【作者】 郭渊博；

【导师】 马建峰；

【作者基本信息】 西安电子科技大学 ， 计算机应用技术， 2005， 博士

【摘要】 在信息安全研究领域,尽管人们已经开发了许多安全技术来防止攻击者对系统的破坏,但由于网络的开放性以及攻击技术的快速传播性,使得想开发出绝对安全的信息系统是不可能的。随之因运而生的就是一种新的信息安全防护手段-容忍入侵。容忍入侵是一种融合了密码技术和容错技术的全新网络安全技术。传统的安全技术更多强调的是如何保护系统以使之免受入侵;而容忍入侵更强调了系统的某些部分即使已经受到攻击者破坏或被攻击者成功控制时,系统如何继续对外提供服务,并保证数据的秘密性和完整性。显然,这种新型信息安全技术更符合当前信息可生存性的需求,是一种很有前途的安全防护手段。本文深入研究了容忍入侵相关的几个模型与系统设计问题,包括面向服务的容忍入侵系统模型、容忍入侵的可信第三方系统设计、容忍入侵的分布式数据存储系统设计,以及自适应安全的容忍入侵安全通信方法。同时对容忍入侵方法的一项关键支撑技术--秘密共享技术进行了研究,使之能够很好地满足容忍入侵的系统设计要求。具体地讲,本文成果包括以下几个方面:1、提出了一种面向服务的容忍入侵方法,给出了其系统模型和系统架构,并讨论了其中所涉及的一些重要的基本功能模块;在该模型基础上,设计了一个以容忍入侵为中心,结合防火墙与访问控制系统、分布式入侵检测系统等技术的,具有反馈交互的三层细粒度的动态纵深防御安全体系结构;2、借助集合论的相关概念研究设计了一种基于通用攻击结构的秘密共享方案,证明了该方案满足秘密共享所要求的秘密重构及完善保密两个基本特性,同时在参与方集上定义了一种关于攻击结构的等价关系,并给出了基于该等价关系的方案化简方法。最后,利用该通用方案的设计思想,对现有的一种基于图的攻击结构的秘密共享方案进行了适当改进;3、针对不具同步时钟模型且主机间不存在可靠通信通道的现实的分布式网络应用场合,通过引入可由协议事件和系统中各主机本地时钟双重驱动的时间片的概念,定义了异步模型中先应式秘密共享的运行状态及其转换过程,给出了异步环境中一种实用有效的先应式秘密共享方法;同时基于消息的冗余传输机制和认证应答机制,设计了一个消息可靠传输协议,用于在主动链路攻击存在的情况下保证协议参与方之间消息的正确传输;4、结合可验证秘密共享技术和知识证明技术,设计了一个计算安全且具有容忍入侵功能的可信第三方系统方案。分析表明,该方案具有正确性和保密性,以更多还原

