基于IPv4/v6下的IPSec与防火墙协同问题研究  

Study on Cooperation of IPv4/v6-Based IPSec and Firewall

作　　者：杨立身[1] 张萍[2] 陈艳格[3] 

机构地区：[1]河南理工大学网络中心,河南焦作454000 [2]河南工程学院计算机系,河南新郑451191 [3]河南理工大学计算机学院,河南焦作454000

出　　处：《通信技术》2008年第6期119-121,共3页Communications Technology

基　　金：河南省校园示范工程项目504058

摘　　要：针对IPSec与防火墙不能协同工作问题,文中提出了一种解决方案,即将协议头和数据部分分别进行安全处理,并将这种分层思想与密钥协商方法结合,让防火墙介入IPSec的密钥协商阶段,经过协商让加密的数据包通过防火墙,并且通过IDS(入侵检测系统)更进一步的防御非法入侵,从而解决IPSec对防火墙功能的处理问题。实验结果表明,该方法保证了IPSec的安全性,提高了防火墙与IPSec结合时的效率。For the cooperation question of IPSec and firewall, this paper proposes the solution that handles security problems on protocol head and data in IP datagram separately, combines this layered approach with the key agreement way, and lets the firewall involved in the key agreement phase of IPSec and the encrypted data packets pass, based on consultation, through the firewall, including IDS （Intrusion Detection System） for further defense against intrusion, thus solving the compatibility operation problem. Test results show that this method can ensure the security of IPSec, and raise the efficiency of combination of firewall with IPSec.

关 键 词：安全关联 密钥协商 入侵检测系统 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]