On the Deployment Approach of IPSec and IP Filter in Routers

Wang Li, Xu Mingwei, and Xu Ke

Journal of Computer Research and Development > 2006 > 43(3): 375-380.

Wang Li, Xu Mingwei, and Xu Ke. On the Deployment Approach of IPSec and IP Filter in Routers[J]. Journal of Computer Research and Development, 2006, 43(3): 375-380.

Citation:

Wang Li, Xu Mingwei, and Xu Ke. On the Deployment Approach of IPSec and IP Filter in Routers[J]. Journal of Computer Research and Development, 2006, 43(3): 375-380.

Citation:

Wang Li, Xu Mingwei, and Xu Ke. On the Deployment Approach of IPSec and IP Filter in Routers[J]. Journal of Computer Research and Development, 2006, 43(3): 375-380.

PDF (309 KB)

On the Deployment Approach of IPSec and IP Filter in Routers

Wang Li, Xu Mingwei, and Xu Ke

(Department of Computer Science and Technology, Tsinghua University, Beijing 100084)

More Information

Published Date: March 14, 2006

Graphical Abstract

Abstract

Abstract

IPSec and IP Filter are among the most important security modules of IPv6 routers. Similar to the function of IP Filter, the security-association query engine of IPSec also needs filtering and matching the IP packages. The IP packages flowing inside the router could be filtered by IP Filter and IPSec for more than once. Thus, the method of deployment between the two modules will have direct influence on the processing performance of IP packages. In this work, the inter-relationship between the two security modules is given in a perspective of router global security. Moreover, a novel deployment approach is proposed. Compared with the open-source IPv6 protocol stack KAME, the improved processing performance of IPSec is obtained and the negative influence of IP Filter on the IPSec is reduced. Meanwhile, the duplicated IP package filtering within the routers is reduced to improve the processing performance of IP package.
- IPSec,
- IP Filter,
- router,
- deployment approach

FullText(HTML)

References (0)

[1]	Wu Jinjin, Liu Quan, Chen Song, Yan Yan. Averaged Weighted Double Deep Q-Network[J]. Journal of Computer Research and Development, 2020, 57(3): 576-589. DOI: 10.7544/issn1000-1239.2020.20190159
[2]	Bai Chenjia, Liu Peng, Zhao Wei, Tang Xianglong. Active Sampling for Deep Q-Learning Based on TD-error Adaptive Correction[J]. Journal of Computer Research and Development, 2019, 56(2): 262-280. DOI: 10.7544/issn1000-1239.2019.20170812
[3]	Zhu Fei, Wu Wen, Liu Quan, Fu Yuchen. A Deep Q-Network Method Based on Upper Confidence Bound Experience Sampling[J]. Journal of Computer Research and Development, 2018, 55(8): 1694-1705. DOI: 10.7544/issn1000-1239.2018.20180148
[4]	Chen Tieming, Yang Yimin, Chen Bo. Maldetect: An Android Malware Detection System Based on Abstraction of Dalvik Instructions[J]. Journal of Computer Research and Development, 2016, 53(10): 2299-2306. DOI: 10.7544/issn1000-1239.2016.20160348
[5]	Fu Ning, Zhou Xingshe, Zhan Tao. QPi: A Calculus to Enforce Trustworthiness Requirements[J]. Journal of Computer Research and Development, 2011, 48(11): 2120-2130.
[6]	Liu Tao, He Yanxiang, Xiong Qi. A Q-Learning Based Real-Time Mitigating Mechanism against LDoS Attack and Its Modeling and Simulation with CPN[J]. Journal of Computer Research and Development, 2011, 48(3): 432-439.
[7]	Zhao Ming, Luo Jizhou, Li Jianzhong, and Gao Hong. XCluster: A Cluster-Based Queriable Multi-Document XML Compression Method[J]. Journal of Computer Research and Development, 2010, 47(5): 804-814.
[8]	Deng Shanshan, Sun yi, Zhang Lisheng, Mo Zhifeng, Xie Yingke. Design of HighSpeed FFT Processor for Length N=q×2\+m[J]. Journal of Computer Research and Development, 2008, 45(8): 1430-1438.
[9]	Han Jingyu, Xu Lizhen, and Dong Yisheng. An Approach for Detecting Similar Duplicate Records of Massive Data[J]. Journal of Computer Research and Development, 2005, 42(12): 2206-2212.
[10]	Li Ronglu, Wang Jianhui, Chen Xiaoyun, Tao Xiaopeng, and Hu Yunfa. Using Maximum Entropy Model for Chinese Text Categorization[J]. Journal of Computer Research and Development, 2005, 42(1): 94-101.