基于容忍入侵的数据库安全体系结构

合集下载

Oracle数据库安全技术分析与对策研究

1引言近年来,随着计算机技术的广泛应用,很多企事业单位、政府部门都建立了自己的网络。

但计算机的安全问题在最近几年才引起人们的关注。

我们知道,数据库中存放着大量的关键数据,这些数据中的有些对所在单位都有着至关重要的作用。

因此,数据库的安全直接关系到公司的存亡,甚至涉及到国家的安全机密。

2Ora cle数据库安全技术分析2.1用户口令管理策略及其改进数据库的安全依赖于始终保密的口令,应该采用如下口令管理策略:1)账户锁定建立一个数据库用户名JP SB,该账户允许连接注册3次,超过3次就会引起账户死锁,它的环境文件名为L im ite d_Profile。

Cre ate Profi le Limite d_profi le lim i t;Fa i le d_L ogin_Attampts3;Cre ate Use rJ PSBIde ntified ByJP1028;Profile Limited_P rofile;Grant Cre ate Se ssiontoJPS B如果J PSB账户连接注册3次,那么该账户就会被Ora cle自动锁住,即使用了正确口令,也会提示出错。

2)口令历史可以通过环境文件的资源PA S SWORD_L IFE_T IME为账户建立一个最大的期限,如要求用户每30天改变一次口令。

A lte rProfi le L imite d_Profile LimitPassword_L ife_Ti m e30;如果口令过期,那么下次注册时必须修改它。

一个过期账户和锁定的账户不同,一个锁定的账户会随时间的推移自动解锁或用由来解锁;一个过期账户ALT ER USERDBA必须在注册时输入新的口令才能重新有效。

2.2数据存储加密较之传统的数据加密技术,数据库密码系统有其自身的要求和特点。

传统的加密以报文为单位,加密脱密都是从头至尾按顺序进行。

而数据库中的数据必须以字段为单位进行加密,否则该数据库将无法被操作。

基于入侵容忍的CA认证中心设计

价值。不管多么努力，足够复杂的计算机系统总会有一些漏
性和调整的研究。通常将这两种容忍技术合并在一起进行系统设计，并按照危害的后果而不是原因进行分类（入侵检测系
统是按照危害的原因而不是后果进行分类的），此时将该系统称为入侵容忍统。
洞。假设攻击者利用了漏洞并控制了系统是比较合理的。在有这样攻击的情况下保证保密性并保持可以接受的服务性能
述了基于入侵容忍ＣＡ认证中心的体系结构、各组件间的相互作用、基于入侵容忍的ＣＡ签名方案及整个系统的工作过程。针对系统的不
足之处，指出了未来工作中需要改进的地方。
关键词：ＰＩＡ；入侵容忍；数字签名Ｋ；Ｃ
ＣＡｓｇｓｄｏｎｒｓｏｏｅａｃＤｅｉｎＢａｅｎＩｔｕｉｎＴｌｒｎｅ
容忍技术包括错误容忍和入侵容忍两个方面，其中错误容忍主要集中在对硬件／软件错误的容忍，入侵容忍则集中在对而恶意攻击的容忍。入侵容忍是在错误容忍的基础上发展起来
的，主要是对静态属性和调整研究的基础上增加了对动态属
安全的认证中心Ｃ（ｅｔｉｔＡｔｏｉ）ＣＡＣｒｆａｅｕｈｒｙ，Ａ是当前网络安ｉｃｔ全领域研究的热点之一，其实现具有重大的实用价值和社会
维普资讯
第３卷第１期３１
ＶＬ３ｏ３
・
计
算
机
工
程
２００７年６月
Ｊｎｅ２０ｕ０７
ＮｏＪ．Ｊ
ＣｏｐｕｔｒＥｎｇｎｅｒｎｇｍｅｉｅｉ

在云计算中基于入侵容忍的敏感数据保护(IJISA-V3-N1-8)

