Analysis and Improvement of the IP Security Model

周立峰,欧阳毅,张绍莲,金志权

DOI: https://doi.org/10.3969/j.issn.1007-130x.2003.02.014

2003-01-01

Abstract:This paper first analyzes the complexity and security of IPSec protocols, then some reformative features are discussed, which not only simplify some complex concepts, but also make effective progress in security performance.

What problem does this paper attempt to address?

IPsec Security Policy Oriented VPN Performance Evaluation Model

顾文婷,潘雪增,楼学庆,郑斯琦

DOI: https://doi.org/10.3778/j.issn.1002-8331.2009.36.023

2009-01-01

Computer Engineering and Applications Journal

Abstract:The complex semantics of IPsec policies increase the difficulty of VPN performance evaluation,lack of framework in performance analysis of IPsec VPN cannot guarantee the effectiveness of evaluation,to solve this issue,a model of VPN performance evaluation based on IPsec security policy is presented.The model constructs a flexible VPN environment,maintains a volume of IPsec security policies which set the measure to VPN performance,compiles statistics in parallel based on concurrency control of multi-thread.At last,experiment is carried on to verify the reliability and the feasibility of this model.
SIP Authentication Mechanism and Its Performace Analysis

金康双,王泽兵,冯雁,陈海燕

DOI: https://doi.org/10.3969/j.issn.1001-3695.2004.08.034

2004-01-01

Abstract:Session Initiation Protocol(SIP) is the Internet Engineering Task Force (IETF) standard for IP telephony,and it has a promising applied prospect.In this work,the security authentication mechanism used by SIP is described.Moreover an experimental performance analysis of the SIP security mechanisms is provided,which based on the open source Java implementation of a SIP proxy server.
Research on Information Security Model and Security System Design

黄益民,平玲娣,潘雪增

DOI: https://doi.org/10.3785/j.issn.1008-973x.2001.06.005

2001-01-01

Abstract:After study of existing security models; analysis of information flow model, Bell-LaPadula(BLP) access control model and Biba access control model; and collation and comparison of their advantages and disadvantages, an improved model is put forward that satisfies the actual demands of information security. An implementation strategy is put forward that ensures information security, reliability, practicality and compatibility in the designed security system. An implementation scheme of this security system and its components and functions is provided. This system combines the following functions: mandatory access contro1, privilege separation, security audit, identity authentication and self-protection. It achieves the level 3 of national information security standard and level B1 of TCSEC standard. It was implemented in the Windows NT and Linux operating system and has yielded good resultsin application.
Research on a Security Architecture for the Internet Protocol

符松,金志权,陈佩佩

DOI: https://doi.org/10.3969/j.issn.1000-3428.2001.10.045

2001-01-01

Abstract:IPSec is a security architecture for the Internet protocol ,which provides transparent protection services for upper protocols. It consists of the protocols of automatic key management, authentication and encryption. In this paper, some modifications and a new protocol for the runtime detection are presented to enhance the efficiency and security of the original architecture.
Implementation of IPSec IKE

杜全文,潘雪增,平玲娣

DOI: https://doi.org/10.3969/j.issn.1000-3428.2002.09.039

2002-01-01

Abstract:It is necessary to implement IKE protocol when using IPSec protocol to ensure IP security.This paper describes how to implement a typical IKE message exchange by multithread in detail.
Security Analysis of WEP Algorithm Used in IEEE 802.11

邢新景,张朝阳,王匡

DOI: https://doi.org/10.3969/j.issn.1003-8329.2003.04.009

2003-01-01

Wireless Communication Technology

Abstract:The WEP security algorithm used in IEEE 802.11 wireless LAN is introduced. Under the basis of a systematical analysis, flaws embedded in WEP are pointed out, and correspondingly, several attacking methods are provided to prove the weakness of WEP. The upgraded version of WEP algorithm-TKIP was also introduced and analyzed. At last, some potential solutions to the security problems are also proposed in using existing IEEE 802.11 equipments.
An overview of QoS protocols and architecture

