基于专业过滤器的网络管理与安全系统

本文介绍了基于专业过滤器的网络管理与安全系统的设计和实现过程，该系统结合了包过滤、用户认证、计费和数据加密等多种技术。由屏蔽路由器、屏蔽主机等实现的包过滤器出于本身的安全、性能和复杂性等考虑，其过滤策略很难改变，用户不能参与管理帐户权限。本系统借鉴了代理服务器中的用户认证功能，使用户可参与管理自己的帐户权限，可有效地防止合法ＩＰ地址的非法盗用。同时，由于采和了硬件加速和包过滤技术，可得到较高的吞吐

A NETWORK MANAGEMENT AND SECURITY SYSTEM BASED ON PROFESSIONAL PACKET FILTER

Design and implementation of the network management and security system based on professional packet filter are presented in this paper. techniques, such as packet filtering, user authentication, accounting and encryption are combined to support the implementation of this system. In packet filters like screen routers and screen hosts,due to the security, performance, and simplicity consideration , the filtering policies are difficult to change , and users can not control the access rights of their accounts.Authentication functionality which usually appears in proxies is applied to this system and effectively prevents the illegal usage of the legal IP addresses by unauthorized users .Users are allowed to manage their accounts' access rights. The throughput of the filter is enhanced by using special hardware. More users can be served by the system.This system has been used in several campus networks ,such as Xi'an JiaoTong University.