VPN中的分布式访问控制

针对VPN系统中的分布式访问控制及其管理问题，分析了现有的IETF模型的不足，提出一种分布式管理的访问控制模型。该模型将全局策略分解为局部(SubDomain，每个SubDomain对应一个网关)策略数据库的集合，同时在IETF的模型中增加策略判决点，以转发用户认证请求。并通过VPN的加密隧道来保护VPN系统安全策略传输过程和用户认证数据的完整性、机密性。本文最后给出了基于CORBA的原型来说明该模型的工作模式，实战证明，该模型能有效解决安全VPN中的策略的分布式管理和用户的漫游问题。

Model of Distributed Access Control on VPN System

Distributed Access Control (DAC) was a big problem in Virtual Private Network(VPN).The existing DAC models of IETF are centralized management and cannot authenticate roaming user easily. This paper presents a model that divides the centralized security policy database into the set of distributed sub domains (asub domain equals a SG) security policy databases, and adds policy forward point to IETF model,and makes use of the encrypted VPN tunnel to protect the integrity and confidentiality of the policy database transportation and users' authentication request.In VPN, every Secure Gateway (SG) has a unique sub domain name, and a pair (sub domain, user ID) represents the unique user identification (ID). A sub domain SG is responsible for the sub domain users' authentication request by the sub domain security policy database.When a user leaves his home sub domain to roam about other sub domain, the sub domain SG sends the user authentication request to the user's home sub domain SG and gets the result to authenticate roaming user.Finally, this paper implements the model based on OBE (an Embedded CORBA) and tests the performance by SmartBits 6000(it can authenticate the request of 1800 roaming users simultaneously). The results show that the model can securely solve the problem of the distributed management of security policy and authentication of roaming users in VPN.