基于分布式联动技术的网络安全策略研究

发布时间：2018-02-12 08:11

本文关键词： 网络安全分布式联动技术设备认证协议　出处：《南京邮电大学》2014年硕士论文　论文类型：学位论文

【摘要】：目前企业网络大多采用分层的组网设计，而设备厂商的防攻击手段大多进行单机部署，缺少设备与设备之间的有效认证，以及安全策略的联动机制，不能有效识别可能发生的攻击行为进而对其进行有效拦截，从而造成网络攻击的扩散，甚至汇聚或核心设备的瘫痪，进而造成网络中断、网络质量下降及其影响面大等问题。本文主要研究通过基于分布式的设备认证，形成跨层网络的联动检测，实现防攻击策略和技术的分布式部署。其中重点对设备认证的技术原理、安全策略的联动技术进行分析和阐述，并给出一种有效的防网络攻击的安全联动技术的部署方案。本文的主要研究成果如下：（1）提出分布式联动安全策略，它扩展了传统以太网交换机的软件，为Commander/Relay角色增加“配置模块”、“认证模块”、“client策略分发和动态调整模块”、“动态检测模块”；并对原有交换机的接口管理模块、AAA/Radius模块、告警管理模块进行了修改。（2）参考MAC认证和密码认证设计出设备安全认证，详细介绍了Client与Commander/Relay之间的认证流程，，Commander、Relay之间的认证流程。（3）设计出分布式联动安全策略的分发、动态调整和检测机制，并对其中的报文进行少量的扩展。
[Abstract]:At present most of the enterprise network design of network layers, and anti attack equipment manufacturers mostly stand-alone deployment, the lack of effective authentication between equipment and equipment, and the security strategy of the linkage mechanism, aggressive behavior can not effectively identify possible and to carry out effective interception, resulting in the diffusion of network attacks, or even sink the core equipment of paralysis, causing network outages, network quality decrease and the impact of large problems.
This paper mainly studies the device authentication based on distributed detection, form a joint cross layer network, distributed attack prevention strategy and technology deployment. The technical principle and emphasis on equipment certification, linkage technology security strategy is analyzed and explained. The deployment scheme and gives an effective attack against network security interaction technology.
The main research results of this paper are as follows:
(1) this paper proposes a distributed interactive security strategy, which extends the traditional Ethernet switch software, add "configuration module for the Commander/Relay role," the authentication module "," client strategy distribution and dynamic adjustment module "," dynamic detection module; interface management module, and the replacement of the original turn of the AAA/Radius module, alarm management module was modified.
(2) design safety authentication based on MAC authentication and password authentication. The authentication process between Client and Commander/Relay is introduced in detail, and the authentication process between Commander and Relay is introduced.
(3) the distribution of distributed linkage security strategy, dynamic adjustment and detection mechanism, and a small amount of expansion of the message are designed.

【学位授予单位】：南京邮电大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【相似文献】