摘要
IPSec安全策略配置是一项复杂和易出错的工作。为解决这问题,提出了通过有序两元判定图表(OBDD)提供全面的IPSec安全策略冲突识别和分类的通用架构模型,并基于该架构模型,开发了一组在通用IPSec策略配置过程中发现策略内部的冲突问题的技术。实验测试证明了该架构模型和技术在发现和解决策略冲突问题的有效性。
IPSec policy configuration remains a complex and error-prone task. A generic model that captures various filtering policy semantics using Boolean expressions is presented. This model is used to derive a canonical representation for IPSec policies using ordered binary decision diagrams. Based on this representation, a comprehensive framework is developed to classify and identify conflicts that could exist in a single IPSec device （intra-policy conflicts） in enterprise networks. The testing and evaluation study on different network environments demonstrates the effectiveness and efficiency of the approach.
出处
《计算机工程》
CAS
CSCD
北大核心
2007年第12期185-187,共3页
Computer Engineering
基金
浙江省自然科学基金资助项目(Y109456)
