通用的主动网络安全机制  

Universal Security Mechanism for Active Network

作　　者：王建国[1] 李增智[1] 王宇[1] 寇雅楠[1] 

机构地区：[1]西安交通大学计算机系统结构与网络研究所,西安710049

出　　处：《西安交通大学学报》2002年第8期818-821,共4页Journal of Xi'an Jiaotong University

基　　金：国家自然科学基金资助项目 (6 0 1730 5 9)

摘　　要：分析了主动网络安全的研究现状 ,遵循主动网络安全工作组提出的安全规范 ,提出了一种通用的主动网络安全机制 .根据主动网络的特点 ,提出了 2个重要的保护对象 :主动结点和主动信包 .该机制构建了认证授权和访问控制 2个执行引擎 ,设计了证书库和安全策略库 .执行引擎在为执行环境提供请求服务时 ,查阅证书库可对创建主动信包的主体进行身份认证 ,并参考安全策略对主动信包访问系统资源进行控制 ,从而有效地保护了主动节点 .引入了权能概念 ,并利用权能描述了动态、复杂的安全控制策略 .采用了数字签名技术和软状态存储机制来保护和隔离主动信包 .该机制能够有效地保护主动节点和主动信包 ,基于该机制实现的安全设施可作为通用组件构建安全的主动网络 .After analyzing the current research about active network security, a universal security mechanism for active network is presented. This mechanism keeps to the security specification proposed by Active Network Security Working Group. According to the characteristics of active network, two important protected objects, active node and capsule, are proposed. This mechanism constructs two engines, authentication/authorization engine and accessing control engine. Certificate database and security policy database are designed so that engines can consult certificate to authenticate principals' identity and refer to security policy to control capsule to access system resources when it provide request services for execution environment. These can protect active nodes effectively. In order to describe the complicated dynamic security control policies, this mechanism imports capability. Digital signature and software states catching mechanism are used to protected and isolated capsules. Active nodes and capsules can be protected effectively with this mechanism. Security facilities implemented with this mechanism can serve as a generic component to build secure active network.

关 键 词：主动网络 安全机制 网络安全 主动信包 资源访问控制 主动结点 数字签名 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]