摘要： 在分析Unix的流机制(Streams)的基础上,详细论述了Unix系统下IPSec内核模块的实现方法:以流模块的方式实现IPSec内核,并且利用流机制的PUSH操作将其配置在TCP/IP协议栈中。最后,给出了提高IPSec内核模块处理性能的几种方法,包括修改MTU值以避免IP包分片、调节流核心资源和采用硬件芯片加密等。
关键词:
流机制,
内核,
流模块,
IPSec协议
Abstract: Based on the principles and techniques of Unix streams mechanism, the implementation method of IPSec kernel module in Unix is discussed in detail: IPSec kernel module is implemented as a stream module and it is located into TCP/IP stack by PUSH operation. Furthermore, some suggestions of improving the processing performance of IPSec module are presented: modifying MTU value to avoid IP fragmentation, tuning the streams kernel resources and adopting crypto-chips for cryptographic operations.
中图分类号:
孔凡玉,于佳,李大兴. 基于Unix流机制的IPSec内核实现与改进[J]. , 2005, 31(03): 52-54.
KONG Fanyu,YU Jia, LI Daxing. Implementation and Improvement of IPSec Kernel Based on Unix Streams Mechanism[J]. , 2005, 31(03): 52-54.