MLCC: A Multi Layered Correlative Control Mechanism for the VPN Topology

摘要

The security model is the key component in the security of network topology research. Especially in the Virtual Private Network (VPN) topology, with the emergence of the tunneling, private routing and cipher technology in VPN, there are two embarrassments for the protection of the entire VPN topology. One is that internal services will be uncovered in the Internet by the tunneling, which can be compromised by attacking the client-side endpoint of a VPN tunnel. The other is that firewall and Intrusion Detection System (IDS) could not completely analyze the network packet content because of the private routing and cipher technology. Based on the analysis of the VPN topology, we put forward the Multi-Layered Correlative Control (MLCC) mechanism. MLCC is a multi-layered security protection mechanism based on VPN gateway incorporating client end-point, firewall, IDS and internal services. There are three types of correlative technology introduced in MLCC, which are endpoint extending, component correlation and service engine. By their combination, MLCC can turn the VPN protection into a correlative and full model and improve the security of the VPN topology. Finally, the performance analysis based on our prototype is presented.