Netfilter框架下多策略边界网关的研究与设计

Research and design of boundary gateway based on multiple policy in Netfilter

为解决等级保护第三级平台的区域边界控制问题,分析了现有区域边界研究的现状。基于Linux下的Netfilter框架,提出了多策略区域边界访问控制模型的思想,用于实现区域边界上自主、强制访问控制策略和可信通道的安全控制。给出了网关的整体设计路线和可信管理系统的功能实现,分析了包过滤提取模块、访问控制裁决模块、角色匹配模块、策略转化模块和策略加载/撤销模块的设计思想。

To deal with enclave boundary control of the third platform in hierarchy protection,the status of the research on boundary enclave,based on the Netfilter framework in Linux is analyzed,and the theory of enclave boundary access control model based on multiple policy is proposed.To realize the DAC,MAC policy and effective control of believable channel,the overall design of the enclave boundary safety gateway and the implementation of the credible management system are given,and the design ideas of the packet filtering module,access control decision module,role matching module,strategy transforming module and strategy loading/removing module are provided.