A VPN Model Based on IP Encapsulation

Zhitang Li,Song Mei

DOI: https://doi.org/10.3321/j.issn:1002-8331.2001.08.014

2001-01-01

Abstract:This paper first introduces IPSec protocols,discusses the complexity to achieve IPSec,and analyses the theory of IP-in-IP tunneling encapsulation in Linux.Then it presents one VPN solution based on Linux IP encapsulation.

What problem does this paper attempt to address?

VPN Test System Based on IPSec Network Protocol

陆敏锋,平玲娣,李卓

DOI: https://doi.org/10.3969/j.issn.1000-3428.2010.03.051

2010-01-01

Abstract:Aiming at the problem that the IPSec-based VPN product, this paper designs and achieves a IPSec-based VPN test system running on the Linux platform. This paper introduces the IPSec protocol and its architecture, and presents the design and achievement of the test system through analyzing the principle of the IPSec protocol. Experiment result shows that this test system is feasible and effective.
Solution to VPN and Authentication System

LI Jian-jun,XU Duan-qing,GUO Wei-qing

DOI: https://doi.org/10.3969/j.issn.1000-7024.2005.09.068

2005-01-01

Abstract:Combining with living examples and based on IPSEC,the realization of the VPN system was approached in many internet circumstances of remote access(such as gateway,broadband,xDSL etc.),and in view of the deficiency and the hidden troubles of the traditional static password,introduces a working mechanism was introduced which took into consideration both the tokencard two factor authentication and Windows AD,and proveds to be flexible and liable for the single-sign on clients.
A Multi-tunnel VPN Concurrent System for New Generation Network Based on User Space

Yan Shen,Qi-fei Zhang,Ling-di Ping,Yan-Fei Wang,Wen-juan Li

DOI: https://doi.org/10.1109/trustcom.2012.41

2012-01-01

Abstract:In the existing large-scale performance test of IPsec tunnel, it often needs special software and hardware. To solve the problem, this article proposed a new method, in which packet was encapsulated in user space, and a multi-tunnel controller was designed and implemented with the method of FSM(finite state machine), which controlled the negotiation and establishment of multiple tunnel, including L2tp, IKEv1, IKEv2, IKEv2+EAP and L2tp Over IPsec. Libpcap was used as the bottom layer driver of package, and the application of zero copy technique had reduced system cost immensely. At last, the result of the experiment verified the performance of the IKEv1 tunnel on Tunnel-mode and Transport-mode.
VPN Implementation Based on IPSec in Linux

周立峰,周昕,金志权

DOI: https://doi.org/10.3969/j.issn.1001-3695.2002.05.021

2002-01-01

Abstract:In this article, we present some rationale and key technology relevant to the im plementation of VPN based on IPSec, then two kinds of typical implementation are described.
Virtual Private Networks Constructed by the Combination of IPSec & L2TP

朱昌盛,余冬梅,王庆梅,谢鹏寿,包仲贤

DOI: https://doi.org/10.3969/j.issn.1000-3428.2002.11.041

2002-01-01

Abstract:The advent of VPN makes it possible for enterprises to transform private confidential massage securely and economically through the Internet. Security tunneling technology is the core technology of VPN, while L2TP IPSec are two tunneling technologies most widely used at present. As the two main accesses to IP network, the combination of L2TP IPSec can share the advantage of L2TP's low cost, initiative, mutual-communication and IPSec's high security, reliability，learn from others' strong points to offset one's weakness, to a great extent, to construct a secure, reliable and low-cost VPN.
A Distributed Object-Based IPSec Multi-Tunnels Concurrent Architecture

Song Wang,Hongbing Lv

DOI: https://doi.org/10.1109/iccps.2011.6089933

2011-01-01

Abstract:In the existing IPSec architecture, in which tunnel is built in kernel, the number of concurrent tunnels is restricted by IP address configured on the machine and user can not control the process of establishing tunnel. This brings inconvenience when we use personal computer to measure the performance parameters of VPN Gateway (e.g. the maximum number of concurrent tunnels and the maximum rate of the new tunnels built). In order to solve this problem, this paper presents a novel IPSec multi-tunnels concurrent architecture which uses distributed objects to build tunnels in user space. The architecture privodes one Console which are used to control all AgentNodes and multiple AgentNodes which are used to build tunnels. In AgentNode, the negotiation processing of tunnels, the IPSec processing of packets and the protocol processing of TCP/IP are all completed in user space by objects. Meanwhile, AgentNode uses virtual IP address instead of local IP address to negotiate tunnel and the number of concurrent tunnels will be unlimited (only limited by memory). Moreover, based on distributed architecture, the number of AgentNode can be arbitrarily extended. Therefore, the system has a great deal of flexibility on the number of concurrent tunnels and the rate of tunnel establishment, which helps to accurately measure the performance parameters of VPN Gateway.
A Multi-Link Aggregate IPSec Model

