欢迎您！东篱公司
退出
-
申报数据库
-
立项数据库
-
成果数据库
-
项目获奖数据库
中文摘要：
针对当前非集中式信息流控制（DIFC）系统无法对主机与网络敏感数据进行一体化有效监控的问题,提出一种基于软件定义网络（SDN）的DIFC系统设计框架——S-DIFC。首先,在主机平面利用DIFC模块对主机中文件及进程进行细粒度的监控;然后,利用标签信息转换模块拦截网络通信,将敏感数据标签添加到网络流中;其次,在网络平面的SDN控制器中,对带有机密信息的流进行多级别的访问控制;最后,在目标主机DIFC系统上,恢复敏感数据所携带的敏感信息标记。实验结果表明,该系统对主机CPU负载影响在10%以内,对内存影响在0.3%以内,与依赖加解密处理的Dstar系统大于15 s的额外时延相比,有效地减轻了分布式网络控制系统对通信的负担。该框架能够适应下一代网络对敏感数据安全的需求,同时分布式的方法能够有效增强监控系统的灵活性。
英文摘要：
To solve the problem that current Decentralized Information Flow Control（ DIFC） systems are unable to monitor the integration of host and network sensitive data effectively, a new design framework of DIFC system based on Software Defined Network（ SDN）, called S-DIFC, was proposed. Firstly, this framework used DIFC modules to monitor files and processes in host plane with fine granularity. Moreover, label mapping modules were used to block network communication and insert sensitive data labels into network flow. Meanwhile the multi-level access control of the flow with security label was implemented with SDN＇s controller in network plane. Finally, S-DIFC recovered security labels carried by sensitive data in DIFC system on target host. The experimental results show S-DIFC influences host with CPU performance decrease within 10%and memory performance decrease within 1. 3%. Compared to Dstar system with extra time-delay more than 15 seconds, SDIFC mitigates communication overhead of distributed network control system effectively. This framework can meet the sensitive data security requirements of next generation network. In addition, the distributed method can enhance the flexibility of monitor system.
同期刊论文项目
同项目期刊论文
期刊信息
位置：