刘正蓝,朱淼良,姜明,吴天福

DOI: https://doi.org/10.3785/j.issn.1008-973X.2003.03.007

2003-01-01

Abstract:This review paper covers several quality of service (QoS) models provided by Internet including IntServ, DiffServ and MPLS. It analyses the architecture and technological characteristics of each model. After an introduction of each model, this paper summarizes what QoS requests they can fulfill and how they implement these requests. It also describes the support of multicast in QoS models in brief. Based on these analytical studies, this paper proposes a total architecture of top-to-bottom, end-to-end QoS model, which takes full advantage of the virtues of the models described beforehand. This model has two prominent points: End-to-End QoS guarantee and flexible extensibility, which represent the trend for the future research of QoS.
IPSec-based Distributed Firewall Security Architecture

崔伟,齐竞艳,蔡圣闻,黄皓

DOI: https://doi.org/10.3969/j.issn.1000-3428.2004.16.051

2004-01-01

Abstract:The paper introduces the basic notion of distributed firewall, analyses the security threatens. Then it introduces IPSec protocols,and presents an IPSec-based distributed firewall security architecture including the internal design and external design.This architecture combines IPSec and some other secure measures with distribtued firewall so as to give distributed firewall stronger security.
Security Analysis and Improvement of Vehicle Ethernet SOME/IP Protocol

Jinze Du,Rui Tang,Tao Feng

DOI: https://doi.org/10.3390/s22186792

IF: 3.9

2022-09-09

Sensors

Abstract:The combination of in-vehicle networks and smart car devices has gradually developed into Intelligent Connected Vehicles (ICVs). Through the vehicle security protocol, ICVs can quickly realize communication transmission. However, with the more frequent connections between smart in-vehicle devices and the network, the relationship between intelligent cars and external systems is becoming more and more complicated, and in-vehicle networks are gradually facing many security issues. Strengthening the security of in-vehicle protocols has become particularly important. This paper uses the model building method based on the Colored Petri Net (CPN) theory to model the Scalable service-Oriented MiddlewarE over IP (SOME/IP) protocol of the vehicle Ethernet. The security protocol is formally verified and analyzed by combining it with the Dolev–Yao adversary model detection method. After verification, the protocol is subject to three attack vulnerabilities: replay, tampering, and deception. We introduce timestamps and random numbers to strengthen the protocol security. After the final analysis and verification, the improved scheme in this paper can effectively improve the security performance of the protocol.

engineering, electrical & electronic,chemistry, analytical,instruments & instrumentation
Toward A Practical Scheme For Ipsec Management

Li Qi,Xu Mingwei,Xu Ke

DOI: https://doi.org/10.1109/ICOIN.2008.4472762

2008-01-01

Abstract:IP Security (IPSec) is an important protection mechanism for securing the Internet communication. However, IPSec is a complex security protocol family, and the management issue is still a challenge for mass deployment. Many researchers have investigated the IPSec management issue with various approaches, the policy configuration and distribution issue remain to be efficiently resolved. A certificate-based scheme to manage IPSec endpoints is proposed in this paper. A Role-based Access Control (RBAC) model is introduced to simplify the process of policy configuration, and policy control mechanism is proposed to check whether new security association conforms to local security policies. The analysis of the scheme shows the flexibility and efficiency of our approach. Based on our proposed scheme, we implement a prototype system with the proof-of-concept and conduct experimental studies to demonstrate the feasibility and performance of our approach.
Analysis method for internet architecture security

