节点文献
网络安全策略监控模型及关键技术研究
Research of Network Security Policy Monitoring Model and Key Technologies
【作者】 彭军；
【导师】 陈性元；
【作者基本信息】 解放军信息工程大学 ， 计算机应用技术， 2009， 硕士
【摘要】 近年来,随着安全管理的发展,安全策略管理已成为研究热点。目前,针对安全策略管理,研究较多的则是在策略统一描述、策略翻译以及策略冲突检测与消解等方面。然而,随着研究的深入,也需要对策略监控技术进行研究,以了解策略在系统中的配置情况以及策略下发到设备之后的执行情况,进一步保证策略管理系统的可靠运行。因此,作为安全策略管理系统的重要组成部分,策略监控技术成为了目前乃至今后一段时期内策略管理发展的又一项前沿技术。本文针对策略监控技术涉及的相关内容进行了深入的分析和研究,主要的工作如下:1.对策略的整个生命周期作了分析和总结,提出了策略配置状态与策略执行状态两个概念,引入有限状态自动机理论,运用到策略状态转换过程中,建立了策略监控模型,并进一步明确了策略监控的目的和任务,奠定了对策略全生命周期的生存状态进行监控的理论基础。2.针对策略监控模型,提出了基于消息通道的策略监控机制——基于双队列的组织有效防止了消息乱序,并使用统一的监控消息格式和消息通道进行封装并排队,屏蔽了不同系统设备的数据差异,获取监控事件数据,提高了监控的效率。3.通过对安全策略的两阶段执行过程的研究,提出了基于双点检测的策略执行监控数据采集方法,实现了对策略执行状态数据的捕获;针对策略监控的远程需求,采用BEEP协议框架进行扩展,设计了策略监控数据传输协议PMDTP(Policy Monitoring DataTransort Protocol),解决了策略监控机制中的两个关键技术。4.基于本文提出的策略监控机制与相关技术方法,对策略监控的原型系统进行了设计实现。综上所述,本文设计了基于Mealy自动机的策略监控模型以及基于消息通道的策略监控机制,并解决了其中涉及的关键技术,一方面为策略监控前沿技术的研究奠定了理论基础,另一方面,为构建一体化的安全策略管理系统提供了有益的技术支持。
【Abstract】 With the development of the security management, security policy management becomes a hotspot in the research of imformation security. Otherwise, few people concerned the research of the policy monitoring technology, which is one of the most important components in the policy management that guarantee the whole security of the system.The monitoring technology has been wildly used in the network management and the resourse management. Therefore, the policy monitoring technology will be a hotspot of the policy research in the future.In this paper, we study the policy and the content interralated of network security devices to solve the policy monitoring problem. The main works of this paper are as follows:1. Propose the states translation theory in the whole life of the policy. Build a policy monitoring model based on the FSA. According to the policy lifecycle and the FSA theory, we build the policy states translation model, which provides us the academic guidance for the study.2. Design the common monitoring message channel for the phase of policy monitoring which can be used for the capture of the monitoring events. Then the policy states can be changed or the illegal events would be alarmed to the manager.3. Propose a double spots detection mechanism for the policy working states monitoring for the acquisition of the policy enforment data; and a transport protocol is designed for the monitoring data transporting based on BEEP, which settled the teledata’s transportting to the policy monitoring platform.4. Based on the research above, we design and implement the policy monitoring prototype system PMS.Policy monitoring technology is a new field in the policy theory. According to the need of the project, we study on the policy monitoring in the policy management system, which provide theoretical and technical supports for constructing security environment.