虚拟专用网毕业论文外文翻译.docx

虚拟专用网毕业论文外文翻译.docx

《虚拟专用网毕业论文外文翻译.docx》由会员分享，可在线阅读，更多相关《虚拟专用网毕业论文外文翻译.docx（6页珍藏版）》请在冰豆网上搜索。

虚拟专用网毕业论文外文翻译

附录：

英文技术资料翻译

英文原文：

Solutions,suchasthevariousencryptionmethodsandPKI,enablebusinessestosecurelyextendtheirnetworksthroughtheInternet.OnewayinwhichbusinessesaccomplishthisextensionisthroughVirtualPrivateNetworks（VPNs）.

AVPNisaprivatenetworkthatiscreatedviatunnelingoverapublicnetwork,usuallytheInternet.Insteadofusingadedicatedphysicalconnection,aVPNusesvirtualconnectionsroutedthroughtheInternetfromtheorganizationtotheremotesite.ThefirstVPNswerestrictlyIPtunnelsthatdidnotincludeauthenticationorencryptionofthedata.Forexample,GenericRoutingEncapsulation（GRE）isatunnelingprotocoldevelopedbyCiscothatcanencapsulateawidevarietyofNetworkLayerprotocolpackettypesinsideIPtunnels.Thiscreatesavirtualpoint-to-pointlinktoCiscoroutersatremotepointsoveranIPinternetwork.OtherexamplesofVPNsthatdonotautomaticallyincludesecuritymeasuresareFrameRelay,ATMPVCs,andMultIProtocolLabelSwitching（MPLS）networks.

AVPNisacommunicationsenvironmentinwhichaccessisstrictlycontrolledtopermitpeerconnectionswithinadefinedcommunityofinterest.ConfidentialityisachievedbyencryptingthetrafficwithintheVPN.Today,asecureimplementationofVPNwithencryptioniswhatisgenerallyequatedwiththeconceptofvirtualprivatenetworking.

VPNshavemanybenefits:

●Costsavings-VPNsenableorganizationstousecost-effective,third-partyInternettransporttoconnectremoteofficesandremoteuserstothemaincorporatesite.VPNseliminateexpensivededicatedWANlinksandmodembanks.Additionally,withtheadventofcost-effective,high-bandwidthtechnologies,suchasDSL,organizationscanuseVPNstoreducetheirconnectivitycostswhilesimultaneouslyincreasingremoteconnectionbandwidth.

●Security-VPNsprovidethehighestlevelofsecuritybyusingadvancedencryptionandauthenticationprotocolsthatprotectdatafromunauthorizedaccess.

●Scalability-VPNsenablecorporationstousetheInternetinfrastructurethatiswithinInternetserviceproviders（ISPs）anddevices.Thismakesiteasytoaddnewusers,sothatcorporationscanaddsignificantcapacitywithoutaddingsignificantinfrastructure.

●Compatibilitywithbroadbandtechnology-VPNsallowmobileworkers,telecommuters,andpeoplewhowanttoextendtheirworkdaytotakeadvantageofhigh-speed,broadbandconnectivitytogainaccesstotheircorporatenetworks,providingworkerssignificantflexibilityandefficiency.High-speedbroadbandconnectionsprovideacost-effectivesolutionforconnectingremoteoffices.

Inthesimplestsense,aVPNconnectstwoendpointsoverapublicnetworktoformalogicalconnection.ThelogicalconnectionscanbemadeateitherLayer2orLayer3oftheOSImodel.VPNtechnologiescanbeclassifiedbroadlyontheselogicalconnectionmodelsasLayer2VPNsorLayer3VPNs.EstablishingconnectivitybetweensitesoveraLayer2orLayer3VPNisthesame.Adeliveryheaderisaddedinfrontofthepayloadtogetittothedestinationsite.ThischapterfocusesonLayer3VPNtechnology.