Li Wei,Cai Zhongmin,Xiaohong Guan

DOI: https://doi.org/10.3321/j.issn:0253-987x.2006.10.001

2006-01-01

Abstract:An analysis method of Internet architecture security is presented by introducing the concept of access relations and access streams to show that the access control is a procedure to reduce access relations according to certain security policies in the traditional network access control. On the basis of the concept, a new scheme of data classification is proposed based on real and anonymous addresses and network addresses of the control and application data. A set of the corresponding global access control rules is established under the conditions of the openness and manageability of the uniform network, security and user privacy. The analysis of the scheme shows that the proposed method reduces access relations significantly, and the level of the Internet architecture security is increased wholly.
A Multi-layer Security Model for Internet of Things

xue yang,zhihua li,zhenmin geng,haitao zhang

DOI: https://doi.org/10.1007/978-3-642-32427-7_54

2012-01-01

Abstract:Since the open architecture at the perception layer, the IoT not only faces the traditional security risks in TCP/IP network, but also faces the new emerging risks. In this paper, through analysising the infrastructure of IoT and the security risks in IoT, a new multi-layer security model is proposed, which aims to improve the security technique in IoT. Based on the new model, a series of effective ways to the security risks are discussed at each different layer, respectively. The characteristics of the model and the application domain are summarized to give out, too.
RESEARCH ON COMPATIBILITY AND RESOLVENT OF IPSec AND NAT

Li Xiaozhan,Pan Jin-gui

DOI: https://doi.org/10.3969/j.issn.1000-386X.2007.02.057

2007-01-01

Abstract:The new version of IP protocol—IPv6 appears with the development of network,but IPSec of IPv6 conflicts with NAT of present network.In order to solve this problem,and promotes that IPv4 shifts toward IPv6 favorably.This paper introduces the basic theory of IPSec and Network Address Transform(NAT) protocol at first,then introduces the conflicts between IPSec and NAT protocol,at last,it anatomies two ways to solve these conflicts.
Quality of protection analysis and performance modeling in IP multimedia subsystem

An’an Luo,Chuang Lin,Kai Wang,Lei Lei,Chanfang Liu

DOI: https://doi.org/10.1016/j.comcom.2009.03.003

IF: 5.047

2009-01-01

Computer Communications

Abstract:IP Multimedia Subsystem (IMS) is widely considered as the main solution for the next generation multimedia rich communication. In order to provide multi-level security service in IMS to mobile users for multimedia applications, it is insufficient to take the security benefits into consideration, but adequately analyzing the impact of security policies in IMS on the performance cost quantitatively is also necessary and significant. In this paper, we first propose a novel study of IMS performance by a QPN model to much more precisely describe SIP signaling in IMS, and made performance evaluation. Then we defined totally seven levels of IMS security policies according to IMS specifications in 3GPP and proposed QoP partition model which quantitatively reflects strength of protection of SIP signaling and users’ security needs. Further more, we did our original contributions to use the QPN model to evaluate the impacts of security mechanism on system performance cost quantitatively. With the multi-view security partition introduced, different security policies could be adjusted according to the application and users’ security requirements, so that multi-level security service can be provided to diverse users and applications for a better tradeoff between security requirements and system performance in IMS.
The Design And Implementation Of Router Security Subsystem Based On Ipsec

Yinghua Wu,Jianping Wu,Ke Xu,Mingwei Xu

DOI: https://doi.org/10.1109/TENCON.2002.1181240

2002-01-01

Abstract:IPSec protocols offer a standard security mechanism, used for security service to upper' protocols (such as UDP and TCP). This paper introduces the design and implementation of Router Security Subsystem based on IPSec, the important part of High Performance Security Router made by Tsinghua University. We complete consummate and reliable security functions, use various optimal methods to enhance the performance furthest.
RESEARCH AND IMPLEMENTATION OF MODEL OF INFORMATION SECURITY EVALUATION

Zhou Guoqiang,Lu Wei,Zeng Qingkai

DOI: https://doi.org/10.3969/j.issn.1000-386X.2007.11.002

2007-01-01

Abstract:An information security evaluation model is proposed.Based on the analyses of contents and functions of security evolution,the architecture of the security evaluation model and platform is presented,and its implementation is given.The main functions of this model are to organize,manage and control the security test and evaluation.It also has features in generalization,integration and configuration.
Study of Security of IPSec Based on IPv 6

