一种IPV6环境下的高性能规则匹配算法研究

发布时间：2018-04-30 04:31

本文选题：防火墙 + 规则匹配　；参考：《计算机科学》2017年03期

【摘要】：防火墙是确保网络安全的关键设施,而规则匹配又是防火墙的核心技术。随着网络技术的发展,互联网体系结构正逐渐从IPV4向IPV6结构发展,原有的IPV4防火墙规则匹配算法很难直接应用于IPV6网络环境,因为IPV6协议所能表示的地址范围远远超过IPV4协议对应的地址范围。因此提出了一种适用于IPV6环境的高性能规则匹配算法HiPRM(High Performance Rule Matching)。HiPRM算法的核心思想是依据规则的协议和目的端口分布特征,先把整个规则集划分成多个子规则集,再利用位选取算法对规则的源和目的IPV6地址组合的特定位进行选取,然后据此构建二叉查找规则树,最后利用规则树把多个规则子集划分成若干个更小的规则集合。而当报文匹配到某个更小的规则集合时,在小规则集中利用线性匹配法确定具体匹配的对应规则。分析和测试表明,HiPRM算法可以在时间复杂度和空间复杂度较低的情况下实现报文的高速匹配,且具有较好的规则集适应性。
[Abstract]:Firewall is the key to ensure network security, and rule matching is the core technology of firewall. With the development of network technology, the Internet architecture is gradually developing from IPV4 to IPV6. It is difficult to directly apply the original IPV4 firewall rule matching algorithm to IPV6 network environment. Because the IPV6 protocol can represent the address range far more than the address range corresponding to the IPV4 protocol. Therefore, the core idea of a high-performance rule matching algorithm, HiPRM(High Performance Rule Matching).HiPRM algorithm, which is suitable for IPV6 environment, is to divide the whole rule set into multiple sub-rule sets according to the protocol of rules and the distribution characteristics of destination ports. Then the bit selection algorithm is used to select the specific bits of the source and destination IPV6 address combination of the rule, and then the binary search rule tree is constructed. Finally, the rule tree is used to divide the multiple rule subsets into several smaller rule sets. When the message matches to a smaller set of rules, the linear matching method is used to determine the matching rules in the small rule set. The analysis and test show that the HiPRM algorithm can achieve high speed packet matching with low time complexity and space complexity, and has good adaptability to rule set.
【作者单位】：国防科学技术大学计算机学院;
【基金】：国家863项目:QoS服务质量保证设计(2012AA01A50606) 国家自然科学基金项目:高级持续威胁网络行为建模与检测方法研究(61303264)资助
【分类号】：TP393.08

【相似文献】