I.J. Intelligent Systems and Applications, 2011, 1, 58-66Published Online February 2011 in MECS (/)Sensitive Data Protection Based on Intrusion Tolerance in Cloud ComputingJingyu Wang1,2 and xuefeng Zheng1School of Information Engineering, University of Science and Technology Beijing, Beijing, ChinaEmail: btu_wjy@,zxfxue@Dengliang Luo2Information and Network Center, Inner Mongolia University of Science and Technology, Baotou, ChinaEmail: luoimust@Abstract—Service integration and supply on-demand coming from cloud computing can significantly improve the utilization of computing resources and reduce power consumption of per service, and effectively avoid the error of computing resources. However, cloud computing is still facing the problem of intrusion tolerance of the cloud computing platform and sensitive data of new enterprise data center. In order to address the problem of intrusion tolerance of cloud computing platform and sensitive data in new enterprise data center, this paper constructs a virtualization intrusion tolerance system based on cloud computing by researching on the existing virtualization technology, and then presents a method of intrusion tolerance to protect sensitive data in cloud data center based on virtual adversary structure by utilizing secret sharing. This system adopts the method of hybrid fault model, active and passive replicas, state update and transfer, proactive recovery and diversity, and initially implements to tolerate F faulty replicas in N=2F+1 replicas and ensure that only F+1 active replicas to execute during the intrusion-free stage. The remaining replicas are all put into passive mode, which significantly reduces the resource consuming in cloud platform. At last we prove the reconstruction and confidentiality property of sensitive data by utilizing secret sharing.Index Terms—Cloud Computing, Virtualization, Intrusion Tolerance, Cloud Security, Virtual Adversary StructureI.I NTRODUCTIONCloud computing distributes computing tasks to virtual resource pools which are constituted of a large number of computers, and cloud computing ensures that various applications can get access to computing power, storage space and various software services when needed. Service integration and supply on-demand coming from cloud computing can significantly improve the utilization of computing resources, reduce power consumption of per service, and effectively avoid the error of computing resources. Cloud computing has the following advantages: super-massive scale, virtualization, high reliability, versatility, high scalability, on-demand service and very low-cost [1]. Notwithstanding there are so many advantages, cloud computing is still facing the following challenges.A. Intrusion tolerance of the cloud computing platformIn cloud computing mode, all the business process will be completed on the server side. So cloud computing platform will become the attacking core of intruders. In addition, cloud computing platform itself also faces a range of unexpected errors. For example, in the first half of 2010, the cloud computing service of Amazon arouse malfunction due to human error and unexpected power failure, which resulted in a small number of users in the eastern United States losing services and led to a very small number of data loss. So if the server once has problems, it will cause all the services not to run normally and the data not to be accessed.B. Intrusion tolerance of the sensitive data of new enterprise data centerThe most two important issues of cloud computing are confidentiality and security. Enterprises store sensitive business data, such as corporate information and customer information, etc., into platforms of cloud service providers to reduce economic-cost by giving up the control of some data. Therefore, enterprises are bound to worry about the security of data in cloud whether it will leak and whether it will be stolen or not.For the issues of confidentiality, integrity, availability and reliability of cloud computing, traditional security technologies, such as intrusion detection, firewall, encryption and decryption, etc., can not completely guarantee them, but a survivable technology that is intrusion tolerance technology can make up well. This paper will address the intrusion tolerance problem of cloud computing platform and new enterprise data center by researching on the related intrusion tolerance technology, such as virtualization replicas group and secret sharing.II.R ELATED W ORKS AND O UR S OLUTIONSThe main idea of intrusion tolerance is utilizing hardware or software fault tolerance technology ofdistributed system to mask the impact of any intrusion or attack on the system function, which guarantees the security and continuity of the core function of system. Today’s institutions and organizations research on intrusion tolerance mainly adopt technologies of threshold cryptography, secret sharing and distributed redundancy replication, etc., on the real hardware platform. All those technologies require systems with high computing power and high storage capacity, and these resources generally can not be partitioned and they are usually designed for specific applications. Therefore the utilization of resources is low, the management is hard to implement, and the versatility is poor. In addition, the system also has higher requirements for the number and quality of redundant components, and the recovery of redundant components will seriously affect the availability of system service. Therefore, this high cost of intrusion tolerance is unacceptable for cloud computing service providers and users, and this is not suitable for the virtualization technology of cloud computing. Virtualization technology has been fully developed since it appeared in the 1960s, but its application is still mostly about the efficient management of resources. In fact, virtualization technology also can be used to build security systems, such as Hans P.Reiser and Rüdiger Kapitza, etc., [2] had researched on the intrusion tolerance system with virtualization technology. With the proposal of cloud computing, researching on the security of cloud computing based on virtualization technology has become critical.In order to address the security, reliability and availability of cloud computing platform, this paper presents a solution of virtualization intrusion tolerance based on cloud computing (CC-VIT). This method allows the system to tolerating F faulty replicas in N=2F+1 replicas and ensure that only F+1 active replicas to execute during the intrusion-free stage. The remaining replicas are all put into passive mode, which significantly reduces the resource consuming in cloud platform. While the traditional Byzantine fault-tolerant algorithm tolerates F faulty replicas require N = 3F +1 replicas.For the sensitive service data of data center in cloud computing can be protected by secret sharing. The current proposed secret sharing schemes are mostly based on access structure [3, 4]. As access structure often describes the authorized subset of system, while the system configuration (properties) and security requirements describe the system threats, and its own vulnerabilities and the security target should be achieved in this system configuration, etc.., so it is very difficult to determine the corresponding access structure. While adversary structure [5, 6] indicates the set of participants which is permitted to be simultaneously compromised in system configuration, which can be directly determined by the system configuration (properties) and its security requirements. For these reasons, we propose the concept of virtual adversary structure based on CC-VIT model, and then present a method of intrusion tolerance to protect sensitive data in data center of cloud computing based on virtual adversary structure. This method partitions sensitive data into segments (partitions) and distributes them to each participant, and ensures that only legitimate participants can associate with their partitions to reconstruct sensitive data. At the same time, the illegal participants associate with their partitions can not obtain any information about sensitive data. All participants in this proposal are virtual machines which run on the virtual machine monitor, so it saves a lager number of physical servers. So this method is able to guarantee the security and integrity of important data or sensitive data, and also can effectively reduce the consumption of physical resources.-VIT P ROTOTYPEA. CC-VIT System StructureThis paper adopts virtualization technology to realize the intrusion tolerance of cloud platform, and its system prototype is shown in Fig. 1. Hypervisor is a very small software layer which is running on the top of hardware and that is also virtual machine monitor. Over the Hypervisor, we divide different domains. In fact these are many virtual machines running on Hypervisor, while service instances are running in the customer domain DomU(Guest Domains)，Guest Domains have passive mode and active mode. Privilege domain, which is Dom0, controls the creation, execution and destruction of client domains.Figure 1. CC-VIT system structureReplica manager consists of the following components: •Basic component that is used to accept client requests;•Group communication system that is used to continuously forward requests to all the replicas;•Replication logic that is used to realize proactive recovery function;•Voter component that is used to activate passive replicas on-demand;•Related mechanism that is used to update states;•Related component that is used to clone replica domains.CC-VIT provides communication through Hypervisor. Replication logic is running in privilege domain Dom0,which is in charge of specific tasks of service instances while specific service replicas are running in the isolated guest domains. The interaction of clients and servers is realized by the replica manager which is running in system domain Dom0.The reasonably design of CC-VIT is based on the following assumptions:• The interaction of clients and remote services isbased on the basis of request/reply network messages, and it is intercepted at the network level.• The remote service can be modeled as a deterministic state machine.• Service replicas, including operating system and execution environment, may fail in Byzantine failure; CC-VIT permits at most replicas fail within a single recovery period. • The other system parts, including Hypervisor and trusted system domain, fail only because of the crash of physical host.In this paper, we call the set of virtual machines whichpermit to be simultaneously compromised in system configuration as virtual adversary structure. Virtual adversary structure indicates the subset of participants which is permitted to be simultaneously compromised in intrusion tolerance system, which is also the number of virtual machines (Guest OS or DomU) in CC-VIT model. B. Work Process of System ServiceIn the CC-VIT there is a physical machine that is used to accept client's requests, and the replica manager of this machine intercepts client's connection requests and forwards these requests to all the replicas of replica group through group communication system. Each replica executes client's requests, and then returns executive results to the physical machine node which accepts client's connection requests. When the physical machine has received a large number of returned results, then replica manager, which runs in system domain Dom0, executes majority voting algorithm to determine a correct result, and returns the results to users. The realization of the whole process is transparent to users. Replication logic specifically realizes the instantiation and initialization of service replica. IV. I NTRUSION T OLERANCE OF T HE C LOUD C OMPUTING P LATFORM A. Hybrid Fault Model The isolated execution environment permitsimplementing heterogeneous fault and intrusion tolerancemodel. That is to say, this mode can tolerate maliciousattacks on the application instances in the application domains, such as the Byzantine failure, and it can tolerate the crash of physical host in system domain and Hypervisor. In this hybrid fault model, service replicas which run in the isolated application domains, including operating systems, middleware structure and implementation services, can all be heterogeneous.Redundant Execution on a Single Host (RESH) [7] is a variant application of CC-VIT model. It permits redundantly executing multiple replicas of service on a single physical host. This redundant execution needs virtual machine monitor to create multi-application domains to realize isolated execution of replica instances. RESH permits tolerating non-benign random faults in replicas, such as undetected bit errors in memory, and as well as to tolerate software faults by using N-versionprogramming.Redundant Execution on Multiple Hosts (REMH) is another variant application of CC-VIT model. It permitsreplicas with same core architecture to redundantlyexecute on multiple physical hosts. The main differencecompared with RESH is that REMH integrates a group communication facility in the replication logic. Group communication module is responsible for thecommunication and coordination between replicas in agroup of physical hosts. REMH allows tolerating full crashes of some of the physical hosts running replicas.B. Active Replicas and Passive Replicas Traditional Byzantine Fault Tolerant (BFT) replication commonly needs executing client's requests on every replica. In order to reduce resource consumption, we introduce the concept of passive replicas to CC-VIT model. During the normal execution of workloads, weneed at least F+1 active replica to detect errors and the remaining replicas are all put into passive mode. If anerror (accident) occurs in active replica or return timeout, another passive replica will be activated to take over. To make this method feasible, the system architecture must allow rapidly activating passive replica. Otherwise, the services will not be available for customers. In this system, virtual machines hosting passive replicas are put into suspended mode. They are only allocated with memory and disk, but not allocated with other resources, such as CPU or bandwidth. When activating the passive replicas, replica manager simply activates the corresponding virtual machine, and this process requires only a few hundred milliseconds. In general, to tolerate F faulty replicas, this system only requires 2F +1 replicas. But in order to tolerate an unlimited number of replica faults during the whole system life-cycle, we should adopt proactive recoverystrategy to continually resume faulty replicas when faultyreplicas is about to break through threshold F. Therefore,as a matter of fact the system needs 2F +2 replicas, andthe extra one replica is passive replica, which will be usedto clone replica domain and realize proactive recovery. C. State Updates and State TransferIn a stateless replication system, the transfer from old replica to new one is almost instantaneous. While in a state-full system, after creating a new instance of operating system, middleware, and service, the new replica needs to be initialized with the service state, which requires the support of state transfer. State transferincreases the unavailable time of service replica in the⎥⎦⎥⎢⎣⎢−<21n fprocess of proactive recovery, as request execution has to be transitorily stopped during the creation of state checkpoint. Furthermore, the state transfer also affects the utilization of network and CPU resources.Virtualization technology can realize storage management of disk through virtual machine monitor. In the virtualization disk management, permanent state storage of virtualization can be used to realize effective state re-mapping