【作者】 左永利；

【导师】 吴中福；

【作者基本信息】 重庆大学 ， 计算机系统结构， 2007， 硕士

【摘要】 入侵容忍技术是一种新的信息安全方法,在过去十几年逐渐显现出来,最近赢得了国内外众多研究者的关注。传统的数据库信息安全研究主要集中在如何进行防御上,如认证、加密、访问控制、防火墙、入侵检测等,其目标是建立安全的数据库系统,然而我们必须清楚地认识到并不是所有的攻击都能有效的被抵御,对于内部攻击更是无能为力,再则传统的数据库安全体系结构不能适应攻击多变的环境。而自适应入侵容忍数据库正是这样的安全系统,他保证了在系统遭受到入侵的情况下,如何使系统仍然能够为合法用户提供不间断的服务,动态地采取各种容侵策略,保证数据库的可用性、完整性和机密性,自适应地提高数据库系统入侵容忍能力。本文首先对入侵容忍技术进行了详细的探讨,讨论入侵容忍技术的实现方法,按照应用类型、研究层次和研究问题对入侵容忍进行分类,介绍了当前国内外相关领域的研究现状,并在此基础上,从系统的整体角度出发,根据数据库系统安全的需求,构建了一种多层次的入侵容忍数据库安全模型——基于角色访问的自适应容侵数据库体系结构。设计使用了冗余及多样性技术,从结构上保证了系统的可生存性;采用基于角色的访问控制技术(RBAC)和神经网络技术等生成并采取动态的容侵策略,使系统具有更强的弹性;事务级的入侵容忍能够有效抵御攻击者利用合法用户信息进行的内部攻击。然后,对系统使用的关键技术进行了详细的描述,并对影响系统容侵性能和效率的关键因素进行了分析,并研究出对策。此外,本文还讨论了一些有争议的问题和未来的研究方向。本文给出的入侵容忍数据库系统模型采用了基于角色的访问控制、秘密共享、间接访问、冗余和多样性等技术,因此具有冗余、安全、自适应入侵容忍等特点。系统不依赖于单个部件的安全,即使某个组件被入侵者攻破也不会使整个系统瘫痪。此外,由于我们的入侵容忍数据库系统是建立在COTS(Commercial-Off-The-Shelf)数据库系统之上的,因此还具有低成本,易扩展,开发周期短等特点。更多还原

【Abstract】 Intrusion tolerance (IT) is a new approach of information security that has slowly emerged during the past decade, and gained impressive momentum recently. Traditional database information security research focused on how to defend against them, such as authentication, encryption, access control, firewall, Intrusion Detection, its goal is to establish a more secure database system, but can not resist all the intrusions, and powerless to do anything more for the internal attacks, more over could not adapt to the ever-changing environment. However Adaptive Intrusion Tolerant Database System is such a system that aiming to continue delivering essential services for legal users under malicious attacks, dynamically adopt various intrusion tolerance strategy to ensure availability, integrity and confidentiality to the database data, and adaptively enhance the system’s intrusion-tolerant ability.The paper begins with a detailed exploration of intrusion tolerance technology, explains the realization of intrusion tolerance technology, gives a sort research based on applying types, research level, and research issue, introduces the status in this area domestic and abroad. Then setting off from systematic entirety, and on the bases of the security of database system, we put forward a multi layer intrusion tolerant security model——An Adaptive Architecture for Intrusion-tolerant Databases on Role-Based Access Control. Redundancy and diversity technology are used in this design, which ensures system’s survivability. Another, the technologies of Role-Based Access Control(RBAC) and Neural Networks etc bring dynamically Intrusion-tolerant policy to this new architecture, and better flexibility is gained. At last, transaction level intrusion-tolerant is offered, which could resist inside attacks.Detailed description about the key technology in this architecture is carried out. Then we have done an analyze to the key factors which effect system performance. At the end, the paper discusses the directions about the intrusion tolerance existing problems and the research.The paper presents an intrusion tolerance database system model,which adopted RBAC, secret shares, indirectly interview, redundancy with variety etc technique, therefore have the redundancy, safe, flexible intrusion tolerant ability etc characteristics. The system is done not depend on safety of single parts. Even a certain module was offended to break,the whole system also can’t be paralyzed by the invader. In addition, database is established on top of the COTS characteristics of low cost, expands easily, because of intrusion tolerance groupware, therefore it still has short Development period etc.更多还原