基于状态检测的防火墙技术

Firewall Technology Based on Stateful Inspection

基于状态检测的防火墙技术,通过WindowsDDK编程实现核心模块基本功能。系统采用基于连接的状态检测机制,将属于同一连接的所有包视为整体数据流,构成连接状态表,并通过规则表与状态表识别其连接因素。其软件防火墙系统含图形用户界面、访问控制模块、系统内核模块及状态检测模块。系统采用设备驱动程序编程构造状态检测模块;网络驱动程序通过NDIS程序库对调用硬件系统。

For the firewall technology based on state inspection, The basic function of kernel module was realized by Windows DDK programming. The state inspection mechanism based on the linkage was adopted in the system; then all the packages attributed to the same linkage were considered as the holistic data stream to construct linkage state table; at last, the linkage factors were recognized by rule table and state table. The software firewall system consists of graphical user interfaces, accessing control module, System kernel module and state inspection. The state inspection module was built up with device driven programming, hardware system is called by using network driven program with NDIS library.