mechanism among multiple domains. This mechanism can be used to realize state transfer strategy with low cost and low overhead. State transfer must deal with the heterogeneity between different replicas, while heterogeneity is usually introduced by diversity. Transferring the state into local replica-specific representations needs some support of replica implementations [8].In CC-VIT system, in order to process the suspended requests, passive replica also must have the recently available application state after activating passive replica. In order to address the problem of state updates and state transfer, this system adopts regular state updates method to update passive replicas. In general, after executing a modifying request, replica managers will retrieve state updates, and the state changes are triggered by the requests from all active replicas. After that, replica managers agree on these state updates and store the verified version of each state updates in a local log. In order to guarantee the correctness of verified versions, we can create distributed checkpoints, and adopt the method of checking local state checksums to verify the validity of local state. Only in the case of an invalid local state, a more expensive remote state transfer is necessary. When the list of log size reaches a certain limit, replica managers temporarily activate local passive replicas to execute the accumulated state updates. After completing state updates, replica managers re-suspend passive replicas which have just been updated, and then replica managers truncate their logs. Note that these periodic updates of passive replicas can reduce the load of instantaneously updating a large number of states on the occurrence of faults, because when a passive replica is activated to tolerate a fault, only state updates after the last periodic update need to be executed.D. Proactive RecoveryTraditional intrusion-tolerant systems [9, 10] generally adopt Byzantine fault tolerant replication algorithms to tolerate a finite number of F replica faults in group of N replicas. But this method has a potential problem. As long as be given sufficient time, an adversary might be able to compromise more than F replicas and break through the threshold F that system can tolerate, which ultimately makes intrusion tolerance system fail. The method to solve this problem is periodicity reinitializing the faulty replicas from a secure base, and the core idea is proactive recovery strategy. Proactive recovery approach can remove some potential intrusions. If we adopt proactive recovery strategy, as long as the number of replica failures that the system can tolerate is limited in the threshold F within a single recovery period, the system can tolerate unlimited replica failures over the system lifetime.In the traditional proactive recovery strategy, we only permit some parts of replicas to restart at the same time to avoid the unavailability of services, while adopting virtualization technology can realize all the replicas simultaneously resume but hardly affect the execution of services. As any virtualization technology provides a core function for creating and destroying domains, so we can achieve an efficient proactive recovery strategy through this mechanism [8]. Periodical recovery strategy can be triggered by the resume service in the isolated system domain. In order to reduce the unavailable time of system services, we can adopt a parallel recovery strategy that creates a new domain in parallel to the execution of the other applications.In the method of virtualization technology, replication logic runs in an isolated and intrusion-free system domain. So replication logic can be used as a trusted entity that is able to completely re-initialize the replica domains without requiring the support of any dedicated hardware. The recovery strategy initializes the complete replica to a “clean” state, securely obtains the service state from other replicas through a fault-tolerant state transfer protocol, and then transfers to the corresponding service state to execute tasks allocated by system. Hypervisor is able to shut down and restart the replicas running in virtual machines. When in the execution of proactive recovery, the new replica instance can be started by using an additional virtual machine in parallel to the execution of the old replica. This method can substantially reduce the downtime of service during recovery, as the boot process does not affect the availability of replica. After initialing the new replica, the replica manager can shut down the old replica and trigger the activation of the new one [11]. However, virtualization-based proactive recovery also has the following shortcomings. On the one hand, proactive recovery usually has some negative impact on services, as the limited local resources (such as CPU and memory) have to be shared among all the replica domains. Proactive recovery inevitably involves the creation of new domains and the destruction of old domains, which inevitability consumes the limited resources. On the other hand, this proactive recovery strategy significantly reduces the unavailable time of service when replica transfers state from an old one to a new one.In fact, in this system, the passive replica has the latest available application state. So the passive replica can be used as the basis of proactive recovery. When the faulty replicas will break through the threshold F, proactive recovery is triggered. In this system, we could clone a passive replica to quickly create a new replica domain with the latest available state, and then obtain the state after the last state updates through state transfer. After state updates and state transfer, the replica manager hands over request execution to the former passive replica (new replica) and shuts down the old faulty active replica. In this way, a potentially faulty replica is efficiently replaced with a clean one, and this system also effectivelyreduces the busty negative effects of proactive recovery on the system platform.E. DiversityVirtualization technology simplifies the introduction of system diversity, as there runs replication logic in the system domain which fully controls the operating systems and the instances of services. The diversity of replicas is the essential technology in intrusion tolerant systems, as it can avoid an adversary to exploit the same vulnerability multiple times within a short time interval. However, virtualization-based recovery mechanism can easily introduce the basis ideal of diversity both in space and in time [12].The hypervisor-based replication architecture allows transparently intercepting the interaction of client–service, independent of the guest operating system, middleware, and service implementation. As long as the assumption of deterministic service state is not violated, the service replicas may be completely heterogeneous, which include different operating systems, middleware, and service implementations. Virtualization -based recovery can be used to provide with diversity in time. For example, the operating system can be changed in the new version, or internal configurations can be modified on each recovery reboot. Address space randomization is another popular technique which is introduced to intrusion tolerance system through diversity.V.I NTRUSION T OLERANCE OF T HE S ENSITIVE D ATA OFN EW E NTERPRISE D ATA C ENTERSecret sharing [13, 14] partitions sensitive data or critical data into multiple security segments (partitions) and distributes them to the collaborating multiple distributed servers set, and ensure the security and integrity of secret or critical data even if parts of system is compromised. Therefore, realizes the decentralization of risk and intrusion tolerance. The participants of secret sharing share a secret S in set P. If we distribute each participant with a segment (partition or shadow) of secret S, we ensure that only legitimate participants can associate with their partitions to reconstruct secret S (the property of reconstruct secret). At the same time, the illegal participants associated with their partitions can not obtain any information about sensitive data (the property of perfect confidentiality), and then we claim such a secret sharing scheme as perfect.Let P={p1,…,p n} be the finite set of all virtual machine identifiers (participants) in the set of virtual machines, and then the virtual adversary structureβis a family of subsets of P that specifies which participants the adversary may corrupt at the same time. It can be informally represented asβ= {X|X⊂P；X is the subset of participants which permit to be simultaneously compromised}.βis monotone, if S∈βand T⊂S then can export T∈β, and can be uniquely determined by the corresponding maximal virtual adversary structure maxβ. The max rtual adversary structure maximal viβmeans that no subset maxinβcontains another one,mely maxnaβ= {X|X ⊂P；X is the set of participants which permit to be simultaneously compromised；∀X1, X2 ∈maxsubβ, X1⊄X2 and X2⊄X1}.Definition 1: 2P is the power set of P, thenβ⊆2P is a virtual adversary structure, ifβsatisfies X ∈β, X'⊆X ⊆P ⇒ X'∈β.Definition 2: Given the virtual adversary structureβover participants set P,the corresponding maximal virtual adversary structure is maxβ={B∈β|B⊄B',∀B'∈β}.To expediently denote virtual adversary structure, we introduce threshold gate. nkΘDefinition 3: Set P={p1,…,p n} as the input of ,then ＝1⇔nkΘnkΘ∃P i1, P i2,…P ik∈P, and P i1 =P i2=…=P ik=1. Namely the output of the gate is 1 only when n input at least k is 1. Obviously, AND gate and OR gate be equivalent to and, while the traditional threshold scheme can be denoted as g(S) =(S).nnΘn1Θnt1+ΘDefinition 4: Let P={p1,…,p n} be the finite set of all participants, K is system secret, then a secret sharing scheme about K can be denoted by a mappingΠ：K→g(p1)×…×g(p n), among which g(p i) is the shares collected by the participant p i (p i∈P). We say thatΠ is the scheme realizes adversary structureβif it satisfies the following two properties:(1)Reconstruction Property.∀X ⊆P, if X∉β, then H(K|{g(p i| p i∈X)}=0, where H(·) denotes entropy.(2) Perfect Property.∀X∈β，H(K|{g(p i|p i∈X)}= H(K'|{g(p i|p i∈X)}，where K' denotes any element in secret space.We define the following rules for facilitation, X, X P， X can be represented by an n-tuple, where n=|P|. That is X=（x1，x2 …x n） {0, 1}∈n，where {XXii∈∉PP=i x1,0,；x=（1x，2x …n x）{0,1}∈n，where i x={XX∉∈P1,P0,ii.The secret sharing based on virtual adversary structureβis as follows:Given the system secret K, the allocation of shares can be described in the following steps:Step 1: Compute maxβ= {B∈β|B B',∀B'∈⊄β}.Without loss of generality, marking maxβ= {B1, …,B m}, where m=|maxβ|;Step 2: Secret K is split into K1, …K m, and satisfying .∑==m1KiikStep 3: Letβω = {W1, W2,…W n} ，where W i=i B，1≤i≤m. We callβωas the write structure ofvirtual adversary structureβ.Step 4: Distributing K i to each W i ∈βω. In this way,∀p ∈P ，the shares belong to p are g(p)={K i | p ∈W i ，1≤i ≤m, p ∈P }. VI. R ESULTS AND E XPERIMENT A NALYSIS OF CC-VIT S YSTEM In order to verify the feasibility of CC-VIT system, werealize the VM-FIT prototype on Dawning server (Intel(R)Xeon(TM) CPU 2.40 GHz, Dual-Core CPUs) which runsCentOS5.4 operating system, the platform uses the xen-3.0.3-94.el5_4.3 as Hypervisor and Linux kernel 2.6.18-164.15.1.el5.centos.plusxen i686 as Dom0, and uses 1GBit/s Switched Ethernet. The experiment tests theavailability of service during proactive recovery, the resource consumption of replicas domain when creating state checkpoints and replica updates as well as the resource consumption when activate passive replica andsuspend active replica.Fig. 2 shows the system CPU usage when creating state checkpoints, updating replica, activating passive replica and suspending active replica. At about the 10th second in Fig. 2, the system captures the state of replica (using snapshot) and creates the corresponding state checkpoints, and then stores the corresponding state checkpoints in the local. At about the 22nd second, the system updates the replica. During about the 38th second and the 55th second, the system completes activating passive replica and suspending active replica two times. At about the 60th second and the 72nd second, the system separately completes the capture of replica state (using snapshot) and the update of state again. From Fig. 2 we can clearly see the CPU usage of system in the whole process. When implementing the capture of state, creating the corresponding state checkpoints and updating the state of replica, the CPU usage has some short time peaks, which last about 2s ~ 3s. During this period of time, the maximal CPU usage is between 80%~90%, and the duration time is about tens of milliseconds. While in the time when activating and updating replica, the peaks of CPU usage lasting about 1s~2s, the maximum usage peak is about 25%.Through this experiment we can note that the average CPU usage of system in the whole process keeps between 20%~ 30%, the short time peaks is just about 80%, and the duration time is very short. Thus we can see that the utilization of system resources is not sufficient. In fact, as long as the system memory, disk and network bandwidth and otherresources permit, we can create more DomUs to guarantee the full use of system resources, and increasethe number of failure replicas that system can tolerate. According to the statistics, the resource utilization oftraditional data center server farm is generally lower than20%, even lower than the lowest 10%. While thevirtualization-based cloud computing can significantlyimprove the resource utilization of platform more than50% or even higher 80% without reducing service quality.This is the benefit of cloud computing.Fig. 3 and Fig. 4 respectively show the availability ofservice when executing proactive recovery based on CC-VIT and traditional BFT. In the experiment, we test thesystem throughput when implementing proactiverecovery in both cases.We adopt the proactive recovery based on CC-VIT model in Fig. 3, and we can see the system throughputs are almost continuous in the whole process. That meansthe provided system services are almost continuous.During the running of the service, when the faulty replicas are going to break through the threshold F and then proactive recovery is triggered. In this system, in order to reduce the downtime of system services, we adopt a parallel recovery strategy that creates a new domain in parallel to the execution of the other applications. In CC-VIT system we could clone a passive replica to quickly create a new replica domain with the latest available state, and then obtain the state after the last state updates through state transfer. After state updates and state transfer, the replica manager hands over request execution to the former passive replica (new replica), and shuts down the old faulty active replica. In this way, a potentially faulty replica is efficiently and continuously replaced with a clean one. In fact, there will be a short interruption of service during the switch of the new and old replicas, as the system will temporarily suspend the current requests when capturing state (using snapshot) and detaching disk volumes during the state transfer of replica [8]. After this step, the system will re-execute all requests executed by the old replica after the snapshot has been taken (capturing state) to guarantee the continuity and correctness of service. Sometimes, users may not feel this short interruption of system service when in the superior performance server or lower load platform. Figure 3. Proactive recovery based on CC-VITFigure 2. Creating state checkpoint and state updates (both sidespeaks); Activating replica and suspending replica (middle peaks)。

