CN103856486A

CN103856486A - Large-scale network logical safety domain access control method

Info

Publication number: CN103856486A
Application number: CN201410070159.0A
Authority: CN
Inventors: 马琳; 刘嵩; 刘福强; 房潇
Original assignee: UNIT 91655 OF PLA
Current assignee: UNIT 91655 OF PLA
Priority date: 2014-02-28
Filing date: 2014-02-28
Publication date: 2014-06-11

Abstract

The invention provides a large-scale network logical safety domain access control method for independent and differentiated protection of different safety domains. The method includes the first step of dividing boundaries between the safety domains into external network boundaries, internal network boundaries, application boundaries, longitudinal boundaries and horizontal boundaries according to connection and information relations between application systems with different types and different grades, and the second step of enabling the external network boundaries to implement one-way data input for physical isolation by adopting mobile storage media, and adopting a one-way safe isolation method and a two-way safe isolation method for logical isolation. According to the large-scale network logical safety domain access control method, the independent and differentiated protection of the different safety domains are achieved, architectures of networks and systems can be straightened out, logical structures of information systems can be more clear, and complexity for system design is simplified.

Description

A kind of large scale network logical security domain browsing control method

Technical field

The present invention relates to a kind of security domain access control method, especially a kind of large scale network logical security domain browsing control method.

Background technology

In a lot of large-scale distributed information systems, related to multiclass application subsystem, comprised again multiple subsystems in different subsystems, different subsystems and subsystem have accessed again a lot of support safeguards systems, make the network configuration more sophisticated of information system

Summary of the invention

The invention provides a kind of independent of different security domains, large scale network logical security domain browsing control method of differentiation protection of realizing.

The large scale network logical security domain browsing control method that realizes the object of the invention, comprises the steps:

(1) connection and the information relationship between the application system of, different stage dissimilar according to information system, is outer net border, Intranet border, application boundary, longitudinal boundary and horizontal boundary five classes by the boundary demarcation between security domain;

(2) described outer net border adopts mobile memory medium to implement one-way data importing and realizes physical isolation; Adopt one-way safety partition method and bidirectional safe partition method to realize logic isolation;

Described Intranet border Adoption Network access control method, virus and malicious code filter method, authentication and authorization method and intrusion detection and the isolation of auditing method implementation strategy;

Described application boundary Adoption Network access control method, access authentication and authorize control method and execute application isolation;

Described longitudinal boundary Adoption Network access control method, virus and malicious code filter method, discriminating/mandate/authentication method and intrusion detection and auditing method practice isolation;

Described horizontal boundary Adoption Network access control method, virtual subnet method and access list approach are guaranteed data exchange safety.

Described outer net border is the border of application system or its external network such as network and the Internet relying on;

Described Intranet border is the border between application system and the network that relies on thereof;

Described application boundary is the border between different application systems;

Described longitudinal boundary is the border between the superior and the subordinate or the similar application system of sane level;

Described horizontal boundary is the exchanging visit border between the inner different operating of application system territory.

The beneficial effect of large scale network logical security domain browsing control method of the present invention is as follows:

Large scale network logical security domain browsing control method of the present invention, for meeting the various demands for security of operation system and network system of information system complexity, take a point principle for territory protection, according to the type of business, importance, the difference of managerial class and safe class, carry out the division of logical security territory, according to " classification, classification, subregion " pattern, under total defense System Framework, classify according to the function of system and purposes, homogeneous system is carried out classification according to position and the importance of disposing, similar internal system at the same level forms subregion according to system, demand for security is decomposed step by step, form defense module independently one by one, it is logical security territory, by the access mechanism between Different Logic security domain is made overall planning, independently safety and Protection is carried out in different security domains inside, realize the independent of different security domains, differentiation protection, so that make the framework of network and system in order, make the logical construction of information system more clear, thereby simplify the complexity of system.

Accompanying drawing explanation

Fig. 1 is the schematic diagram of large scale network information system logical security territory boundary demarcation of the present invention.

Embodiment

As shown in Figure 1, large scale network logical security domain browsing control method of the present invention, comprises the steps:

Described horizontal boundary is the exchanging visit border between the inner different operating of application system territory;

Physical security technological means is for guaranteeing Environmental security, installation security and the media safety of information system, Environmental security comprises the safety of the environment at information system place, installation security comprises the safety of information system relevant device, and media safety comprises the safety of media data and the safety of media itself.

Network security technology means are mainly for the fail safe of basic network and availability, realize the functions such as network access security, network exchange safety and virus filtration, emphasis solves border access security problem, guarantee the safety of communication and exchange, and information system is carried out to Real-Time Monitoring, the weak link in active searching network, and in the time attacking generation, can find in time its inherent law, judge in real time, exactly source, means, the point of attack and the Harm of attack.

The safety problem of the main settlement server of Host Security technological means and terminal, realize the security protection to server and terminal: provide host computer system security protection and monitor audit ability, can carry out security monitoring and audit to behaviors such as main frame access in violation of rules and regulations, illegal external connection, peripheral hardware copy and accesss to netwoks, take precautions against secret leaking event to occur; Security risk assessment and hidden danger ability of discovery are provided, find in time and repair leak; Main frame virus killing ability is in real time provided, realizes the antivirus protection to server and terminal.

Application safety technological means is take certificate management system as basis, provide the function such as authentication and rights management for applied business, by Secure Application DLL (dynamic link library) or application proxy mode, the services such as confidentiality, integrality, non-repudiation, access control are provided for application system, and possess the security audit ability to application system, can register user, the behavior such as system use carries out audit trail.

Technology On Data Encryption means are for guaranteeing integrality and the confidentiality of system significant data information at transmitting procedure and storing process, and while guaranteeing completeness error to be detected in storing process, have corresponding measure information is recovered.

Embodiment recited above is described the preferred embodiment of the present invention; not scope of the present invention is limited; design under spiritual prerequisite not departing from the present invention; various distortion and improvement that the common engineers and technicians in this area make technical solution of the present invention, all should fall in the definite protection range of claims of the present invention.

Claims

1. a large scale network logical security domain browsing control method, comprises the steps:

2. large scale network logical security domain browsing control method according to claim 1, is characterized in that: described outer net border is the border of application system or its external network such as network and the Internet relying on;