远程接入VPN用户解决方案

前言 随着业务的发展,移动办公用户通过Internet远程接入企业内网VPN的需求日益明显.本文提供的方案为员工访问企业内部局域网提供了方便和安全的接入方法.该方案的特点是系统管理集成化、技术标准国际化,系统兼容性好,接入响应速度快.该方案主要由两大部分组成,一为接入系统,二为认证系统.该方案采用目前通行的设计思路,接入方式为IPSEC VPN,采用动态密钥的身份认证,使用防火墙策略,可以保证移动用户接入企业内部网数据在传输上的安全.     

5G金融专网中终端后路由应用部署研究

随着5G标准的完善,行业用户逐渐基于运营商公共基础设施构建出属于自己企业的安全专网,实现端到端的移动办公远程接入。移动终端后路由（Routing Behind）应用于移动VPN网络,是一种通过一台无线设备将多台终端设备接入网络并与网络侧设备进行双向数据业务的技术方案,实现了企业分支机构的移动办公,通过一台无线设备将多个企业用户接入企业内部网络,并支持企业用户与企业内部网络进行双向互访,使企业用户和总部间的互访更加灵活、快速、安全。     

CDMA1X企业移动接入解决方案

CDMA1X企业移动接入业务适用范围:移动办公型,企业应用型、特殊专业型。黑龙江联通CDMA1X企业移动揍人三种解决1.远程VPN服务的企业移动接入(1)简要说明AccessVPN能使用户随时,随地以其所需的方式访问企业内部资源,主要用于企业员工或企业的小分支机构通过远程拨号的方式构建的班拟网。     

设计下一代VPN面临的挑战

虚拟专用网（VirtualPrivateNetwork，VPN）在过去很短的时间内得到了快速发展，现在，下一代VPN已经开始萌芽，那些希望建立VPN并从中受益的企业及其网络设计人员必须花费大量时间和精力了解未来VPN的各个组成部分和很多设计细节。随着VPN的发展，未来的VPN将是一系列相关网络的混合体，使企业的移动员工、商业伙伴和供应商可以访问公司的关键应用。VPN最终将成为运行新业务程序和服务的平台，旨在提高企业对市场变化的应变速度，使制造和生产实现流水化作业，并更为方便地在客户需要时向他们提供所需的任何信息。VPN的未来演变…     

自组织网络中的自优化技术与方法

文章介绍了移动通信网络的自组织网络(SON)技术;该技术使得网络设备可以自主部署、优化以及操作,从而能够降低网络运营开销、同时提升用户感知。文章重点讨论自优化方案,包括移动负载均衡方案、移动鲁棒性优化方案、随机接入信道(RACH)优化方案、节能优化方案。文章指出未来SON研究将会在新场景下的方案更新、无线接入技术间(Inter-RAT)场景考虑、节能方案的更新等领域进行深化。     

随时随地办公不再是梦——IBM WebSphere无线安全VPN方案助您业务腾飞

尽管在无线数据网络中取得进展，公司仍面对着管理移动团队的成本、覆盖范围和安全性的巨大压力。企业非常需要有一种让员工能够在家和任何地方就可以访问到企业内部关键数据的远程办公方案，为移动工作人员提供随时随地的办公环境，提高工作效率。     

TD-SCDMA无线网络覆盖解决方案

介绍了由无线接入网络(RAN)组成的TD-SCDMA网络拓扑结构和由大唐移动开发的基于TD-SCDMA标准的基站产品及其特点,介绍了各种典型的网络组网应用场景及其特点,并针对这些场景,提出了相应、灵活的组网覆盖解决方案.结论是大唐移动TD-SCDMA产品及其方案在未来中国TD-SCDMA网络的建设中有广阔的市场前景.     

BYON给企业的新挑战

说起携带自己网络（Bring Your Own Network,BYON）应该还是个相当新的词汇,意味着企业员工可以在移动中使用BYON,比如员工使用中国电信的Wi—Fi无线接入服务,这意味着最终用户会在可用选择不多时,自行创建一个可替代网络同时从多个网络访问企业的敏感数据,甚至下载文件到个人的云存储系统中,而这一切就会给企业信息安全带来巨大的风险甚至是毁灭性的灾害。     

基于IPSec的MVPN原理和实现

随着Internet和无线数据技术的发展,移动虚拟专用网(MVPN)技术越来越受业界关注。MVPN把虚拟专用网(VPN)扩展到无线接入环境与无线数据应用结合,是建立在移动网资源上的虚拟专用网络,由移动IP(MIP)支持终端的移动性,使远程移动用户能简单、安全、高速地访问企业内部的网络资源。文中介绍了MVPN的基本概念及基于IP安全协议(IPSec)的MVPN基本原理,讨论了端到端自愿型隧道MVPN和基于网络的强制型隧道MVPN的实现方法和原理,最后对MVPN的市场应用进行了简要分析。     

