信息安全运维审计模型及关键技术研究

发布时间：2018-04-01 22:00

本文选题：电力信息安全　切入点：运维审计模型　出处：《华北电力大学(北京)》2014年博士论文

【摘要】：智能电网的建设极大促进了电力行业信息化的发展,在信息化与电力工业的深度融合过程中,来自企业内部的威胁正成为电力信息安全亟待解决的问题。目前电力二次系统采用分区分域的防护策略,实现了工业控制系统和管理信息系统的隔离,侧重于防范外部攻击,但对于来自内部的安全风险防范保护存在严重不足。本论文基于电力行业信息安全现状,研究内部安全威胁的防范策略和安全保护手段,重点针对信息系统的运行维护操作安全防护,研究了一种基于审计的行为管控模型,防范内部用户的不合规操作带来的安全风险。论文的研究工作及取得的主要成果体现在以下几个方面：(1)分析了电力行业业务系统和信息安全的研究现状,研究了电力信息系统业务安全面临的威胁和电力信息系统运维审计的安全需求,在此基础上,提出了运维审计模型,设计了旁路监听审计网络模型和基于代理的运维审计网络模型。结合基于角色的访问控制(RBAC)模型和通用访问控制框架(GFAC),对信息安全运维审计模型的访问控制机制进行了形式化描述和分析。(2)研究了运维安全审计的关键技术,重点研究了高效的网络数据包捕获和数据流重组技术,主要内容有：①传统网络数据包抓取方式需要进行多次数据复制和上下文切换,效率较低,本文研究了网络数据包“零拷贝”技术,采用“无锁化”数据同步机制,显著减少了数据复制和上下文切换开销。②研究了基于共享内存的数据流快速重组技术,根据运维审计系统的特性,简化了对TCP协议的处理流程,设计了高效的TCP流状态机,实现数据的高效转发。③提出了自适应双协议栈技术,使发给本机和需要转发的数据都能够得到有效处理。④提出了局域网自适应哈希(LAAH)算法,对TCP数据包进行快速查找和定位处理,根据网络数据流的局部性特征,采用移至最前法对冲突结点进行处理,有效减少了哈希冲突的查找时间。电力行业运维审计应用场景的模拟测试表明LAAH算法具有很好的效率。(3)研究了基于字符命令和图形的运维协议的解析和回放技术。研究了网络虚拟终端(NVT)和XTERM终端控制命令序列。研究了远程桌面协议(RDP)的原理和解析方法。设计并实现了RDP运维会话的回放程序,包括回放文件和支持时间控制、播放控制的播放器。(4)针对常见运维协议,分析了协议的认证过程中的安全风险,研究了增强认证安全的方法。提出动态随机用户密码(DRUP)模型,通过可信网络通道传输一次性动态随机用户名密码,然后在不可信或存在安全风险的网络通道中将其用于登录验证,从而解决了运维认证过程中泄露用户凭证的问题。(5)针对某省电力公司的信息系统运维的安全需求,根据研究的审计模型和关键技术,采用构件架构技术,设计并实现了一套运维审计系统软件,并进行了安装部署和运行测试。
[Abstract]:The construction of the smart grid has greatly contributed to the development of electric power industry informatization, in the integration of information technology and the depth of the electric power industry process, from the internal threat is becoming the power information security problems to be solved. The power system adopts two protection strategy partitions the domain, realizes the isolation of industrial control system and management information system focus on prevention, external attacks, but for internal security risk protection is inadequate. The present situation of information security in electric power industry based on the study of the internal security threat prevention strategy and safety protection methods, key operation for the information system maintenance operation safety protection, studies a kind of behavior control model based on audit, prevention an internal user security risk operation brings. The main achievements of the research work of this paper and has been reflected in the following aspects Surface: (1) analyzed the research status of electric power industry, business systems and information security, the security of power information system business and the threat of power information system operation and maintenance of the audit security requirement, on this basis, put forward the operation and maintenance of the audit model, audit design bypass monitoring network model and network operation and maintenance of the audit model based on agent. Combining the role based access control (RBAC) model and general access control framework (GFAC), the model of the operation and maintenance of information security audit access control mechanism was described and analyzed. (2) research on key technology of operation and maintenance of safety audit, focus on efficient network packet capture and data flow recombination technology. The main contents are as follows: firstly, the traditional network packet capture methods require multiple data copying and context switching, low efficiency, this paper studies the network packet "zero copy". Operation, using "lock free" data synchronization mechanism, significantly reduces the data copying and context switching overhead. Study on shared memory data stream technology based on rapid reorganization, according to the characteristics of operation and maintenance of the audit system, simplifies the process of the TCP protocol, the design of efficient TCP flow state machine, efficient implementation of data forwarding the proposed adaptive. The dual stack technology, to make the machine and the need to retransmit the data can be treated effectively. The proposed adaptive LAN Hashi (LAAH) algorithm, the TCP packet fast search and positioning, according to the local characteristics of network data flow, to deal with the conflict node adopts to the method effectively reduces the lookup time. Hashi conflict simulation test of power industry operation audit application scenarios show that LAAH algorithm has good efficiency. (3) research based on the character and command Parsing and playback technology maintenance agreement. Graphics on the network virtual terminal (NVT) and XTERM terminal control command sequence. On the remote desktop protocol (RDP) principle and analytic method. The design and implementation of RDP operation and maintenance session playback procedures, including file playback and support time control, the player (playing control. 4) for common maintenance agreement, analyses the risk of security authentication protocol in the research methods of enhancing authentication security. The dynamic random user password (DRUP) model, through the trusted network channel transmission time dynamic random username and password, and then in the network channel will not trusted or there are security risks for login authentication thus, to solve the operation and maintenance of the certification process leaked user credentials. (5) the security requirements for the maintenance of the information system of electric power company, according to the audit model research and Key technology, using component architecture technology, designed and implemented a set of operation and maintenance audit system software, and carried out the installation and operation test.

【学位授予单位】：华北电力大学(北京)
【学位级别】：博士
【学位授予年份】：2014
【分类号】：TM76;TP309

【相似文献】