大话容止套装搭配:急求高手翻译一段计算机专业文章

《IPSec Overview》
One of the weaknesses of the original Internet Protocol is that it lacks any sort of general purpose mechanism for ensuring the authenticity and privacy of data as it is passed over the internetwork. Since IP datagrams must usually be routed between two devices over unknown networks, any information in them is subject to being intercepted and even possibly changed. With the increased use of the Internet for critical applications, security enhancements were needed for IP. To this end, a set of protocols called IP Security or IPSec was developed.
The IP Security protocol (IPsec) provides several security services to networked applications. Services include:
1. Confidentiality - Making data unreadable by eavesdroppers
2. Data Integrity - Guaranteeing that data is not changed between sender and receiver
3. Data Authentication - Guaranteeing that received data was not sent by an imposter
IPsec operates at the Network layer. Security services can be provided at any of several network layers, and there are advantages and disadvantages to each. The diagram below illustrates a simplified network protocol stack:
IPSec can be applied to IP packets in two different ways, or modes:
• Transport mode
• Tunnel mode
Transport mode protects the packet's payload, higher-layer protocols, but leaves the original IP address in the clear. The original IP address is used to route the packet through the Internet. ESP transport mode is used between two hosts. Transport mode provides security to the higher-layer protocols only.
ESP tunnel mode is used when either end of the tunnel is a security gateway, a Concentrator, a VPN optimized router, or a PIX Firewall. Tunnel mode is used when the final destination is not a host, but a VPN gateway. The security gateway encrypts and authenticates the original IP packet. Next, a new IP header is appended to the front of the encrypted packet. The new outside IP address is used to route the packet through the Internet to the remote end security gateway. Tunnel mode provides security for the whole original IP packet.