基于多级入侵容忍的数据库安全模型

入侵容忍；表决机制
［中图分类号］Ｔ３３Ｐ９［文献标识码］Ａ［文章编号］１７ —１９（０２００２０６１６６２１）４— ００— ３
一
、
问题提出
第一级—— 用户（ｓｒＬｙｒ：取的安全措施Ｕｅａｅ）采
２所示．
图２基于多级入侵容忍的数据库安全体系结构
三、体组件介绍具
１策略管理者．
装；并将过滤后的请求转发给相应的数据库；接受系统的响应结果给用户．
２ — ０
体上考虑人侵容忍的方案，冗余和多样性技术结将
合，利用事务级入侵容忍技术，现了数据的机密实性、可用性和完整性．统主要由策略管理者、终系对
端用户提供服务的服务器、理服务器、决机制、代表冗余异构数据库、ＤＩＳ和事务级入侵容忍构成，图如
２１０２年８月第２８卷第４期
江苏教育学院学报（自然科学）
ＪｕｎｌｆｉｇｕＩｓｔｔｏｄｃｔｎ（ａｒｌｃｅｃｓｏｒａｏａｓｔｕｅｆｕａｉＮｔａＳｉｎｅ）ＪｎｎｉＥｏｕ
Ａｕ．２１ｇ，０２Ｖｏ，８Ｎｏ４ｌ２．
数据库安全及解决方案现在仍主要集中在系统
的防御上，采用了防火墙、证、认加密、侵检测等手入

基于多层次入侵容忍数据库的安全体系入侵容忍实现

摘要：数据库的整体结构出发，论多层次入侵容忍数据库安全体系结构中入侵容忍的实现途径。从讨文献标识码：Ａ文章编号：６２７０（０８０～１３０１７ — ８０２０）６０９ — ２
用户和ＤＭＳ间的交互关系其实就是一个由输入与输出Ｂ之的映射关系构成的集合，，示，：用表即
作者简介：高雪霞（９４，，南长垣人，士，乡学院计算机科学系讲师，究方向为网络数据库、１７～）女河硕新研自然语言理解；郜伟（９４）男，南淮１７－，河滨人，州大学机械工程学院，究方向为自动控制技术。郑研
・
１４９・
软件导刊
２０正０８
复制控制管理：
，＜ｎｕ，ｕｕ＞；＝［ＩｐｔＯｔｔ／ｐ在这里，洞其实就是，漏的一个子集，：即
＝
ＩＩｐｔＯｔｕ＞＜ｎｕ，ｕｕ＞，ＩｐｔＯｔｕ＞为未＜ｎｕ，ｕｔｌｐＯｔｔＩ＜ｎｕ，ｕｔｐＩｔｐｐ
一
个动态的优先级。ＭＰ定期向ＡＳ送消息，Ｐ要对ＭＰ发ＳＰ发ＡＳＳ
出的信息及时做出回应。果在固定时间内ＭＰ没有接受到某如Ｓ
设运行在Ｏ上的数据库系统为Ａ．则从系统的整体性考Ｓ虑，其受到攻击的可能性由Ｏ的漏洞和ＤＭＳＳＢ的漏洞两个部分

软考-信息安全工程师学习笔记70——入侵容忍及系统生存技术应用

软考-信息安全工程师学习笔记70——入侵容忍及系统生存技术应用入侵容忍及系统生存技术是网络安全防御思想的重大变化，其技术目标是实现网络安全弹性，确保网络信息系统具有容侵能力、可恢复能力，保护业务持续运营人侵容忍及系统生存技术原理入侵容忍及系统生存技术的思想是假定在遭受入侵的情况下，保障网络信息系统仍能按用户要求完成任务。

生存性 3R 方法，该方法首先将系统划分成不可攻破的安全核和可恢复部分；然后对一定的攻击模式，给出和应的3R 策略：抵抗（Resistance）、识别(Recognition）和恢复（Recovery)，并将系统分为正常服务模式和被黑客利用的入侵模式，给出系统需要重点保护的基本功能服务和关键信息，针对两种模式分析系统的 3R 策略，找出其弱点并改进；最后，根据使用和入侵模式的变化重复以上的过程。

3R 方法假定基本服务不可攻破，入侵模式是有限集，维持攻防的动态平衡是生存性的前提入侵容忍及系统生存技术主要有分布式共识、主动恢复、门限密码、多样性设计等。

分布式共识避免单一缺陷主动恢复则通过自我清除技术，周期性让系统迁移转变到可信的状态，破坏攻击链条；门限密码则可以用于保护秘密，门限密码算法通常用（n，k）形式表示，n 表示参与者的个数，k 表示门限值（也称为阈值），表示获取秘密最少需要的参与者个数；多样性设计可以避免通用模式的失效，如操作系绕的多样性可增强抗网络蠕虫攻击能力。

