具有主动防御能力安全路由器的研究与设计

本文通过对现有路由器的攻击手段和防御方法进行研究分析,指出了现有路由器被动防御方式的缺陷.文中将路由器收到的IP包分为两大类:中转IP包和终点IP包.通过对两种IP包的威胁进行分析比较,指出终点IP包是潜在威胁最大的包,并采用主动防御的思路解决终点IP包对路由器的威胁.文中最后通过引入一个具有智能学习、分析和防御能力的协处理机,协助路由器对终点IP包进行专门处理,使路由器免受终点IP包的攻击,具备主动防御的能力和攻击容忍性,且不影响路由器的路由性能.

Study and Design for Security Router Having Active Defense Capability

In this paper, the attack and defense ways of present routers are studied and analyzed. It shows that the passive defense ways of available routers have some disadvantages. The Internet Protocol (IP) packets received by a router is divided into two class- transfer IP packets and end IP packets. The comparison of the threats concludes that the end IP packets are the most dangerous ones, which should be actively defended. An assisting device having intelligent learning, analyzing and defense capabilities is introduced to deal with the end IP packets specially, and protect the router from their attacks. Hence, the router will have the abilities of active defense and attack-bearing, and its performance will not be influenced.