包过滤防火墙系统的设计与研究  

Design and Research on Packet Filter Firewall System

作　　者：赵可新[1] 陈玉芳[1] 

机构地区：[1]河北工程技术高等专科学校,河北沧州061001

出　　处：《现代电子技术》2011年第6期112-113,117,共3页Modern Electronics Technique

基　　金：国家"863"计划资助项目(2.5.1.25)

摘　　要：为了实现保护信息不被窃取或破坏,设计了一款个人防火墙。该防火墙集成了个人防火墙中普遍采用的两种包过滤方法,即通过内核态下的网络封包拦截获得网络数据包的进程、端口、协议等详细信息,根据协议和端口规则对网络数据封包进行处理;同时,通过用户态下对应用程序数据包的拦截来设置自己的应用程序规则来进行过滤。采用推理机实现过滤规则的动态生成;提高了包过滤防火墙的性能,能更好地保证网络信息的安全。A personal firewall was designed to protect information from theft or damage. The firewall integrated two commonly used packet filtering methods in personal firewall, that is the network packet＇s core block accessed to the process, port and protocol of network packet, and processed the network data packet according to protocol and port rules; at the same time, set the packer＇s own application rules and filtered through intercepting the packet of application in user mode. The inference machine was used to achieve the dynamic generation of filter rules, which improved the performance of packet filtering fire-wall, and guaranteed the security of network information.

关 键 词：防火墙 包过滤 推理机 网络数据包 

分 类 号：TN919-34[电子电信—通信与信息系统]