【作者】 周剑岚；

【导师】 王红卫； 冯珊；

【作者基本信息】 华中科技大学 ， 系统工程， 2006， 博士

【摘要】 随着Internet推动的全球信息化迅速扩展,计算机网络成为现代社会发展所依赖的重要基础设施。虚拟空间Cyberspace的安全保障也成为世界各国继国力和主权行使所及的领土、领空、领海之外的又一个国防领域。如何在复杂性不断增长的网络环境中,建立强大有效的信息安全保障体系,是当今全球瞩目的重大课题。网络与信息安全保障体系的有效性,又取决于其整体的应变能力。随着网络技术的高速发展,计算机和互联网的广泛应用,单位内部网络规模日益庞大,网络拓扑结构愈趋复杂,网络安全保障实现的难度与日俱增,向人类社会提出了严峻的挑战。基于Agent的综合内网安全系统的研究,是作者面向这种挑战所作的努力。网络是信息的载体与流通渠道,信息是网络生存的理由和服务的对象。两者的安全性也是相辅相成的。网络与信息安全管理从管理网络线路和设备实体到维护信息主权保障安全存储和传输,再到信息资源使用效益的极大化和网络运作成本的极小化,有其特殊的发展规律,并具有空间分布、时变、异构同存等系统复杂性。因此,网络与信息安全保障与防御系统的设计与实现属复杂系统工程。虽然网络按其敷设空间大小分为广域网(WAN)和局域网(LAN)等,但网络与信息安全系统的设计与实现却只按信息主权归属和本网合法享用信息的用户计算机所在空间范围而定。本文所研究的网络与信息安全系统属于这类主权归专门机构所有的计算机专用网络,称此专用网络为内网。本文所论安全问题属内网的安全系统设计。本文中的单位内部网络需要对网内的主机进行监控,也称可控内网(Controllable Internal Network, CIN)。70%的网络安全问题出自内部网络,而防火墙技术不能百分百阻断入侵,因此,强化防火墙以内的网络安全策略和措施,具有无庸置疑的重要性和现实的必要性。又因为内部泄密及发动攻击者和具备积极防范意识而掌握减免灾害技术者都是“人”。所以,内部网络的安全策略和技术选择是面向“人”的。本文的研究目标是:在以“人”为本的重要思想指导下,将安全防线设置到每一位合法用户的主机上。采用先进的多Agent(智能体)技术,将内网安全保障系统实现为综合的单位内部网络安全系统(Comprehensive Internal Network Security System, CINSS)。保障内网信息资源的安全服务包括身份认证、访问控制、安全审计等等,同时,病毒等也对内网安全构成很大的威胁。因此,CINSS在分析了国内外同类技术与产品的安全性需求、综合功能、成本和易实现性等基础上,提出并实现了基于Agent技术的综合内网安全系统。CINSS的具体子系统和研究内容包括:身份认证与访问控制子系统;漏洞检测子系统;安全审计子系统;软件自保护模块和Agent执行环境的防护。CINSS的技术解决思路如下:利用软件防火墙的主机数据包过滤技术实现身份认证和基于角色的网络访问控制,将以上功能封装成认证Agent。因此,系统的正常运行依赖于网络的各主机都必须安装认证Agent。认证Agent作为一种软件,可被用户有意无意的损坏,因此,CINSS必须对其进行防护,这属于软件自保护技术。同时,内部用户仍旧可以通过携带新机器,或重新安装操作系统等方式逃避认证而非法访问网络,因此,对认证Agent的执行环境必须进行监测,主动发现并防范该类安全性问题。另外,hacker或病毒是通过漏洞感染主机的,因此,整合漏洞检测系统,通过检测主机漏洞,评估其安全风险级别,将高风险的主机与网络隔离起来,实现事前对主机和网络的防御。将安全审计或其它安全软件封装成移动Agent,在需要时派遣至网络各节点中完成相应的安全任务,从而实现可定制的安全策略。各种Agent之间是通过协作来完成安全任务的,因此,通信的安全性问题十分重要;可以简便地利用相关用户登录口令的hash值作为密钥,基于对称加密算法的安全通信机制实现之。更多还原

【Abstract】 With the rapid global information development driven by Internet, computer network turns into one of the most important infrastructures. The security safeguard of the Cyberspace has become another national defense field except that the territoriality, airspace and marginal sea dealt with by the all the countries. How to build powerful and effective information security architecture in the complicated network environment is the great task. The effect of the network and information security architecture lies on the whole resourcefulness. With the rapid development of the network technique and the broad application of the computer and Internet, the network scale becomes larger, the topological structure becomes more complex, the security safeguards difficulties increase steadily, and all of these bring forward severe challenge. The research of the agent-based comprehensive internal network security system is the effort made by the author.The network is the carrier and channel, the information is the object of the network serves. Both complement each other. The management of network and information security covers from the maintenance of network cables and device entities to the secure storage and transmission, then to the maximum information resources utilizing benefit and the minimum network management cost, all of these have their rules and the systematical complicated characteristics of distributed, time-variant and commensal isomer. So, the design and implementation of the network and information security safeguards and defense systems belong to the complex systems engineering.Although the network can be divided as Wide Area Network (WAN) and Local Area Network by its size, the information dominion belonging and the legal user computer sharing the information determines the design and implementation of the network security system. What the network and information security system researched by this paper belongs to this kind of computer special network, which is called the internal network and possessed by the specialized agency. What the security problems demonstrated and discussed by this paper belong to the design of internal network system. Because all the hosts in the internal network should be monitored, the network is also called Controllable Internal Network (CIN).Almost 70% security problems come from internal network; the firewall can’t prevent all of the outside intrusions, so the strength of the network security policies and measurements inner the firewall are very important and necessary. All of the telltales, the attackers and the engineers alleviating disasters are the“humans”. So, the security policies and technique choices of the internal network are orientated to the“human”.The research object of this paper is listed as fellows: under the important human centered idea, it is necessary to put the security defense on each illegal user host. This paper devotes to the comprehensive internal network security system (CINSS) based on the advanced multiple agent technique.The internal network security services include authentication, access control, security audit and so on, meanwhile, viruses pose threats to the network. So, CINSS proposes and implements the agent-based comprehensive internal network security system after analyzing the national and international congener techniques and products by considering the security requirements, comprehensive functionalities, costs and easy to realize. The concrete sub-systems and research context include: the authentication and access control sub-system; the vulnerabilities detection sub-system; the security autdit sub-system; the software self-protection and the agent operation environment defense.The technique solution of the CINSS is listed as below: using the host packets filter to implement the authentication and role-based network access control and integrating these functionalities into the authentication agent. The normal operation of this system relies on the agent installed on each host. Because the users can destroy the authentication software agent, CINSS must provide the protection mechanism for the agent, which belongs to the self-software protection technique. Meanwhile, the inner users could carry the new host or reinstall the operative system to escape the authentication and access the network uncontrollably, so, it is necessary to monitor the agent operation environment, to forwardly detect and prevent such security problem. Otherwise, hackers and viruses attack or infect the hosts through the host vulnerabilities, it is significant to integrate the vulnerabilities detection system. Such system is used to evaluate the security risk class, to isolate the high risks host from the network, ultimately, to realize the proactive defense. The mobile agent encapsulated by security audit or other security packages are dispatched to the network nodes to implement corresponding security tasks, which customs the security policies. The secure communication problem is very important due to the cooperation among the agents; the user password related hash value is used as secret key, which implements the communication mechanism by the method of Symmetric Cryptography.更多还原