【作者】 李哲；

【导师】 周安民；

【作者基本信息】 四川大学 ， 通信与信息系统， 2004， 硕士

【摘要】 数据库系统中用户的访问控制方法是衡量数据库系统安全性的重要标志之一。目前大多数数据库系统的访问控制安全策略都采用的是用户名／口令认证方式，这种方式的安全保障是十分有限的，有可能遭遇被动的嗅探攻击、主动的中间人攻击和口令猜测攻击。而且用户一旦登录数据库系统之后，客户端与服务器之间进行频繁的数据交换时，如何保证数据在网络传输过程中的保密性和完整性，以防数据被嗅探和篡改，这也是一个应该引起重视的问题。 SSL历经多次修订，已经成为世界上部署最为广泛的安全协议，尽管SSL最常见的用途是保证Web通信的安全，但实际上它也是一种相当通用的协议，适用于保护种类繁多的各种通信数据的安全。在实际应用中，如果只是在SSL连接上简单地承载应用数据，往往会引发事与愿违的安全隐患与性能瑕疵，应用层协议需要协议设计者对SSL有了足够的了解后才能在其上安全运行。通过对SSL工作原理及其安全特性的深入研究，我们认为SSL基于证书的认证方式能够很好地解决目前大多数数据库基于用户名／口令认证方式所暴露出来的诸多问题，而且如果将证书与ACL结合起来使用，还能对不同权限的数据库用户进行访问控制。另外，在SSL协议中，要求客户与服务器之间的数据是经过加密的，而且在提供保密性的同时，SSL还以它特有的数据整合方式提供完整性保护。因此，利用SSL的这一特点，我们也可以为数据库系统中客户端与服务器的数据传输构建一条密文通道。 本文在指出了常用的基于用户名／口令的数据库访问控制方法的弱点的同时，详细研究了在SSL协议应用中涉及到的数字证书、加密算法、性能优化等四川大学硕士学位论文SSL协议在数据库系统安全中的应用研究问题，提出了在网络数据库系统的用户访问控制中使用基于SSL协议的证书认证这一双向身份鉴别方式，利用SSL在数据库用户和服务器之间构建一条安全的保密通道，将SSL协议与数据库安全有机地结合起来，并在此基础上设计实现了一个简单的数据库插件系统。 经测试表明，利用5 SL构建数据库用户与服务器之间的安全连接这一设想是可行的，能够实行有效的双向身份认证，满足我们在访问控制和保密通信两方面的安全需求。 关键词:数据库;SSL协议;证书;认证。更多还原

【Abstract】 The access control method is one of the most important aspects in measuring the security of a database system. Nowadays most database systems are using client/password authentication method as their access control security strategy, which has poor security preservation and has been suffering varieties attacks, such as passive sniffing attack, active man-in-the-middle attack and password guess attack. Further more, once clients have logged into database systems and while the clients and servers are exchanging their data, how to protect the confidentiality and integrity of data from intercepting and modifying on the wire has caught a great deal of attention.Modified for many times, SSL has become the most widely used secure protocol in the world. Although it is usually used to secure network communications, SSL is actually a common protocol, which is suitable for protecting the security of varieties of communication data. In reality, just simply transferring data on SSL usually causes unexpected security and function problems. The SSL protocol requires a good understanding of security principles to apply securely so that the application protocol developers can make their designs work well. Through profoundly studying on the work principles of SSL and its security features, we realize that the certificate-based authentication method can solve the problems existing in client/password-based authentication method mentioned above. For themore, if we use certificates combined with ACL, we can well control database clients with different access authorities. In addition, SSL requires the data transferred between clients and servers should be encrypted. Further more, not only does SSL provide us data confidentiality, it also preserves the integrity of data by its special way of data package. Therefore, we can use this to build up a cipher text communication pipe for data transferring between clients and servers of database systems.In this paper, we discuss the shortcomings of client/password-based database access control method, and we also talk about digital certificate, cryptographic algorithms and function improvement in SSL application. After all these work, we recommend that the SSL-based certificate authentication can be used as client access control method in database systems, and we can also use SSL to set up a safe secret communication channel. Based on above specification, we developed and realized a simple database plug system.It proves that the tentative idea of using SSL in database systems is desirable. It not only can provide us reliable authentication, but also can satisfy our demands in both access controlling and secret communication.更多还原