基于LINUX分布式复合网关安全原型的研究与设计

【作者】 庹琴；

【导师】 杨路明；

【作者基本信息】 中南大学 ， 计算机应用技术， 2004， 硕士

【摘要】 Internet特有的共享性、开放性及其依存的TCP／IP网络协议体系，从根本上决定了它缺乏一种可靠的网络安全机制。本文以网络安全技术中的防火墙技术为研究基础，分析了传统防火墙技术的发展历程，比较了现有防火墙系统所采用技术及各自的不足之处，针对TCP／IP协议中现存的各种安全问题，提出了本篇的研究课题即如何运用多种网络安全技术来构建一个可靠的安全网关原型系统，以及如何搭建一个高效集成的安全的网络运行环境。 论文通过对Linux内核安全机制的研究和学习，在分析Linux内核Netfilter安全功能框架和安全辅助体系Iptables工作原理的基础上，提出一种基于Linux平台的分布式复合网关安全原型(PLBDHG Prototyping A Linux-Based Distributed Hybrid Gateway)。论文对该安全网关原型建立和实现过程中采用的安全技术和安全策略进行了详细研究和探讨，并阐述了建立和设计开发PLBDHG安全网关原型的必要性及意义。 PLBDHG安全网关原型采用多级分层的网络安全技术和多种系统安全策略相结合的优化体系结构设计。系统设计实现了基于状态检测的网络数据的获取和监控、数据信息流的过滤和分析、网络地址转换及透明代理、网络流量监控和负载均衡、及基于状态信息的网络连接的跟踪和路由策略等功能。它将网络层安全策略与应用层安全策略、系统级安全策略与用户级安全策略有效结合加以运用。安全网关系统层次化设计的功能原型实现了集多种功能于一体的、基于系统安全策略和用户规则的安全访问控制。系统通过一定的运行环境和实验平台，对该安全模型进行了评估，并从有效性和可行性方面进行了论述。最后，论文对下一步的研究工作及未来防火墙技术的发展趋势和研究方向提出了建议。更多还原

【Abstract】 The features of Internet and its protocols set-TCP/IP decided they couldn’t maintain a secure and reliable network protection because of their fatal flaws, this mechanism essentially results in big security problems which brought us into troubles sometimes even disaster. Firewall system as a branch of computer security techniques, has been done a lot of research and still couldn’t achieve a perfect solution. How to build a relative secure and reliable network running environment based on multi-level contronl of firewall system becomes our main purpose in this paper.After been doing plenty research on the long process of firewall system development, we decided to establish a safe network gateway model prototyping based on Linux p latform. By utilizing the features of netfilter in Linux kernel space and iptables mechanism in the user space, the PLBDHG(Prototyping A Linux-Based Distributed Hybrid Gateway) has been built and could implement multi-level protection in our network system. This is a significant and meaningful research .PLBDHG is based on Linux platform, designed under multi-tier secure protection and optimized system security policies. For gaining better protection and efficient access control to the network, the model combined high protection built in both network layer and application layer. By analyzing the protocols in network layer and application layer, this model achieves the functionality which includes not only stateful packet inspection , dynamic packet filtering, NAT and Proxy server, but also data filtering, IDS, rule-based access control connection tracking and load balancing of LVS etc. This security prototyping integrates all these functions into one, makes them work collaboratively and efficiently, to maintain a secure and reliable network running environment. At last part of this paper, author also gives out the conclusion and some suggestions on the further research of this project.更多还原