远东控股集团--SSL VPN 设计.doc

《远东控股集团--SSL VPN 设计.doc》由会员上传分享，免费在线阅读，更多相关内容在学术论文-天天文库。

1、作者远东控股集团信息中心马建明时间2012年4月21日目录1引言41.1目的和范围41.2预期读者41.3文档约定52术语、定义和缩略语53设计依据54系统概述55构架说明66设计原理76.1系统构架的考虑76.2动态特性的考虑86.3关键技术的考虑86.4复用性的考虑96.5扩展性的考虑96.6安全性的考虑97接口设计9引言目的和范围预期读者表1预期读者读者分类目的软件工程师文档约定无术语、定义和缩略语表2本文使用的专用缩略语缩略语原文中文含义设计依据《SSLVPN需求说明书》《FrameworkforIPBasedVirtualPrivateNetwo

2、rks,RFC2764》系统概述ThisimplementationonlysupportsEthernet,soonlytheEthernetprotocolisdiscussed.Figure4.1OverviewofNetworkStructure构架说明BeforegoingintomoredetailofhowthisSSLVPNsworks,itisnecessarytotakealookatthenetworklayout. Figure2.1showsthenetworklayoutthatthisimplementationuses.So

3、metermsaredefinedherewhichtherestofthepaperreferstooften. Sothereadershouldunderstandtheirdefinitions.1.TheInternetThisimplementationassumesclientsneedtousetheInternettoaccesstheprivatenetwork. Thenetworktrafficbetweenclientsandtheprivatenetworkneedstobeencryptedtoavoidbeingeavesd

4、ropped. Howtheclientsreachtheserversreallydependsonthesetupofthenetwork. Aslongastheclientscantalktotheserver,itisfine. TheInternetisonlyusedasageneralapproachhere.2.PrivateNetworkAprivatenetworkisanisolatednetworkofacompanyororganization. Privatehostsarelocatedwithintheprivatenet

5、work.3.PrivateHostPrivatehostsarelocatedinsideoftheprivatenetworkandhavetheirownprivatenetworkIPaddressesthatarereservedfortheprivatenetwork,suchas192.168.x.x.PrivatehostsmayormaynothaveInternetaccess. Onlyhostsinsideoftheprivatenetworkareabletoaccessthem.4.ServerServershaveaccess

6、totheprivatehostsandtheInternet. Theserversarethegatewaysbetweenclientsandprivatehosts. EachserverneedstohavethreeIPaddresses:anInternetIPaddresstoconnecttoInternet,aprivatenetworkIPaddresstoconnecttotheprivatenetworkandaspoofedIPaddressforNATwhichisusedintheprivatenetwork. WhenEt

7、hernetframesreachaserverfromtheclients,theserverdoesNATtopretenditistheservertriestotalktotheprivatehosts. Privatehostsneverknowoftheexistenceofclients. TherearemoredetailsabouthowtheNATworksinspecificationofserverSection4.3. Eachserverhasadaemontohandlethetrafficbetweenclientsand

8、privatehosts.5.ClientsClientsarel