Yun-he Zhang,Zhi-tang Li,Mei-zhen Wang,Ling Xiao

DOI: https://doi.org/10.1109/etcs.2009.639

2009-01-01

Abstract:Internet has become the universal information communications infrastructure. VPN is commonly used to implement communications over different branch intranets. IPSec is a suit of protocols that adds security to communications at the IP layer, and it is a popular technology to implement VPN. On the basis of analysis on the insufficiency of traditional IPSec systems, a multi-link aggregate IPSec model is proposed. The new model can negotiate multiple groups of security policies on different physical links for same branch intranet pair, and distribute IPSec traffics over multiple links. A prototype system of the new model which is based on Netfilter mechanism is implemented on Linux platform. Analysis on the test result from the prototype system shows that the new model can work better under the environment of multi-link, and can enhance the capability and reliability of VPN application.
A VPN Solution Based on IPSec and MPLS

郑刚,周源远,张福炎

DOI: https://doi.org/10.3969/j.issn.1001-3695.2003.10.030

2003-01-01

Abstract:This paper explores the advantages and disadvantages of IPSec VPN and MPLS VPN according to VPN requirements, and puts forward a VPN solution integrated with IPSec and MPLS, which is aimed to get the advantages of the two techniques.
Fastpath-based VPN Gateway over Network Processor

Bo Ji,Jinfang Zhou,Junda Zhu,Liping Qian

DOI: https://doi.org/10.1049/cp:20061251

2006-01-01

Abstract:Networks, along with the explosive growth of the Internet, developed quickly and make our lives more convenient and efficient. However, at the same time, people will face much more network security problems such as illegal observation, modification, IP Spoofing, etc. This article proposes a novel type of universal software architecture named Fastpath which is purposely designed and optimized for Network Element (NE) in the Next Generation Networks (NGN), under Linux. Furthermore, it illustrates the experience in developing IPSec-based VPN gateway over IXP425, and offloading IPSec processing to NPEs and coprocessors by using APIs of software AccessLibrary through Open Crypto Framework (OCF). Finally, we investigate the performance issues both internally and externally. Through the benchmarks, we analyze the performance of the system and identify that Fastpath and network processor together can construct a universal and high-functional platform for NE which focuses on network processing.
Solution of VPN on MPLS Backbone Networks

赵鹏,罗平,刘蓓洁

DOI: https://doi.org/10.3321/j.issn:0372-2112.2002.z1.027

2002-01-01

Abstract:Currently, most VPNs are based on Internet Protocol which has disadvantages in speed, expansibility and quality of service etc. Accordingly, we bring forward a solution of VPN on Multiprotocol Label Switching (MPLS) backbone network. We introduce Certificate Authority (CA) in this solution because both MPLS and IPSec haven't made a clear definition of authorizing identity. Taking advantages of MPLS in transporting efficiency, authorizing identity by CA, exchanging keys by Internet Key Exchange Protocol (IKE) and encrypting data by IPSec protocol, we construct a secure and efficient VPN on MPLS backbone network. Furthermore, we describe the realization of every component of MPLS VPN in detail.
NEW Research about VPN Communication Based on Protocol of IPSec over Http

MEI Song,LI Zhi-tang

DOI: https://doi.org/10.3969/j.issn.1000-1220.2007.06.012

2007-01-01

Abstract:This paper first discusses the classic methods of covering communication to traverse the firewall devices which control the networking communication. And based on the analysis of IPSec protocol architecture, that the limitation of network compatibility of IPSec is got. So the new protocol of IPSec over Http based on IPSec tunnel and Http tunnel is exposed with its structure and procedure. The structure of FreeSWAN is improved and the performance test data are presented in order to validate this new protocol. Finally, the performance of the new system is analysed detailedly.
Application of IPSec Technique to VPN

马淑萍,阳小华,李海燕

DOI: https://doi.org/10.3969/j.issn.1673-0062.2004.02.018

2004-01-01

Abstract:In current VPN applications,IPSec-based VPN is followed with great interests.This paper analyzes safe system structure,implementation strategy of IPSec and problems needed to pay attention to.Some integrated solutions to realize VPN are also provided.
Hybrid-mode IPv6 IPSec-VPN Implementation Toward Linux Netfilter Scheme

沈燕然,张青山,王新,薛向阳

2008-01-01

Abstract:Development of IPv6 networks brought the need of secure communication between private networks and different kind of personal devices.Secure and scalable communication protection scheme is required.While IPSec-VPN is a popular solution,it has several drawbacks such as forced requirement of accessor's knowledge about VPN gateways.In this paper,we proposed a new IPSec-VPN packaging mode-hybrid mode,and gave the implementation of it using Linux kernel netfiltering scheme.Applications show that the hybrid-mode IPSec-VPN works well for different VPN topologies and makes VPN gateways transparent to users.
Session-Based Tunnel Scheduling Model in Multi-link Aggregate IPSec VPN

Yunhe Zhang,Zhitang Li,Song Mei,Cai Fu

DOI: https://doi.org/10.1109/MUE.2009.89

2009-01-01

Abstract:IPSec VPN is commonly used to implement secure communications between different branch intranets over public networks. Multi-link aggregate IPSec VPN can make better use of multiple physical links of corporation. On the basis of analysis on the insufficiency of packet-based scheduling, a session-based tunnel scheduling model for multi-link aggregate IPSec VPN is proposed. The new model can distribute IPSec traffics over multiple tunnels negotiated on different physical links in unit of session. A prototype system of the new model which adopts Netfilter mechanism is implemented on Linux platform. Analysis on the test result for the prototype system shows that the new model can work effectively, the cost of scheduling is controllable and the performance of model is acceptable.
IPSec:Fundamental of Network Security and VPN

