基于加速引擎的防火墙部署方案

Improving the firewall through the accelerator engine

文章提出一种提升防火墙数据吞吐量的新方法,引入一台加速引擎的设备,通过实时学习模仿防火墙的安全策略,协同防火墙共同处理网络数据包,降低需要防火墙处理的数据包数量,克服了传统防火墙易于产生性能瓶颈的问题;同时基于Linux/netfilter实现了一个原型系统,并验证了该方案的有效性和可行性。

A new approach of increasing the throughput of the firewall is proposed. An implementor, the so-called firewall accelerator engine is introduced. It can learn the behavior of the firewall and cooperate with it by greatly decreasing the amount of the packets delivered to the firewall. A prototype system based on Linux/netfilter is built to test and verify the scheme. The feasibility of implementing the accelerator engine in real networks is also discussed.