Multi-Layered Security Framework for Document Access Control

由於網路技術的快速發展，企業組織所建立的內部網路其所及範圍與複雜度都日趨增加。同時隨著病毒與木馬後門等惡意程式的攻擊型態產生， 以往被視為安全可信賴的內部網路環境，其安全性問題受到極大的威脅。新型的木馬後門程式利用網路穿隧技術，透過標準的網路服務通訊埠，輕易地穿透企業防火牆進行內外的溝通與監視。而另一方面，透過內部網路進行文件的分享與存取，已成為各企業組織運作不可缺少的部分，文件安全性的問題尤其關係整個企業組織的發展，如何才能確保其安全，避免遭受可能的網路攻擊，便成為主要的研究課題。在本論文中，我們以企業組織的內部網路為範圍，研究提出S.P.A.C多層次的安全性架構，來提供安全的文件存取控制。在此架構下，我們同時可以與其他安全性機制(如IPsec, SSL)相結合，以發揮最大弁遄C另外在設計考量方面也以具彈性、低成本為目標，來減少企業組織實際應用的困難。相關研究的安全性機制包括各種個人防火牆技術與設計：以代理伺服器作為應用層面的控制、以動態封包過濾之個人防火牆作為網路底層的安全、以分散式防火牆來對使用端同時進行保護與控制、以動態密碼認證來作為整合的存取控制。With the highly advanced network technology, the Intranet of the organization has become more complicated and widely applicable. At the same time, new attack models of the malicious software, such as virus and Trojan horse, have also been developed. The Intranet environment, which used to be considered as safe and reliable in the past, suffers tremendous threats. Those novel viruses and Trojan attacks make use of the tunneling technique to bypass the firewall via standard service ports, such as port 80. On the other hand, the sharing of documents in Intranet is essential for present organization, and its security problem has been a threat to development of the organization. The ways to secure the document access and protect Intranet from attacks have become an important issue. In this dissertation, we focus on the security problem for document access control in Intranet, and propose the S.P.A.C. multi-layered security framework to secure it. Within the framework, some present security mechanisms such as IPSec, and SSL can also be integrated to provide more security. We also consider the flexibility and cost in the design to reduce the potential difficulties of physical deployment in the organization. A compete security framework comprises the proxy server technique for application level access control, the dynamic packet filter personal firewall technique for stopping the illegal network packets, the distributed firewall technique for controlling and protecting the client machines, and the dynamic id/password authentication for integration of document access control.Contents 1 Introduction 1 1.1 Background 1 1.1.1 Motivation 1 1.1.2 Security Categories 4 1.2 Security Target 6 1.2.1 Security Environment 6 1.2.2 Assumptions 10 1.2.3 Threats 10 1.2.4 Objectives 11 1.3 Organization of the Dissertation 12 2 Related Work 14 2.1 Network Security 14 2.1.1 Internet Layer 14 2.1.2 Transport Layer 15 2.1.3 Application Layer 15 2.2 Threat Models 16 2.3 Network Attacks 17 2.3.1 Port Scanning 18 2.3.2 Packet Sniffing 19 2.3.3 Man-in-the-Middle Attacks 19 2.3.4 Denial of Service Attacks 20 2.3.5 Trojan/Backdoor 21 2.3.6 Other Attacks 21 2.4 Firewalls 22 2.4.1 Firewall 22 2.4.2 Proxy 24 3 Designing the Framework 25 3.1 S.P.A.C. Framework 25 3.1.1 #S (Web Server) 28 3.1.2 #C (Client) 30 3.1.3 #P (Proxy Server) 33 3.1.4 #A (Authentication Server) 36 3.2 Integrated Access Control 37 4 Security Mechanisms 43 4.1 Dynamic Password Authentication 43 4.1.1 User Authentication 43 4.1.2 Protocol Design 45 4.1.3 Analysis 47 4.1.4 Deployment and Implementation 48 4.2 Dynamic Packet Filter Personal Firewall 49 4.2.1 Against the Attacks 49 4.2.2 XML-based Firewall Ruleset 49 4.2.3 Implementation 51 4.3 Distributed Firewall 52 4.3.1 Login Authentication 53 4.3.2 Protocol Design 56 4.4 Personal Firewall Enhancement 58 4.4.1 Protection from ARP Spoofing 58 4.4.2 Network-Saver 60 5 Evaluation 63 5.1 Design Analysis 63 5.1.1 Port Scanning 64 5.1.2 Packet Sniffing 65 5.1.3 Man-in-the-Middle Attacks 66 5.1.4 Denial of Service Attacks 67 5.1.5 Trojan/Backdoor 67 5.2 Functional Test 68 5.2.1 Distributed Firewall 70 5.2.2 Dynamic Packet Filter Firewall 71 5.2.3 Anti-ARP Spoofing 71 5.3 Penetration Test 72 5.3.1 Port & Vulnerability Scanning 72 5.3.2 Denial of Services 73 6 Conclusions and Future Work 76 6.1 Conclusions 76 6.2 Future Work 77 7 Bibliography 7