基于主机的网络层访问控制机制设计与实现  

Design and Implementation of Host-based Access Control Mechanism on Network Layer

作　　者：李莉[1] 沈苏彬[1] 毛燕琴[1] 

机构地区：[1]南京邮电大学网络技术研究中心,南京210003

出　　处：《计算机工程与应用》2006年第8期114-117,140,共5页Computer Engineering and Applications

基　　金：国家自然科学基金资助项目(编号:60273091)

摘　　要：目前大部分访问控制机制实施于网络边缘,无法解决网络内部的安全问题。文章提出了一种基于主机的网络层访问控制机制,它由密钥协商协议和报文检测协议组成,对主机的网络行为和报文传递提供安全控制,适合在局域网等小范围网络实施,能够解决网络内部的假冒、篡改等安全问题。在局域网环境下实现了基于Linux平台的访问控制系统,对系统总体设计方案、开发平台、关键机制的实现方法及相关技术进行了详细叙述。并对实现的原型系统进行简单测试和分析。Presently most access control mechanisms are implemented on the edge of networks,which can not solve inner security problems.A host-based access control mechanism on network layer is put forward.Consisting of key exchange protocol and packet check protocol ,the mechanism provides control to the behavior of hosts and packet trans- mission inside the network,which is suitable for mini-scale networks such as LANs and can solve security problems inside the network such as spoofing,modifying and so on.The access control system based on Linux is implemented in a LAN.The whole architecture of the system,the development platform,implementation methods of important mechanisms and relevant techniques are discussed in detail.Simple testing and analysis is given to this system.

关 键 词：访问控制 密钥协商 报文检测 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]