IPSec的NAT兼容性改进  

Improvement of Compatibility of IPsec with NAT

作　　者：姚志林[1] 刘淑芬[1] 韩正服[2] 

机构地区：[1]吉林大学计算机科学与技术学院,长春130012 [2]吉林大学网络中心,长春130012

出　　处：《吉林大学学报（理学版）》2005年第4期450-454,共5页Journal of Jilin University:Science Edition

基　　金：吉林省自然科学基金(批准号:20000542).

摘　　要：通过分析Internet网络层安全协议(IPSec)工作机制提出一种改进的隧道封装方法.通过数据发送方在数据包中封装本主机的IP地址,并在接收方对其进行相应的处理,在解决IPSec与网络地址翻译技术NAT兼容性问题的基础上,使得通信双方可以灵活决定对通信的保护方式.与Internet工程任务组的解决方案相比,在不损失安全性及只增加很小开销的前提下,保持了灵活设置安全策略的能力.An improved tunnel encapsulation method was proposed based on the analysis of the mechanism of Internet network layer security protocol IPSec. On the basis of encapsulating the original IP address of the host in the data packet and doing corresponding management of it at the opponent side and solving the incompatibility problem between IPSec and NAT the two sides of the communication can still configure their security policy flexibly. Compared with the solution method of Internet engineering task force, our method can keep the flexibility of security policy configuration without the loss of security and with adding a little spending.

关 键 词：网络安全技术 网络层安全协议 网络地址翻译 用户数据报封装 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]