支持TNC的SSL VPN系统的研究

发布时间：2018-05-08 10:07

本文选题：可信网络连接 + 虚拟专用网　；参考：《西安电子科技大学》2014年硕士论文

【摘要】：SSL VPN是一种用于安全远程访问企业内部敏感数据的VPN技术，与复杂的IPSec VPN相比，SSL VPN配置简单，部署方便，已成为商业应用领域最主要的安全远程接入方式。传统SSL VPN能保证只有授权用户才能接入企业内部网络，还能对在线传输的敏感数据进行加密保护，但接入者使用的终端是否安全，传统SSL VPN并不关心。如果终端不安全，比如已经中了病毒或木马，接入企业内部网络后，很可能因不合规的终端行为，导致企业内部敏感数据泄露，甚至对整个企业内部网络的安全带来威胁。TNC是一种对接入终端进行完整性度量的技术，可利用其对终端的完整性进行保护，进而保证终端行为的合规。目前，TNC在局域网接入控制中的应用已很成熟，但在远程接入控制中的应用则鲜有成功案例。本文研究“支持TNC的SSL VPN系统”，就是要将TNC技术应用到远程接入技术SSL VPN中，以保证远程接入时，不仅接入者身份合法，而且接入终端行为合规。本文先对TNC技术和SSL VPN技术进行了介绍，，然后对SSL VPN系统的底层协议TLS进行了扩展，以使其支持TNC需要的EAP消息的传递。在此基础上，基于OpenVPN、FreeRADIUS和TNC@FHH，设计并实现了一个支持TNC的SSLVPN系统，并针对BIOS的完整性检查、BOOTLOADER的完整性检查、系统配置的合规性检查编写了TNC要求的IMC和IMV模块。最后，对系统进行了测试，结果表明，系统工作正常，实现了保证远程接入时，不仅接入者身份合法，而且接入终端行为合规的目标。
[Abstract]:SSL VPN is a kind of VPN technology used for secure remote access to sensitive data in enterprises. Compared with the complex IPSec VPN, SSL VPN has become the most important secure remote access mode in the commercial application field because of its simple configuration and convenient deployment. The traditional SSL VPN can guarantee that only authorized users can access the internal network of the enterprise and encrypt the sensitive data transmitted online. However, the traditional SSL VPN does not care about the security of the terminal used by the accessor. If the terminal is not secure, such as having been hit by a virus or a Trojan horse and connected to the internal network of an enterprise, it is very likely that sensitive data inside the enterprise will be leaked due to irregular terminal behavior. TNC is a technology to measure the integrity of the access terminal, which can be used to protect the integrity of the terminal and ensure the compliance of the terminal behavior. At present, the application of TNC in LAN access control is very mature, but there are few successful cases in remote access control. In this paper, "SSL VPN system supporting TNC" is studied, which is to apply TNC technology to the remote access technology SSL VPN, so as to ensure that the remote access system not only has the legitimate identity of the accessor, but also the behavior compliance of the access terminal. This paper first introduces TNC and SSL VPN technology, then extends the underlying protocol TLS of SSL VPN system to support the EAP message transmission required by TNC. On this basis, a SSLVPN system supporting TNC is designed and implemented on the basis of OpenVPN Freeradius and TNC @ FHH, and the IMC and IMV modules required by TNC are written for the integrity check of BIOS and the compliance check of system configuration. Finally, the system is tested and the results show that the system works normally and achieves the goal of not only the legal identity of the accessor, but also the behavior compliance of the access terminal when the remote access is guaranteed.
【学位授予单位】：西安电子科技大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【共引文献】