Application Research Of Host-based Access Control In Inner Network

Nowadays a great number of organizations, including enterprises and government departments, are building and developing their inner network systems, and then join the Internet. At the same time, the attack threats have always been accompanying the development of the network. For there are so many users in a local network, the communication in the organization's inner network is faced with much more latent threats, including the network packets sniffer, IP spoof, session hijacking etc. Therefore the Perimeter firewalls cannot take on the important task of resisting the attacks. The Cannikin Effect concerning the network security also troubles the security engineers to attend one thing and lose another when they manage the inner network. It is in all probability that the attacker penetrates all around the inner network from one aggressed point. So how to ensure the inner network security has been very important in the research of the information technology security field.With the complexity of running environment of the inner network, onlya little security countermeasure which is even out of integration will no longer guarantee security working, and no longer resist hundreds or even thousands of kinds of attacks. Thereby a systematic security strategy which is executed easily should been given to protect the inner network.When the above requirements are considered, in this thesis a host-based access control model in inner network is put forward. Its basic idea is that by changing the layered network protocol stack of host in inner network, a security access control layer is inbuilt between the datalink layer and IP layer, so as to control all the packets which go through the host's protocol stack, including the incoming and outgoing packets. For the purpose of security data control, a trust management sub-model based on credential-policy verification is built. Besides, datalink-layer-based sequences validation and network data encryption for every packet are adopted. The changed protocol stack is installed and running in every host in the inner network. Each host can run not only as a server, but also as a client, so that it gets the aim of symmetrical security access between the hosts in distributed inner network environment.After the system is installed and running, one security communication session between two hosts consists of two processes in sequence. The first process is the 4-handshake, and then the formal data transport process based on the former 4-handshake. The former process initializes and establishes the approbatory session, and finishes the negotiation of the sessionkey and then the sequence numbers pool. Meanwhile, the seed for the sequence number is encrypted using the negotiated sessionkey and then transported, that will produce the pool. The latter process and its security is based on the former of 4-handshake. During this process, every packet is encrypted using the sessionkey, andadded with additional datalink-layer-based sequence number, to go into the network. And the receiving host confirms its sequence number, and then deciphers the packet. Thus, the confidentiality and synchronism of communication security is ensured. All the security resources are built rationally and rely close to each other, to provide the whole system with effective security and rigor logic.This research model has some characteristics and innovations as follows:1. The access control is symmetrical, flexible, for multi-user and credential-policy-based in distributed network. It avoids the disadvantages of normal ACL style used mostly that is huge and complicated, difficult to maintain and extend. The relationship between the hosts is peer to peer, but not based evidently on C/S mode.2. It is transparent to the application layer, i.e. the execution of the model is independent to specific application. By using the credential-policy-based sub-model, the association between the specific application and the access control policy is divided, and this association will be solved only by configuring the credential and policy,...