CommonexamplesofLayer3VPNsareGRE,MPLS,andIPSec.Layer3VPNscanbepoint-to-pointsiteconnectionssuchasGREandIPSec,ortheycanestablishany-to-anyconnectivitytomanysitesusingMPLS.

Genericroutingencapsulation（GRE）wasoriginallydevelopedbyCiscoandlaterstandardizedasRFC1701.AnIPdeliveryheaderforGREisdefinedinRFC1702.AGREtunnelbetweentwositesthathaveIPreachabilitycanbedescribedasaVPN,becausetheprivatedatabetweenthesitesisencapsulatedinaGREdeliveryheader.

PioneeredbyCisco,MPLSwasoriginallyknownastagswitchingandlaterstandardizedviatheIETFasMPLS.ServiceprovidersareincreasinglydeployingMPLStoofferMPLSVPNservicestocustomers.MPLSVPNsuselabelstoencapsulatetheoriginaldata,orpayload,toformaVPN.

HowdoesanetworkadministratorpreventeavesdroppingofdatainaVPN?

Encryptingthedataisonewaytoprotectit.Dataencryptionisachievedbydeployingencryptiondevicesateachsite.IPSecisasuiteofprotocolsdevelopedwiththebackingoftheIETFtoachievesecureservicesoverIPpacket-switchednetworks.TheInternetisthemostubiquitouspacket-switchedpublicnetwork;therefore,anIPSecVPNdeployedoverthepublicInternetcanprovidesignificantcostsavingstoacorporationascomparedtoaleased-lineVPN.

IPSecservicesallowforauthentication,integrity,accesscontrol,andconfidentiality.WithIPSec,theinformationexchangedbetweenremotesitescanbeencryptedandverified.Bothremote-accessandsite-to-siteVPNscanbedeployedusingIPSec.

TherearetwobasictypesofVPNnetworks:

Site-to-site

Remote-access

Asite-to-siteVPNiscreatedwhenconnectiondevicesonbothsidesoftheVPNconnectionareawareoftheVPNconfigurationinadvance.TheVPNremainsstatic,andinternalhostshavenoknowledgethataVPNexists.FrameRelay,ATM,GRE,andMPLSVPNsareexamplesofsite-to-siteVPNs.

Aremote-accessVPNiscreatedwhenVPNinformationisnotstaticallysetup,butinsteadallowsfordynamicallychanginginformationandcanbeenabledanddisabled.ConsideratelecommuterwhoneedsVPNaccesstocorporatedataovertheInternet.ThetelecommuterdoesnotnecessarilyhavetheVPNconnectionsetupatalltimes.Thetelecommuter'sPCisresponsibleforestablishingtheVPN.TheinformationrequiredtoestablishtheVPNconnection,suchastheIPaddressofthetelecommuter,changesdynamicallydependingonthelocationofthetelecommuter.

Asite-to-siteVPNisanextensionofaclassicWANnetwork.Site-to-siteVPNsconnectentirenetworkstoeachother,forexample,theycanconnectabranchofficenetworktoacompanyheadquartersnetwork.Inthepast,aleasedlineorFrameRelayconnectionwasrequiredtoconnectsites,butbecausemostcorporationsnowhaveInternetaccess,theseconnectionscanbereplacedwithsite-to-siteVPNs.

Site-to-siteVPN

Inasite-to-siteVPN,hostssendandreceivenormalTCP/IPtrafficthroughaVPNgateway,whichcanbearouter,firewall,CiscoVPNConcentrator,orCiscoASA5500SeriesAdaptiveSecurityAppliance.TheVPNgatewayisresponsibleforencapsulatingandencryptingoutboundtrafficfromaparticularsiteandsendingitthroughaVPNtunnelovertheInternettoapeerVPNgatewayatthetargetsite.UponreceIPt,thepeerVPNgatewaystrIPstheheaders,decryptsthecontent,andrelaysthepackettowardthetargethostinsideitsprivatenetwork.

