【作者】 张腾；

【导师】 罗守山；

【作者基本信息】 北京邮电大学 ， 信息安全， 2014， 硕士

【摘要】 随着互联网信息技术的发展,越来越多的用户加入了互联网,使得原本紧缺的IPv4地址变得更加匮乏。因此,目前大面积的部署IPv6网络用以解决IPv4地址匮乏的趋势越来越明显。然而,基于IPv6网络的安全技术研究却跟不上时代的步伐,而传统IPv4网络的安全评估技术也无法复制运用在IPv6网络上。为此,对IPv6网络安全问题研究、IPv6网络的安全评估技术研究成了一个更新的话题。经调研发现,日本、欧洲、美国早在90年代初期就已经对IPv6网络安全进行研究。同时,我国作为互联网发展的大国,也在不断对IPv6网络发展进行跟进,譬如已经把高校网络建立成IPv6网络,作为研究和实验的基地。本文以高校IPv6网络为依托,研究了面向IPv6网络的安全评估技术,主要包括对IPv6网络渗透测试方法的研究,解决IPv6主机发现问题和渗透测试步骤的方案设计；对IPv6网络特有攻击方式的研究,了解了IPv6网络存在的特有脆弱点问题；对IPv6网络攻击图的研究,解决了IPv6网络下攻击图自动化生成的问题；对IPv6网络风险评估方法的研究,解决IPv6网络评估和风险值计算的问题；以及面向IPv6网络的安全态势分析,对IPv6机构层面、地域层面、业务系统层面以及威胁弱点层面的进行多层次安全态势展示。在实践中,本文为了对所研究的安全评估技术进行实验验证,开发了面向IPv6网络安全评估系统,有助于在实战中对IPv6网络下的系统进行安全评估。系统包含了渗透测试模块、弱点知识库模块、攻击图生成模块、评估结果导出模块以及安全态势分析模块。本文基于校园网络搭建的模拟评估实验环境,演示了在IPv6网络下,对IPv6网络下被评估主机进行扫描发现、渗透测试和弱点验证,完成后将安全评估技术文档上传至系统实现自动化解析,之后存储到IPv6弱点知识库中的过程。最后,利用系统演示了如何进行攻击图的自动化生成和最终安全评估结果的导出,以及基于评估的结果对IPv6网络下的弱点情况实现安全态势展示。更多还原

【Abstract】 With the development of Internet information technology, more and more users join in the Internet, which makes the already scarce IPv4addresses become more scarce. Therefore, the trend of the deployment of IPv6network in large area has become more and more obvious for solving the shortage of IPv4network’s address. However, technology research for IPv6network’s security couldn’t keep up with the pace of the times, and the traditional assessment technology for IPv4network’s safety is unable to replicate the IPv6network. Therefore, the research about problems and security evaluation technology on IPv6network has become newer topic. The research has found that Japan, Europe, American has conducted the research on IPv6network’s security in the early90’s. At the same time, as the Internet developing country, China has kept up with the development of the IPv6network. For example, our country has regarded colleges and universities as the base for research and experiment for IPv6network.Based on IPv6network of colleges and universities, this paper studied the security evaluation technology on the IPv6network, including the penetration testing technology which has solved the IPv6network’s host finding problems and the design of penetration testing step, and the research of specific attack method on IPv6network which made us understand the unique vulnerability problems on IPv6network. This paper studied the attack grap on IPv6network which has solved the automatic generation of IPv6network’s attack graph, and the method of evaluation for IPv6network’s security in order to solve the IPv6network’s evaluation and the problems of risk value calculation. Finally, this paper has displayed IPv6network’s security situation on the institutional level, regional level, the IPv6business system level and the threat vulnerability level.In practice, in order to verify the reliability of safety assessment methods, this paper designed a demo system for the process of IPv6network’s security evaluation which contained the penetration testing module, the storage for the base of IPv6network’s weakness knowledge, the automatic generation of IPv6network’s attack graph and safety assessment report. To observe the vulnerability information situation of IPv6network, this paper designed the module for analysis and display about IPv6network’s security situation. Through relying on the evaluation of the weakness of the knowledge base, the system can reveal the automated assessment of situation for IPv6network’s security.更多还原