IPv6防火墙高性能规则匹配算法研究  

Research of High Performance Firewall Based On IPv6

作　　者：江峰[1] 王勇军[1] 王晓东[1] 解培岱[1] 

机构地区：[1]国防科技大学计算机学院,湖南长沙410073

出　　处：《中国电子商情（通信市场）》2011年第4期85-92,共8页

摘　　要：IPv6防火墙作为下一代网络安全的关键技术，其性能越来越受到人们的重视。当前Linux内核中的防火墙模块Netfilter／Ip6tables基于顺序查找算法实现规则匹配，当规则数增加时，其性能急剧下降。本文分析了基于HiPAC算法的IPv4高性能防火墙规则匹配技术，针对大规则集下该算法分段太多而导致子节点数迅速增加问题，提出了一种基于位选取法的IPv6防火墙规则匹配算法。该算法具有O（log2n）的时间复杂度和O（n）的空间复杂度，性能相对于Ip6tables实现算法有了极大的改善。As is known to all, IPv6 firewall is one of the most important technologies for the next generation network security. People had paid much more attention to its performance. As part of Linux kernel, Netfilter/Ip6tables implement rule matching using linear search algorithm, its performance will dramatically decrease with the increasing of rules. To get started, this paper detailed in a high performance firewall based on HiPAC algorithm, and then, considering that the number of subnodes will dramatically increase due to large number of rules, we put forward a high performance IPv6 firewall based on Bit Selection. The time complexity of this algorithm is O（log2n）, and space complexity is O（n）, which has a good improvement over Ip6tables.

关 键 词：LINUX防火墙 高性能 规则匹配 IPV6 Netfilter/Ip6tables 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]