IPv6下基于病毒过滤防火墙的设计与实现  

Design and Implementation of IPv6 Transparent Firewall with Virus Filtering

作　　者：张玉芳[1] 熊忠阳[2,3] 赖苏[1] 张科[1] 刘君[1] 王银辉[1] 

机构地区：[1]重庆大学计算机学院 [2]重庆大学电气工程博士后流动站 [3]重庆大学信息与网络管理中心,重庆400030

出　　处：《计算机科学》2009年第4期108-111,共4页Computer Science

基　　金：教育部留学回国人员启动基金(教外司留[2007]1108-10);中国博士后科学基金(20070420711)资助

摘　　要：包过滤防火墙无法检测出网络病毒,因此对其研究很有必要。设计的防火墙屏蔽了Linux自身的TCP/IP协议栈,重新构建了适合防火墙专用的TCP/IP协议栈,完成了防火墙上TCP协议的连接保持、数据包确认、文件传输等功能。防火墙主要考虑了HTTP协议下的文件过滤,使得内网主机在通过HTTP协议下载文件时自动过滤病毒文件,保证内网主机的安全;防火墙以Linux可加载内核模块形式实现,可以过滤链路层以上的各层;为提高病毒检测速度,提出了将病毒检测软件运行在核心态的方法。实验结果表明:设计的防火墙在性能和功能上都达到了预期目的。The existing packet filtering firewall is helpless for the spread of network virus,making a study on the designed of anti-virus firewall is very necessary. This paper designed and realized an experimental anti-virus firewall in IPv6. The firewall was realized in the form of kernel loadable module, and can be used to filter virus above link layer. The special TCP/IP used for firewall is rebuilt because transparent mode firewall cannot be run in the original TCP/IP of Linux. The firewall can get and resolve IPv6 packets and the IPv6 in IPv4 tunnel packet. It can also traverse every extension header until higher protocol layers. The firewall uses open source software to filter the virus in the network and ensures network security. For working in the kernel mode, the detecting speed was improved. The experimental results show that the performance and function of the firewall achieve the desired objectives.

关 键 词：IPV6 防火墙 透明模式 病毒过滤 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]