摘要： 提出了网络隧道代理机制，对主要隧道协议进行代理，并对隧道生命周期的全过程管理设计了两种隧道代理模型，即传统型隧道的隧道代理模型和扩展型隧道的隧道代理模型，分析了它们的工作过程。设计了隧道代理系统结构图，并对各组成部分，即访问策略库、访问控制服务器、系统日志、隧道信息数据库、隧道代理服务器的功能进行了划分。与隧道技术、代理技术相比，隧道代理机制有更好的安全性。

关键词: 隧道, 代理, 隧道代理机制, 隧道代理模型, 隧道代理系统

Abstract: This paper presents tunnel proxy mechanism that acts as a proxy for main tunnel protocols and monitors tunnels in the whole course of tunnel lifecycle. Two tunnel proxy models are proposed. The first one is the traditional tunnel proxy model and the second one expands the first one. A framework of tunnel proxy system is presented and several components in this system are defined, such as access policy database, access control server, system log, tunnel information database and tunnel proxy server. In comparison with tunnel technology and proxy technology, tunnel proxy mechanism provides more security.

Key words: Tunnel, Proxy, Tunnel proxy mechanism, Tunnel proxy model, Tunnel proxy system