in kernel, the number of concurrent tunnels is restricted by IP address configured on the machine and user can not control the process of establishing tunnel. This brings inconvenience when we use personal computer to measure the performance parameters of VPN Gateway (e.g. the maximum number of concurrent tunnels and the maximum rate of the new tunnels built). In order to solve this problem, this paper presents a novel IPSec multi-tunnels concurrent architecture which uses distributed objects to build tunnels in user space. The architecture privodes one Console which are used to control all AgentNodes and multiple AgentNodes which are used to build tunnels. In AgentNode, the negotiation processing of tunnels, the IPSec processing of packets and the protocol processing of TCP/IP are all completed in user space by objects. Meanwhile, AgentNode uses virtual IP address instead of local IP address to negotiate tunnel and the number of concurrent tunnels will be unlimited (only limited by memory). Moreover, based on distributed architecture, the number of AgentNode can be arbitrarily extended. Therefore, the system has a great deal of flexibility on the number of concurrent tunnels and the rate of tunnel establishment, which helps to accurately measure the performance parameters of VPN Gateway.
Design and Implementation of Enterprise Information Network Based on MPLS VPN

Duan Quan

Abstract:The advantages and disadvantages of MPLS VPN over traditional VPN are compared. The methods using MPLSVPN technology interconnecting all branch offices and factories across regions through an enterprises network are described. With reduced networking complexity and cost, MPLS VPS provides the capability to deliver private network services over a shared infrastructure.

Computer Science,Engineering
Design and Implementtationg of an IPsec VPN Gateway Base on OpenWRT

Hua Jiang,Qingrui Wang,Gang Zhang,Jinpo Fan

DOI: https://doi.org/10.1088/1742-6596/1176/4/042007

2019-03-01

Journal of Physics: Conference Series

Abstract:IPSec VPN is a virtual private network technology implemented using the IPSec protocol. Aiming at the problem that the national secret algorithm is relatively less applied to network security products, a gateway based on Openwrt system equipment is designed. The OpenWRT system includes the complete strongswan software, making it easy to set up a VPN. The design replaces the aes algorithm, the sha256 algorithm and the ECDSA algorithm used in the IPSec VPN in the StrongSwan source code with the SM4, SM3 and SM2 algorithms respectively, and replaces the ECDSA-SHA256 certificate with the SM2-SM3 certificate according to the X509 certificate standard to achieve the national secret standard. The SM4, SM3 and SM2 algorithms are provided by the SSX0912 encryption chip, and the certificate is placed in the SSX0912 encryption chip for dense storage. It is proved that the scheme is completely feasible, and the IPSec VPN that can be realized can run stably for a long time and has high practical value. By setting up the development environment test, the gateway runs stably, has small delay, and has higher security, and the device has high communication speed, small occupation volume, high flexibility, and strong specificity.
Research on Key Technology of VPN Centralized Management Based on SNMP

黄勇,陈小平,潘雪增,陈红洲,蒋晓宁

DOI: https://doi.org/10.16208/j.issn1000-7024.2008.09.057

2008-01-01

Abstract:Under the WAN environment,large-scale VPN networks is effectively and safely managed by long-distance centralized mana-gement system based on SNMP.To solve the flaw of topology discovery,a method in which agent initiates registry to the server is pro-posed.After analysis of the SNMPv3 security features,the public key authentication mechanism is introduced and the procedure of key negotiation is discussed in detail.For poor reliability and real-time data transmission of UDP-based SNMP,a strategy of configuration based on XML is given,which is proved to be feasible and efficient by the result of experiment at last.

VPN Implementation Based on IPSec in Linux

VPN Test System Based on IPSec Network Protocol

Solution to VPN and Authentication System

A VPN Solution Based on IPSec and MPLS

Implementation of IPSec IKE

Fastpath-based VPN Gateway over Network Processor

IPsec Security Policy Oriented VPN Performance Evaluation Model

Virtual Private Networks Constructed by the Combination of IPSec & L2TP

IPSec:Fundamental of Network Security and VPN

Hybrid-mode IPv6 IPSec-VPN Implementation Toward Linux Netfilter Scheme

A Multi-tunnel VPN Concurrent System for New Generation Network Based on User Space

Implementation and Performance Evaluation of IPSec VPN Based on Netfilter

The research of VPN security gateway based on IPSec

Implementation of Provider Edge Router in MPLS VPN

Dynamic hub-and-spoke VPN system based on IPSec

Solution of VPN on MPLS Backbone Networks

Design and Implementation of IPsec VPN IoT Gateway System in National Secret Algorithm

A Distributed Object-Based IPSec Multi-Tunnels Concurrent Architecture

Design and Implementation of Enterprise Information Network Based on MPLS VPN

Design and Implementtationg of an IPsec VPN Gateway Base on OpenWRT

Research on Key Technology of VPN Centralized Management Based on SNMP