移动互联网的通行证式统一威胁管理架构  

Token-based UTM Architecture for Mobile Internet

作　　者：李宁 李柏潮 LI Ning;LI Bochao(School of Electronics and Information Technology,Sun Yat-Sen University,Guangzhou 510006,China;School of Information Science,Xinhua College,Sun Yat-Sen University,Guangzhou 510520,China)

机构地区：[1]中山大学电子与通信工程学院,广州510006 [2]中山大学新华学院信息科学学院,广州510520

出　　处：《信息网络安全》2020年第3期18-28,共11页Netinfo Security

基　　金：国家自然科学基金[U1636118];广东省科技发展专项资金[2017B030306015]。

摘　　要：越来越多的恶意软件以智能手机为攻击目标,智能手机的安全是移动互联网所面临的重要问题之一。智能手机在运算能力、电量供应等方面受限,难以运行复杂的安全软件保障自身的安全,且统一威胁管理等安全设备的现有部署方法不适用于移动互联网。文章提出将移动终端安全作为网络的一项可定制的基础服务,设计了通行证式统一威胁管理架构及对应的通行证式统一威胁管理协议。在该架构中,安全策略不再与网络位置绑定,而是与用户身份绑定,使得用户移动到任何位置都可以获得按需的、差异化的安全服务。性能分析和实验表明,该架构对现有网络的改动小,具有良好的可扩展性;智能手机通信开销小;网络流量更加均衡,网络整体吞吐量得到提高。More and more malware attacks on smart phones,the security of smart phones is one of the most important problems in mobile Internet.Smart phones are limited in computing power,power supply and other aspects,so it is difficult to run complex security software to ensure their own security,and the existing deployment methods on security devices,such as unified threat management(UTM),are not suitable for mobile Internet.This paper puts forward that taking mobile terminal security as a kind of customizable basic services of network,and designs token-based UTM architecture and its corresponding token-based UTM protocol(UTP).In this architecture,the security policy is no longer bound to the network location,but to the user ID,so that users can get on-demand and differentiated security services when they move anywhere.Performance analysis and experiments show that the architecture has good scalability and takes little change on the existing network.The communication cost on smart phones is small,the network traffic is more balanced,and the overall network throughput is improved.

关 键 词：移动互联网安全 通行证式统一威胁管理 安全策略 用户身份 面向安全的服务 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]