IPSec安全策略形式化技术的研究  

Research on Formal Modeling Technology of IPSec Security Policy

作　　者：黄俊[1] 韩玲莉[1] 

机构地区：[1]中国计量学院计算机科学系,杭州310018

出　　处：《计算机工程》2007年第12期185-187,共3页Computer Engineering

基　　金：浙江省自然科学基金资助项目(Y109456)

摘　　要：IPSec安全策略配置是一项复杂和易出错的工作。为解决这问题,提出了通过有序两元判定图表(OBDD)提供全面的IPSec安全策略冲突识别和分类的通用架构模型,并基于该架构模型,开发了一组在通用IPSec策略配置过程中发现策略内部的冲突问题的技术。实验测试证明了该架构模型和技术在发现和解决策略冲突问题的有效性。IPSec policy configuration remains a complex and error-prone task. A generic model that captures various filtering policy semantics using Boolean expressions is presented. This model is used to derive a canonical representation for IPSec policies using ordered binary decision diagrams. Based on this representation, a comprehensive framework is developed to classify and identify conflicts that could exist in a single IPSec device （intra-policy conflicts） in enterprise networks. The testing and evaluation study on different network environments demonstrates the effectiveness and efficiency of the approach.

关 键 词：网络安全 IPSEC 安全策略 防火墙 形式化模型 有序两元判定图表 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]