SDIG: Toward Software-Defined IPsec Gateway

2016 IEEE 24th International Conference on Network Protocols (ICNP) Pub Date : 2016-11-01 DOI:10.1109/ICNP.2016.7785316

Wei Li, Fengxu Lin, Guanchao Sun

{"title":"SDIG: Toward Software-Defined IPsec Gateway","authors":"Wei Li, Fengxu Lin, Guanchao Sun","doi":"10.1109/ICNP.2016.7785316","DOIUrl":null,"url":null,"abstract":"The current IPsec gateway integrates many functions of IPsec operation, tunnel management and forwarding decision, which makes the IPsec gateway complicated in maintenance and deployment. The problem of maintaining such devices prevents IPsec VPN from applying widely. The emergence of SDN provides an innovative way to decouple the control plane and data plane. In this paper, a Software-Defined IPsec Gateway (SDIG) is proposed to achieve net2net IPsec VPN. Different from the traditional IPsec gateway, the SDIG device serves as a data plane equipment that just concentrates on exchanging IKE packets and encrypting/decrypting IP packets. A global view of SDIG devices can be constructed in the SDN controller by collecting the status of all devices. Therefore the controller can manage and configure SDIG devices centrally, and simplify deployment complexity. Outbound IP packets for the SDIG device can be viewed as a trigger to control the establishment of IPsec tunnels. The SDIG device and the controller exchange information through a customized southbound protocol. The prototype system of SDIG is implemented, and the preliminary experimental results show that the method is feasible and effective.","PeriodicalId":115376,"journal":{"name":"2016 IEEE 24th International Conference on Network Protocols (ICNP)","volume":"41 1","pages":"0"},"PeriodicalIF":0.0000,"publicationDate":"2016-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"11","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"2016 IEEE 24th International Conference on Network Protocols (ICNP)","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.1109/ICNP.2016.7785316","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}

引用次数: 11

Abstract

The current IPsec gateway integrates many functions of IPsec operation, tunnel management and forwarding decision, which makes the IPsec gateway complicated in maintenance and deployment. The problem of maintaining such devices prevents IPsec VPN from applying widely. The emergence of SDN provides an innovative way to decouple the control plane and data plane. In this paper, a Software-Defined IPsec Gateway (SDIG) is proposed to achieve net2net IPsec VPN. Different from the traditional IPsec gateway, the SDIG device serves as a data plane equipment that just concentrates on exchanging IKE packets and encrypting/decrypting IP packets. A global view of SDIG devices can be constructed in the SDN controller by collecting the status of all devices. Therefore the controller can manage and configure SDIG devices centrally, and simplify deployment complexity. Outbound IP packets for the SDIG device can be viewed as a trigger to control the establishment of IPsec tunnels. The SDIG device and the controller exchange information through a customized southbound protocol. The prototype system of SDIG is implemented, and the preliminary experimental results show that the method is feasible and effective.

查看原文本刊更多论文

SDIG:向软件定义IPsec网关

目前的IPsec网关集成了IPsec操作、隧道管理和转发决策等多种功能，使得IPsec网关的维护和部署非常复杂。这些设备的维护问题阻碍了IPsec VPN的广泛应用。SDN的出现提供了一种创新的方式来解耦控制平面和数据平面。本文提出了一种软件定义IPsec网关(SDIG)来实现net2net IPsec VPN。与传统的IPsec网关不同，SDIG设备作为数据平面设备，只专注于交换IKE报文和对IP报文进行加解密。通过收集所有设备的状态，可以在SDN控制器中构建SDIG设备的全局视图。因此，控制器可以集中管理和配置SDIG设备，降低部署复杂度。SDIG设备出方向的IP报文可以看作是控制IPsec隧道建立的触发器。SDIG设备和控制器通过自定义的南向协议交换信息。实现了SDIG的原型系统，初步实验结果表明了该方法的可行性和有效性。

本文章由计算机程序翻译，如有差异，请以英文原文为准。

求助全文

约1分钟内获得全文求助全文

来源期刊

2016 IEEE 24th International Conference on Network Protocols (ICNP)

自引率

0.00%

发文量