邻居发现协议在基于FPGA的IPv6 over AOS网关上的实现

针对IPv6协议接入空间通信网络的需求,重点讨论了邻居发现协议(NDP)在基于现场可编程门阵列(FPGA)的IPv6 over CCSDS-AOS网关上的实现。在IPv6 over CCSDS-AOS网关系统上搭建NDP协议模块,实现网关地址解析;通过状态机控制实现NDP协议模块功能。实验表明,该设计解决了IPv6 over CCSDS-AOS网关主动和被动地址解析以及邻居缓存表查找和管理问题,不需要网关对NDP进行协议转换和转发。目前已在IPv6 over CCSDS-AOS网关中应用。     

从IPv4向IPv6的过渡

目前,IPv6及相关协议已经相对成熟.然而,IPv4网络向IPv6网络的过渡和互通仍然是个艰巨的任务,直接影响了IPv6的发展.本文在对现有的各种互通与过渡方案进行综合分析的基础上,针对目前转换与互通中所存在的问题,提出了一种穿透NAT实现IPv6终端互连的隧道机制.该机制可以支持所有常见的NAT类型,无需特殊的IPv6地址前缀,可以向用户提供固定的IPv6地址.另外,针对IPv6网络和IPv4网络间的信息交互的不断增加,而基于通用处理器的IPv4/IPv6转换网关很难满足性能需求的现状,基于专用网络处理器平台研发了高性能的IPv4/IPv6转换网关,在IPv4与IPv6网络间实现了高性能的地址和协议转换,为IPv4网络向IPv6网络的平滑升级提供了保证.     

A new worm exploiting IPv6 and IPv4-IPv6 dual-stack networks: experiment, modeling, simulation, and defense

It is commonly believed that the IPv6 protocol can provide good protection against network worms that try to find victims through random address scanning due to its huge address space. However, we discover that there is serious vulnerability in terms of worm propagation in IPv6 and IPv4-IPv6 dual-stack networks. It is shown in this article that a new worm can collect the IPv6 addresses of all running hosts in a local subnet very quickly, leading to accelerated worm propagation. Similar to modeling the self-replicating behaviors of biological viruses, a Species-Patch model and a discrete-time simulator are developed to study how the dual-stack worm spreads in networks with various topologies. It is shown that the worm could propagate in the IPv6 and IPv4-IPv6 dual-stack networks much faster than in the current IPv4 Internet. Several effective defense strategies focusing on network deployment are proposed.     

基于IPv4/IPv6隧道过渡机制的VPN技术分析

文章通过对基于IPv4的IPsec VPN和IPv4／IPv6过渡时期网络特点的研究，提出了一种基于IPv4／IPv6隧道过渡机制的VPN网络的解决思路，并对其原理进行阐述。针对过渡时期不同类型的传统隧道网关之间不能通信的缺陷，文中提出了一种基于隧道过渡技术的多隧道VPN网关以解决异种网关间的通信问题，并对该网关的结构功能进行了分析。     

Building Traversing NAT IPv6 Tunnel Gateway System Relies on Netfilter/Iptable Framework

The transition from IPv4 to IPv6 is doomed to be a long process. The network Address translation （NAT） technology is used very popularly in IPv4 network to make up the shortage of network address. It is a desiderated problem to make the users behind NAT gateway to access to IPv6 networks. By studying the transition technology from IPv4 to IPv6 and introducing NAT technology in IPv6, a scenario is put forward through 6to4 tunnel The scenario is implemented and the gateway system＇s performance is analyzed.     

IPv4/IPv6转换网关的SNMP代理设计与实现

基于NAT-PT技术的IPv4/IPv6转换网关部署在IPv4/IPv6网络边缘,用于两网互通.对转换网关提供网络管理功能对保障两网互通有着重要意义.然而,网关所在网络业务流量的复杂性和其基于网络处理器的架构对网络管理的实现提出了挑战.本文提出了一种转换网关SNMP代理的设计方案,定义了NAT-PT MIB,实现了网络处理器环境下分布式MIB的采集并提供了对IPv4/IPv6两网内进行网络管理的支持.     

