普适的宽带路由器IPSec改造方案

网络安全性问题的日益突出迫切要求对现有普通宽带路由器进行支持IPSec的改造。以往的基于加密卡串接网络处理单元的改造方法导致资源利用率低、工程实现难度大及普适性差。文章提出了一种新的改造方案,能够利用宽带路由器的快通道实现加密数据包的高速传输,利用慢通道维护IPSec协议的运行及相关安全信息的下发,以一种母板结构普适地实现了对宽带路由器的高效IPSec改造。

Adaptive Renewal Scheme for Broadband Routers to Add the Function of IPSec

The general consensus of the importance regarding Internet security leads to the development of IPSec for broadband routers, so as to secure communications across the Internet. The existing method for broadband routers to add the function of IPSec usually brings the defects such as inefficient usage of resources, complicated hardware implementation and poor universality for the encryption card serially connecting to the parts of network processor in routers. By using the fast path of routers to forward encrypted packets at line speed, the slow path to maintain the operation of IPSec and dispatch the corresponding secure information, our new scheme which is implemented based on a mother board can offer better efficiency and universality.