arXivDaily arXiv每日学术速递 周一至周五更新
arXiv周末暂无论文更新,休息一下吧,周末愉快~~
arXiv cs/0110013cs.NIcs.LO
收藏

一种用于TCP/IP分组过滤的动态访问列表方案

A Proposal for Dynamic Access Lists for TCP/IP Packet Filering

Scott Hazelhurst

摘要:

使用IP过滤来提高系统安全性是公认的,尽管它所能实现的有限,但已被证明是高效和有效的。在安全策略的设计中,始终存在可用性和安全性之间的权衡。限制访问意味着阻止合法使用网络;允许访问意味着可能允许非法使用。静态访问列表使得找到一个平衡点变得特别明显--我们在100%的时间里付出了安全性下降的代价,即使在1%的时间里增加了可用性。动态访问列表将允许规则在短时间内更改,并允许非专家进行本地更改。网络管理员可以设置仅允许某些基本服务的基本安全准则。所有其他服务都受到限制,但用户可以请求临时例外,以允许对网络的额外访问。根据用户的权限授予这些例外。本文包括以下主题:(1)TCP/IP过滤的基本介绍;(2)动态访问列表的语义;(3)允许动态访问的建议协议;(4)表示访问列表的方法,以便可以有效地执行动态更新和查找。

英文摘要:

The use of IP filtering to improve system security is well established, and although limited in what it can achieve has proved to be efficient and effective. In the design of a security policy there is always a trade-off between usability and security. Restricting access means that legitimate use of the network is prevented; allowing access means illegitimate use may be allowed. Static access list make finding a balance particularly stark -- we pay the price of decreased security 100% of the time even if the benefit of increased usability is only gained 1% of the time. Dynamic access lists would allow the rules to change for short periods of time, and to allow local changes by non-experts. The network administrator can set basic security guide-lines which allow certain basic services only. All other services are restricted, but users are able to request temporary exceptions in order to allow additional access to the network. These exceptions are granted depending on the privileges of the user. This paper covers the following topics: (1) basic introduction to TCP/IP filtering; (2) semantics for dynamic access lists and; (3) a proposed protocol for allowing dynamic access; and (4) a method for representing access lists so that dynamic update and look-up can be done efficiently performed.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