高隐蔽性IPSec协议研究  

Research on High Covert IPSec Protocol

作　　者：陈洋 陈浩[1] 骆华杰 郭栋 廖根箔 CHEN Yang;CHEN Hao;LUO Huajie;GUO Dong;LIAO Genbo(No.30 Institute of CETC,Chengdu Sichuan 610041,China)

机构地区：[1]中国电子科技集团公司第三十研究所,四川成都610041

出　　处：《信息安全与通信保密》2020年第11期111-117,共7页Information Security and Communications Privacy

摘　　要：介绍IPSec协议的工作原理,阐述高安全性要求的企业对IPSec VPN技术运用于互联网环境提出的抗阻断、高隐蔽等需求。随后对现有的基于IPSec协议的集成运用和改造运用类解决方案进行分析对比,提出了一种利用TCP及应用层协议承载进行NAT穿越和密钥协商的IPSec协议改造思路。通过在专用IPSec VPN网关设备上突破TCP加速关键技术,一定程度上弥补协议封装导致的性能损失,验证了新IPSec协议具有较强的网络穿透性和隐蔽性。Firstly,the working principle of IPSec protocol is introduced,and the new requirements of security sensitive enterprises are expounded for the application of IPSec VPN Technology in Internet environment,such as anti blocking and high covert.After analyzing and comparing the existing solutions of integrated application and transformation application based on IPSec protocol,an idea of improving IPSec protocol by using TCP and application layer protocol to carry out NAT traversal and key negotiation is proposed.By breaking through the key technology of TCP acceleration on the customized IPSec VPN gateway,the performance loss caused by protocol encapsulation is compensated to a certain extent,which verifies that the new IPSec protocol has strong network penetration and high covert.

关 键 词：IP层安全 虚拟专用网络 NAT穿越 TCP加速 高隐蔽 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]