入侵容忍及系统生存技应用1．弹性 CA 系统CA 私钥是 PKI 系统的安全基础，一旦 CA 私钥泄露，数字证书将无法得到信任。

为保护CA 私钥的安全性，研究人员提出弹性CA 系统，容忍一台服务器或多台设备遭受入侵时，PKI系统仍然能够正常运行。

其主要技术方法是采用门限密码的技术。

通过将私钥d 分解成若干个数的和，即 d =d1+d2+dt，再将 di 分到第 i 个服务器中去，当需要签名时，客户机将需要的签名信息 Hash 结果 M 发送到这 t 个服务器中，各服务器将计算结果送回客户机，客户机再计算。

基于入侵容忍的集成数据库安全结构

基于入侵容忍的集成数据库安全结构
李方涛 ’ 朱小燕盂丽荣，，
（．１清华大学计算机系智能技术与系统国家重点实验室，北京１０８；００４２山东大学计算机科学与技术学院，山东济南２０６）．５０１
摘要：出了一种综合的数据库安全结构，提该结构利用密码学知识，计了加密认证模块，设实现了数据的完整性、密性，机并保证了源数据的合法性。该结构还具有单一错误检测修正功能，一错误的纠正，单可以容忍在数据传输过程中的错误，实现了数据库的外部级入侵容忍。内部容忍模块给出了一种基于入侵容忍的内部数据库结构，高数据库的柔性和抵御入侵提的能力。该系统不仅具有入侵容忍功能，而且还具有加密认证功能，用于安全需求较高的领域。适
１０８，Ｃｉａ．ＣｌｇｆｏｕｅｃｅｃｄＴｃｏｏｙｈｎｄｎｉｅｓｙｉａ５００４ｈｎ；２ｏｌｅｍｐｔｒｉｎｅａｅｈｌｇ，ＳａｇｏｇＵｎｖｒｉ，Ｊｎｎ２０６，Ｃｈｎ）０ｅｏＣＳｎｎｔ１ｉａ
ｉＣｐｌｅｄｅｅｔｅｈｇｅｅｕｉｖｌｓｅｄｄｔａａｐｙｔｆｌｓｎｏｉｗｈｒｉｈｒｃｒｔｌｅｅｅ．ｈｓｙｅｉｎＫｅｒｓｉｔｓｏｌｒｎｅｅｃｙｔｎａｔｅｔｃｔｎｄｔｂｓｅｕｉ；ｅｏｏｅｔｏｙｗｏｄ：ｎｒｉｎｔｅａｃ；ｎｒｐｉ；ｕｎｉａｉ；ａａｅｓｃｒｔｕｏｏｈｏａｙｒｒｒｃｉｎｃ

基于自适应入侵容忍的数据库安全体系结构

ｐｉａｉｎｔｅｆ—ｓａｉｚｄｌｖｌｆａａｉｔｇｉａｄａａｌｉｉｎｔｅｆｃｆａｔｃｓａｄｄｍａｅ，ａｄｔｌｃｔｓｗｉｈａｓｌｏｔｌｅｅｅｔｎｅｒ哆ｎｖｉｌｔｉｈａｅｏｔｋｎａｇｂｉｏｄｂａｙａｎｏ
ｒｄｃｈｏｔｏｅｕｉｅｕｅｔｅｃｓｆｓｃｒｔｙ．Ｋｅｗｏｄｉｔｕｉｎｔｌｒｃｙｒｓｎｒｓｏｏｅａｅ；ｄｔａｅｓｃｒｔｎａａｓｅｕｙ；ａａｔｅｒｃｎｉｕａｉｎｂｉｄｐｉｅｏｆｇｒｔｏｖ
自我诊断、修复和重构的能力，并能为合法用户提供所需的全部或者降级的服务。目前的人侵容忍数据库（ｎｕｉｏｅｎａＩｔｓｎＴｌａｔ．ｒｏｒＤ
ｔａｙｔ）ａｓＳｓｍ系统，简称ＩＤｂｅｅＴＢ，普遍存在以下几个问题：（）１在面临攻击时，如何维持稳定水平数
数据库安全研究的重点在于如何保护数据的机密性、完整性和有效性。随着系统复杂性和用户数量的增加，防火墙、访问控制、入侵检测、认证、加密等防御措施对于一些恶意的攻击有时是无效的，。因此，在防御失败的情况下，必须２ｊ寻找一种方案增强现有数据库系统的安全，使它们针对攻击具有自动恢复的能力或称弹性，提高

基于多级入侵容忍的数据库安全体系结构

数据库的可生存性、可用性及关键数据的机密性、完整性。与其他入侵容忍数据库相比，中提出的数据库安全体系结构能有效抵御来自文于Ｏ级、ＤＭＳ以及事务级的恶意攻击，同时降低了安全成本。ＳＢ级关翻：入侵容忍；数据库安全；冗余；事务容忍
ＡｒｈｔｃｕｅｆｒＤａａａｅＳｃｒｔｓｄｏｕｔ・ａｅｃｉｅｔｒｏｔｂｓｅｕｉｙＢａｅｆＭｌｉｙｒｌ
２ＳｈｏｏｏｐｔｒｃｅｃｎｅｈｏｏｙＳａｄｎｉｅｓｔ，ｉａ５０．ｃｏｌｆｍｕｅｉｎｅａｄＴｃｎｌｇ，ｈｎｏｇＵｎｖｒｙＪｎｎ２０６）ＣＳｉ１
［ｂｔｃｈａｅａｏｔｍｌ— ｙｒｅｕｉｏｅｉｅｒｅｒｕｄｎｙｎｒｔａｈｅｔｒ，ａｅｓｏｔｒｌｅｕｔｓａｇＡｓａｔＴｉｐｐｒｄｐｕｉａｅｓｒｙｄｌｎｇａｓｅｎａｃｄｖｉｙｒｉｃｅｍｋｓｅｆｎｇａｓｃｒｒｅｙｒｉｓｓｔｌｃｔｍ，ｔｔｄａａｅｃｔｕｓｕｉｅｉｔｔｙ
能力。
近年来，容忍入侵的数据库系统的研究取得很多成果，
但也存在一些问题：１（）没有从系统的整体结构上考虑容忍入侵的方案；２（）系统的安全成本过高。本文采用面向服务的入
侵容忍思想，提出一种基于多级容忍入侵的数据库安全体系
结构。
田１多缓入侵彝墨ｔ据库安全体熏结构
Ｉｔｕｉｎｔｌｒｎｅｎｒｓｏ．ｏｅａｃ

基于自适应入侵容忍的数据库安全体系结构

图１ＴＢ结构图ＩＤ
三ｌｏ ∽ Ｊ弓Ｑ硒Ｊ ∞ ａ ∈ｏｏ≥ ∞ｚ
维普资讯
Ｉｌ术．术Ｉ用术学技实技
２
、
系统存在的问题
消息类型；发送者；接受者；参数名称；值；单位；行为；各个消息包含７项内容，各项内容用分号隔开。第一项内容，消息类型指出了消息的类型，它的值决定了剩余项内容的格式。发送者指出了发送部件的名称。接收者指出了目的地部件的名称。参数名称指出＿需要被改变的参数。值是ｒｌ由ＳＳ提供的新的参数值。单位指出了度量的单位，其可Ｍ
数据库安全研究的重点在于如何保护数据的机密性、完整性和有效性。随着系统复杂性和用户数量的增加，防火墙、访问控制、入侵检测、认证、加密等防御措施对于一些恶意
１
，
系统的工作原理
策略执行管理器（ＥＭ）Ｐ，负责代理普通用户的事务，并执行系统范围内的入侵容忍策略，如隔离和破坏控制。入侵检测器（Ｄ）Ｉ，使用事务日志、数据库中捕捉到的踪迹以及
一
的攻击有时是无效的 ” 。因此，在防御失败的情况下，我们 ’ 必须寻找一种方案增强现有数据库系统的安全，使它们针对
维普资讯
实技学．术Ｕ用术Ｉ术技
基于自适应入侵容忍数据库安全体系结构内

