嵌入式Linux防火墙系统的设计与实现

发布时间：2018-10-11 15:04

【摘要】：随着科学技术的飞速发展,计算机网络产业也迅速发达起来,对全球的技术、经济和社会生活影响十分巨大。计算机网络,尤其是因特网,它的范围十分广泛,它所涉及的范围不仅是金融、政府,还有其它如生活等各个领域。信息共享也是它的一大特点。由于现在频繁出现QQ号码被盗,热点被盗取等网络安全问题,以至于网络安全产品让人们越来越加以重视。目前,在网络安全产品中,出现最早、使用量最大的防火墙,被用户和研发机构所广泛使用着。但普通的防火墙却无法避免一些问题,比如,网络应用受到结构性限制、内部安全隐患、效率较低和故障率高等等。嵌入式防火墙是一种以嵌入式技术为基础的新型防火墙,该防火墙将安全策略逐步延伸到了网络末端,有效地克服了传统边界防火墙的局限,创建了一种更为完善的安全防护架构。Linux具有开源可移植性以及成熟的Netfilter/Iptables防火墙架构,这些特性使其被移植,形成嵌入式防火墙系统成为可能。设计嵌入式Linux防火墙再加以实现并且进行测试是本文的主要步骤。首先要提出问题,对基于ARM处理器的嵌入式Linux防火墙的体系架构进行提出,制定出Linux一种内核裁剪的方案;其次,由于Netfilter/Iptables在大数量规则集下性能较低,进行解决计划,提出了Iptables结合NF-hipac、Ipset使用的方法,并将过程步骤标出,用来制定成详细的计划;再次,由于系统已经实现,针对它而得出性能测试结果及详尽完整的功能。功能测试主要证明系统的可用性;性能测试主要给出了影响系统性能的参数,通过改变参数并加以测试,得出优化系统的途径;最后,设计了防火墙日志分析辅助管理系统,测试证明该系统功能良好,适合中小规模应用。
[Abstract]:With the rapid development of science and technology, the computer network industry has developed rapidly, which has a great impact on the global technology, economy and social life. The computer network, especially the Internet, has a very wide range. It involves not only finance, government, but also other fields such as life. Information sharing is also one of its major characteristics. Due to the frequent occurrence of QQ number theft, hot spots stolen and other network security issues, network security products make people pay more and more attention. At present, among the network security products, the earliest and most widely used firewall is widely used by users and R & D organizations. But common firewall can not avoid some problems, for example, network application is subject to structural restrictions, internal security risks, low efficiency and high failure rate, and so on. Embedded firewall is a new type of firewall based on embedded technology. The firewall extends the security policy to the end of the network step by step, and effectively overcomes the limitation of traditional boundary firewall. Linux has open source portability and mature Netfilter/Iptables firewall architecture, which makes it possible to form embedded firewall system. Designing and testing embedded Linux firewall is the main step of this paper. First of all, the problem should be raised, the architecture of embedded Linux firewall based on ARM processor is put forward, and a kernel tailoring scheme of Linux is worked out. Secondly, because of the low performance of Netfilter/Iptables in large number of rule sets, the solution is planned. The method of combining Iptables with NF-hipac,Ipset is put forward, and the process steps are marked out to make a detailed plan. Thirdly, because the system has been implemented, the performance test results and the complete function are obtained. The function test mainly proves the usability of the system, the performance test mainly gives the parameters that affect the system performance, through changing the parameters and testing, the way to optimize the system is obtained. Finally, the firewall log analysis assistant management system is designed. The test shows that the system has good function and is suitable for medium and small scale application.
【学位授予单位】：电子科技大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【相似文献】