基于策略的网络安全管理系统设计与实现-计算机应用技术专业论文.docxVIP

摘要綦]j策略的网络安全管理方法是分布式系统安全管理领域新的研究方向，被学术群、 摘要 綦]j策略的网络安全管理方法是分布式系统安全管理领域新的研究方向，被学术群、 业界和标准化组织公认为是解决太规模分布式系统的安仝管理问题最有希颦的方法。奉义 t要研究基于策略的网络安全管理系统的设计和实现问题。 本文深入研究了基于策略的恻络安全管理思想，尤其是Ponder策略模型及其艾现。和 此基础上，设计并实现了一个基于笫略的网络安全管理系统。系统结合底层的安全机制刈 Ponder语言’编译器进行了扩展，能够方便地定义分布式防火墙策略、网络访问控制策略和 文件系统访问控制策略。同时，系统实现了蚓形化的管理工具集，集成了域管理、资源管 理、策略管理、同志管理等功能，为安全管理员提供了方便的嘲络安令管理接I I。系统还 ‘实现了独立丁底层安全机制的策略配置管理体系，有效文现了刈寅全策略的自动分发、延 行时管理、自动适心被管对象变化、各底层安全机制问联动的支持。 本文实现的安命管理系统集安全策略的定义、配置及其实施功能于 体，与传统网络 安全管珲系统相比，具有更好的可扩展性和灵活性，为网络系统的安全管理提供了‘利嗍i 的技术途径。 关键词：基于策略的管理、策略配置、策略语言 策略管理框架、网络安全管理 第1Il负 一一 一一 堡：垦!堡查兰塑．!：兰堕堡兰 Abstract Policy—based network security management is one of the latest developments in network and distributed systems security management．Academio and commercial settings，as well as standardization bodies are concentrating on policy—based network security management as a very promising solution for security management of large—scale distributed systems．The thesis is major in researching the issue of designing and implementation of policy—based network management system． This paper have deeply researched policy—based network security management， especially to Model of Ponder policy management and its implementation Based on the researching we have designed and implemented a policy—based network security management system．combining low-level security mechanism the system has extended Ponder compiler and so expediently define policy for distributed firewall，access control of network and file system．The system also has implemented a graphical toolkit which is integrated with functions of management domain，resource，log and policy，which provides some convenient interfaces of network security management for security administrator．The system has implemented the architecture of deploying and managing policy that is independent to low-level security mechanism，and effectively sustains for auto～distributing policy，management policy in runtime，。self-reacting changing of the managed objects，linkage between se