LI PEIGUO,LUO PING

DOI: https://doi.org/10.3969/j.issn.1008-0570.2007.27.020

2007-01-01

Abstract:The Next Generation Internet is going to base on IPv6(Internet Protocol version 6) that has to support IPsec(Internet Protocol Security) that provided two kinds of security mechanisms: Encryption and Authentication. This paper is aimed to introduce the architecture of IPsec, their functions and their relationships. A new opinion is brought forward about the IPsec theory and IPsec application based on IPv6 . This paper summarized that IPsec can be provided with the advantages and be confronted with the challengesin the next generation Internet based on IPv6.
A Framework and It's Application for Security Architecture of Computer Networks

Haixin Duan,Jianping Wu

DOI: https://doi.org/10.3321/j.issn:1002-8331.2000.05.008

2000-01-01

Abstract:The definitions of some concepts related to security architecture for computer networks are presented firstly in this paper, and then, a framework is proposed from the aspect of security requirements. Based on the analysis of dependence among security services, a method is presented for classifying and rating network security according to se curity services and mechanisms. After the analysis of security mechanisms in TCP/IP protocol including IPSec and SSL, a protocol layered entity model is presented for implementation of security services and security management. From the aspect of entity unit, all kinds of security technologies are organized into to four layers. The place of security management in the architecture and content of management activities for large networks are described. At the end of this paper, further research directions are pointed about the security architecture.
A Performance Analysis Method for Intrusion Prevention System

Wei LIU,Quan-lin LI,Li RUI

DOI: https://doi.org/10.3969/j.issn.1671-1122.2015.09.011

2015-01-01

Abstract:Intrusion prevention system (IPS) is a crucial defensive measure against malicious attacks to information system. However, the improper IPS conifguration can have a negative impact on network performances in terms of end-to-end delay or packets loss. Most researchers mainly focus on putting forward new IPS and analyzing the different methodologies, but ignoring the research of quantitative analysis on IPS. By analyzing the system as a quasi-birth-and –death process, this paper obtains the steady probabilities distribution to compute some important indices by establishing a two-dimensional Markov chain model. The experimental results prove that the general analytical method can effectively evaluate the performances of IPS, and also testify the correctness of the model indirectly.
Investigating the impact of network security on the line current differential protection system

Andreas Aichhorn,Andreas Unterweger,René Mayrhofer,Dominik Engel

DOI: https://doi.org/10.1049/joe.2018.0242

2018-09-10

The Journal of Engineering

Abstract:This paper analyses the influence of network security measures on the system behaviour of a power system protection device. In this particular case, an IP‐based Ethernet protection interface of a line current differential protection system is considered. IPsec has previously been proposed to be part of the security concept of the protection interface. Therefore, the authors conduct a trade‐off analysis regarding the influence of IPsec on the protection function and consequently on the system safety. This work shows that the protection function of the relay is not impaired as long as the additional CPU performance for the encryption by the protection relay is available and the necessary bandwidth on the communication channel is provided.

English Else

Analysis and Improvement of the IP Security Model

IPsec Security Policy Oriented VPN Performance Evaluation Model

SIP Authentication Mechanism and Its Performace Analysis

Research on Information Security Model and Security System Design

Research on a Security Architecture for the Internet Protocol

Implementation of IPSec IKE

Security Analysis of WEP Algorithm Used in IEEE 802.11

An overview of QoS protocols and architecture

IPSec-based Distributed Firewall Security Architecture

Security Analysis and Improvement of Vehicle Ethernet SOME/IP Protocol

Toward A Practical Scheme For Ipsec Management

Analysis method for internet architecture security

A Multi-layer Security Model for Internet of Things

RESEARCH ON COMPATIBILITY AND RESOLVENT OF IPSec AND NAT

Quality of protection analysis and performance modeling in IP multimedia subsystem

The Design And Implementation Of Router Security Subsystem Based On Ipsec

RESEARCH AND IMPLEMENTATION OF MODEL OF INFORMATION SECURITY EVALUATION

Study of Security of IPSec Based on IPv 6

A Framework and It's Application for Security Architecture of Computer Networks

A Performance Analysis Method for Intrusion Prevention System

Investigating the impact of network security on the line current differential protection system