利用IPSec來實現VPN

Mechanisms for Implementing VPN Based on IPSec

莊家維(Jia-Wei Chuang)

指導教授 ： 涂世雄

中原大學/工學院/電機工程研究所/碩士(2002年)

https://doi.org/10.6840/cycu200200187

摘要

論文摘要
在本論文中，我們提出兩種利用IPSec來建立VPN的方法。和傳統VPN 不同的地方是，這兩種方法在認證和資料加密方面都提供更安全的保障。除此之外，由於IPSec是IETF所訂立的統一規格，所以各家廠商能經由遵循此規格來研發VPN的產品，如此一來，VPN便能廣泛的應用到各個公司、企業團體而沒有所謂產品不相容的問題產生。
我們要利用IPSec來實現VPN的理由可以有下面幾點：(1) IPSec 中的Authentication Header (AH) Protocol和Encapsulating Security Payload (ESP) Protocol 可以為VPN提供更完善的認證和資料加密的功能，而金鑰交換方面則由ISAKMP/Oakley來改善Diffie-Hellman的缺點和增加安全服務協商的功能。(2) IPSec 是位於TCP/IP layer的底部。因此，當我們將IPSec實現在防火牆或是路由器上時，不需要去變動到上層的應用程式，這對公司、企業團體來說能減少許多額外的成本。(3) 當我們將IPSec實現在公司網路的防火牆或是路由器時，內部網路的電腦不需要知道它所送出去的封包經過何種加密或認證的處理，同樣的，當外面網路有封包要傳送到內部網路的電腦時，在經過公司防火牆時會將加密或認證過後的封包經過處理後再轉送到內部電腦，因此內部電腦不需要具備IPSec的軟體。

關鍵字

虛擬私人網路 ； 網路安全 ； 區域網路

並列摘要

Abstract

This thesis provides two new mechanisms for implementing the Virtual Private Network (VPN) based on IPSec. Different with traditional VPN, these mechanisms provide stronger security in authentication and confidentiality. In addition, via implementing IPSec, making VPN has uniform specification and can be used extensively.
The reasons for us to adopt IPSec to implement VPN are as follows. First, the two protocols of IPSec, Authentication Header (AH) and Encapsulating Security Payload (ESP), can enhance security of VPN’s authentication and confidentiality. Then, the ISAKMP/Oakley is a key exchange protocol that can improve Diffie-Hellman weakness and negotiate security attributes. At last, the application programs using IPSec need not be modified in any way. This is particularly important when securing application programs that are not available in source code, which is common today. This transparency sets IPSec apart from security protocols that operate above Internet. At last, IPSec is also designed to be usable both with IPv4 and IPv6. This means that vendors can provide identical specifications for VPN’s products.
In summary, to describe the results of our work are as follows:
1. When IPSec is implemented in VPN, it provides strong security.
2. IPSec is below the transport layer (TCP, UDP) and so is transparent to applications. There is no need to change software on a user or server system when IPSec is implemented in VPN’s firewall or router. Even if IPSec is implemented in end systems, upper-layer software, including applications, is not affected.
3. When IPSec is implemented in VPN, it can be transparent to end-users. There is no need to train users on security mechanisms, issue keying material on a per-user basis, or revoke keying material when users leave the organization.
4. When IPSec is implemented in VPN, it can provide security for individual users such as homeworker and remote access.
According to the IPSec-based VPN, we believe the VPN will be securer and be used more extensively in the future.

並列關鍵字

IP Security ； VPN ； network security ； Internet Key Exchange

參考文獻

[3] William Stallings, NETWORK SECURITY ESSENTIALS：Applications and Standards,

[4] Comer, Douglas, Internetworking with TCP/IP. Vol. II, Design,

REILLY, 1999.

[6] Roger Younglove, “Virtual private network – how they work”, Computing &

[7] William Stallings, NETWORK SECURITY ESSENTIALS：Applications and Standards,