复合型防火墙扫描防御与客户端认证模块的设计与实现

发布时间：2018-11-26 15:37

【摘要】：随着网络规模的不断扩大以及网络应用的多样化，网络安全问题日益严峻，网络安全愈发变得难以人工控制。在市场需求的推动下，产生了各式的网络安全产品。在越来越多样的网络安全产品中，防火墙超越了其他网络安全领域，成为发展最快的安全产品之一。在防火墙产品的升级过程中，传统的纯软件式防火墙已经不能够适应当前市场对防火墙性能需求和多样化的功能需求，专用的高性能防火墙设备成为大多数网络服务商的必然选择。同样由于多样化的网络安全功能需求，防火墙的检测方式也在不断发生着变化。从最初始的单包过滤防火墙，到各种应用代理防火墙，防火墙体系结构与检测方式都在不断的向前发展。对于专业防火墙设备而言，综合前人的智慧，去芜存菁是一个必然的选择。复合型防火墙就是这样一种选择的结果。复合型防火墙基本上兼容了前两个阶段防火墙的优势，既能在单包攻击防御方面保持高效，同时又通过应用代理弥补单包防火墙的功能缺陷。本文基于复合型防火墙架构，设计并实现了扫描攻击防御和客户端认证代理两个业务模块，同时对这两个业务处理过程中的一些关键部分提出了优化思路与解决方案。在整体结构设计方面，综合了两种防火墙的优势以及具体业务模块的要求，在报文预处理，业务数据管理和攻击日志管理等几个方面进行了统一的处理，从整体上提高了防火墙的性能。在扫描攻击防御部分，提出了一个统一的报文统计流程，在简化计数操作的同时，，可以对目前公认的三种扫描攻击做出有效而准确的识别。在客户端认证代理部分，提供了面对目前三种主流网络应用协议的多种代理方式。在业务处理流程中，设计了一个有效的老化数据维护的层次结构模型，减少系统计时器中断频率。本文最后提供了系统的主要测试数据，通过功能测试与性能测试两个角度，证明了本系统功能的正确性与高效性。在功能测试部分，模拟了实际业务中的不同情景，全面对业务逻辑进行测试。在性能测试中，在相同环境下，通过新模块对转发性能影响对比，验证了系统的高效性。
[Abstract]:With the expansion of network scale and the diversification of network applications, network security is becoming more and more serious, and network security becomes more and more difficult to control manually. Driven by market demand, a variety of network security products have emerged. Among more and more network security products, firewall surpasses other network security fields and becomes one of the fastest growing security products. In the process of upgrading firewall products, the traditional pure software firewall can no longer adapt to the current market demand for firewall performance and diverse functions. Dedicated high-performance firewall equipment has become the inevitable choice of most network service providers. Also due to the diverse network security requirements, firewall detection methods are constantly changing. From the initial single-packet filter firewall to various application proxy firewalls, firewall architecture and detection methods are constantly developing. For professional firewall equipment, the synthesis of the wisdom of the predecessors, desolation is an inevitable choice. A composite firewall is the result of such a choice. The composite firewall is basically compatible with the advantages of the first two stages of the firewall. It can not only maintain high efficiency in the defense of single packet attack, but also make up the functional defects of the single packet firewall through application proxy. Based on the composite firewall architecture, this paper designs and implements two business modules, scanning attack defense and client authentication proxy, and puts forward some optimization ideas and solutions for some key parts of these two service processing processes. In the aspect of overall structure design, the advantages of two kinds of firewalls and the requirements of specific business modules are synthesized, and the unified processing is carried out in several aspects, such as message preprocessing, business data management and attack log management, etc. The overall performance of the firewall is improved. In the part of scanning attack defense, a unified packet statistic flow is proposed, which simplifies the counting operation and can effectively and accurately identify the three kinds of scan attacks. In the client authentication agent part, it provides a variety of proxy ways to face the three main network application protocols. In the business process, an effective hierarchical model for the maintenance of aging data is designed to reduce the interrupt frequency of the system timer. Finally, the main test data of the system are provided, and the correctness and efficiency of the system are proved by the function test and the performance test. In the part of function test, we simulate the different scenarios of actual business and test the business logic comprehensively. In the performance test, under the same environment, the efficiency of the system is verified by comparing the effect of the new module on the forwarding performance.
【学位授予单位】：哈尔滨工业大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【相似文献】