防火墙的动态访问控制机制  

Dynamic Access Control Mechanism for Firewalls

作　　者：郑卫斌[1] 张德运[1] 李胜磊[1] 

机构地区：[1]西安交通大学电子与信息工程学院计算机系,西安710049

出　　处：《计算机工程与应用》2003年第32期182-184,共3页Computer Engineering and Applications

基　　金：国家863网络安全管理与测评技术基金资助(编号:863-301-05-03);国家"九五"科技攻关基金资助(编号:96-743-01-04-01)

摘　　要：防火墙的静态过滤规则对安全的管理是基于IP地址而非基于用户,这在实际应用中是很不方便的。针对这种情况,文章提出了一个防火墙的动态访问控制机制,它可以在验证用户身份的基础上,实施基于用户的灵活的动态安全策略。该机制利用HTTP重定向技术实现透明的WEB认证,采用事件驱动方式、BitMap和Hash表算法等保证系统具有良好的性能。目前该机制的原型已经在Linux下实现,并应用在防火墙上,实践表明该机制具有安全策略灵活且可管理,使用简单,大用户量下扩展性好等优点。In a firewall,access control is reached using filter rules.Traditional filter rules are static,and security is managed on a per-address basis rather than a per-user basis,which is undesirable.This paper,proposes a dynamic ac-cess control mechanism for firewalls.With user authentication,it allows dynamic and flexible security policies enforced on a per-user basis.It uses HTTP redirection to achieve transparent WEB-based authentication,and adopts an event-driven architecture,Bitmap and hash table algorithms to achieve good performance.The mechanism is implemented in Linux,and applied in a firewall,which shows flexible and manageable security policy,easy to use,and scalability under large num-ber of users.

关 键 词：防火墙 访问控制 认证 

分 类 号：TP393.07[自动化与计算机技术—计算机应用技术]