摘要
无线网络飞速发展人们在充分享受各种无线接入网络便利的同时，各种安全问题也逐渐暴露出来。由于IPSec能够提供较好的安全保护，能够有效解决上述问题，应用范围不断扩大。在传统的TCP协议中，假设丢包都是由网络拥塞造成的，这不适用于错误丢包比拥塞丢包更容易发生的无线链路。此时，启用拥塞控制机制，将导致TCP端到端的性能降低。而且现有的很多改进方案无法用于加密通信中因为IPSec与TCP在无线网络中的改进方案之间存在冲突。在无线通信网络中，要保证通信的安全性和TCP协议的性能，就必须解决他们之间的冲突。而在在VPN系统的大规模应用中，由于其部署环境复杂也面临不同软件在NDIS内核框架中的冲突和内核模块开发移植维护困难等问题。
在对目前流行的基于Windows平台的VPN系统体系结构及其实现技术进行深入分析的基础上，针对嵌入式终端的特点，提出了一种新的基于虚拟网卡的技术详细阐述了其原理和优点。然后给出了在WinCEVPN系统中实现该技术的体系结构能够从根本上解决上述问题。
根据应用存在的性能问题对现有的各种无线网络下TCP性能改进机制与IPSecVPN的兼容性进行了详细的分析比较各种可能方案之间的优点与缺点。在分析现有改进算法的基础上，提出了一种适用于有线/无线混合网络IPSec兼容的端到端的优化机制。通过接收端数据包到达时间间隔的变化累积来判断无线链路的状况，用ACK标记ELN通知发送端，避免不必要的拥塞控制而导致性能下降。通过NS2仿真实验并与TCPReno进行了性能对比。结果表明，该机制能有效提高TCP在无线移动场景下的网络传输性能同时和现有的安全机制也相兼容。
关键词：TCP；VPN体系结构;虚拟网卡;有线无线混合网络；性能评价；拥塞控制；端到端
Abstract
Whilewirelessaccesstechnologyhasexperiencedarapidgrowthinrecentlyyears.Thepeoplewhilefullyareenjoyingeachkindwirelessanumberofsecurityconcernshavebeenraisedforwirelessnetworksingeneral.TCPisoriginallydesignedonlyforwirednetworkandassumesthatanylossisduetocongestion.Howeveritisdifferentinwirelesssituationinthatwirelesserrorsaremorelikelytooccurthancongestion.Suchnon-congestionpacketlosswhendealtwithinvokingacongestioncontrolalgorithmresultingindegradeend-to-endperformance.Atthesametimemanyexistapproachcannotworkwhentheencryptionisusedinthecommunication.SothesecuritymechanismandTCPimprovingmechanismcompatibilityalsoistakenintoconsideringofourworks.Butinthelarge-scaleapplicationofVPNsystembecausethedeploymentenvironmentiscomplexfrequentlycanfacethedifferentsoftwareinNDISkernelframeconflictsimultaneouslythekernelmoduledevelopmentthetransplantmaintainsquestionandsoondifficulty.
ThispaperdeeplyanalysesthepopulararchitectureandimplementtechnologybasedonWindowsVPNsystemstructuresimultaneouslyaimsatembedterminalcharacteristicproposedonekindnewbasedonvirtualNetworkcardtechnologyindetailelaborateditsprincipleandthemerit.TheproducedsystemhasrealizedthistechnicalsystemstructureinWinCEVPNcouldfundamentallysolvetheaboveproblem.
AimingattheperformanceproblemofVPNapplythispaperproposedanewend-to-endTCPperformanceimprovingmechanismbyusingtheintervalmovementcumulatedofthepacketsreceivedtimeonreceiverwhichcanestimatethewirelesslinkcondition.ThenitmarkstheELN（Explicitlossnotification）bittonotifythesenderandTCPcouldbemodifiedsoastorefrainfromgoingintocongestionavoidance.ComparingtheTCPRenoandthemodifiedTCPbysimulationsusingNS2，theresultsshowitachievesangreatimprovementovermobilewirelessnetworksandcanworktogetherwithcurrentsecuritymechanism.
