基于状态检测的TCP包过滤的设计与硬件实现  

Design and Hardware Implementation of TCP Packet Filtering Based on State Detection

作　　者：迟秀伟[1] 唐朔飞[1] 季振州[1] 李鑫[1] 

机构地区：[1]哈尔滨工业大学计算机科学与工程系,黑龙江哈尔滨150001

出　　处：《计算机工程与科学》2006年第10期23-24,31,共3页Computer Engineering & Science

基　　金：国防"十五"预研基金资助项目(41316.3.3)

摘　　要：状态检测是目前防火墙的主流技术。本文介绍了状态检测防火墙的工作原理,提出了针对TCP数据包状态检测的流程和状态转换的模型,采用了序列号范围检查、动态超时管理等办法保证系统的安全性,利用哈希算法对状态表进行操作,最终在FPGA上实现。实验结果表明,该设计能很好地适应千兆网络环境。State detection is the main stream of the current firewall technologies. This paper introduces the principle of state detection firewall. The flowchart of state detection and the model of state transition for the TCP packets are presented. A method of sequence number scope check and dynamic timeout management ensures the system security. A hash algorithm is adopted to manage the state table, and the design is implemented on FPC-A. The experiment shows that the design can work well in a Gigabit network environment.

关 键 词：状态检测 防火墙 TCP FPC-A千兆网络 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]