P2P主動防禦系統之設計與實作

Abstract

P2P（Peer to Peer）網路自90年代末開始崛起，隨著近期P2P應用範圍越來越廣泛，相對亦衍生出不少資安問題，諸如著作權、頻寬問題、病毒偽檔、個人隱私等。教育部於2008年正式行文各級學校禁止使用P2P軟體進行非法檔案傳輸，然而P2P軟體大量使用動態連接埠，傳統Layer3防火牆已經無法有效阻擋其連線。 本研究針對此問題，以自由軟體為基礎，設計一套傳輸層的防禦的方式（稱之為T4-terminator，T4代表Transport Layer4），並引用兩套應用層的防禦套件（L7-filter、IPP2P），證明能有效禁止P2P連線行為。另外，本研究以免費軟體建構出測試環境，分別對三套防禦系統進行效能測試，最後分析其優缺點，提供網管人員管理P2P網路之參考。

P2P（Peer to Peer）applications have emerged since late 1990s. However, the widespread adoption of P2P applications lately have accounted for some concerns about information security, such as copyright、bandwidth、virus、individual privacy and so on. In 2008, Ministry of Education in Taiwan composed an official document, which stated schools at all levels should forbid the illegal usage of P2P file transfer. However, since P2P applications used dynamic ports in a large amount and thus the traditional Layer3 firewalls were unable to block them. To resolve this problem, we designed an IPS based on transport layer inspection to drop P2P traffic.We named our IPS as T4-terminator(T4 for Transport Layer4).We also studied two other IPS,L7-filter and IPP2P,which are baesd on Open Source software . Furthermore, we also established a benchmarking environment with freeware, which is used to evaluate the performance of these approaches. The conclusions could offer a reference to MIS people for managing P2P network.