【Abstract】 Intrusion-tolerance is the technique of using fault-tolerance to achieve securityproperties. It is an emerging approach to build survivable systems in recognizing that nosystem will be absolutely exempt from intrusions, and is considered as the ultimatedefense of the information systems. Instead of focusing on intrusion prevention, itassumes that system vulnerabilities cannot be totally eliminated, and that externalattackers or malicious insiders will identify and exploit these vulnerabilities and gainillicit access to the system. Its aim is to design systems with the capacity to fulfill itsprimary missions in the presence of intrusion or partial compromising. The toleranceparadigm in security has deserved great attention recently.This thesis is concerned with the design and construction of the intrusion-tolerantsystems. Some relevant models and systems design are presented in this thesis,including a services-oriented intrusion-tolerant model, a computationally secure andintrusion-tolerant Trusted-Third-Party system design, a protocols suite for distributeddata storage based on Tornado Codes tolerating Byzantine servers, and a novelapproach to adaptive secure communication on distributed environment. Besides, wefocused on the design of practical Secret Sharing scheme, one of the most importantbuilding blocks in the architecture of a range of different intrusion tolerant system.This thesis makes several contributions, including:1. Focusing on the effects of intrusion, which can be represented as the fails ofcomponents and function of the systems, a Services Oriented Intrusion-tolerant model ispresented, its framework and main building blocks are discussed, some fundamentalconcepts and principles of this model are introduced and summarized. Furthermore, afine-grained dynamical information security architecture through defense in depth withthree tier is proposed.2. We propose an efficient secret sharing scheme realizing generalized adversarystructure, and prove that the scheme satisfy both properties of the secret sharing scheme,i.e. the reconstruction property and the perfect property. The main features of thisscheme are that it performs modular additions and subtractions only, and that each shareappears in multiple share sets and is thus replicated. The former is an advantage in termsof computational complexity, and the latter is an advantage when recovery of somecorrupted participants is necessary. So our scheme can achieve lower computation costand higher availability. Some reduction on the scheme also is done in finally, based onan equivalence relation defined over adversary structure. Analysis shows that reducedscheme still preserves the properties of original one. Also, according to the designmethodology of above scheme, an improvement on some existing secret sharing schemerealizing graph-based prohibited structure is done.3. A method to realize practical proactive secret sharing in asynchronous networkswith unreliable links is proposed. The asynchronous PSS is obtained by introducing aconcept of time phase, which is defined not only in term of protocol events, but also intimings of all participants. Based on this concept, the states and their transitions ofasynchronous PSS is characterized. And, the reliable communications betweenparticipants is yields by the development of a reliable message transmit protocol, whichis designed by using the mechanisms of messages redundant transmission andauthenticated acknowledge. The results show that our schemes are correct and perfectwhile do not loss of communicating and computing performances.4. An original approach to establish a computationally secure and intrusion-tolerantTrusted-Third-Party system is presented, which is built on known verifiable secretsharing schemes knowledge proof techniques. Analysis shows that under theassumption of a Diffie-Hellman decisional problem, an adversary gets zero knowledgeabout the secret of the system, and in the random oracle model, an active adversarycannot impersonate successfully. By conducting a number of experiments in thefault-free case and various fault scenarios, we show that it has an acceptableperformance of practicability. Finally, with the use of Object Z, a formal language forsystem specification in an object-oriented style, we take this intrusion-tolerantTrusted-Third-Party system as an example to describe the components needed toformalize of an intrusion-tolerant system in the Object Z formalism, and illustrates howthese components can be combined via inheritance to produce complete model ofintrusion-tolerant system.5. A protocols suite for distributed data storage based on Tornado Codes toleratingByzantine servers is proposed, which is running on the client-server mode, andguarantee that the process of storing the information is correct even when some of theservers fail. We also consider some additional security requirement of the system, suchas integrity, privacy, and authentication. Among them, integrity is achieved by using thecryptographic tool called “distributed fingerprint”, which is the concatenation of thehash values of all the data fragments encoded by the Tornado Codes;Privacy of the datais guaranteed by combination use of the symmetric cryptosystem and thresholdcryptosystem;authentication is obtained by using the intrusion-tolerantTrusted-Third-Party model to authorize the write/read handles to the user when he/sherequest an legal access to the system.6. A novel approach to adaptive secure communication on distributed environmentis proposed, in which the adaptive is driven by multi-sources, including threat,performance, etc. By using of redundancy and adaptation, the secure communicationsystem can dynamically reconfigure its security policy on per session basis, based onthe awareness of system’s current security situation, resources available, configuration,and the user’s preference, thereby achieve a better tradeoff in system’s security andperformance. Also, the details of building blocks of adaptive secure communicationsystem are discussed, with the emphasis on the design of the system’s security situationassessment framework by using Dempster-Shafer’s (D-S) Evidential Reasoning Theory,and a security policy mechanism decision making model based on the AnalyticHierarchy Process.更多还原