论文部分内容阅读
研究防火墙 (或过滤路由器 )应用于传输网络中的管理问题与吞吐量问题 .一方面 ,手工配置分布在各个接入点的大量防火墙 ,无法满足开放的、动态的网络环境的安全管理需求 ;另一方面 ,大量过滤规则的顺序查找导致了防火墙吞吐量下降 .针对一个典型的传输网络和它的安全政策需求 ,提出了一种基于政策的访问控制框架(PACF) ,该框架基于 3个层次的访问控制政策的抽象 :组织访问控制政策 (OACP)、全局访问控制政策 (GACP)和本地访问控制政策 (L ACP) .根据 OACP,GACP从入侵监测系统和搜索引擎产生 ,作为 L ACP自动地、动态地分配到各防火墙中 ,由防火墙实施 LACP.描述了 GACP的分配算法和 LACP的实施算法 ,提出了一种基于散列表的过滤规则查找算法 .PACF能够大量减轻管理员的安全管理工作 ,在描述的安全政策需求下 ,基于散列表的规则查找算法能够将传统顺序查找算法的时间复杂度从 O(N)降低到 O(1) ,从而提高了防火墙的吞吐量 .
On the one hand, manual configuration of a large number of firewalls distributed at each access point fails to meet the security management requirements of an open and dynamic network environment; on the other hand, the firewall (or filter router) is applied to management problems and throughput problems in transmission networks. On the one hand, the order-finding of a large number of filtering rules leads to the decrease of firewall throughput.Aiming at a typical transmission network and its security policy requirements, a policy-based access control framework (PACF) is proposed based on three levels Abstractions in access control policies: Organization Access Control Policy (OACP), Global Access Control Policy (GACP), and Local Access Control Policy (LACP) According to OACP, GACP is generated from intrusion detection systems and search engines as LACP automatically, Dynamically allocated to each firewall, the implementation of LACP by the firewall.Describes the GACP allocation algorithm and implementation of LACP algorithm, a hash table-based filtering rules search algorithm.PACF can greatly reduce the administrator’s security management, in the Described security policy requirements, the rules based on the hash table lookup algorithm can search the traditional order Method of reducing the time complexity from O (N) to O (1), thereby improving the throughput of the firewall.