The Design And Research Of Network Security Project Of Sasac Guangxi

State-owned Assets Supervision and Administration Commission of Guangxi Ethnic autonomous region People’s Government (SASAC Guangxi) had begun a series of informational technology engineering construction since2005to support operation. Because of inadequate investment in the building of the early, leading to lack of construction and application of the project, resulting in network security protection there are many problems. In this paper, with the actual of SASAC Guangxi, focusing on the solutions to improve network security issues for the information systems has been completed in SASAC Guangxi.In this paper, Through detailed analysis the information construction of SASAC Guangxi, and various types of network security hidden danger and security reform demand, based on the actual compared the advantages and disadvantages of several mainstream information security system and framework, put forward the overall structure of ideas of the improvement design scheme of the Guangxi SASAC network security, and on this basis, using a variety of network security technology to give the feasible design scheme and the concrete implementation plan of the improvement design scheme of the SASAC Guangxi network security. Program mainly deals with:By the use of SSL VPN technology, set up private network supporting existing IPSec VPN, to solve the problem of low efficiency and management by IPSec VPN packet spending big cause transmission; application the technology of auditing network security logs and flow analysis control to solve the need of existing network Internet access management and security post-mortem analysis of decision-making; Application PKI technology system with the SSL VPN prevention network external access network layer of the risk, solve LAN internal identity authentication demand etc.. And tested the main content of the program:compared the different indicators by the SASAC Guangxi network architecture on IPSec VPN and SSL VPN:connection speed, access control, attack protection performance, combined with the effect of digital certificates; deployed network Log security audit system and flow analysis control system to test the effectiveness and feasibility of internet access management and security log analysis for decision-making; made the CA to test the internal identity and access control effect and feasibility by VPN remote access and LAN access; comparative test the effect by the impact on the actual use by the LAN control technology including VLAN, MAC address binding, the addition of message authentication mechanism and so on to solve management problems and by people and workplace change.