基于用户体验的Wi-Fi安全接入方案设计与实现

在数字化信息化高速发展的今天,基于良好用户体验解决最终用户快速便捷使用无线网络的需求与无线网络接入安全之间的矛盾,是一个重要的研究课题。本文以集团型企业为背景,分析了国有大中型制造企业在无线网络方面的现状及需求,寻找并制定适合集团型企业各场景的无线网络安全接入方案,对无线网络接入场景进行了详细设计,对不同接入途径的安全验证方式进行研究。同时根据不同的场景和安全级别,整合无线平台、验证平台、上网审计平台、有线网络、监控平台等,达到整体无线方案的优化,验证无线网络安全接入对于企业用户使用集团应用黏性增加的促进作用。     

Remote access virtual private network architecture for high‐speed wireless internet users

The new emerging broadband wireless network (BWN) technologies with high‐speed wireless internet access promotes corporations to provide their roaming employees with high‐speed wireless access to the computing resources on their corporate networks. Thus, a value added service to broadband wireless network is the remote access virtual private network (VPN), where the corporate legitimate users can connect to their offices wirelessly from different locations and get secure services as if they were connected to the corporate local area network (LAN). One of the most important challenges is to block out illegitimate user requests, which are wirelessly received, to protect corporate privacy. Registration (adding new users) and authentication (accepting current users) functions should be implemented with highly secured wireless connection. These functions are accomplished by encapsulating (i.e. tunneling) the user information in a secured form to the corporate authentication server through the internet traffic. The corporate authentication server then grants or denies the user access. In this paper, we propose a new operational design algorithm for remote access wireless VPN authentication and registration protocols that depends on modifying tunnel establishment as compared to existing dial‐in VPN mechanisms. The modifications proposed in this paper are made to support successful deployment of the remote access VPN services over high‐speed wireless network. The paper presents an overview of two tunneling approaches using Layer 3 and Layer 2 separately for implementing these functions. Then we propose how we establish the tunnel in both approaches, and compare it to similar operation steps previously reported for the dial‐in VPN protocols. The proposed algorithms are distinguished from previously developed dial‐in VPN protocols by using L2TP and IPSEC instead of mobile IP. It is also shown that the steps involved in the establishment of the tunnel are functionally different and more appropriate to our applications using communication environment of the BWN. Finally, a qualitative analysis of the added functions, and a comparison between L2TP‐based and IPSec‐based approaches are established. Copyright © 2004 John Wiley & Sons, Ltd.     

Traffic load metrics for multihomed mobile IP and global connectivity

Support for host mobility an essential and necessary feature for roaming users who connect to wireless networks via access points. Access points may have different capabilities, be connected to different networks and be installed by different providers. A mobile host will discover multiple access points in this environment. In such an environment, a mobile host should be able to use the best available connection to communicate with a correspondent host and perhaps use multiple connections for different hosts. In areas with wireless local area network access, pockets with limited or no coverage could exist. Such restricted connectivity could be compensated by neighbor hosts who form an ad hoc network and relay packets until they reach an access point. This paper describes and discusses a proposed solution towards enabling and supporting connectivity in wireless networks. In the proposed solution the network layer software will evaluate and decide which wireless network connections to use. A Running Variance Metric (RVM) and a Relative Network Load(RNL) are used to measure the traffic load of access points in wireless access networks. RVM and RNL can be efficiently used for both infrastructure networks and ad hoc networks. Multihomed Mobile IP (M-MIP) is an extension of Mobile IP that enables mobile hosts to use multiple care-of addresses simultaneously. The extension enhances network connectivity by enabling the mobile host, the home agent and correspondent hosts to evaluate and select the best connection. A proposed gateway architecture using M-MIP that integrates wired IP networks with ad hoc networks is described. The M-MIP and gateway architecture using the RVM and RNL metrics have been validated with simulation studies and results are presented.     

Mobility support across hybrid IP-based wireless environment: review of concepts, solutions, and related issues

The 4G or Beyond 3G wireless networks is consist of IP-based heterogeneous access networks from 3G cellular, WiFi, WiMAX to other emerging access technologies such as mesh networks. The key objective of designing the next generation wireless networks is to support of mobile subscribers. To support the mobile host in the hybrid wireless access technologies, many solutions based on network protocol stack have been proposed in the literature. In this article, after review of mobility concepts, a special attention is given to some of the mobility management methods as well as handover techniques across various wireless access networks. We have also compared the major mobility protocols in each layer for their features. Finally, some of the open issues that needed to be addressed in mobility management protocol in the next generation wireless networks are outlined.     

