铁路移动通信网网络安全关键技术研究

发布时间：2018-05-20 16:50

本文选题：接入安全 + 鉴权　；参考：《北京交通大学》2017年硕士论文

【摘要】：随着计算机网络在各个领域的渗透,网络攻击手段越来越先进,网络不安全事件频发。因此近几年,我国已将网络安全上升到国家战略层面。而作为国家重要基础设施的铁路行业,铁路移动通信网网络安全防御也将面临更大的威胁和挑战。鉴于此,本文针对现有铁路移动通信网络存在的安全问题,进行详细的分析与讨论,并提出相应的安全解决方案,以全面保障铁路移动通信网网络安全。本文首先针对铁路移动通信网接入安全进行了相应的分析与讨论。对于非法设备接入问题,简要分析了设备识别寄存器(Equipment Identification Register,EIR)的工作原理,并且详细阐述了 EIR的两种方案在铁路的布置流程以及后期的改进方案。其次针对无线入侵的潜在威胁,简要分析了 A5算法缺陷以及伪基站对于铁路安全的干扰。为了有效抵御伪基站等干扰攻击,提出了的一种协商型的鉴权方式,实现移动台和网络的双向鉴权,保障铁路移动通信网接入的安全。其次,针对铁路移动通信系统GPRS子系统的安全,在端到端安全传输方面提出了一个适用于铁路GSM-R通信的安全传输模型。该模型在核心网增加了一个安全控制中心,主要负责密钥分发与储存,使得端到端会话都具有会话密钥,从而保证了非安全数据在GPRS子系统传输的安全。在GRRS子系统组网安全方面,重点对域名系统(Domain Name System,DNS),认证服务器(Remote Authentication Dial In User Service,RADIUS)以及防火墙的布置进行了详细的安全讨论,针对RADIUS现有设备认证业务与网管业务使用同一端口可能会暴露机车数据的问题,有针对性地进行了优化改造,实现业务分离,从而保障GPRS子系统的安全。针对GPRS子系统的业务安全,对铁路RADIUS、铁路数字移动通信系统GPRS归属服务器(GRIS Home System,GROS)网络日志进行了两种方法的监测分析。首先在Linux环境下使用Python调用MySQL完成有关规则的算法实现,得出了异常结果,并对结果进行了分析验证。在Windows环境下通过java编程设计出人机对话界面,实现了日志数据导入程序半自动化处理的功能。并对两种数据处理方案进行时间测试以及可操作性分析。在基于java编程分析的基础上增加了逻辑规则阈值时间的可选。并引入异常率的概念,分析了各种阈值时间对异常率的影响。该日志分析软件使得铁路对异常业务的监测分析更加便捷与准确,保障铁路移动通信网的业务安全。最后,本文对铁路移动通信网络的安全工作进行了总结,并对未来的工作进行了展望。
[Abstract]:With the penetration of computer network in various fields, network attack means are more and more advanced, and network insecurity incidents occur frequently. Therefore, in recent years, our country has raised the network security to the national strategic level. As an important national infrastructure, railway mobile communication network security defense will also face greater threats and challenges. In view of this, this paper analyzes and discusses in detail the security problems existing in the existing railway mobile communication network, and puts forward corresponding security solutions to ensure the overall security of the railway mobile communication network. In this paper, the access security of railway mobile communication network is analyzed and discussed. For the problem of illegal equipment access, this paper briefly analyzes the working principle of device identification register Identification register, and expounds in detail the layout flow of two schemes of EIR in the railway and the improvement scheme in the later stage. Secondly, aiming at the potential threat of wireless intrusion, the defect of A5 algorithm and the interference of pseudo-base station to railway safety are analyzed briefly. In order to resist the interference attack of pseudo-base station effectively, a negotiated authentication method is proposed to realize the bidirectional authentication between mobile station and network, and to ensure the security of railway mobile communication network access. Secondly, aiming at the security of GPRS subsystem of railway mobile communication system, a secure transmission model for railway GSM-R communication is proposed in the aspect of end-to-end secure transmission. In this model, a security control center is added to the core network, which is mainly responsible for key distribution and storage, so that end-to-end sessions have session keys, thus ensuring the security of the transmission of non-secure data in the GPRS subsystem. In the aspect of GRRS subsystem network security, the security of domain name system Name system DNSN, authentication server remote Authentication Dial In User Service radius) and the arrangement of firewall are discussed in detail. Aiming at the problem that the same port of RADIUS equipment authentication service and network management service may expose locomotive data, this paper optimizes and reconstructs the existing equipment authentication service and realizes the separation of services, thus ensuring the safety of GPRS subsystem. Aiming at the service safety of GPRS subsystem, two methods of monitoring and analyzing railway radius and GPRS home server of railway digital mobile communication system (GRIS Home system group) are presented in this paper. Firstly, using Python to call MySQL in Linux environment to complete the algorithm implementation of the rules, the abnormal results are obtained, and the results are analyzed and verified. The man-machine dialogue interface is designed through java programming in Windows environment, and the function of semi-automatic processing of log data import program is realized. Time test and maneuverability analysis of two kinds of data processing schemes are also carried out. On the basis of programming analysis based on java, the optional threshold time of logic rule is added. The concept of abnormal rate is introduced, and the influence of threshold time on anomaly rate is analyzed. The log analysis software makes the monitoring and analysis of abnormal services more convenient and accurate, and ensures the safety of railway mobile communication network. Finally, the security work of railway mobile communication network is summarized, and the future work is prospected.
【学位授予单位】：北京交通大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：U285.21;TN915.08

【相似文献】