自适应入侵容忍数据库系统的研究

自适应入侵容忍数据库系统的研究
王晓燕;杜萍
【期刊名称】《电脑与电信》
【年(卷),期】2008(000)008
【摘要】入侵容忍技术是一种新的信息安全方法.本文首先对入侵容忍技术进行了详细的探讨.讨论入侵容忍技术的实现方法,从系统的整体角度出发,根据数据库系统安全的需求,构建了一种多层次的入侵容忍数据库安全模型--基于角色访问的自适应客侵数据库体系结构.
【总页数】3页(P27-28,38)
【作者】王晓燕;杜萍
【作者单位】东华理工大学数学与信息科学学院,江西,抚州,344000;东华理工大学数学与信息科学学院,江西,抚州,344000
【正文语种】中文
【中图分类】TP3
【相关文献】
1.一种弹性入侵容忍数据库系统的设计 [J], 黄志国;韩慧莲
2.入侵容忍技术在数据库系统中的应用 [J], 于常辉;孟丽荣;徐成强
3.一种入侵容忍的Web数据库系统设计方案 [J], 郑顾平;徐露锋
4.用于入侵容忍数据库系统的多阶段控制技术 [J], 李文才;孟丽荣;于常辉
5.一种入侵容忍的安全数据库系统设计方案 [J], 孟丽荣;夏思淝;陈驰;冯仕红
因版权原因，仅展示原文概要，查看原文内容请购买。

入侵容忍实时数据库的半马尔可夫生存能力评价模型

陈长清裴小兵周恒刘云生
（中科技大学软件学院武汉华４０７）３０４
摘
要
针对事务和数据的实时特性，出了具有入侵容忍能力的实时数据库系统的体系架构．于实时性的要给基
求和入侵检测存在的延迟，出了半马尔可夫评价模型，实时数据库在入侵容忍条件下的生存能力进行评价，提对并
根据此模型给出相关的量化准则，义了完整性与可用性等生存性指标，实时数据库的生存能力进行了验证．定对由于误报、出率和攻击强度等因素会对生存能力造成重大影响，此利用ＴＰ基准测试对其进行了详细的数据检因ＣＣ
（ｃｏｌｆＳｆｗａｅＥｎｉｅｒｎＳｈｏｏｏｔｒｇｎｅｉｇ，ＨｕｚｏｇＵｉｅｓｔｆＳｉｃｎｃｎｌｇＷｕａ４０７）ａｈｎｎｖｒｉｏｃｅｅｄＴｅｈｏｏｙ，ｈｎ３０４ｙｎａ
ｔｒｓｐｏｏｅｏｈｅｌｔｍｅｄｔｂｓｙｔｍ．Ｃｏｓｄｒｎｅｌｉａａｔｒｎｎｒｓｏｕｅｉｒｐｓｄｆｒｔｅｒａ— ｉａａａｅｓｓｅｎｉｅｉｇｒａ— ｍｅｐｒｍｅｅｓａｄｉｔｕｉｎｔ
ｄｔｃｉａｅｙ，Ｓｅ — ａｋｏｖａｕｔｏｅｅｔｏｎｌｔｎｃｍｉＭｒｖｅｌａｉｎｍｏｄ１ｉｓａｉｈｅｏａｃｓｈｅｓｖｖａｌｔｆｒａ — ｅｓｅｔｂｌｓｄｔｃｅｓｔｕｒｉｂｉｉｙｏｅｌｔｍｅｄｔｂｓ．Ｂａｅｎｔｓｍｏｅ，ｒｌｖｎｔｑｎｉａｔｖｒｔｒａａｅｇｉｅｏｄｅｉｈｅｉｉａｉａａａｅｓｄｏｈｉｄｌｅｅａｕａｔｔｉｅｃｉｅｉｒｖｎｔｆｎｅｔｎｄｃ — ｔｓｏｈｅｓｒｉａｉｉｙ，ｓｃｓｉｔｇｉｙａｖａｌｂｉｉｙ，ＳｓｔａｉａｅｔｕｒｉａｌｙｏｏｒｆｔｕｖｖｂｌｔｕｈａｎｅｒｔｎｄａｉａｌｔＯａｏｖｌｄｔｈｅｓｖｖｂｉｔｆｉｒａ— ｉａａａｅＢｅａｅｈｅｆｃｏｓｓｃｓｆｌｅａａｍ，ｄｅｅｔｏａｅａｄｔｎｔｎｓｔｅＩｔｍｅｄｔｂｓ．ｃｕｓｔａｔｒｕｈａａｓｌｒｔｃｉｎｒｔｎｈｅｉｅｉｙｏｆａｔｃ ቤተ መጻሕፍቲ ባይዱ ｅｉｔａｋｓｈｖｍｐｏｔｎｔｅｆｃｓｏｎｔｕｒｉａｌｔｒａｆｅｔｈｅｓｖｖｂｉｉｙ，ｔｙａｅａａｙｅｈｅＴＰＣ— ｂｎｃｈｅｒｎｌｚｄｂｙｔＣｅｈｍａｋｉｒｎ

基于入侵容忍的数据库安全体系模型

随着计算机技术的发展，据库管理系统已经在商业、数军事等各种领域有了广泛的应用，数据库的安全问题也一直倍受人们的关注。数据库安全研究的重点就是保证数据库的机密
性、完整性、效性。有然而，传统的数据库安全技术如防火墙、侵检测、密技入加术、认证技术等一直是侧重于对攻击的防御上，于黑客攻进对系统内部的情况，系统本身并没有具体的解决措施，能任其只肆意的破坏，且破坏会不断扩散，并从而使得系统会付出沉重
ｓｓｉｉｕｒｎａｔｎｒｓｌｔｄ，ｎｌ—ｔｇａｇｏｔｌｅｈｏｏｙｗａｒｓｎｅｏｐｅｅｔｄｍａｅｐｏｉａｔｎｃｍｂｎｄｔｅｍｕｔｕｐｃｏｓｔｓｃｉｓａｅｉａｅａｄｍｕｔｓａｅｄｍａｅｃｎｒｃｎｌｇｓｐｅｅｔｄｔｒｖｎａｇｒｌａｏｏｉｏｔｆｉ，ｅｒｏｏｉｅｈｌ＿ｉ
ｓａｅｃｎｏｔｈｏｇｉｎａｔｎｒｉ，ｅｓｓｅａｒｅｄｃｅｉａｉｎｆｈａｇ．ｏｅｓｒｈｎｈｓｍｉｉａｉ，ｔｇｏｔｌｃｎｌｙｔｔｓｃｏｇｎｔｙｔｍｍｙｕｈｒｅｕｅｈｖｓｅｄｍａｅＴｎｕｅｗｅｅｓｔｖｄｎｉｒｅｏｗｈｒａｉｍｅｇｈｆｔｒｔｎｏｏｔｔｙｅｓｎｇｔｃｎｐｖｅｕｉｅｒｐｅｅｖｅｏｇｉａｅｕｅｓａｒｉｎｔｒｔｄｓｒｉｒｅｉｔｓｒ．ｏｄｎｕｃｆｌｔｍ

入侵防御参数

份证、手机和固定电话号码、银行卡、IP 地址和文件指纹功能。
支持双机热备和双机主备功能，并且主备热备时需支持连接状态和配置同步。
支持硬件 BYPASS。在设备故障、重启及断电的情况下可保障网络畅通，能够手动配置 BYPASS 的
启停。
高可用系统应支持高负载下的 bypass 功能，使得系统在 CPU 和内存较高情况下启动 bypass 功能，避免
信息应包括源目的 IP、协议类型、文件基本信息、危险等级及文件的应用的详细信息（如邮件的
发件人、收件人、标题等），方便对恶意文件进行追踪，
系统支持恶意代码动态检测联动功能，能够和防 http、ftp、邮件协议中包含的 office 文档、图片文档及压缩文档提交给 APT 检测系统，并获得
不少于 40 万；
对于 HTTP 协议和邮件协议，提供信息替换功能，用以通知用户病毒被阻断，管理员可以自行设
置替换信息；
具备邮件内容过滤功能，有效防止恶意邮件及信息外泄。可根据邮件 SMTP 命令、发件人、主题、
附件、IP 及邮件大小进行邮件过滤，（截图证明并加盖公章）
内容防护
能够基于流量特征的 P2P 应用识别系统，提供权威机构的证明文件并加盖公章。系统能够检测敏感信息的外泄行为并阻止传输行为，有效保护用户的知识资产，支持检测和防范的对象包括但不限于：信息和文件中的关键字，身份证、手机和固定电话号码、银行卡、IP 地址等信息监控，重要数据文件保护等。并可以设置白名单。需通过产品界面截图证明正则表达式（身
所投产品必须提供以下证明文件（扫描件加盖原厂公章）：
产品资质要求
具备公安部颁发的《计算机信息系统安全专用产品销售许可证》(国标三级)；具备公安部或国家保密局出具的检测报告 ★具备中国信息安全测评中心颁发的《国家信息安全测评信息技术产品安全检测证书》（EAL3+级）具有国家版权局颁发的《计算机软件著作权登记证书》；