An End-To-End Approach for Transparent Mobility Across Heterogeneous Wireless Networks

With the advent of a myriad of wireless networking technologies, a mobile host today can potentially be equipped with multiple wireless interfaces that have access to different wireless networks. It is widely perceived that future generation wireless networks will exhibit a similar trend in supporting a large variety of heterogeneous wireless access technologies that a mobile host can choose from. In this paper, we consider such a multi-homed mobile host and propose an end-to-end solution that enables the seamless use of heterogeneous wireless access technologies. The unique features of the proposed solution include: (i) a purely end-to-end approach to handle host mobility that requires no support from the underlying network infrastructure, (ii) seamless vertical handoffs when the mobile host migrates from one access network to another, (iii) ability to support different congestion control schemes for a live connection traversing different interfaces, and (iv) effective bandwidth aggregation when the mobile host has simultaneous access to multiple networks. We present the design and details of the proposed approach, and evaluate its performance through simulations and real-life field experiments.     

MPLS VPN业务在运营商城域网中应用探讨

目前VPN技术在运营商和企业网络中应用逐渐成为主流.随着VPN技术的日益成熟,MPLS VPN在运营商城域网中的应用日益广泛.本文通过MPLS VPN技术原理的基础来阐述业务模型,并以六安移动建设的电子政务专网业务重点介绍企业组网的需求并给出使用MPLS VPN技术构建企业专网的组网方案,对MPLS VPN业务在运营商...     

iMobile EE – An Enterprise Mobile Service Platform

iMobile is an enterprise mobile service platform that allows resource-limited mobile devices to communicate with each other and to securely access corporate contents and services. The original iMobile architecture consists of devlets that provide protocol interfaces to different mobile devices and infolets that access and transcode information based on device profiles. iMobile Enterprise Edition (iMobile EE) is a redesign of the original iMobile architecture to address the security, scalability, and availability requirements of a large enterprise such as AT&T. iMobile EE incorporates gateways that interact with corporate authentication services, replicated iMobile servers with backend connections to corporate services, a reliable message queue that connects iMobile gateways and servers, and a comprehensive service profile database that governs operations of the mobile service platform. The iMobile EE architecture was also extended to provide personalized multimedia services, allowing mobile users to remotely control, record, and request video contents. iMobile EE aims to provide a scalable, secure, and modular software platform that makes enterprise services easily accessible to a growing list of mobile devices roaming among various wireless networks.     

MPLS VPN技术在电力企业广域网中的应用

为实现电力企业双网隔离的要求,从MPLS VPN原理入手,结合滁州电力系统信息网络实际情况,构建了从网络核心层、汇聚层到接入层的安全管理体系。介绍了MPLS VPN技术的基本原理。实际应用表明,MPLS VPN既可将现有网络划分成逻辑上隔离的网络,实现各个业务系统之间的隔离,又可以将企业信息外网与信息内网的灵活、高效、安全结合起来,为用户提供高质量的网络服务。     

移动接入解决方案持续监测机制研究

针对处理机密信息的终端用户设备通过移动通信网安全接入相同保密等级的政府机构内部网络或政府合作企业内部网络的问题,美国国家安全局基于商用密码产品和安全产品给出了双层加密和持续监测的移动接入整体解决方案。解决方案提出了持续监测框架、监测点位置、监测数据收集方法,以及监测点选择、告警触发条件等实施要求。对各监测点网络流量特征、安全事件数据汇集手段、系统动态安全模型的分析,可为基于移动通信网等开放网络的虚拟私有专网整体监测方案设计提供参考。     

A-MAC: Adaptive Medium Access Control for Next Generation Wireless Terminals

Next generation (NG) wireless networks are envisioned to provide high bandwidth to mobile users via bandwidth aggregation over heterogeneous wireless architectures. NG wireless networks, however, impose challenges due to their architectural heterogeneity in terms of different access schemes, resource allocation techniques as well as diverse quality of service requirements. These heterogeneities must be captured and handled dynamically as mobile terminals roam between different wireless architectures. However, to address these challenges, the existing proposals require either a significant modification in the network structure and in base stations or a completely new architecture, which lead to integration problems in terms of implementation costs, scalability and backward compatibility. Thus, the integration of the existing medium access schemes, e.g., CSMA, TDMA and CDMA, dictates an adaptive and seamless medium access control (MAC) layer that can achieve high network utilization and meet diverse quality of service (QoS) requirements. In this paper, an adaptive medium access control (A-MAC) layer is proposed to address the heterogeneities posed by the NG wireless networks. A-MAC introduces a two-layered MAC framework that accomplishes the adaptivity to both architectural heterogeneities and diverse QoS requirements. A novel virtual cube concept is introduced as a unified metric to model heterogeneous access schemes and capture their behavior. Based on the virtual cube concept, A-MAC provides architecture-independent decision and QoS based scheduling algorithms for efficient multi-network access. A-MAC performs seamless medium access to multiple networks without requiring any additional modifications in the existing network structures. It is shown via extensive simulations that A-MAC provides adaptivity to the heterogeneities in NG wireless networks and achieves high performance.