On the Deployment Approach of IPSec and IP Filter in Routers

Wang Li, Xu Mingwei, and Xu Ke

Journal of Computer Research and Development > 2006 > 43(3): 375-380.

Wang Li, Xu Mingwei, and Xu Ke. On the Deployment Approach of IPSec and IP Filter in Routers[J]. Journal of Computer Research and Development, 2006, 43(3): 375-380.

Citation:

Wang Li, Xu Mingwei, and Xu Ke. On the Deployment Approach of IPSec and IP Filter in Routers[J]. Journal of Computer Research and Development, 2006, 43(3): 375-380.

Citation:

Wang Li, Xu Mingwei, and Xu Ke. On the Deployment Approach of IPSec and IP Filter in Routers[J]. Journal of Computer Research and Development, 2006, 43(3): 375-380.

PDF (309 KB)

On the Deployment Approach of IPSec and IP Filter in Routers

Wang Li, Xu Mingwei, and Xu Ke

(Department of Computer Science and Technology, Tsinghua University, Beijing 100084)

More Information

Published Date: March 14, 2006

Graphical Abstract

Abstract

Abstract

IPSec and IP Filter are among the most important security modules of IPv6 routers. Similar to the function of IP Filter, the security-association query engine of IPSec also needs filtering and matching the IP packages. The IP packages flowing inside the router could be filtered by IP Filter and IPSec for more than once. Thus, the method of deployment between the two modules will have direct influence on the processing performance of IP packages. In this work, the inter-relationship between the two security modules is given in a perspective of router global security. Moreover, a novel deployment approach is proposed. Compared with the open-source IPv6 protocol stack KAME, the improved processing performance of IPSec is obtained and the negative influence of IP Filter on the IPSec is reduced. Meanwhile, the duplicated IP package filtering within the routers is reduced to improve the processing performance of IP package.
- IPSec,
- IP Filter,
- router,
- deployment approach

FullText(HTML)

References (0)

[1]	Li Yuan, Yang Sen, Sun Jing, Zhao Huiqun, Wang Guoren. Influential Cohesive Subgraph Discovery Algorithm in Dual Networks[J]. Journal of Computer Research and Development, 2023, 60(9): 2096-2114. DOI: 10.7544/issn1000-1239.202220337
[2]	Li Xin, Liu Guiquan, Li Lin, Wu Zongda, Ding Junmei. Circle-Based and Social Connection Embedded Recommendation in LBSN[J]. Journal of Computer Research and Development, 2017, 54(2): 394-404. DOI: 10.7544/issn1000-1239.2017.20150788
[3]	Yuan Xinpan, Long Jun, Zhang Zuping, Luo Yueyi, Zhang Hao, and Gui Weihua. Connected Bit Minwise Hashing[J]. Journal of Computer Research and Development, 2013, 50(4): 883-890.
[4]	Jiao Jian, Yao Shan, Li Xiaojian. Research on Network Bidirectional Topology Discovery Based on Measurer by Spreading[J]. Journal of Computer Research and Development, 2010, 47(5): 903-910.
[5]	Jin Xin, Xiong Yan, Li Min, and Yue Lihua. A Connectible-Cell Based Topology Control Algorithm for Wireless Sensor Networks[J]. Journal of Computer Research and Development, 2008, 45(2): 217-226.
[6]	Liu Wei, Cui Li, Huang Changcheng. EasiFCCT：A Fractional Coverage Algorithm for Wireless Sensor Networks[J]. Journal of Computer Research and Development, 2008, 45(1): 196-204.
[7]	Yang Liu, Li Zhenyu, Zhang Dafang, Xie Gaogang. Topology Discovery with Smallest-Redundancy in IPv6[J]. Journal of Computer Research and Development, 2007, 44(6): 939-946.
[8]	Sun Yantao, Shi Zhiqiang, Wu Zhimei. Automatic Discovery of Physical Topology in Switched Ethernets[J]. Journal of Computer Research and Development, 2007, 44(2): 208-215.
[9]	Zhu Pengfei, Dai Yingxia, and Bao Xuhua. PKI-Based Mutual Connections Constrained with Discrepancy of Trust Domains[J]. Journal of Computer Research and Development, 2006, 43(10): 1804-1809.
[10]	Wen Yingyou, Zhao Jianli, Zhao Linliang, and Wang Guangxing. A Study of the Relationship Between Performance of Topology-Based MANET Routing Protocol and Network Coverage Density[J]. Journal of Computer Research and Development, 2005, 42(4): 684-689.