基于IPv4/IPv6协议转换技术的IDC过渡方案

由于IPv4地址的短缺,未来网络将向下一代IPv6网络过渡,并且由于IPv4与IPv6的差异,使得这两个网络之间无法互相通信。为在过渡期间,用户能够同时享受IPv4与IPv6两个网络的服务,运营商必须使用IPv4/IPv6网络过渡技术,以达到平滑过渡的目的。文章讨论在教育网中如何通过IPv4/IPv6协议转换技术使IDC机房从IPv4网络平滑过渡到IPv6网络的一个通信场景和解决方案。     

基于透传的IPv6个人区域网无线网关设计

主干网络设备和操作系统支持IPv6协议的请况下,大量的个人区域网网关仅使用IPv4地址转换的方式连接互联网,不能支持IPv6,提出一种数据链路层透传的数据包处理方式,使IPv6数据直接通过网关,减少地址转换或者中间代理的过程,实现内部网直接接入IPv6网络。经分析和实验,该设计方法在不影响IPv4使用的情况下使个人区域网内部设备顺利接入IPv6网络。     

DICOM image secure communications with Internet protocols IPv6 and IPv4.

Image-data transmission from one site to another through public network is usually characterized in term of privacy, authenticity, and integrity. In this paper, we first describe a general scenario about how image is delivered from one site to another through a wide-area network (WAN) with security features of data privacy, integrity, and authenticity. Second, we give the common implementation method of the digital imaging and communication in medicine (DICOM) image communication software library with IPv6/IPv4 for high-speed broadband Internet by using open-source software. Third, we discuss two major security-transmission methods, the IP security (IPSec) and the secure-socket layer (SSL) or transport-layer security (TLS), being used currently in medical-image-data communication with privacy support. Fourth, we describe a test schema of multiple-modality DICOM-image communications through TCP/IPv4 and TCP/IPv6 with different security methods, different security algorithms, and operating systems, and evaluate the test results. We found that there are tradeoff factors between choosing the IPsec and the SSL/TLS-based security implementation of IPv6/IPv4 protocols. If the WAN networks only use IPv6 such as in high-speed broadband Internet, the choice is IPsec-based security. If the networks are IPv4 or the combination of IPv6 and IPv4, it is better to use SSL/TLS security. The Linux platform has more security algorithms implemented than the Windows (XP) platform, and can achieve better performance in most experiments of IPv6 and IPv4-based DICOM-image communications. In teleradiology or enterprise-PACS applications, the Linux operating system may be the better choice as peer security gateways for both the IPsec and the SSL/TLS-based secure DICOM communications cross public networks.     

Layer 3 VPN Services over IPv6 Backbone Networks: Requirements, Technology, and Standardization Efforts

Layer 3 virtual private networks (L3VFN) enable organizations to connect geographically dispersed sites to one another across the packet switched network of a service provider. The most popular form of L3VPN is based on BGP/MPLS (border gateway protocol/multiprotocol label switching) technology in which the service provider offers a network-based IP VPN routing and forwarding service to its customers across its own IPv4-based MPLS backbone network. With the deployment of IPv6-based backbone networks underway, there is an emerging requirement to support these same L3VPN services across a native IPv6 backbone network. This introduces a requirement to provide routing and tunneling of IPv6 VPN (and IPv4 VPN) packets across an IPv6 backbone network. Softwires is an Internet Engineering Task Force (IETF) Working Group chartered to address the requirement of providing a generalized, network-based, multi-address family, IP routing and tunneling capability across native IP backbone networks pursuant to IPv6 transitions. Elements of the softwires work can form the basis of an L3VPN over IPv6 solution. After providing a brief overview of how L3VPN works in various topologies, this article presents the requirements for L3VPN services over an IPv6 backbone network and discusses a possible solution set that builds over the softwire technology and related IETF standards. Finally, we outline future directions and how the softwire technology can support new services and improved scalability     

一种站点级IPv6地址分配方案

IPv4地址分配的缺陷导致当今IPv4网络潜在的低效和浪费问题。为了不重蹈IPv4地址分配不合理的覆辙，在部署IPv6的开始就以谨慎而有效地方法进行地址分配是非常重要的。相关组织对这个问题也提出了若干建议和标准，本文根据最新的RFC文档关于IPv6地址体系结构及分配策略的建议提出了一种可扩展的IPv6全球单播地址分配方案。该方案在RFC3177建议基础上对／48地址前缀的站点级地址块进行分配，该方案不仅具有灵活的可扩展性，而且支持对不同类型的业务实施不同的策略，为全面实现IPv6奠定了基础。     

IPv4/IPv6综合组网关键技术研究

对新一代互联网协议IPv6在地址空间、移动性、安全性以及服务质量等方面的技术特点进行了综合分析。深入探讨了IPv4/IPv6综合组网主要运用的双协议栈、隧道和翻译等几种关键技术,并从使用场合、兼容性和实现的方便性等方面对这些技术进行了分析比较,提出了过渡时期IPv4/IPv6综合组网的策略建议。对当前IPv4向IPv6演进的研究与实践具有较好的参考价值。     

一种新的IPv6 DNS自动更新系统

本文阐述了一种新型的基于客户机/服务器模型的IPv6 DNS自动更新系统.首先分析了IPv6 DNS自动更新技术目前的进展及存在的问题,然后,针对这些问题提出了一种支持多个IPv4/v6地址、支持安全动态更新、支持地址自动检测和地址过滤、基于客户机/服务器模型的IPv6 DNS自动更新系统.此系统支持多种主流操作平台,并为用户的使用和网络的整体部署提供了极大的灵活性.最后对其以后的应用进行了展望.     

