Design And Implement Of VPN Security Admittance Control

The VPN use authentication, data integrality validation, data encryption, anti-rebroadcast technologies and so on, to provide strong protection of the tunnel security for the data transmission. However, if the terminal node connected into the VPN has the security risk, or exists malicious act, even if these nodes passed authentication, data transmitted on the security tunnel maybe unsafe. Therefore it need to protect accessing terminals.Based on the thorough analysis to each kind of the popular technology of security accessing terminals at present, combined with characteristics of VPN, the idea of VPN security admittance control is proposed. And the implement scheme of VPN security admittance control based on NDIS frame of Windows platform is provided. The main idea of this kind of plan is: The security policy server produces security policies according to the actual security requirements, and then delivers them to the terminals. A terminal provides each kind of terminal control function following the security policies, such as the network access control, the terminal health examination, the device control, the crack scan, security audit, anti-virus, threat defense, system integrity control and so on. Thereinto, the network access control provides the rule control of accessing the network of the terminal application and the rule control of accessing the terminal IP messages. And the terminal health examination provides to the system health examination, prevents the terminal that doesn't conform to concrete security policy to connect into, thus avoids the security risk. The device control provides with the serial port or parallel port equipments control and the USB equipments control in high level security environment. The main implement technology is: Using the NDIS-Hook technology to filtrate the IP message; using Service Provider Interface technology to control the action of application accessing network; using Windows Management Instrumentation technology and so on, to exam the system.health.