Research On Strong Authentication And Access Control For Active Networks

Security is the prerequisite of active networks to be popularized in practice. Although many security policies and mechanisms are provided, most of them are implemented in static ways and can not meet the dynamic security requirements for active networks. This paper begins with an overview of the threats and security technologies of active networks, then presents a design and description of the implementation of a secure authorization prototype for active networks, which combines strong authentication and access control. The main work is summarized as follows:(1)Improving on the existing strong authentication model for active networks. The existing authentication model for active networks consists of end-to-end authentication and hop-by-hop authentication, either of which has to do public-key decryption twice and therefore affects the system performance. In improved strong authentication model, we only need to do public-key decryption once and thus raise the authentication efficiency.(2)Presenting a decentralized role activation management based access control model. This model which can consistently enforce security policy and meet the dynamic security requirements for active networks is derived from traditional role based access control model with a mechanism of decentralized role activation management as a plus, which is suitable for dynamic features of active networks.(3)Presenting an implementation mechanism of access control, which combines active capability and role activation policy. To be in a state of balance between efficiency and flexibility of access control, we combine active capability with role activation policy to build an implementation mechanism of access control for active networks. The mechanism cuts the overhead of active nodes and networks from verification, evaluation and transmission of active capability.(4) Presenting a secure authorization prototype. The prototype implements our strong authentication and access control model described above and can meet the dynamic security requirements for active networks. Finally the performance of the prototype is tested and evaluated.