Huafeng Lu,Qiufeng Wu

DOI: https://doi.org/10.3321/j.issn:1002-8331.2001.02.013

2001-01-01

Abstract:This paper introduces basic concepts and major components of IPSec protocol suite,the security extensions to the existing TCP/IP protocol suite,discusses the method of constructing VPN by using IPSec,and shows FreeS/WAN,an IPSec-based VPN implementation,as an example.
Comprehensive Experiment Design of VPN based on Virtual Machines

YANG Hao-miao,CHENG Hong-rong,ZHANG Wen-ke

DOI: https://doi.org/10.3969/j.issn.1009-8054.2012.06.026

2012-01-01

Abstract:A virtual private network(VPN) is a technology in build up the private network on the public communication infrastructures such as the Internet,which could be built up on PPTP,L2TP over IPSec,or SSTP tunnels.Traditional VPN Experiment is based on SSTP Protocol.Two more general Experiments,respectively based on L2TP/IPSec Protocol and SSTP Protocol,are designed.However,these experiments based on virtual machine platform are more convenient and economical.In addition,various security apparatuses on Windows system platform are also involved in the comprehensive experiment,such as active directory,DNS server,DHCP server,firewall,certification authority(CA),and so on.
Implementation of Virtual Private Network Based on Ipsec

伊萨姆,肖石林,曾庆济

DOI: https://doi.org/10.3969/j.issn.1002-5561.2004.04.012

2004-01-01

Abstract:this paper is a brief introduction of fundamentals and implementations of the virtual private network (VPN),a comparison between characteristics and technologies of the traditional and based on IPsec VPN.Through studying IPsec, we presented a method of designing end-to-end VPN system based on combined SA of IPsec, and analyzing of its security.
The research of VPN security gateway based on IPSec

Zhao Ling

Abstract:This paper is the research of security gateway that can set up a Virtual Private Network(VPN),the gateway adopts IPSec protocol as the security protocol of the network layer.Firstly,introduces the concept of VPN and its critical techniques;Secondly,describes the key technique to implement VPN security gateway—IPSec and its architecture,working mode and implement structure; Finally,analyzes the important role of security gateway in VPN system in detail.

Engineering,Computer Science
Comprehensive Experiment Design of IPSec based on VMWare

YANG Hao-miao,ZHANG Wen-ke,JIANG Lei

DOI: https://doi.org/10.3969/j.issn.1002-0802.2012.06.002

2012-01-01

Abstract:IPSec is a basic security protocol of the Internet.The communicating peers should implement mutual ID authentication prior to the building up of IPSec channel.Traditional experiment of IPSec ID authentication is based on "Pre-shared keys".Two more general experiments are designed,respectively based on "Kerberos Protocol" and "Certificate".And the experiment based on virtual machine platform is comparatively convenient and economical.In addition,various security apparatuses on Windows platform are also involved in the comprehensive experiment,including active directory,DNS server,DHCP server,firewall,certification authority(CA),and so on.
The Implementation of Virtual Private Network on Windows NT Platform

WEN Gang,Yu Zhidong,ZHANG Shensheng

DOI: https://doi.org/10.3969/j.issn.1000-3428.2001.01.011

2001-01-01

Abstract:To establish an enterprise virtual private network is a necessary requirement of an enterprise which is facing the global competition. This article presents a kind of VPN implementation on Windows NT platform whieh is based on IPSec and combined with Network Address Translating (NAT) technology and having the advantage of IP packet compressing. Meanwhile, this article discusses the problems during the implementation.

A VPN Model Based on IP Encapsulation

VPN Test System Based on IPSec Network Protocol

Solution to VPN and Authentication System

A Multi-tunnel VPN Concurrent System for New Generation Network Based on User Space

VPN Implementation Based on IPSec in Linux

Virtual Private Networks Constructed by the Combination of IPSec & L2TP

A Distributed Object-Based IPSec Multi-Tunnels Concurrent Architecture

A Multi-Link Aggregate IPSec Model

A VPN Solution Based on IPSec and MPLS

Fastpath-based VPN Gateway over Network Processor

Solution of VPN on MPLS Backbone Networks

NEW Research about VPN Communication Based on Protocol of IPSec over Http

Application of IPSec Technique to VPN

Hybrid-mode IPv6 IPSec-VPN Implementation Toward Linux Netfilter Scheme

Session-Based Tunnel Scheduling Model in Multi-link Aggregate IPSec VPN

IPSec:Fundamental of Network Security and VPN

Comprehensive Experiment Design of VPN based on Virtual Machines

Implementation of Virtual Private Network Based on Ipsec

The research of VPN security gateway based on IPSec

Comprehensive Experiment Design of IPSec based on VMWare

The Implementation of Virtual Private Network on Windows NT Platform