防火墙规则的动态分配和散列表匹配算法

防火墙应用在大型传输网络中存在管理和吞吐量问题 :手工方式配置多个防火墙 ,无法适应开放的、动态网络环境 ;大量过滤规则导致防火墙吞吐量下降。针对管理问题 ,提出了一种访问控制政策的自动分配与动态配置方法 ,将全局过滤规则自动地分发到相应的防火墙 ;利用入侵监测系统和搜索引擎的结果 ,自动定位防火墙、动态配置过滤规则。针对吞吐量问题 ,提出了一种基于散列表的规则匹配算法 ,该算法在所讨论的安全政策下可以将时间复杂度从 O(N )降低到 O(1) ,从而提高了防火墙的吞吐量

Dynamic allocation and hash table based match algorithms for firewall rules

Throughput and management issues arise when firewalls are applied in large transit networks. The manual configuration of large numbers of firewalls distributed in many access points can not provide open and dynamic environment and the large number of filtering rules decreases each firewall's throughput. Management can be improved using algorithms to automatically allocate global filtering rules to individual firewalls and to dynamically configure all of the firewalls according to the results of intrusion detection systems and search engines. The throughput of individual firewalls can be improved using a hash table based rule matching algorithm, which reduces the time complexity from O(N) to O(1) for transit networks, and therefore, increases the firewall throughput.