PRINCIPLE AND IMPLEMENTATION OF FIREWALL MECHANISM IN LINUX KERNEL

徐辉,潘爱民,阳振坤

2002-01-01

Abstract:This paper elaborates on the firewall mechanism in Linux 2.2 kernel, named IPchains, and gives the analysis of its scheme and implementation. The concept of dynamic Network Address Translating and IP masquerade in Linux are also discussed. A brief introduction is given to the firewall in the new 2.4 Linux kernel at the end of this paper.

What problem does this paper attempt to address?

A Reference Model And System Architecture For Database Firewall

L Cai,Xh Yang

DOI: https://doi.org/10.1109/ICSMC.2005.1571196

2005-01-01

Abstract:More and more network attacks are focusing on application level vulnerabilities. Recently, several examples of this trend have been highly publicized such as the SQL Slammer and SQL Snake attacks. Traditional firewalls, used for protecting the database, only prevent attacks searching for vulnerabilities. Database firewalls take defense deep into the organization by providing full syntax control and audit of the SQL AN stream before it reaches the database, and enforcing content-driven access to database. This paper proposes a layered reference model for database firewalls by enhancing the capability of COAST Laboratory's model. It separates a database firewall into three layers (network layer, schematic layer and semantic layer) according to the knowledge, computation target, and the control granularity of each layer. Based on this model, a database firewall product had been prototyped It can greatly improve the database security by introducing self-controlled authentication principal mapping, object mapping, and mandatory access control modules.
The Fire Wall Based on Linux

Xiaorong Gao

2003-01-01

Abstract:With the constant development of the application of computer network, the network security is more and more important. This paper discusses the key techniques of network security and shows how to build a firewall based on Linux. Besides, it gives prospects for the development of future firewall.
Internet Firewall and its Linux Implementation

Huafeng Lü,Qiufeng Wu

DOI: https://doi.org/10.3321/j.issn:1002-8331.2001.08.015

2001-01-01

Abstract:This paper explains the basic theory of the Interbet firewall technology,introduces the architectures of several kinds of firewall,and gives out some firewall softwares under Linux operating system and their applications.
On the Implementation of a Firewall Based on Linux Platform

范训礼,景广军

DOI: https://doi.org/10.3969/j.issn.1000-2758.2002.03.011

2002-01-01

Xibei Gongye Daxue Xuebao/Journal of Northwestern Polytechnical University

Abstract:This paper presents a firewall system based on Linux - L-Firewall, which combines packet filter and proxy technology. Proxy and authentication are implemented on B1 level operating system. The paper emphasizes on the L-Firewall frame, especially on the implementation of packet filter module. L-Firewall provides not only HTTP, FTP proxy and packet filter, but also content filter, network address translation to protect network from IP spoofing and IP source route spoofing. L-Firewall tallies with GB/T17900-1999 and GB/T18020-1999.
The research of firewall technology in computer network security

Wei Chen,Yantao Wang,Xin Yue

DOI: https://doi.org/10.1109/PACIIA.2009.5406566

2009-11-01

Abstract:This paper analyzes the computer network security features and the main threat, synthesis the firewall technology of current domestic and international, on the basis of various firewalls' principles, advantages and shortcomings. Through the synthesis and compare of various techniques, in-depth study of the main factors affection firewall performance, combined with the network status quo of Heilongjiang Provincial Center, this paper researches the firewall technology of the actual application in the computer network security, then refers the new technique called tight coupling firewall, finally the article leads to a lack of firewall technology and the direction of its development.

Computer Science
An Efficient Privacy-Preserving Scheme for Wireless Link Layer Security

Yanfei Fan,Bin Lin,Yixin Jiang,Xuemin (Sherman) Shen

DOI: https://doi.org/10.1109/glocom.2008.ecp.891

2008-01-01

Abstract:In this paper, we propose an efficient privacy-preserving scheme for secure packet transmission at wireless link layer. The proposed scheme is constructed by using hash values in reverse hash chains as interface identifiers. It can successfully and efficiently resist the Media Access Control (MAC) address based attacks, such as flow tracking and traffic analysis, which are launched by either outside or even inside attackers. In addition, some optimization techniques are also introduced to further improve the efficiency of the proposed scheme. The extensive analysis and simulations demonstrate the enhanced security and efficiency of the proposed scheme.
Design for Firewall Integrating with Intrusion Detection

Jian Xie

2004-01-01

Abstract:It is hard for single- functioned secure products to meet the current demand,and the trend begin to change towards Integration.A frame of firewall based on Linux is discussed as to improve the ability of security control.
Intrinsic Security: A Robust Framework for Cloud-Native Network Slicing via a Proactive Defense Paradigm

