IPSec:Fundamental of Network Security and VPN

Huafeng Lu,Qiufeng Wu

DOI: https://doi.org/10.3321/j.issn:1002-8331.2001.02.013

2001-01-01

Abstract:This paper introduces basic concepts and major components of IPSec protocol suite,the security extensions to the existing TCP/IP protocol suite,discusses the method of constructing VPN by using IPSec,and shows FreeS/WAN,an IPSec-based VPN implementation,as an example.

What problem does this paper attempt to address?

VPN Test System Based on IPSec Network Protocol

陆敏锋,平玲娣,李卓

DOI: https://doi.org/10.3969/j.issn.1000-3428.2010.03.051

2010-01-01

Abstract:Aiming at the problem that the IPSec-based VPN product, this paper designs and achieves a IPSec-based VPN test system running on the Linux platform. This paper introduces the IPSec protocol and its architecture, and presents the design and achievement of the test system through analyzing the principle of the IPSec protocol. Experiment result shows that this test system is feasible and effective.
Solution to VPN and Authentication System

LI Jian-jun,XU Duan-qing,GUO Wei-qing

DOI: https://doi.org/10.3969/j.issn.1000-7024.2005.09.068

2005-01-01

Abstract:Combining with living examples and based on IPSEC,the realization of the VPN system was approached in many internet circumstances of remote access(such as gateway,broadband,xDSL etc.),and in view of the deficiency and the hidden troubles of the traditional static password,introduces a working mechanism was introduced which took into consideration both the tokencard two factor authentication and Windows AD,and proveds to be flexible and liable for the single-sign on clients.
Implementation of IPSec IKE

杜全文,潘雪增,平玲娣

DOI: https://doi.org/10.3969/j.issn.1000-3428.2002.09.039

2002-01-01

Abstract:It is necessary to implement IKE protocol when using IPSec protocol to ensure IP security.This paper describes how to implement a typical IKE message exchange by multithread in detail.
The research of VPN security gateway based on IPSec

Zhao Ling

Abstract:This paper is the research of security gateway that can set up a Virtual Private Network(VPN),the gateway adopts IPSec protocol as the security protocol of the network layer.Firstly,introduces the concept of VPN and its critical techniques;Secondly,describes the key technique to implement VPN security gateway—IPSec and its architecture,working mode and implement structure; Finally,analyzes the important role of security gateway in VPN system in detail.

Engineering,Computer Science
VPN Implementation Based on IPSec in Linux

周立峰,周昕,金志权

DOI: https://doi.org/10.3969/j.issn.1001-3695.2002.05.021

2002-01-01

Abstract:In this article, we present some rationale and key technology relevant to the im plementation of VPN based on IPSec, then two kinds of typical implementation are described.
A Multi-tunnel VPN Concurrent System for New Generation Network Based on User Space

Yan Shen,Qi-fei Zhang,Ling-di Ping,Yan-Fei Wang,Wen-juan Li

DOI: https://doi.org/10.1109/trustcom.2012.41

2012-01-01

Abstract:In the existing large-scale performance test of IPsec tunnel, it often needs special software and hardware. To solve the problem, this article proposed a new method, in which packet was encapsulated in user space, and a multi-tunnel controller was designed and implemented with the method of FSM(finite state machine), which controlled the negotiation and establishment of multiple tunnel, including L2tp, IKEv1, IKEv2, IKEv2+EAP and L2tp Over IPsec. Libpcap was used as the bottom layer driver of package, and the application of zero copy technique had reduced system cost immensely. At last, the result of the experiment verified the performance of the IKEv1 tunnel on Tunnel-mode and Transport-mode.
Virtual Private Networks Constructed by the Combination of IPSec & L2TP

朱昌盛,余冬梅,王庆梅,谢鹏寿,包仲贤

DOI: https://doi.org/10.3969/j.issn.1000-3428.2002.11.041

2002-01-01

Abstract:The advent of VPN makes it possible for enterprises to transform private confidential massage securely and economically through the Internet. Security tunneling technology is the core technology of VPN, while L2TP IPSec are two tunneling technologies most widely used at present. As the two main accesses to IP network, the combination of L2TP IPSec can share the advantage of L2TP's low cost, initiative, mutual-communication and IPSec's high security, reliability，learn from others' strong points to offset one's weakness, to a great extent, to construct a secure, reliable and low-cost VPN.
The Design And Implementation Of Router Security Subsystem Based On Ipsec

Yinghua Wu,Jianping Wu,Ke Xu,Mingwei Xu

DOI: https://doi.org/10.1109/TENCON.2002.1181240

2002-01-01

Abstract:IPSec protocols offer a standard security mechanism, used for security service to upper' protocols (such as UDP and TCP). This paper introduces the design and implementation of Router Security Subsystem based on IPSec, the important part of High Performance Security Router made by Tsinghua University. We complete consummate and reliable security functions, use various optimal methods to enhance the performance furthest.
IPSec-based Distributed Firewall Security Architecture

