分向、分步及分层的防火墙过滤结构

A Flow-differentiated,Multi-stepped and Layered Firewall Filtering Structure

随着策略集的不断膨胀,现有的过滤结构造成了采用不同过滤算法的软件防火墙时间或空间利用率下降,同时防火墙过滤结构方面的研究仍然不足。针对这一问题,提出了一种分向、分步及分层的防火墙过滤结构,其中分向、分步结构是过滤结果正确性的保证,而分层结构能提高防火墙时间或空间的使用效率。对本过滤结构进行了功能和性能分析,并和采用现有结构的防火墙进行了对比。最后给出了测试结果,实验证明本过滤结构应用效果明显。

According to the existing structure the time or space utilization of different packet filtering algorithms declines with continuous expanding policy sets,more related investigation is still very deficient.This paper proposes a new flow-differentiated,multi-stepped and layered firewall filtering structure.flow-differentiated and multi-stepped filtering guarantees the result correct,and layered structure improves the time and space utilization.In the paper,we analysis its performance,and compares it with the existing structures. At last, we provide the actual testing result which shows good filtering performance.