入侵容忍数据库隔离算法设计

信息技术
２０１６年第
任强
（中国人民银行廊坊市中心支行，河北廊坊０６５０００）
摘要：入侵容忍数据库是解决数据安全问题的有效途径，但是入侵容忍数据库隔离算法的性能严重影响入侵容忍数据库的运行效率，成为制约入侵容忍数据库技术应用的主要障碍。这里通过分析入侵检测和攻击恢复的过程，给出一种入侵容忍数据库隔离算法的设计思路，以提高入侵容忍数据库的运行效率。关键词：入侵容忍；隔离；算法
１概述３隔离算法设计数据库原子事务的性质表明，只有被提交成功的事务才能改写基于上述的隔离方案，设计隔离算法如下：数据库中的数据。因此，在理论上只要我们能在事务提交前检测出开始它是否是恶意的，则可以在引起错误前回滚该事务。然而，这个方案如果ＳＱＬ语句想插人数据的表（表示为Ｒｉ）没有为可疑用户建事实上是不可行的：首先，事务执行的速度远远快于检测的速度，而立可疑版本（指示为Ｓｉ）降低事务的执行速度会引起严重的拒绝服务。其次，一些经过授权创建Ｓｉ；却是恶意的事务很难检测出来。这些恶意事务与其他合法的事务看如果ＳＱＬ语句在值域没有子查询起来一样。基于事务语义的异常检测可能是鉴别这种恶意事务的仅重写插入语句，使ｓｉ代替Ｒｉ；有的有效手段，然而对于异常检测要想在合理的检测反应时间和虚附送重写的插入语句到ＯｒａｃｌｅＳｅｒｖｅｒ；警率的条件下实现１００％的检测率，即使可以实现也是非常困难的。否则假设ＳＱＬ语句的子查询访问数据表Ｒｊ１， …．，Ｒｊｎ因此，可行的目标应该是在数据库被破坏后，尽快定位被破坏的部对于每一个Ｒｊｋ，如果包含Ｓｊｋ中被删除的记录，则从Ｒｊｋ中删分并修复，从而是数据库在遭受攻击时可以继续提供服务。除，并在内存中保存这些记录；２损害数据的隔离方案对于每一Ｓｊｋ，如果包含Ｒｊｋ中没有的记录，则插入这些记录到２．１隔离工作过程Ｒｊｋ中；重写插入语句，去掉 ” ＩＮＳＥＲＴＩＮＴＯｔａｂｌｅ＿ｎａｍｅ ” ；首先，根据门限值ＴＨ和ＴＨ作为入侵检测报告两种级别的警告。当异常事务高于异常门限ＴＨ时，该事务被报告为恶意的；当异重写由前一步骤产生的查询语句；常事务高于异常门限ＴＨ，而低于异常门限ＴＨ时，该事务被报告假设结果表示为Ｔｏ — Ｉｎｓｅｒｔ，附送这个语句序列到Ｏｒａｃｌｅｓｅｒｖｅｒ为可疑的（ＴＨ和ＴＨ的值取决于先前攻击的统计分析）。当恶意事执行；务被报告之后，系统进行以下工作；当可以事务被报告之后，协调者删除已经被插入到Ｒｉ１， …，Ｒｊｎ的每一个记录；对已经被从Ｒｊ１，… ，Ｒｊｎ中删除的记录，重插入这些记录到在隔离管理者的协助下，将Ｔ（以及提交Ｔ的用户之后的事务）重定向到虚拟的隔离数据库中，在那里用户被隔离。随后，如果用户被Ｒｉ１， …，Ｒｊｎ；证明是恶意的，隔离管理者将取消该用户的操作；如果用户不是恶将Ｔｏ＿Ｉｎｓｅｒｔ中的每一个记录插入到相应的Ｓｊｋ；意的，隔离管理者将该用户的操作结果导入主数据库。采用这种方结束案，破坏扩散能被急剧减少而不牺牲检测速度或降低对正常事务的４下一步的工作可用性。本方案说明，基于ＣＯＴＳ组件来建设的容忍入侵的数据库系统我们按用户隔离是因为由同一个用户提交的事务应该相互了结构具有以下优点：解结果。这个方案应该能够同时隔离多个用户。将一组用户隔离在（１）一个多层的深度防御方式，通常比使系统的可存活性依赖同一个虚拟数据库可以有助于解决合谋攻击，然而，当只有部分用于一个或两个诸如入侵探测的机制效率的方法有更多的成本效益；户是恶意的时候，这将导致大量的应用性下降。（２）适应性的容忍入侵机制通常比提前编制的容忍入侵机制有更多采用完全的数据库复制去隔离用户有两个缺点：一是代价高的成本效益；（３）面向服务的容忍入侵数据库系统通常比面向状态昂；二是没被隔离的用户更新结果对隔离用户是不可见的。在该方的容忍入侵数据库系统有更多的成本效益。案中，我们采用数据版本虚拟构建隔离数据库。一个数据对象Ｘ通针对下一步工作，我们认为未来研究方向应该有以下几个方常总是拥有唯一信任版本，记为ｘ［ｍａｉｎ］。只有当ｘ被隔离用户更新面：后，ｘ拥有一个特别的可疑版本。这样，总的可以版本的数量将大大首先，恶性事务也许能被一系列部分复制的数据库服务器掩盖，这里每个服务器只执行一组而并非全部事务。这样一个伪装的少于信任版本的数量。隔离算法有两个关键部分：（１）隔离用户进行怎样读写操作（注框架的关键挑战应该是安全与数据一致性间的权衡。意，未被隔离的用户只能访问主数据库）；（２）一个隔离用户被证明其次，入侵探测器的准确性和反应时间对容忍入侵数据库系统这点一般是正确的。因此，为了使配是非恶意之后，如何将其融合到主数据库。对第一个问题，我们可以的整个成本效益有很大的影响，知道该探测器采取单向隔离：如果没有一致的可疑版本，隔离者可以读信任版本，置一个探测器的容忍入侵的数据库系统有成本效益，根据假正数率，假负数率和探测反应时间）是很值且所有隔离者的写操作都标记为可疑版本。第二个问题的关键在于需要做到怎样好（信任版本和可疑版本不一致。如果一个可信用户和一个可疑用户分得的。最后，操作系统级和事务级的容忍入侵机制应该被无缝的整合别更新同一个对象ｘ，ｘ［ｍａｉｎ］与可疑版本将不一致，为了进行融合就这个整合需要仔细研究这两级必须其中一个更新。此外，研究表明即使不是更新同一个对象也会来建造多层的容忍入侵数据库系统。引起不一致。并且，一个隔离对象的融合可能会影响到另一个仍旧机制间的关系。例如，尽管使用事务级方式不能探测出操作系统级数据污染，但事务级方式对恢复这些污染十分有用。被隔离的用户。这些不一致必须在融合时解决掉。参考文献２．２隔离方案的特点本方案具有以下的特点：（１）在很大程度上，隔离对可疑用户是『ｌｉｅｄ、玉海，孟丽荣．基于入侵容忍的数据库安全解决方案计算机２００５（３）．透明的。（２）隔离带来的额外存储开销很低。（３）数据在隔离前和融工程与设计，２１陈驰，孟丽蓉，夏思淝．入侵容忍数据库系统中选举方案的设计与合后是一致的。（４）在融合过程中，如果这里有某些不一致，某些隔『Ｊ１．微电子学与计算机，２００２，１９（１１）：４１ — ４３．离的或未被隔离的事务不得不退回以解决这个问题，这是该方案的实现Ｉ主要代价。幸运的是，研究表明事务回滚的代价只有５％。在不一致问题

入侵容忍数据库隔离算法设计

入侵容忍数据库隔离算法设计入侵容忍数据库是解决数据安全问题的有效途径，但是入侵容忍数据库隔离算法的性能严重影响入侵容忍数据库的运行效率，成为制约入侵容忍数据库技术应用的主要障碍。

