IPSec与NAT协同工作的一种解决方案  

Implementation on Coorpertation Between IPSec and NAT

作　　者：刘庆华[1] 林邓伟[1] 

机构地区：[1]焦作大学信息工程学院,河南焦作454003

出　　处：《河南科技大学学报（自然科学版）》2008年第4期65-68,共4页Journal of Henan University of Science And Technology:Natural Science

基　　金：河南省科技攻关项目(0424220156;0524220074)

摘　　要：Internet网络层安全协议IPSEC和网络地址协议NAT不兼容,这严重限制了IPSEC的应用范围。解决的方法必须是既能使IPSEC数据流穿越NAT,又不必修改路由器和NAT,部署方便。本文分析了现有解决方案的局限性,对IETF(因特网工程任务组)提出的基于UDP封装的IPSec穿越NAT方案进行了改进,提出了一种新的封装格式,即封装整个IPSec数据报,将主机自身的IP地址一同进行封装,经过UDP封装后,其源地址被更改为原始IP地址,保护了原始IP地址和端口号,了IPSec报文对NAT设备的透明穿越。该方案通过对IPSec协议的扩展,有效地支持了IPSec数据流传输路径中的NAT转换。The application range of IP security protocol(IPSEC)is restricted due to the incompatibility of IPSEC and network address translator(NAT).The rule that must to be followed by the solutions for IPSEC passing through NAT is that IPSEC passes through NAT without any changes to the routers and NAT on the internet.There are limits to the current solutions.Base on the IETF draft,an encapsulation format of UDP is put forward to avoid the conflict between IPSec and NAT.Because the IP address of the senderis necessary to be encapsulated into the packet,the packet's source address will be changed to the original address when it is disposed by the destination host outside.The upper protocol layers above the network layer of the host outside would be thought as communicating with a host with the original IP address.By the amelioration,the data can traverse the NAT gateway transparently.According to this solution,IPSec protocol suit is extended to support the NAT transform through the transmission path of IPSec data stream effectively.

关 键 词：因特网安全协议 网络地址转换 用户数据 数据传输 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]