【作者】 吴迪；

【导师】 李忠献；

【作者基本信息】 北京邮电大学 ， 信息安全， 2013， 硕士

【摘要】 随着互联网的高速发展,几乎所有的企事业单位在日常工作中都离不开计算机。然而,企业在感受网络所带来的便利的同时,也面临着各种各样的攻击和威胁：机密泄漏、数据丢失、网络滥用、身份冒充、非法入侵等。网络安全管理系统致力于保护局域网内部主机的安全,系统可以通过添加不同的安全设备来实现对网内主机的全方位保护,但是引用第三方安全设备来实现内网安全管理的系统也带来了新的问题。首先,添加安全设备必然带来兼容性等方面的问题,带来一些额外的开销。例如,每添加一款安全设备,开发人员都需要添加一系列相应的页面来支持该设备,给开发人员带来较大的工作量。其次,安全设备会在遇到风险时实时将事件上报给安全管理系统,当多个设备同时上报时,为了保证系统能够正确的接收所有上报的事件,就要求安全管理系统具备一定的高并发处理能力,但是目前主流的Apache和Tomcat服务器在高并发处理方面性能较弱,有可能导致安全事件出现漏报和误报的情况,带来安全隐患。为了解决以上引入第三方安全设备带来的新问题,本文利用Nginx代理服务器设计了一种方案：1)利用Nginx代理服务器的重定向功能实现从安全管理系统到安全设备管理系统的跨域访问,从而减少了因添加安全设备带来的额外的工作量问题。2)设计开发一款基于Nginx的通信模块,该模块能够接收安全设备发送过来的HTTP请求,同时对请求内容进行解析、处理和入库。凭借着Nginx的超强高并发处理能力,来解决由于大量事件同时上报导致的事件漏报和误报现象。经过测试,对于第一个问题,能够实现从安全管理系统直接跨域访问安全设备管理系统；对于第二个问题,测试表明新开发模块能够接收到安全设备上报的事件,且压力测试证明Nginx服务器能够处理至少20000事件的并发上报,完全能够满足本系统的要求。更多还原

【Abstract】 With the rapid development of the Internet, almost all enterprises are inseparable from the computer in their daily work. Otherwise, while the enterprise experiences the convenience brought about by the network, it faces a variety of attacks and threats:secrets leakage, data loss, network abuse, identity impersonation, illegal invasion and so on. Network security management system is committed to protect the security of the hosts in the LAN by adding different safety devices.But adding the third-party security devices to the network security management system can also bring new problems. First, adding safety devices will inevitably bring about compatibility issues and other aspects of problem, which will bring some additional expenses. For example, when adding a safety device, developers need to add a series of pages to support the device, which bring developers greater workload. Secondly, the safety device will report the risk events to the safety management system in time when it occors.When multiple devices reported at the same time,in order to ensure the system is able to correctly receive all reported events,the system should have the ability of high concurrent processing.But Apache and Tomcat server are weak in highly concurrent processing performance and they may lead to security occurrence of false negatives and false positives which will bring about security threat.In order to solve the problem caused by adding third-party security devices, I design a scheme based on Nginx proxy server:1) In order to achieve the function of cross-domain access that from safety management system to safty device management system, I use the redirect function of Nginx proxy server, which reduces the additional workload by adding safety devices.2) I design and develop a communication module based on Nginx which is able to receive HTTP request from safety devices, pares the request content, processing and storage. With the super high concurrent processing capability of Nginx, to resolve false negatives and false positives due to the large number of events reported to the server at the same time.After testing we get the following conclusions:as for the first question,we can realize the function of cross-domain access that from safety management system to safty device management system; as for the second question, the communication module can receieve events from the safety devices, and stress test show that Nginx server is able to handle at least20,000concurrent events reported, which fully able to meet the requirements of the system.更多还原