Qiang Wu,Ran Wang,Xincheng Yan,Chunming Wu,Rongxing Lu

DOI: https://doi.org/10.1109/MWC.001.2100251

IF: 12.777

2022-01-01

IEEE Wireless Communications

Abstract:Opening-up sharing has prompted the multi-tenancy architecture, whereby different vendors (including outsourcees) work together with network operators to form a vibrant service ecosystem, resulting in several advantages as well as risks. In particular, the static nature of existing architectures in network functions virtualization-based (NFV-based) clouds facilitate hacking. Thus, much attention has been focused on determining how to avoid the uncontrollable cloud security induced by complex production relations and non-trustworthy software/hardware sources when the two sets of security risks intersect. In this article, we investigate latent persistent threats against cloud environments and determine a high degree of complementarity and consistency between the NFV-based cloud environment and the dynamic defense concept. More specifically, new NFV-based cloud features provide an effective implementation for dynamic defense, while the generalized robustness of dynamic defense theory allows for high security gains. Intrinsic cloud security (iCS) is then proposed to align NFV-based clouds, mimicking defense and the moving target defense (MTD) paradigm to implement a seamless integration and symbiosis evolution between security and NFV-based clouds. We quantify the impact on system overhead to account for efficiency and cost issues. The simulation analysis demonstrates that the enhanced mode is able to consistently obtain a more beneficial and stable defense compared with the counterparts.
Research on Information Security Model and Security System Design

黄益民,平玲娣,潘雪增

DOI: https://doi.org/10.3785/j.issn.1008-973x.2001.06.005

2001-01-01

Abstract:After study of existing security models; analysis of information flow model, Bell-LaPadula(BLP) access control model and Biba access control model; and collation and comparison of their advantages and disadvantages, an improved model is put forward that satisfies the actual demands of information security. An implementation strategy is put forward that ensures information security, reliability, practicality and compatibility in the designed security system. An implementation scheme of this security system and its components and functions is provided. This system combines the following functions: mandatory access contro1, privilege separation, security audit, identity authentication and self-protection. It achieves the level 3 of national information security standard and level B1 of TCSEC standard. It was implemented in the Windows NT and Linux operating system and has yielded good resultsin application.
IPSec-based Distributed Firewall Security Architecture

崔伟,齐竞艳,蔡圣闻,黄皓

DOI: https://doi.org/10.3969/j.issn.1000-3428.2004.16.051

2004-01-01

Abstract:The paper introduces the basic notion of distributed firewall, analyses the security threatens. Then it introduces IPSec protocols,and presents an IPSec-based distributed firewall security architecture including the internal design and external design.This architecture combines IPSec and some other secure measures with distribtued firewall so as to give distributed firewall stronger security.
Design and implementation of security gateway prototype system based on protocol translation

CHEN Zhi-xiang,LU Yin,LU Sang-lu,CHEN Dao-xu

2007-01-01

Journal of Computer Applications

Abstract:This paper described the design of a security gateway based on protocol translation in IPv4-IPv6 hybrid network, and implemented a security gateway prototype system based on Linux 2.6 kernel netfilter framework. The prototype system tracks up-layer UDP/TCP connections based on protocol translation and it performs hybrid end-to-end access control policies. Experimental testing results indicate that it has small latency during end-to-end packet transmission and may satisfy the needs of enterprise networking.
Design and Implementation of a Firewall IPS Module

Xiang-dong QIAO,Tong YANG,Jing-wei ZHANG

DOI: https://doi.org/10.3969/j.issn.1009-3516.2007.04.018

2007-01-01

Abstract:Two different design schemes about firewall IPS module are brought up.In the first scheme snot-inline technique and the QUEUE action of netfilter are used to achieve dropping of attack data packet.In the second one,IPS about Denial of Service attack is achieved with the benefit of combination of synccokies,the new netfilter fuzzy match,PSD match,U32 match with an improvement on the firewall kernel.After comprehensive comparison,the module is developed according to the second scheme.The experiment shows that the designed module works well in defending main DOS attack.
Hybrid-mode IPv6 IPSec-VPN Implementation Toward Linux Netfilter Scheme

沈燕然,张青山,王新,薛向阳

2008-01-01

Abstract:Development of IPv6 networks brought the need of secure communication between private networks and different kind of personal devices.Secure and scalable communication protection scheme is required.While IPSec-VPN is a popular solution,it has several drawbacks such as forced requirement of accessor's knowledge about VPN gateways.In this paper,we proposed a new IPSec-VPN packaging mode-hybrid mode,and gave the implementation of it using Linux kernel netfiltering scheme.Applications show that the hybrid-mode IPSec-VPN works well for different VPN topologies and makes VPN gateways transparent to users.
Principle and Application of Network Address Translation Systems

包亮,潘金贵

DOI: https://doi.org/10.3969/j.issn.1002-137X.2001.07.010

2001-01-01

Computer Science

Abstract:Since Network Address Translation (NAT)systems, which will translate address between two address realms,were first introduced to solve the address shortage problem,they have been adopted in many domains. In this paper, basic principles, primary forms and application will be discussed. And some countermeasure on the co-exist with IPSec will be given.
Firewall Network Security Research

Chen Liang

Abstract:Text information on the content of network security and the fundamental changes, expounding China's development of national information security system and the importance of the establishment of China's network security system with the need. On the network firewall security technology and the classification of the main technical characteristi.