这里通过分析入侵检测和攻击恢复的过程，给出一种入侵容忍数据库隔离算法的设计思路，以提高入侵容忍数据库的运行效率。

标签：入侵容忍；隔离；算法1 概述数据库原子事务的性质表明，只有被提交成功的事务才能改写数据库中的数据。

因此，在理论上只要我们能在事务提交前检测出它是否是恶意的，则可以在引起错误前回滚该事务。

然而，这个方案事实上是不可行的：首先，事务执行的速度远远快于检测的速度，而降低事务的执行速度会引起严重的拒绝服务。

其次，一些经过授权却是恶意的事务很难检测出来。

这些恶意事务与其他合法的事务看起来一样。

基于事务语义的异常检测可能是鉴别这种恶意事务的仅有的有效手段，然而对于异常检测要想在合理的检测反应时间和虚警率的条件下实现100%的检测率，即使可以实现也是非常困难的。

因此，可行的目标应该是在数据库被破坏后，尽快定位被破坏的部分并修复，从而是数据库在遭受攻击时可以继续提供服务。

2 损害数据的隔离方案2.1 隔离工作过程首先，根据门限值THm和THs作为入侵检测报告两种级别的警告。

当异常事务高于异常门限THm时，该事务被报告为恶意的；当异常事务高于异常门限THs，而低于异常门限THm时，该事务被报告为可疑的（THs和THm的值取决于先前攻击的统计分析）。

当恶意事务被报告之后，系统进行以下工作；当可以事务被报告之后，协调者在隔离管理者的协助下，将Ts（以及提交Ts的用户之后的事务）重定向到虚拟的隔离数据库中，在那里用户被隔离。

随后，如果用户被证明是恶意的，隔离管理者将取消该用户的操作；如果用户不是恶意的，隔离管理者将该用户的操作结果导入主数据库。

采用这种方案，破坏扩散能被急剧减少而不牺牲检测速度或降低对正常事务的可用性。

我们按用户隔离是因为由同一个用户提交的事务应该相互了解结果。

基于入侵容忍的分布式数据库安全体系结构

技术创新中文核心期刊《微计算机信息》(管控一体化)2006年第22卷第11-3期360元/年邮局订阅号:82-946《现场总线技术应用200例》信息安全基于入侵容忍的分布式数据库安全体系结构I nt r usi on-t ol er antbased ar chi t ect ur e f ordi st r i but ed dat abase syst em secur i t y(1.华北电力大学;2.吉林大学)郑顾平1徐露锋1徐沛娟2ZHENG G UPI N G XU LUFENG XU PEI JUAN摘要:分析了分布式数据库系统的结构及其面临的安全问题,提出了一种基于容侵技术的分布式数据库体系结构。

从事务处理的角度出发,结合入侵检测和容侵技术,对被攻击的部分进行定位和修复,为合法用户提供不间断的服务。

采用门限秘密共享技术,实现关键数据的机密性。

关键词:分布式数据库;入侵容忍;入侵检测中图分类号:TP309.2;TP392文献标识码:AAbs t r ac t :Thi s pa pe r a na l y s e s t he s t r uc t ur e o f di s t r i but e d da t a ba s e s y s t e m a nd i t s s e c ur i t y i s s ue,t he n pr o po s e s a n a r c hi t e c t ur e f o r di s t r i but e d da t a ba s e s y s t e m s e c ur i t y ba s e d o n i nt r us i o n t o l e r a nc e.W i t h i nt r us i o n de t e c t i o n a nd i nt r us i o n t o l e r a nc e t e c hno l o g y,ba s e d o n t r a ns a c t i o ns ,t hi s a r c hi t e c t ur e c a n de t e c t i nt r us i o ns ,l o c a t e a nd r e pa i r t he da ma g e c a us e d by t he i nt r us i o ns ,t hus ,t he s y s t e m c a n pr o v i de uni nt e r r upt e d s e r v i c e s t o l e g i t i ma t e us e r s .Thr e s ho l d s e c r e t s ha r e s c he me s a r e pr e s e nt e d t o pr o t e c t c o nf i de nt i a l da t a.K e y wor ds :di s t r i but e d dat abas e ,i nt r us i on t ol e r anc e ,i nt r us i on de t e c t i on文章编号:1008-0570(2006)11-3-0100-031引言I nt e r ne t 的高速发展推动着分布式数据库的发展,另一方面它也加剧了分布式数据库安全问题的复杂性。

基于容忍入侵的网络安全防护系统设计与分析

２１年第Ｏ期０２５
基于容忍入侵的网络安全防护系统设计与分析
侯丽波
（辽宁警官高等专科学校，辽宁大连１６３１０６）
摘要：文章阐述了新一代网络防护可生存性的重要性，并对容忍入侵概念及功能做了介绍。文中引入容忍入侵的设计思想，采用冗余结构，实现系统即使被入侵或故障发生也能提供正常有效服务的容忍入侵的
Ｋｅｒｓｓｒｉａｉｔ；ｎｒｓｏｌｒｎｅｈｔｒｇｎｏｓｒｄｄｎｙｙｗｏｄ：ｕｖｖｂｌｉｔｉｎｔｅａｃ；ｅｅｏｅｅｕ；ｅｕａｃｉｙｕｏｎ
Ｏ引言
随着网络安全问题的日益严峻，网络安全防护研究也越加深入，网络安全纵深防御体系是当前比较重要的安全防御思想，其主要是从整体防御的角度 Ⅲ发，逐层对系统进行安全保护，相对于单独应付某种特定攻击的安全措施，纵深防御体系是一个
系统安全防护体系
关键词：可生存性；容忍入侵；异构；冗余
中图分类号：Ｔ３３０文献标识码：Ａ文章编号：１７— １２（０２０ — ０４０Ｐ９．８６１１２２１）５０２ — ３
ＤｅｉｎａｎａｙｉｆＮｅｗｏｋＳｃｉｙＰｒｔｃｉｎＳｔｍｓｄｓｇｎｄＡｌｓｓｏｔｒｅｕｒｔｏｅｔｏｙ为。第二代网络安全防护实现过程中承认了即使使用了保护技术也会有入侵存在，但系统的正常运行是建立在系统部件功能不失效的前提下，该时期以检测技术为重要安全防护技术，并结合系统保护和恢复技术，实现系

入侵容忍 [浅析入侵容忍系统的安全性量化方法]

《入侵容忍 [浅析入侵容忍系统的安全性量化方法]》摘要：要：网络系统的攻击与防御，在网络服务普及的同时早就成为了计算机领域内的重要课题，在网络技术发达的今天，基于安全性的技术越来越多，为了更好地保护私钥，出现了基于门限密码学原理的入侵容忍系统摘要：网络系统的攻击与防御，在网络服务普及的同时早就成为了计算机领域内的重要课题。

在硬件技术与系统结构不断发展的同时，网络系统的复杂程度逐渐超越了人们最初的预计。

在复杂的网络环境中，完美的安全系统已经只能成为理想的模型。

入侵容忍系统在这种情况下成为网络系统安全防御的重要策略，并逐渐在实际操作中占有越来越多的比例。

关键词：入侵容忍系统；安全性；量化方法在网络技术发达的今天，基于安全性的技术越来越多。

在网络安全研究技术人员的努力下，已经开发出很多开放环境中服务系统的安全防护技术，包括防火墙技术、存储控制、数据加密算法等。

而在网络技术发达的同时，网络系统的复杂性也越来越高，攻击的方式与技术也在不断发展，想要实现理想状态的网络服务系统是无法完成的。

在这种情况下，我们对网络环境的服务系统的安全性要求就必然要降低水准，只要能够保证关键系统的足够安全性即可。

也就是说在系统遭受入侵的时候，甚至网络系统遭到一定程度的破坏时，能够完成系统的基本功能。

这就是网络系统的入侵容忍。

一、入侵容忍的概念计算机系统的构成从图灵机到现在的大规模集成化系统，系统的复杂程度已经远远超越了最初设计时的现象。

在网络迅速发展的今天，人们采取了各种各样的安全防范方法和策略来提升系统的安全性。

在传统的解决方式中，安全技术的最终目标是将具有风险的攻击排除在系统之外，包括入侵检测、防火墙、认证系统、访问控制、加密等。

但实际情况是，网络系统的构成越来越复杂，使用服务的用户群也越来越庞大，系统运作的细节和用户的控制复杂程度已经远远超出了预计，想要让防御措施深入到每个细节或控制每个用户的安全风险是不可能实现的。

在这样的环境中，传统的防御手段无法对所有恶意攻击进行抵御。