Abstract: In order to solve security problems based on the policy and construct a security-policy-based network security architecture in IPv6 networks, a multi-hierarchy and multi-domain security policy system in which the central policies are uniformly stored, distributed domain by domain and local policies are obtained by negotiation is presented. The frame of the system and its realization scheme are designed in detail and the feasibility of the system is theoretically verified. The system which is flexible and expansible fits the requirements of policy management based on the security domain.

Key words: IPSec policy, security policy management, security systems, IPv6