一种面向Portal认证的IPv6可信地址分配机制

随着网络规模的增长,对网络进行精细化管控变得尤为重要。在下一代互联网中将用户可信身份嵌入 IPv6 地址后缀形成可信地址,能够进一步提高网络行为的可追溯性。目前已有研究基于 Portal 认证配合DHCPv6将用户的身份信息嵌入用户终端的IPv6地址中,但是为了分配可信地址而改动的DHCPv6过程造成了机制对用户终端不透明,无法大规模部署。提出了一种面向Portal认证的IPv6可信地址分配机制,通过服务器信令交互配合软件定义网络（SDN）技术实现IPv6可信地址的间接分配,而且与地址分配方式无关。最后,实现了一个原型系统并在江苏南京电信现网机房评估了其可行性和性能,结果表明此机制在对终端透明的情况下仅带来很少的额外开销。     

IPv6网络环境下的蠕虫传播模型研究

研究了IPv6网络中,蠕虫在子网间和子网内传播的多种扫描策略;讨论了基于P2P的去重复和可控机制;研究了一种能够在IPv6网络中形成大规模传播的新型混合式蠕虫——NHIW。NHIW具有随机扫描蠕虫的特点,同时能够迅速获取子网内的易感染活跃主机IPv6地址,并能解决重复感染的问题。通过研究NHIW不同传播阶段的时延,理论分析其传播率,建立了NHIW的3层传播模型TLWPM。实验表明,NHIW能够在IPv6网络中形成大规模传播。最后,针对NHIW的特点,讨论了相关防御策略。     

IPv6网络域名系统综述

随着IPv4地址的枯竭,IPv6技术以其充足的地址空间,良好的网络层次划分等技术优势,成为了下一代互联网的核心。作为联系其互联网内两大基础性资源——域名及IP地址的纽带,域名系统在互联网由IPv4向IPv6网络演进的过程中,将继续发挥其重要作用。本文对于域名系统为适应IPv6网络所做出的改变进行了详细的总结与分析．并针对IPv4向IPv6过渡阶段域名系统所面临的问题,提出域名系统的过渡解决方案。     

4over6:基于非显式隧道的IPv4 跨越IPv6互联机制

IPv6骨干网正在逐步建成并走向实用,纯IPv6的骨干网(如中国下一代互联网:CNGI)已经出现,而已有的大量互联网应用和服务仍存在于IPv4网络中,因此出现了大规模复杂IPv4网络通过IPv6骨干网互联的需求,然而目前没有满足这种需求的过渡机制.本文提出了一种基于IPv6的IPv4网络互联过渡机制框架,对4over6过渡机制框架进行了阐述和分析,并通过原型系统实现,对4over6机制框架进行了原理和功能验证测试.为减小路由开销,提出了ISP独立部署方案,增强了4over6机制框架的可实施性.4over6过渡机制框架具备对网络和端系统透明性、轻型和可自适应动态选路特性,网络管理维护负担小,可适应于大规模、复杂的网络互联等优点.     

IPv6网络体系结构与网络改造分析

IPv6与IPv4相比,在地址资源获得方面有了一定补充,在应用IPv6网络体系结构后,既能够有效增加网络地址数量,也有利于各种设备顺利连接互联网。对IPv6进行概述,提出了IPv6网络体系结构与网络改造方案。     

Research on IPv6 address configuration for wireless sensor networks

The paper proposes an IPv6 address configuration scheme for wireless sensor networks. In the scheme, one wireless sensor network is divided into multiple clusters and the scheme creates the IPv6 address formats for the cluster heads and the cluster members respectively. Based on the proposed IPv6 address format, the scheme proposes to adopt the division method of the hash function to allocate the IPv6 addresses for the cluster heads and cluster members and to utilize linear probing to deal with assigned address collision. From the perspectives of duplicate address detection cost, address configuration cost and address configuration delay time, the paper analyzes and compares the performances of Strong DAD, MANETConf and the proposed scheme. Analytical results demonstrate the effectiveness and efficiency of the proposed scheme. Copyright © 2010 John Wiley & Sons, Ltd.