IPSec/VPN安全策略的正确性探讨  

How to Ensure the Correctness of IPSec / VPN Security Policy

作　　者：刘瑶瑶 邢伟 

机构地区：[1]江苏金盾检测技术有限公司,江苏南京210013

出　　处：《无线互联科技》2015年第24期35-36,84,共3页Wireless Internet Technology

摘　　要：随着IPSec/VPN策略的广泛应用,如何正确地制定和配置在执行安全需求的时候是非常关键的。现在很多情况下,IPSec/VPN策略是由系统管理员来定义,很多时候的策略是不正确的。然后,网络的动力会影响策略的设置甚至导致意外冲突。为了处理这些问题,需要定义IPSec的安全需求,策略和相关的一些参数。基于这些定义,提供一种区域间的架构来生成正确和有效的安全策略。当网络堵塞时也能配置安全策略,同时,当有新的安全策略加进来时也能处理。最终,可通过模拟数据来评估解决方案。With IPSec/VPN polices being widely deployed, how to correctly specify and configure them is critical in enforcing security requirements. Under current practice, IPSec/VPN polices are usually specified by system administrators and thus prone to errors. However, dynamic aspects in the network may interfere with the existing policy set up and thus cause unexpected conflict. To deal with these problems, we formally define IPSec security requirements, polices, and their correctness criteria. Based on these definitions, we present an inter-domain architecture to automatically generate correct and efficient security policies. Our approach works when we are given a set of security requirements for a single end-to-end traffic flow.

关 键 词：IPSec/VPN 安全需求 安全策略管理 安全策略保证 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]