Remote-AccessVPN

Remote-accessVPNsareanevolutionofcircuit-switchingnetworks,suchasplainoldtelephoneservice（POTS）orISDN.Remote-accessVPNscansupporttheneedsoftelecommuters,mobileusers,andextranetconsumer-to-businesstraffic.Remote-accessVPNssupportaclient/serverarchitecturewhereaVPNclient（remotehost）requiressecureaccesstotheenterprisenetworkviaaVPNserverdeviceatthenetworkedge.

Inthepast,corporationssupportedremoteusersbyusingdial-innetworksandISDN.WiththeadventofVPNs,amobileusersimplyneedsaccesstotheInternettocommunicatewiththecentraloffice.Inthecaseoftelecommuters,theirInternetconnectivityistypicallyabroadbandconnection.

Inaremote-accessVPN,eachhosttypicallyhasCiscoVPNclientsoftware.WheneverthehosttriestosendtrafficintendedfortheVPN,theCiscoVPNClientsoftwareencapsulatesandencryptsthattrafficbeforesendingitovertheInternettotheVPNgatewayattheedgeofthetargetnetwork.UponreceIPt,theVPNgatewaybehavesasitdoesforsite-to-siteVPNs.

Anemergingremote-accesstechnologyisCiscoIOSSSLVPN.Thistechnologyprovidesremote-accessconnectivityfromalmostanyInternet-enabledhostusingawebbrowseranditsnativeSecureSocketsLayer（SSL）encryption.SSLVPNsallowuserstoaccesswebpagesandservices,includingtheabilitytoaccessfiles,sendandreceiveemail,andrunTCP-basedapplicationswithoutIPSecVPNClientsoftware.Theyprovidetheflexibilitytosupportsecureaccessforallusers,regardlessofthehostfromwhichtheyestablishaconnection.Thisflexibilityenablescompaniestoextendtheirsecureenterprisenetworkstoanyauthorizeduserbyprovidingremote-accessconnectivitytocorporateresourcesfromanyInternet-enabledhost.

SSLVPNcurrentlydeliverstwomodesofaccess:

clientlessandthinclient.WithclientlessSSLVPN,aremoteclientneedsonlyanSSL-enabledwebbrowsertoaccessHTTP-orHTTPS-enabledwebserversonthecorporateLAN.InathinclientSSLVPNenvironment,aremoteclientmustdownloadasmall,Java-basedappletforsecureaccessofTCPapplicationsthatusestaticportnumbers.UDPisnotsupportedinathinclientenvironment.

SSLVPNsareappropriateforuserpopulationsthatrequireper-applicationorper-serveraccesscontrol,oraccessfromnon-enterprise-owneddesktops.SSLVPNsarenotacompletereplacementforIPSecVPNs.IPSecVPNsallowsecureaccesstoallofanorganization'sclient/serverapplications.Additionally,SSLVPNsdonotsupportthesamelevelofcryptographicsecuritythatIPSecVPNssupport.WhileSSLVPNscannotreplaceIPSecVPNs,inmanycases,theyarecomplementarybecausetheysolvedifferentproblems.Thiscomplementaryapproachallowsasingledevicetoaddressallremote-accessuserrequirements.

TheprimarybenefitofSSLVPNsisthattheyarecompatiblewithDynamicMultIPointVPNs（DMVPNs）,CiscoIOSFirewalls,IPSec,intrusionpreventionsystems（IPSs）,CiscoEasyVPN,andNetworkAddressTranslation（NAT）.

中文译文：

解决方案，如各种加密方法和PKI，使企业能够安全地通过互联网扩展其网络，实现这一企业网络扩展的方式之一就是通过虚拟专用网。

VPN通常是通过公共网络建立隧道的专用网络，VPN不是使用专用的物理连接，而是使用一个虚拟链路通过互联网实现远程站点到本地网络的连接，起初VPN的IP隧道中并不包含对身份验证和加