崔伟,齐竞艳,蔡圣闻,黄皓

DOI: https://doi.org/10.3969/j.issn.1000-3428.2004.16.051

2004-01-01

Abstract:The paper introduces the basic notion of distributed firewall, analyses the security threatens. Then it introduces IPSec protocols,and presents an IPSec-based distributed firewall security architecture including the internal design and external design.This architecture combines IPSec and some other secure measures with distribtued firewall so as to give distributed firewall stronger security.
Fastpath-based VPN Gateway over Network Processor

Bo Ji,Jinfang Zhou,Junda Zhu,Liping Qian

DOI: https://doi.org/10.1049/cp:20061251

2006-01-01

Abstract:Networks, along with the explosive growth of the Internet, developed quickly and make our lives more convenient and efficient. However, at the same time, people will face much more network security problems such as illegal observation, modification, IP Spoofing, etc. This article proposes a novel type of universal software architecture named Fastpath which is purposely designed and optimized for Network Element (NE) in the Next Generation Networks (NGN), under Linux. Furthermore, it illustrates the experience in developing IPSec-based VPN gateway over IXP425, and offloading IPSec processing to NPEs and coprocessors by using APIs of software AccessLibrary through Open Crypto Framework (OCF). Finally, we investigate the performance issues both internally and externally. Through the benchmarks, we analyze the performance of the system and identify that Fastpath and network processor together can construct a universal and high-functional platform for NE which focuses on network processing.
Research on a Security Architecture for the Internet Protocol

符松,金志权,陈佩佩

DOI: https://doi.org/10.3969/j.issn.1000-3428.2001.10.045

2001-01-01

Abstract:IPSec is a security architecture for the Internet protocol ,which provides transparent protection services for upper protocols. It consists of the protocols of automatic key management, authentication and encryption. In this paper, some modifications and a new protocol for the runtime detection are presented to enhance the efficiency and security of the original architecture.
A VPN Solution Based on IPSec and MPLS

郑刚,周源远,张福炎

DOI: https://doi.org/10.3969/j.issn.1001-3695.2003.10.030

2003-01-01

Abstract:This paper explores the advantages and disadvantages of IPSec VPN and MPLS VPN according to VPN requirements, and puts forward a VPN solution integrated with IPSec and MPLS, which is aimed to get the advantages of the two techniques.
Construction of Security Wireless LAN Based on VPN

吴丽华,史烈

DOI: https://doi.org/10.3969/j.issn.1000-3428.2005.04.061

2005-01-01

Abstract:Security is a crucial problem in design and deployment of wireless LAN. The security technology used in nowadays 802.11 equipment WEP and 802.11x, has security flaws in design and can't protect the security of WLAN. This paper presents a network deployment scenario using VPN technology in WLAN, and discusses the design of VPN gateway in it.
Research on Key Technology of VPN Centralized Management Based on SNMP

黄勇,陈小平,潘雪增,陈红洲,蒋晓宁

DOI: https://doi.org/10.16208/j.issn1000-7024.2008.09.057

2008-01-01

Abstract:Under the WAN environment,large-scale VPN networks is effectively and safely managed by long-distance centralized mana-gement system based on SNMP.To solve the flaw of topology discovery,a method in which agent initiates registry to the server is pro-posed.After analysis of the SNMPv3 security features,the public key authentication mechanism is introduced and the procedure of key negotiation is discussed in detail.For poor reliability and real-time data transmission of UDP-based SNMP,a strategy of configuration based on XML is given,which is proved to be feasible and efficient by the result of experiment at last.
A Distributed Object-Based IPSec Multi-Tunnels Concurrent Architecture

Song Wang,Hongbing Lv

DOI: https://doi.org/10.1109/iccps.2011.6089933

2011-01-01

Abstract:In the existing IPSec architecture, in which tunnel is built in kernel, the number of concurrent tunnels is restricted by IP address configured on the machine and user can not control the process of establishing tunnel. This brings inconvenience when we use personal computer to measure the performance parameters of VPN Gateway (e.g. the maximum number of concurrent tunnels and the maximum rate of the new tunnels built). In order to solve this problem, this paper presents a novel IPSec multi-tunnels concurrent architecture which uses distributed objects to build tunnels in user space. The architecture privodes one Console which are used to control all AgentNodes and multiple AgentNodes which are used to build tunnels. In AgentNode, the negotiation processing of tunnels, the IPSec processing of packets and the protocol processing of TCP/IP are all completed in user space by objects. Meanwhile, AgentNode uses virtual IP address instead of local IP address to negotiate tunnel and the number of concurrent tunnels will be unlimited (only limited by memory). Moreover, based on distributed architecture, the number of AgentNode can be arbitrarily extended. Therefore, the system has a great deal of flexibility on the number of concurrent tunnels and the rate of tunnel establishment, which helps to accurately measure the performance parameters of VPN Gateway.
Design and Implementation of IPsec VPN IoT Gateway System in National Secret Algorithm