Keywords：TCP;VirtualNetWorkCard;Wired-cum-WirelessNetworks;PerformanceEvaluation;CongestionControlend-to-end;IPSec;VPNArchitecture
目录
学校代码10487密级I
摘要I
ABSTRACTII
目录IV
1绪论1
1.1研究背景1
1.2国内外研究现状3
1.3主要研究内容6
2无线网络VPN解决方案8
2.1无线网络TCP与VPN协议8
2.2无线TCP性能改进模型15
2.3TCP改进方案性能分析与IPSEC兼容性解决方案22
2.4本章小结24
3基于虚拟网卡的VPN体系结构25
3.1基于WINDOWSVPN系统设计25
3.2新的VPN体系结构图28
3.3虚拟网卡启动流程32
3.4报文处理过程的分析33
3.5本章小结34
4新的无线TCP性能改进方案36
4.1NS2仿真工具的介绍36
4.2MODIFIED-TCP的定义37
4.3MODIFIED-TCP的设计思想38
4.4时间变化累计的计算42
4.5MODIFIED-TCP改进的实现43
4.6本章小结45
5VPN系统结构分析和性能评价47
5.1与传统VPN体系结构的比较47
5.2TCP改进模型性能的评估标准47
5.3MODIFIED-TCP参数分析48
5.4MODIFIED-TCP性能分析49
5.5本章小结52
6总结与展望54
6.1总结54
6.2展望55
致谢56
附录1攻读学位期间发表论文目录60
参考文献
[1].MajstorF.WLANsecuritythreatssolutions[C].inLCN'03.2003.
[2].ParkJ.S.DicoiD.WLANsecurity:currentandfuture[J].InternetComputing2003.7(5):p.60-65.
[3].LiangC.Z.H.F.H.AnewauthenticationandkeyexchangeprotocolinWLAN[C].inITCC2005.2005.
[4].RFC2401SecurityArchitectureoftheInternetProtocol[S]IETF*IETF1998.
[5].京京工作室IPSEC:新一代因特网安全标准.1999北京:机械工业出版社.
[6].AlshamsiA.SaitoT.AtechnicalcomparisonofIPSecandSSL[C].inAINA2005.2005.
[7].林闯单志广任丰原计算机网络的服务质量(QoS).2004北京:清华大学出版社.4-9.
[8].HB.S.SandK.R.HImprovingReliableTransportandHandoffPerformanceinCellularWirelessNetworks[J].1995.1(4):p.469-481.
[9].Hui-minL.Y.Y.M.Z.ImproveTCPperformanceoverwirelesslink[C].inPIMRC2003.2003.
[10].RFC1631TheIPNetworkAddressTranslator(NAT)IETF*IETF1994.
[11].RFC2709SecurityModelwithTunnel-modeIPsecforNATDomains[S]IETF*IETF1999.
[12].RFC2341CiscolayerTwoForwarding(Protocol)"L2F"inIETF1998.
[13].RFC2661layerTwoTunnelingProtocol"L2TP"inIETF1999.
[14].RFC2153ThePoint-to-PointProtocol(PPP)IETF*IETF1994.
[15].RFC2865RemoteAuthenticationDialInUserService(RADIUS)IETF*IETF2000.
[16].RFC1701GenericRoutingEncapsulation(GRE)IETF*IETF1994.
[17].BakreA.BadrinathB.R.I-TCP:indirectTCPformobilehosts[C].inDistributedComputingSystems1995.Proceedingsofthe15thInternationalConference.1995.
[18].BakreA.V.BadrinathB.R.ImplementationandperformanceevaluationofIndirectTCP[J].Computers1997.3(46):p.260-278.
[19].I.RheeN.BalaguruSSeshanA.G.N.R.MTCP:ScalableTCP-likecongestcontrolforreliablemulticast[C].inINFOCOM.1999.
[20].T.GoffJ.MoroniskD.S.PhatakA.V.G.Freeze-TCP:Atrueend-to-endTCPenhancementmechanismformobileenvironments[C].inINFOCOM.2000.
[21].林华生，程时端移动自组织网络中TCP性能优化的研究.计算机工程与应用2004.12(12).
[22].符刚.移动VPN解决方案.in无线及移动通信委员会学术年会论文集.2004.
[23].G.DeBlasM.PatronoL.MarraP.TomasicchioG.AnIPSec-awareTCPPEPforintegratedmobilesatellitenetworksCiccarese[C].inPersonalIndoorandMobileRadioCommunications2004.2004.Italy:IEEEInternationalSymposiumonPublication.
[24].尤晋元史美林陈向群Windows操作系统原理.2001北京:机械工业出版社.
[25].陈向群王雷马洪兵等编著WindowsCE.NET系统分析及实验教程.2003北京:机械工业出版社.
[26].DingWJ.A.AANewExplicitLossNotificationandAcknowledgementforWirelessTCP[C].inPIMRC2001.2001.SanDiegoCA.
[27].StevensW.R.TCP/IP详解卷1.Vol.1.2004北京:机械工业出版社.
[28].RFC2409TheInternetKeyExchange(IKE)[S]IETF*IETF1998.
