【作者】 郑爱蓉；

【导师】 许榕生；

【作者基本信息】 福州大学 ， 计算机软件与理论， 2005， 硕士

【摘要】 网络发展给人类生活带来便利的同时，也同样带来了严重的安全问题。这个安全问题不仅影响到人类正常生活、工作秩序，严重到破坏国家和民族的安全。特别是近几年，由于上网用户的增加以及新业务的不断出现，网络带宽呈爆炸性增长。这种趋势迫切要求与之要适应的高性能网络安全设备来支持带宽的升级。防火墙作为内部网络与外部网络之间的一道屏障，是保护网络的最重要安全手段之一，因此最先受到人们重视的网络安全产品。本论文针对目前防火墙的发展和使用状况，从广义角度深入研究和分析了不同硬件平台构架的千兆防火墙的性能问题，设计并实现基于IXP2400网络处理器的千兆防火墙解决方案。论文的研究内容和结论如下：分析X86架构的千兆防火墙在实现中遇到的性能瓶颈，指出用X86架构千兆防火墙的硬件固有缺陷；并对ASIC与网络处理器进行分析比较，指出用网络处理器实现防火墙的强大优势。提出适用于大规则集多维HSIPBG算法，为包括防火墙在内的多种应用提供了高速、高效的数据包分类算法。设计并实现了基于Intel IXP2400网络处理器的千兆包过滤防火墙。实验证明网络处理器技术以及HSIPBG算法的运用为1G及更高带宽下的防火墙提供了高性能、可扩展性线速千兆防火墙解决方案。本论文的研究针对线速千兆防火墙在设计和实现中出现的问题进行了探讨，提出了一个基于网络处理器的较为全面、系统解决方案。目前，一些研究结论已得到成功运用，另一些将作为973课题的研究成果在未来的实践中完善、推广。更多还原

【Abstract】 Development of network brings us not only convience and serious network security problem. The problem impacts people’s order at life and work, even security of our country and nation. Especial recent years，network bandwidth blows up with growth of internet user and emergency of new service. The trend is in urgent need of high speed network equipment which can support upgraded bandwidth. As a barrier between intranet and extranet, firewall is one of the most important tools to protect network so that it is the network security product which paid attention first.Aiming at the present development and status of utilization of firewall, the thesis has broadly studied and analyzed the performance of gigabit firewalls base on different hardware plane, designed and implemented a scheme for gigabit firewall based on IXP2400. The main contents and conclusions of the thesis are summarized as follows:Analyze the bottleneck of gigabit firewall base on X86, point out limitation of such gigabit firewall on its hardware; Then compare ASIC with network processor, discuss superiority of network processor which we will choose for firewall.Present HSBIPG(Hash Search Based on IP Group)packet classification algorithm for various applications include firewall which needs large classification. The algorithm is considered high speed and high performance.Designing and implementing HSIPBG packet classification algorithm based on the Intel IXP2400 network processor. The employing of network processor and HSIPBG proved to allows the solution for firewall working line rate in 1G or higher broadband with high performance and expansibility by experiment.The thesis researches and discusses difficulties of designing and implementing a line <WP=4>rate gigabit firewall and present a comprehensive and systemic firewall system based on network processor. At present, some of conclusions have been applied successfully, and the others will be consummated and generalized in the future as the production of “973” project.更多还原