發(fā)布時(shí)間：2018-01-19 11:37

  本文關(guān)鍵詞： 單向隔離 BLP模型 無干擾 隱通道控制　出處：《北京交通大學(xué)》2015年碩士論文　論文類型：學(xué)位論文

【摘要】：隨著鐵路運(yùn)輸需求的不斷增長,當(dāng)前的鐵路系統(tǒng)面臨極大的挑戰(zhàn)。鐵路信息化發(fā)展戰(zhàn)略已經(jīng)將智能鐵路作為未來的發(fā)展方向。為實(shí)現(xiàn)鐵路系統(tǒng)更加智能和高效地運(yùn)作,需要鐵路各個(gè)業(yè)務(wù)系統(tǒng)之間互聯(lián)互通、信息共享和協(xié)同工作,然而連通不同安全級(jí)的業(yè)務(wù)系統(tǒng),會(huì)帶來一系列嚴(yán)重的網(wǎng)絡(luò)安全威脅,例如敏感信息泄漏、網(wǎng)絡(luò)攻擊與入侵等。傳統(tǒng)的網(wǎng)絡(luò)安全防護(hù)技術(shù)雖然保證了一定級(jí)別的網(wǎng)絡(luò)安全,但卻無法實(shí)現(xiàn)徹底的安全隔離,而且對于內(nèi)部原因造成的敏感信息泄漏安全問題也無能為力。隨著新型網(wǎng)絡(luò)攻擊的不斷出現(xiàn)以及鐵路信息系統(tǒng)對安全的特殊需求,如何從根本上保證不同安全級(jí)網(wǎng)絡(luò)的邊界安全,從而實(shí)現(xiàn)鐵路信息系統(tǒng)不同安全域之間安全隔離與信息可靠交換,已經(jīng)成為當(dāng)前智能鐵路建設(shè)亟待解決的問題之一,也是本文研究的課題。 本文首先對現(xiàn)有的安全隔離與信息交換技術(shù)及其原理進(jìn)行分析,并總結(jié)了它們各自的優(yōu)點(diǎn)與不足。在理論方面,研究了經(jīng)典的BLP(Bell-LaPadula Model)安全理論模型,分析基于該模型的單向通信在安全性與可用性之間的矛盾。為解決該矛盾,本文引入信息流無干擾模型的思想,通過降級(jí)域,實(shí)現(xiàn)信息以降級(jí)方式逆向流動(dòng),彌補(bǔ)了遵循BLP模型的單向通信在可用性方面的缺陷。在安全性方面,借助虛擬化隔離技術(shù)將通信進(jìn)程的執(zhí)行環(huán)境分離,對降級(jí)域潛在的隱通道進(jìn)行安全控制。基于以上研究,本文提出單向安全隔離與信息交換機(jī)制,該機(jī)制不僅實(shí)現(xiàn)了不同安全級(jí)網(wǎng)絡(luò)之間物理單向隔離與虛擬化隔離的雙重安全隔離,也保證了信息的可靠交換。最后,基于單向安全隔離與信息交換機(jī)制,本文設(shè)計(jì)并實(shí)現(xiàn)了單向安全網(wǎng)關(guān)原型系統(tǒng),通過對原型系統(tǒng)的測試與分析,論證了該機(jī)制的可行性。在實(shí)際應(yīng)用上,利用單向安全網(wǎng)關(guān)原型系統(tǒng),實(shí)現(xiàn)了不同安全級(jí)網(wǎng)絡(luò)之間文件單向“擺渡”,數(shù)據(jù)庫單向同步以及郵件單向轉(zhuǎn)發(fā),并在鐵路信息安全等級(jí)保護(hù)關(guān)鍵技術(shù)示范系統(tǒng)中得到應(yīng)用。 本文的研究成果綜合考慮了多種安全隔離技術(shù)的特點(diǎn),在BLP安全模型基礎(chǔ)上,結(jié)合了信息流無干擾模型的思想,協(xié)調(diào)了安全性和可用性之間的矛盾,在滿足不同安全級(jí)網(wǎng)絡(luò)信息交換的同時(shí),有效解決了各種網(wǎng)絡(luò)入侵攻擊和敏感信息泄漏安全問題,為鐵路信息系統(tǒng)不同安全域之間安全隔離與信息交換提供了技術(shù)和理論上的參考。
[Abstract]:With the increasing demand of railway transportation. The current railway system is facing a great challenge. The development strategy of railway informatization has taken intelligent railway as the future development direction. In order to achieve the railway system more intelligent and efficient operation. Railway business systems need to be interconnected, information sharing and collaborative work. However, connecting different security level business systems will bring a series of serious network security threats, such as leakage of sensitive information. The traditional network security protection technology can guarantee a certain level of network security, but it can not achieve a complete security isolation. Moreover, there is nothing that can be done about the safety of sensitive information leakage caused by internal reasons. With the continuous emergence of new network attacks and the special security requirements of railway information systems. How to guarantee the boundary security of different security level networks fundamentally, so as to realize the security isolation and reliable exchange of information between different security regions of railway information system. It has become one of the problems to be solved urgently in the construction of intelligent railway, and it is also the research topic of this paper. In this paper, the existing security isolation and information exchange technology and its principle are analyzed, and their respective advantages and disadvantages are summarized. This paper studies the classical BLP(Bell-LaPadula Model security theory model, and analyzes the contradiction between security and usability of one-way communication based on this model. This paper introduces the idea of non-interference model of information flow, and realizes the reverse flow of information in downgrade mode through demotion domain, which makes up for the shortcomings of one-way communication following BLP model in usability and security. With the help of virtualization isolation technology, the execution environment of communication process is separated, and the potential hidden channels in degraded domain are controlled safely. Based on the above research, this paper proposes a one-way security isolation and information exchange mechanism. This mechanism not only realizes the double security isolation of physical one-way isolation and virtualization isolation between different security level networks, but also ensures the reliable exchange of information. Finally, based on one-way security isolation and information exchange mechanism. This paper designs and implements the prototype system of one-way security gateway, and proves the feasibility of the mechanism by testing and analyzing the prototype system. In practical application, the prototype system of one-way security gateway is used. The paper realizes file one-way "ferry", database one-way synchronization and mail one-way forwarding between different security level networks, and is applied in the demonstration system of key technology of railway information security level protection. The research results of this paper take into account the characteristics of various security isolation technologies. Based on the BLP security model and the idea of information flow non-interference model, the contradiction between security and usability is coordinated. At the same time, it can effectively solve the security problems of various network intrusion attacks and sensitive information leakage. It provides a technical and theoretical reference for the security isolation and information exchange between different safety domains of railway information system.
【學(xué)位授予單位】：北京交通大學(xué)
【學(xué)位級(jí)別】：碩士
【學(xué)位授予年份】：2015
【分類號(hào)】：TP393.08

