状态检测防火墙的设计与实现.pdf

合肥工业大学
硕士学位论文
状态检测防火墙的设计与实现
姓名:肖鹏
申请学位级别:硕士
专业:计算机技术
指导教师:侯整风;管玉生
2008-05
状态检测防火墙的设计与实现

摘要

近年来,随着计算机技术的发展,互联网的应用日益丰富,但网络的安全
问题也越来越突出。防火墙作为实现网络间访问控制的一项有效措施,是强化
网络安全的重要手段。
本文介绍了防火墙技术的研究现状和发展趋势,分析了 Windows 网络体
系结构,研究了网络封包截获技术。针对防火墙的过滤技术,探讨了状态检测
防火墙中的特点、工作原理和关键技术。并在此基础上,提出了一种状态检测
防火墙实现方案。通过建立并维护一张连接状态表,运用连接跟踪技术和合法
性检测技术,实现对系统的访问控制。
本系统采用 Visual C++ 和 Windows DDK for XP 作为开发工具,在
Windows XP 下调试通过,并在典型的网络环境下进行了系统测试。测试结果
表明,本方案所设计的状态检测防火墙,能够有效地实现网络间的安全访问控
制。

关键词:状态检测包过滤防火墙 SPI NDIS
Design and Implementation of Stateful Inspection Firewall

ABSTRACT

In recent years, with the development puter technology, the use of the
is ing richer, but work's security problems are more and more
prominent. As an important means to strengthen work security,firewall
achieve an effective measure of access control between work.
In this dissertation, firewall technology of the status research and development
trend of it are introduced first. Then we analyses the work architecture,
and the technology of packets intercepted. As for firewall filtering technology, we
discuss the characteristics of principle and the key technology. And on this basis,
propose a stateful-inspection firewall Solution. Through the establishment and
maintenance of a connection status table, with the use of tracking technology and
connect legitimacy detection technology, implementation of the access control
system.
This system is under development and debugged in the Windows XP with
Visual C + + and Windows DDK for XP as a development tool. We take a
system test in a work environment. Test results show that the scheme
designed by the stateful inspection firewall can effectively achieve work
security access control.

Keywords:Stateful-inspection;Packet filtering;Firewall;SPI;NDIS
表格和插图清单
表 TCP∕ IP 协议和 OSI 模型的对应关系................................................. 10
图 OSI 参考模型........................................