针对ICMP报文处理问题的IPSec协议改进方案  

An Improved IPSec Protocol Scheme for the Problem of ICMP Packet Processing

作　　者：胡少凤[1] 李之棠[1] 

机构地区：[1]华中科技大学计算机学院,湖北武汉430074

出　　处：《计算机工程与科学》2004年第2期11-14,共4页Computer Engineering & Science

摘　　要：IPSec应用在通道模式下时,对原始IP数据报另外封装了一个外部通道IP头(其中的源、目的地址分别指向实施IPSec的起始、终止端点的地址),导致报文传输途中的路由器对其封装的IP数据报所产生的ICMP差错报文不能在因特网上进行正确转发。该问题是一个难解决的问题,目前暂无成熟可行的方案。针对此问题,本文提出两种对IPSec协议进行改进的方案,均能保证在不影响原有IPSec实施效率的前提下,解决该难题。When IPSec is used in the tunneling mode, an additional external tunnel IP header to the initial IP packet is adjoined, in which the source and destination addresses are pointed to the original and final nodes that implement IPSec protocols respectively. This causes the router in packet transferring cannot forward correctly the ICMP error packets generated by its encapsulated IP data packets on the Internet. This is a hard nut to crack and there is now no mature and feasible scheme. The improved IPSec protocol scheme for this problem can give a satisfactory resolution without decreasing the efficiency of the current IPSec.

关 键 词：ICMP报文处理 IPSEC协议 因特网 路由器 安全性 

分 类 号：TN915.04[电子电信—通信与信息系统]