[29].RFC2402IPAuthenticationHeader[S]IETF*IETF1998.
[30].RFC2406IPEncapsulationSecurityPayload(ESP)[S]IETF*IETF1998.
[31].KuroseJ.F.andK.W.Boss计算机网络自顶向下方法与Internet特色.2005北京:机械工业出版社.335-338341-355.
[32].RFC2883AnExtensiontotheSelectiveAcknowledgement(SACK)OptionforTCPIETF*IETF2000.
[33].OhzahataS.KimuraS.EbiharaY.KawashimaK.AqueuemanagementmethodforimprovingTCPperformanceinwirelessenvironments[C].inWCNC'2004.2004.
[34].OmotayoA.WilliamsonC.Multi-layeranalysisofWebbrowsingperformanceforwirelessPDAs[J].LocalComputerNetworks2004:p.660-667.
[35].MinX.W.Z.L.J.S.Y.Bit-erroridentificationforTCPperformanceimprovement[C].EmergingTechnologies:FrontiersofMobileandWirelessCommunication2004.2(2):p.561-566.
[36].ShagdarO.ShiraziM.N.B.Z.ImprovingECN-basedTCPperformanceoverwirelessnetworksusingahomogeneousimplementationofEWLN[C].inICT2003.2003.KyotoJapan.
[37].邓晓衡陈志刚张连明TCPYuelu:一种基于有线/无线混合网络端到端的拥塞控制机制.计算机学报2005(8):p.1342-1350.
[38].M.GerlaM.Y.SanadidiR.W.TCPWestwood:BandwidthEstimationforEnhancedTransportoverWirelesslinks.UCLAComputerScience2001.
[39].江小丹李宏李晃等显式丢失通告算法的实现及其性能分析.计算机工程2003.29(18).
[40].ChintaM.HelalA.LeeC.ILC-TCP:aninterlayercollaborationprotocolforTCPperformanceimprovementinmobileandwirelessenvironments[C].inWCNC2003.2003.
[41].ZorziM.Ontheanalyticalcomputationoftheinterferencestatisticswithapplicationstotheperformanceevaluationofmobileradiosystems[C].inCommunicationsIEEETransactions.1997.
[42].VacircaF.DeVendictisA.BaiocchiA.OptimalDesignofHybridFEC/ARQSchemesforTCPoverWirelesslinkswithRayleighFading[J].MobileComputing2006.5(4):p.289-302.
[43].VacircaF.DeVendictisA.TodiniA.BaiocchiA.OntheeffectsofARQmechanismsonTCPperformanceinwirelessenvironments[C].inGLOBECOM'03.2003.
[44].HaasZ.J.AgrawalP.Mobile-TCP:anasymmetrictransportprotocoldesignformobilesystems[C].inICC97.1997.
[45].ChanM.C.RamjeeR.ImprovingTCP/IPperformanceoverthirdgenerationwirelessnetworks[C].inINFOCOM2004.2004.
[46].RatnamK.MattaI.WTCP:anefficientmechanismforimprovingTCPperformanceoverwirelesslinks[C].inISCC'98.1998.
[47].YizhouLiJacobL.Proactive-WTCP:anend-to-endmechanismtoimproveTCPperformanceoverwirelesslinks[C].inLCN'03.2003.
[48].RFC2246TransportlayerSecurityVersion1.0[S]inIETF1999.
[49].SB.Transport-friendlyESP(orlayerViolationsforFunandProfit)[C]NetworkDistributedSystemSecuritySymp.inNDSS′99.1999.SanDiegoCA.
[50].NashA.公钥基础设施（PKI）—实现和管理电子安全.2002北京:清华大学出版社.
[51].武安河Windows2000/XPWDM设备驱动程序开发.第二版ed.Vol.3-9.2005北京:电子工业出版社.
[52].RichterJ.Windows核心编程.2000北京:机械工业出版社.190-226397-410.
[53].徐雷鸣庞博赵耀NS与网络模拟.2003北京:人民邮电出版社.3-9.
[54].李之棠刘刚肖凌一种与IPSec兼容的基于有线无线混合网络的TCP性能优化机制.小型微型计算机系统2007.
[55].RFC3561AdhocOn-DemandDistanceVector(AODV)RoutinginIETF2003.
[56].WennstromA.BrunstromA.RendonJ.ImpactofGPRSbufferingonTCPperformance[J].ElectronicsLetters2004.40(20):p.1279-1281.
[57].J.PadhyeV.FiroiuD.TowsleyJ.K.ModelingTCPThroughput:ASimpleModelanditsEmpiricalValidation.inACMSIGCOMM'98.1998.