Engineering,Computer Science
Firewall Traffic Control Based on Network Processor

ZENG Wu,ZHANG Guo-bing,HUANG Hao

DOI: https://doi.org/10.3969/j.issn.1001-3695.2006.11.028

2006-01-01

Abstract:Network processor is a kind of programmable processor combining the flexibility of software and the high perfor-mance of hardware.This paper analyses some of the buffer management and packet scheduling algorithms,designs a new firewall traffic control algorithm called DPTC and provides its design and implementation on the Intel's network processor.
Wired Equivalency Privacy and Its Implemention

李挥,郑继荣,陈曦

DOI: https://doi.org/10.3969/j.issn.1003-353x.2003.07.010

2003-01-01

Abstract:The security mechanism of wireless local area network is presented and theoreticallyanalyzed. The logical design of WEP module in wireless LAN MAC Controller is described in detail.The WEP module is modeled in Verilog HDL, and verified by Verilog-XL。
Research And Design Of Nids Based On Linux Firewall

Jia Zongpu,Liu Shufen,Wang Guowei

DOI: https://doi.org/10.1109/SPCA.2006.297482

2006-01-01

Abstract:Firewall has many shortages, such as it cannot keep away interior attacks, it cannot provide a consistent security strategy, and it has a single bottleneck spot and invalid spot, etc. Intrusion Detection System (IDS) also has many defects, such as low detection ability, lack of effective response mechanism, poor manageability, etc. If firewall and IDS are integrated, the cooperation of them can implement the network security to a great extent: on the one hand, IDS monitors the network, provides a real-time detection of attacks from the interior and exterior, and automatically informs firewall and dynamically alters the rules of firewall once an attack is found; on the other hand, firewall loads dynamic rules to hold up the intrusion, controls the data traffic of IDS and provides the security protection of IDS. Based on constructing firewall with Iptables in the environment of Linux OS, the respective characters of firewall and IDS are analyzed. Then, the viewpoint of integrating firewall and IDS to realize the network security is proposed, and the application and algorithm of intrusion detection are systemically analyzed and designed.
An Enhanced Security Auditing Mechanism for Linux

徐辉,潘爱民

DOI: https://doi.org/10.3969/j.issn.1001-3695.2004.11.052

2004-01-01

Abstract:An enhanced security auditing mechanism for Linux is proposed.This mechanism is based on loadable kernel mo-(dule) and provides system level and application level auditing functions.System audit generates an audit record for every security sensitive system call.Application level audit abandons the traditional auditing fashion that auditing system completely depends on applications writing log file in user space.Instead,applications and system kernel will generate audit record coordinately.Examples are given for intrusion detection with this mechanism.
Design and Implementation of Enterprise Network Security System Based on Firewall

Hui Yuan,Lei Zheng,Shuang Qiu,Xiangli Peng,Yuan Liang,Yaodong Hu,Guoru Deng

DOI: https://doi.org/10.1007/978-3-030-15235-2_142

2019-04-25

Abstract:With the rapid development of the network, in recent years, the Internet has greatly improved people’s lives, and the real-time, sharing and distance-removing characteristics of network information transmission have made the operation and management of enterprises more efficient and coordinated. The basis of refinement. At the same time, various network security incidents have followed, such as hacker attacks on computer network systems, and various types of viruses, Trojans and other active attacks emerge one after another. In this regard, this paper analyzes the enterprise network security system of firewall from the perspective of enterprise network security, briefly summarizes the background, advantages and disadvantages of firewall technology, and designs and implements a client software according to the actual needs of users. The network performs real-time intelligent security monitoring. After the system design is completed, the security is tested by building a simulation platform, including qualitative testing and quantitative testing, which are divided into security and performance to verify whether the system can achieve and guarantee performance.

PRINCIPLE AND IMPLEMENTATION OF FIREWALL MECHANISM IN LINUX KERNEL

A Reference Model And System Architecture For Database Firewall

The Fire Wall Based on Linux

Internet Firewall and its Linux Implementation

On the Implementation of a Firewall Based on Linux Platform

The research of firewall technology in computer network security

An Efficient Privacy-Preserving Scheme for Wireless Link Layer Security

Design for Firewall Integrating with Intrusion Detection

Intrinsic Security: A Robust Framework for Cloud-Native Network Slicing via a Proactive Defense Paradigm

Research on Information Security Model and Security System Design

IPSec-based Distributed Firewall Security Architecture

Design and implementation of security gateway prototype system based on protocol translation

Design and Implementation of a Firewall IPS Module

Hybrid-mode IPv6 IPSec-VPN Implementation Toward Linux Netfilter Scheme

Principle and Application of Network Address Translation Systems

Firewall Network Security Research

Firewall Traffic Control Based on Network Processor

Wired Equivalency Privacy and Its Implemention

Research And Design Of Nids Based On Linux Firewall

An Enhanced Security Auditing Mechanism for Linux

Design and Implementation of Enterprise Network Security System Based on Firewall