关键词: 防火墙,规则匹配,IPV6,二叉树

Abstract: As is known to al1,firewall is the core device to guarantee network security,and rule matching is one of the most important technologies to firewall.However,those high performance rule matching algorithms based on IPV4 are not suitable for IPV6 with the network derivation from IPV4 to IPV6.The main cause of this situation is that the range of IPV6 address is much bigger than the range of IPV4 address.Thus we suggested a high performance rule matching algorithm suitable for IPV6,named HiPRM (High Performance Rule Matching).HiPRM algorithm classifies the whole rule set into several parts with the protocol and destination port field of rules,and it selects special bits from the combination of source and destination IPV6 address of rules to construct binary trees.After the construction of binary trees,those rule sets are split into smaller rule sets.When a packet matches one of these smaller rule sets,the linear searching algorithm is used to find the matching rules in this small rule set.Analysis and experiment results show that HiPRM algorithm not only has good time and space performance,but also has better scalability with different rule sets.

Key words: Firewall,Rule matching,IPV6,Binary tree