Research And Implementation Of IPSec System Based On Distributed Router

The rapid development of Internet makes the network environment become morecomplex, so it should be pay more attention to the security of the network.How to preventall kinds of attacks and strengthen the anti-attack capability, which is critical for thesecurity and privacy of the entire network.Router as the key equipment of the Internet, especially the high performance routerwhich adopts the distributed structure should provide the security protectionfor the entirenetwork. IPSec(IP Security)is a series of protocols that IETF task group constituted toprovide security services in the network layer. IPSec protocol suite can realize the mostdemand of network security, provide securityguarantees for transmiting sensitiveinformation in the unprotected Internet. Therefore, the implementation of IPSec systembased on distributed router, which is of great significance to the communication andsecurity of the entire network.In this thesis,the development of IPSec system is based on the distributed router, thissystem is strictly according to the network security protocol standards developed by theIETF.This thesis mainly completed the design and implementation of IPSec system in thedistributed router system. Through the analysis of the key technologies of IPSec,combining the characteristis of distributed router, this thesis puts forward the IPSecencryption/decryption scheme based on the hardware encryption card on the router. Theconcrete scheme about the implementation of IPSec on the distributed router isgiven,including the IPSec system framework design,IPSec function module division, theoverall process flow of IPSec packet processing, etc.At the same time, this thesis studiesthe extended functionality of IPSec, IPSec peers detection mechanism, in combination withthe practical situation of the project, puts forward to use BFD instead of DPD, andanalyzes its feasibility and superiority.Finally we set up the test environment, the basicfunction of the IPSec system was verified through the comprehensive functional testing,performance testing. And the IPSec encryption card uses multi-core processors, which improves the processing performance of encryption/decryption.