【參考文獻(xiàn)】

相關(guān)期刊論文 前10條

1 劉金鎖;;基于單向隔離技術(shù)的電力內(nèi)外網(wǎng)信息安全交互平臺(tái)研究[J];電力信息化;2010年08期

2 丁慧麗;陳麟;李霞;;基于BLP模型的單向傳輸系統(tǒng)安全性分析[J];計(jì)算機(jī)安全;2010年06期

3 饒躍東;熊瑜;;基于“震網(wǎng)”病毒的物理隔離網(wǎng)絡(luò)的風(fēng)險(xiǎn)控制措施[J];廣西科學(xué)院學(xué)報(bào);2012年01期

4 曹震;孫德剛;史林港;唐碧華;謝剛;;單向信道的信息可靠傳輸機(jī)制研究[J];計(jì)算機(jī)工程與應(yīng)用;2011年24期

5 周偉;尹青;郭金庚;;計(jì)算機(jī)安全中的無干擾模型[J];計(jì)算機(jī)科學(xué);2005年02期

6 張興;黃強(qiáng);沈昌祥;;一種基于無干擾模型的信任鏈傳遞分析方法[J];計(jì)算機(jī)學(xué)報(bào);2010年01期

7 陳睿,田忠和;物理隔離網(wǎng)閘數(shù)據(jù)交換技術(shù)的研究[J];計(jì)算機(jī)與數(shù)字工程;2005年02期

8 王昌達(dá);李志國;管星星;薄兆軍;;IP時(shí)間隱通道通信協(xié)議的研究[J];計(jì)算機(jī)應(yīng)用研究;2012年07期

9 趙伯聽;李飛;牟鵬至;;一種安全單向信息傳輸設(shè)備研究及設(shè)計(jì)[J];計(jì)算機(jī)應(yīng)用與軟件;2010年06期

10 劉波;陳曙暉;鄧勁生;;Bell-LaPadula模型研究綜述[J];計(jì)算機(jī)應(yīng)用研究;2013年03期

，

本文編號(hào)：1444026