【正文】 eature of the firewall can be summarized as the implementation of decentralization strategy on the development, preservation of logs scattered on a security strategy must develop a unified administrator , The strategy must be pushed to the edge of works that host implementation of the log will be unified collection, centralized management. This paper first analysis of the current traditional firewall and the role of the existing problems, and then distributed through the firewall configuration, the key advantages of the technology and indepth research, and distributed firewall technology and research from several more representative Kind of model was pared concluded. Secondly, through the firewall strategy for the definition, implementation and distribution mechanism of the slightly distributed firewall management were discussed and strategies for the implementation of the functions, features and related technology to do a systematic analysis. Once again, through the implementation of the strategy for the implementation of the programme, and the structure, processes and stability of the subbined with China39。 關(guān)鍵詞 ：分布式防火墻，包過濾，策略執(zhí)行器， NDIS The Deign and Research of the Distributed Firewall Abstract With the rapid development of Interent work security issues more and more people39。 再次，通過對策略執(zhí)行器的實施方案的比較，以及結(jié)構(gòu)，處理流程和穩(wěn)定性的分并結(jié)合我國目前網(wǎng)絡(luò)的實際狀況，實現(xiàn)了一個分布式防火墻系統(tǒng)，給出了系統(tǒng)中 包過濾模塊的軟件實現(xiàn)。 本文首先分析了目前傳統(tǒng)防火墻的作用和存在的問題，接著對分布式防火墻的經(jīng)構(gòu)、關(guān)鍵技術(shù)以及優(yōu)勢進行了深入地研究，并對分布式防火墻的相關(guān)技術(shù)以及研究領(lǐng)較有代表性的幾種模型進行了比較總結(jié)。分布式防火墻設(shè)計 摘 要 隨著 Interent 的飛速發(fā)展，網(wǎng)絡(luò)安全問題越來越受到人們的關(guān)注，防火墻己經(jīng)成網(wǎng)絡(luò)安全的重要產(chǎn)品，邊界防火墻作為一種有效的網(wǎng)絡(luò)安全技術(shù)，提供了對企業(yè)內(nèi)部網(wǎng)絡(luò)的保護，但在不斷擴大的網(wǎng)絡(luò)規(guī)模和日益多樣化的網(wǎng)絡(luò)技術(shù)面前，邊界防火墻的缺也日益突出，它很難實現(xiàn)網(wǎng)絡(luò)的安全性和網(wǎng)絡(luò)性能之間的均衡。 為了 克 服 傳統(tǒng)防火墻的缺陷，而又保留其優(yōu)點，人們提出了分布式防火墻的概念分布式防火墻的本質(zhì)特征可概括為“策略集中制定分散實施，日志分散產(chǎn)生集中保存安全策略必須有管理員統(tǒng)一制定，策略必須被推到網(wǎng) 絡(luò)的邊緣即主機上實施，日志必統(tǒng)一收集、集中管理。 其次，通過對防火墻策略的定義、實施和分發(fā)機制的研究，對分布式防火墻的略管理進行了探討，并對策略執(zhí)行器的功能、特點和相關(guān)技術(shù)做了系統(tǒng)的分析。 最后，總結(jié)了全文并提出了一些值得研究的問題。s attention, firewall, work security has been a major product, the border firewall as an effective work security technology, provides an internal work protection, but in the Expansion of the work size and increasing diversity in front of the work technology, lack of border firewall also have bee increasingly prominent, it39。s current work of the actual situation and achieve a distributed firewall systems, the system is in the packet filtering software modules To achieve. Finally, summed up the text and made a number of issues worthy of study. Key Words: Distributed Firewall,Packetfiltering, rule executer,NDIS I 目 錄 1 緒論 ......................................................................................................................... 1 課題背景 ..................................................................................................... 1 國內(nèi)外研究現(xiàn)狀 ....................................................................................... 1 2. 分布式防火墻技術(shù)基礎(chǔ) .............................................................................. 3 防火墻概述： ............................................................................................ 3 傳統(tǒng)防火墻的體系結(jié)構(gòu)和實現(xiàn)技術(shù) .................................................. 4 防火墻的體系結(jié)構(gòu) ............................................................................... 4 防火墻實現(xiàn)技術(shù) ................................................................................... 4 防火墻的作用 ....................................................................................... 6 邊界防火墻的局限性 ........................................................................... 7 分布式防火墻的提出 ............................................................................. 8 分布式防火墻性能分析 .......................................................................... 8 分布式防火墻的基本原理 ..................................................................... 9 分布式防火墻的體系結(jié)構(gòu)及基本功能 ............................................ 11 分布式防火墻的體系結(jié)構(gòu) ................................................................. 11 分布式防火墻的功能 ......................................................................... 12 分布式防火墻實現(xiàn)的關(guān)鍵技術(shù) .......................................................... 12 3 分布式防火墻的總體設(shè)計 .......................................................................... 14 設(shè)計目標 .................................................................................................... 14 概述 ..................................................................................................... 14 設(shè)計目標的需求和安全狀況 ............................................................. 14 系統(tǒng)體系結(jié)構(gòu) ......................................................................................... 15 管理控制中心 ......................................................................................... 16 策略文件 .................................................................................................... 16 IP 過濾策略執(zhí)行器 ............................................................................... 17 II 包過濾 ................................................................................................. 18 日志 .................................................................................................... 18 4. 分布式防火墻的實現(xiàn) ................................................................................. 19 開發(fā)平臺與開發(fā)工具 ........................................................................... 19 包過濾模塊的實現(xiàn) ................................................................................ 19 中間層設(shè)計原理 ................................................................................. 19 編寫中間層驅(qū)動程序 ......................................................................... 21 流程分析 ............................................................................. 21 在 Passthru 中實現(xiàn)過濾功能 ........................................................... 23 日志上傳功能的實現(xiàn) .........................................................................