协议脆弱性分析及其测试研究  

Vulnerability analysis and testing of protocols

作　　者：石万清[1] 张炜[2] 

机构地区：[1]安徽大学电子科学与技术学院,合肥230039 [2]中国科学技术大学计算机系,合肥230027

出　　处：《计算机工程与应用》2008年第13期106-109,共4页Computer Engineering and Applications

摘　　要：网络安全问题已引起人们的广泛关注,通信协议设计和实现的健壮与否对于网络安全至关重要。使用扩展了的构造类别代数描述协议规范,基于该描述,从一致性和完备性角度对协议可能存在的漏洞进行分析;系统地给出了一种针对潜在漏洞进行脆弱性测试的测试方法,使用类似于协议测试的方法测试实现系统能否抵御针对该漏洞的攻击。实现了一个分布式的协议脆弱性测试平台KD-TclRunner,对国内外著名厂商的通信设备进行脆弱性测试。Strong design and implementation of communication protocols is of vital importance to network security which has already drawn wide attention of the whole society.In this paper,an extended constructed type algebra is used to model the protocols.Based on the model,an analysis of consistency and completeness is proposed to find the potential vulnerability of protocols.A method to test whether the implementation of system can resist those attacks resulting from the vulnerabilities similar to testing the conformity of protocols is given.A distributed test platform KD-TclRunner is developed to test the vulnerability of the communication devices made by famous vendors at home and abroad.

关 键 词：构造类别代数 脆弱性测试 分布式测试平台 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]