Linux2.6内核IPSec支持机构的研究与分析  

Research and Analysis of IPSec Support Mechanism in Linux Kernel 2.6

作　　者：周莉[1] 黄宪[2] 陆建德[2] 

机构地区：[1]苏州市职业大学计算机工程系,江苏苏州215000 [2]苏州大学计算机学院,江苏苏州215006

出　　处：《计算机技术与发展》2007年第5期191-194,198,共5页Computer Technology and Development

基　　金：江苏省自然科学基金资助项目(BK2004039)

摘　　要：新的Linux2.6内核提供了对IPSec的支持机构,文中对Linux 2.6内核中新加入的IPSec代码进行了深入分析。对比先前不支持IPSec的网络协议栈的Linux内核,揭示了Linux 2.6内核“无缝”接入IPSec处理的方法;阐述了内核中IPSec重要组件——安全关联SA、安全策略的设计思想以及相关数据库SAD和SPD的构建方法;分析了基于Netlink套接字通信的内核IPSec管理模块、内核加密算法函数库,总结出一套Linux 2.6内核IPSec支持机构提供给用户进程的调用方法。New Linux kernel 2.6 has provided the IPSec support mechanism, and this paper has made thorough analysis tO the IPSec code embedded in Linux kernel 2.6. Compares the Linux 2.6 kernel＇ s protocol stack with previous kernels＇ that don＇ t suppoix IPSee, and un, leashes the methods＂ of the IPSec seamless integration in Linux 2.6 kemel. It illustrates the design thoughts.of SA and SP structures that are both important IPSec elements,and constructing methods of SAD and SPD. Also analyzed the management module that based on the communication of Netlink sockets and the crypto function hank,and summarized a suit of methods that provided by IPSec support mechanism in Linux＇kernet 2.6 that can be utilized by user process.

关 键 词：IPSEC 安全关联 安全策略 Netlink套接字 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]