Research And Implementation Of High-performance Security Gateway Based On IPv6

With the rapid development of network applications,there are more and more types of network attacks and complicated attack methods.The need for security protection capabilities to protect a fragile network environment is also becoming more complex.In the evolution from IPv4 to IPv6,the gateway's protection approaches for IPv6 networks need to be updated.Based on such background,this thesis focuses on the fast packet classification and security channel establishment issues involved in high-performance security gateways in IPv6 networks:(1)An IPv6 fast packet classification based on hash and Adelson-Velsky-Landis Tree(PCHA)is proposed.This algorithm uses a hash table to find IPv6 addresses quickly,and uses the AVL tree structure to store flow labels to reduce space consumption,thereby achieving fast matching classification aiming to IPv6 packets.(2)A construction scheme of inter-network security channel suitable for security gateway is proposed.This solution is based on the F-stack data forwarding protocol stack,combined with IPSec's open source software implementation solution,StrongSwan,to implement IPv6 data encryption on the network layer.(3)This paper addresses the performance testing of IPv6 packet classification algorithms in actual networks.Based on the physical gateway and network traffic tester,the actual network environment is established,and a test solution for the impact of packet classification algorithms on throughput is designed.The performance of PCHA is tested and analyzed in a real network environment.In addition,the establishment of the IPSec security channel is tested between the physical gateways to ensure the security of data transmission.