关键词: 网络安全, IPSec, 安全策略, 形式化模型

Abstract: IPSec has become the defacto standard protocol for secure Internet communications。Although IPSec supports a rich set of protection modes and operations, its policy configuration remains a complex and error-prone task. In this paper, we present a generic model that captures various filtering policy semantics using Boolean expressions. We use this model to derive a canonical representation for IPSec policies using Ordered Binary Decision Diagrams. Based on this representation, we develop a comprehensive framework to classify and identify conflicts that could exist in a single IPSec device (intra-policy conflicts) in enterprise networks. Our testing and evaluation study on different network environments demonstrates the effectiveness and efficiency of our approach.

Key words: Network Security, IPSec, Security Policy, Formal model