Design And Implementation Of A Security Gateway Based On LWIP And OPEN SSL

Along with the rapid development of network,network security issues is prominent increasingly,the function of traditional network security equipment is simplex,unable to cope with a variety of network threats at the same time,the appearance of security gateway solves this problem.At present,in the network,the data that is transmitted in the form of HTTPS(Hypertext Transfer Protocol over Secure Sockets Layer)message increases gradually,this type of data provides sensitive information for encryption and protection,but at the same time,brings new difficulties to the security gateway to detect it also.In order to make the security gateway be able to detect the HTTPS message,the OPEN SSL(OPEN Secure Sockets Layer)is need to be embedded in the security gateway.This thesis explains the architecture of OPEN SSL firstly,and then the architecture of OPEN SSL is modified in order to make the OPEN SSL be embedded in the Netfilter framework,this thesis explains the processing and operation that is required in this modification in detail.In order to improve the performance of security gateway,the introduction of LWIP(Light Weight Internet Protocol)protocol stack is needed in the security gateway.This thesis introduces the basic model of LWIP,and then the LWIP is optimized and improved,to make it more suitable for the network environment that is more real-time and concurrent.To achieve bidirectional agent,the traditional method of Single-CT(Single Connection Tracking)needs to maintain the characteristic of TCP on both ends of the equipment,which makes the degree of coupling of the TCP and CT is very large,and there will be exception usually in this model when dealing with changing package due to the adjustment of the sequence number and window.In order to get rid of disadvantages of traditional method,this thesis puts forward a new method of Double-CT(Double Connection Tracking)combined with LWIP to complete bidirectional agent,the new method is expounded detailedly in this thesis,and the effectiveness of the new method is verified.