可扩展的深度包检测系统设计

发布时间：2018-08-13 12:15

【摘要】：随着网络成为人们生活中的重要组成部分，网络安全已经成为网络技术业界关注的重点问题之一。网络运营商、互联网服务提供商以及虚拟互联网业务提供商越来越需要安全高效运行的网络。深度数据包检测借助网络数据包深度分析，实现流量管理、安全和网络分析，更进一步能够进行网络数据包的内容层的深度分析。本文提出了基于ATCA架构的深度包检测系统的设计与实现方案，该系统以业界知名OpenDPI为系统原型，全面分析DPI系统的实现技术，完成了基于ATCA架构的DPI系统设计，充分利用开放的ATCA架构的交换刀片、计算刀片、网络处理器刀片、存储刀片、ATCA机框，构建了高性能的深度包检测系统，并对负载均衡器、网络数据检测器和管理进行需求分析、设计与实现。特别是在数据层面处理引入了多核网络处理器进行网络数据包的深度分析，借助该类处理器产生具有网络协议与安全处理的协处理器，，大幅提升DPI系统的性能。同时通过ATCA系统整合了计算刀片、存储刀片，有利于提供对数据深入分析、存储的可能。基于ATCA架构的深度包检测系统的技术方案具有以下三方面的优势：第一、构建了高吞吐、扩展能力的深度包检测系统；第二、利用多核网络处理器的网络数据包进行分析处理；第三、实现了网络数据包抓取、分析、存储的一体化设计。
[Abstract]:With the network becoming an important part of people's life, network security has become one of the most important issues in the network technology industry. Network operators, Internet service providers and virtual Internet service providers increasingly need safe and efficient operation of the network. With the help of network data packet depth analysis, depth data packet detection can realize traffic management, security and network analysis, which can further analyze the depth of network data packet in the content layer. In this paper, the design and implementation of the depth packet detection system based on ATCA architecture is proposed. The system takes the well-known OpenDPI as the system prototype, analyzes the implementation technology of the DPI system, and completes the design of the DPI system based on the ATCA architecture. The high performance depth packet detection system is constructed by making full use of open ATCA architecture switch blade, computing blade, network processor blade, storage blade and ATCA frame. The requirements of load balancer, network data detector and management are analyzed. Design and implementation. In particular, multi-core network processors are introduced to analyze the network data packets at the data level, and coprocessors with network protocols and security processing are generated with the help of these processors to greatly improve the performance of DPI systems. At the same time, the calculation blade and the memory blade are integrated through the ATCA system, which provides the possibility of in-depth analysis and storage of the data. The technical scheme of the depth packet detection system based on ATCA architecture has the following three advantages: firstly, a deep packet detection system with high throughput and expansibility is constructed; second, the network data packet of multi-core network processor is analyzed and processed. Third, realize the integrated design of network packet capture, analysis and storage.
【学位授予单位】：吉林大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【相似文献】