Yan Jiang,Jing Huang,Yunsong Fan,Xiaobin Zhu

DOI: https://doi.org/10.13052/jcsm2245-1439.1345

2024-06-14

Journal of Cyber Security and Mobility

Abstract:With the development of Internet of Things technology, the security threats faced by the industrial control field are increasing, and strengthening the security protection capabilities of intelligent systems on IoT highways is becoming increasingly important. IPSec VPN tunneling technology can achieve identity authentication and encrypted data transmission, and is an important means to achieve secure data transmission in intelligent systems on Expressway intelligent tunnel system. The commonly used IPSec VPN gateway uses a traditional Linux protocol stack-based approach for data capture, which requires multiple data copies and context switching, resulting in low efficiency of IPSec services. In addition, the commonly used IPSec VPN security gateway is implemented on the basis of the open-source IPSec framework, using internationally recognized algorithms for encryption and decryption, which poses security risks. This article is based on the IPSec protocol, and studies the high-speed network packet capture framework PFRING technology, the fusion technology of national secret algorithm and IPSec protocol. It designs and implements an IPSec VPN IoT security gateway based on national secret algorithm. After experimental verification, the IPSec VPN gateway system constructed in this article has complete functions and better performance than the common open-source IPSec frameworks OpenSwan and strongSwan, and can meet the application requirements of IoT data encryption transmission.
Implementation and Performance Evaluation of IPSec VPN Based on Netfilter

Zhao Da-yuan,Jiang Yi-xin,Lin Chuang,Li Yan-xi

DOI: https://doi.org/10.1007/bf02828626

2005-01-01

Wuhan University Journal of Natural Sciences

Abstract:We mainly explore two problems when combining IPSec module into TCP/IP stack by porting the famous IPSec software (FreeS/WAN) into a security gateway. One is how to implement the IPSec module based on Netfilter in Linux 2.4. x kernel. The other problem is the performance evaluation. We test the throughput of our security gateway before and after applying IPSec with different encryption/decryption algorithms, including the software-based and hardware-based method. With these testing data, we analyze further system performance bottleneck. In the end, we also infer the quantitative relation between the system throughput and the speed of encryption/decryption algorithm and propose some valuable conclusions for improving performance.
Study of Security of IPSec Based on IPv 6

LI PEIGUO,LUO PING

DOI: https://doi.org/10.3969/j.issn.1008-0570.2007.27.020

2007-01-01

Abstract:The Next Generation Internet is going to base on IPv6(Internet Protocol version 6) that has to support IPsec(Internet Protocol Security) that provided two kinds of security mechanisms: Encryption and Authentication. This paper is aimed to introduce the architecture of IPsec, their functions and their relationships. A new opinion is brought forward about the IPsec theory and IPsec application based on IPv6 . This paper summarized that IPsec can be provided with the advantages and be confronted with the challengesin the next generation Internet based on IPv6.
Hybrid-mode IPv6 IPSec-VPN Implementation Toward Linux Netfilter Scheme

沈燕然,张青山,王新,薛向阳

2008-01-01

Abstract:Development of IPv6 networks brought the need of secure communication between private networks and different kind of personal devices.Secure and scalable communication protection scheme is required.While IPSec-VPN is a popular solution,it has several drawbacks such as forced requirement of accessor's knowledge about VPN gateways.In this paper,we proposed a new IPSec-VPN packaging mode-hybrid mode,and gave the implementation of it using Linux kernel netfiltering scheme.Applications show that the hybrid-mode IPSec-VPN works well for different VPN topologies and makes VPN gateways transparent to users.
Security Transmission of FTP Data Based on IPSec

Wanbo Zheng,Shufen Liu,Zongwei Liu,Qingxing Fu

DOI: https://doi.org/10.1109/sws.2009.5271783

2009-01-01

Abstract:With the analysis of IPv6's IPSec protocol and principles, the paper designs various modules of IPSec, and achieves IPSec function. By the analysis of the FTP under IPv4 and IPv6 environment, the paper realizes the function of FTP in data transmission of IPv6. The test results of FTP data transmission based on IPSec show that the data transmission is successful and secure, the design and realization are feasible.

IPSec:Fundamental of Network Security and VPN

VPN Test System Based on IPSec Network Protocol

Solution to VPN and Authentication System

Implementation of IPSec IKE

The research of VPN security gateway based on IPSec

VPN Implementation Based on IPSec in Linux

A Multi-tunnel VPN Concurrent System for New Generation Network Based on User Space

Virtual Private Networks Constructed by the Combination of IPSec & L2TP

The Design And Implementation Of Router Security Subsystem Based On Ipsec

IPSec-based Distributed Firewall Security Architecture

Fastpath-based VPN Gateway over Network Processor

Research on a Security Architecture for the Internet Protocol

A VPN Solution Based on IPSec and MPLS

Construction of Security Wireless LAN Based on VPN

Research on Key Technology of VPN Centralized Management Based on SNMP

A Distributed Object-Based IPSec Multi-Tunnels Concurrent Architecture

Design and Implementation of IPsec VPN IoT Gateway System in National Secret Algorithm

Implementation and Performance Evaluation of IPSec VPN Based on Netfilter

Study of Security of IPSec Based on IPv 6

Hybrid-mode IPv6 IPSec-VPN Implementation Toward Linux Netfilter Scheme

Security Transmission of FTP Data Based on IPSec