跳到主要內容

臺灣博碩士論文加值系統

(3.235.56.11) 您好!臺灣時間:2021/08/04 09:04
字體大小: 字級放大   字級縮小   預設字形  
回查詢結果 :::

詳目顯示

我願授權國圖
: 
twitterline
研究生:高迦南
研究生(外文):Canaan Kao
論文名稱:安全的網路嵌入式作業系統核心設計與實作
論文名稱(外文):The Design and Implementation of Canix: A Secure Operating System Kernel for Embedded Networking Systems
指導教授:黃能富黃能富引用關係
指導教授(外文):Nen-Fu Huang
學位類別:碩士
校院名稱:國立清華大學
系所名稱:通訊工程研究所
學門:工程學門
學類:電資工程學類
論文種類:學術論文
論文出版年:2004
畢業學年度:92
語文別:英文
論文頁數:44
中文關鍵詞:安全作業系統嵌入式網路系統
外文關鍵詞:SecureOperating SystemEmbedded Networking System
相關次數:
  • 被引用被引用:0
  • 點閱點閱:136
  • 評分評分:
  • 下載下載:0
  • 收藏至我的研究室書目清單書目收藏:2
網路設備上的嵌入式系統我們簡稱為ENS(Embedded Networking System),如Cisco公司的IOS就是一套相當有名的ENS。ENS最主要的功能除了管理裝置本身的資源與處理封包外,還包含了其他的加值服務,例如網路頻寬管理與網路存取控制等等。我們這個研究的目的是要設計一個安全的ENS 核心,這個核心我們稱之為Canix,它除了具有一般ENS的功能外,我們特別加強它的彈性與安全性,因為隨著網際網路攻擊工具的普及,使得一般不具網路專業知識的使用者,也可以輕易地成為網路入侵者,而網路設備往往也是被攻擊的標的之一,因此新一代的ENS也必須要有自我防衛的功能。
在整個核心的架構上我們採用封包驅動模組化設計,這種設計方便我們變更封包的處理流程與加入新的功能。而當封包通過每個模組的時候,我們採用Zero-Copy這樣可以降低複製封包的行為進而提升處理效率。為了避免造成緩衝區溢位的弱點,整個核心對於記憶體的存取特別增加邊界檢查。另外我們也設計了自衛模組,當設備本身遭受網路攻擊的時候它可以保護自己不受入侵。自衛模組主要由三個子模組所組成,第一個是IP位址過濾器,第二個是封包完整性測試,第三是動態調整網路資源老化的時間。由於我們只實作一個 ENS 必要的部份,所以整個核心顯得精簡並且容易移植。基於我們的研究經驗,實作一個全新的ENS,並不是一件遙不可及的事,並且我們可以徹底掌握整個系統的架構。
The main function of most network devices is to forward packets selectively and purposely. Moreover, the operating system inside a network device, namely embedded networking system (ENS), plays an important role in treatment of incoming packets. Canix is a secure operating system kernel for embedded networking systems. Our goal is to design a simple and elegant monolithic kernel. It provides the suitable packet-processing flows and reserves the value-added function for further system extending. The major task of an embedded networking system kernel is packet processing so that we keep the kernel to dedicate its processing power to networking. For surviving under network attacks, we introduce the self-protection mechanisms. It will reduce the performance slightly but gain more security for whole system. Based on our developing experience, it is not hard to develop a whole new customizing ENS kernel and we have maximal flexibility of the kernel architecture.
[1] Abraham Silberschatz, Peter Baer Galvin, Greg Gagne, Applied Operating System Concepts First Edition, John Wiley & Sons,2000
[2] IOS from Wikipedia, the free encyclopedia.
http://en.wikipedia.org/wiki/IOS
[3] N.F. Huang and Shi-Ming Zhao, “A Novel IP Routing Lookup Scheme and Hardware Architecture for Multi-Gigabit Switch Routers,” IEEE Journal of Selected Areas on Communications (IEEE JSAC), Vol. 17, No.6, June 1999, pp.1093-1104.
[4] Cheng-Shang Chang, Performance guarantees in communication networks, SpringerVerlag, 2000.
[5] Heady, R., Luger, G., Macabe, A., Servilla, M., ”The architecture of a network level intrusion detection system”, Technical Report CS90-20, Department of Computer Science, University of New Mexico, Aug. 1990
[6] Eric S. Raymond,” The Jargon File, version 4.4.7”
http://www.catb.org/~esr/jargon/
[7] Aleph One,” Smashing The Stack For Fun And Profit”, Phrack Magazine Volume Seven, Issue forty-nine.
http://www.cs.ucsb.edu/~jzhou/security/overflow.html
[8] Linux kernel patch from the Openwall Project.
http://www.openwall.com/linux/
[9] Vendicator, Stack Shield.
http://www.angelfire.com/sk/stackshield/

[10] Crispin Cowan, Calton Pu, David Maier, Heather Hinton, Peat Bakke, Steve Beattie, Aaron Grier, Perry Wagle, and Qian Zhang, ” Automatic Detection and Prevention of Buffer-Overflow Attacks”, in the 7th USENIX Security Symposium, San Antonio, TX, January 1998.
[11] Malachi Kenney, “Ping of Death”.
http://www.insecure.org/sploits/ping-o-death.html
[12] Port scanning from Wikipedia, the free encyclopedia.
http://en.wikipedia.org/wiki/Port_scanning
[13] Fyodor, ”The Art of Port Scanning”.
http://www.insecure.org/nmap/nmap_doc.html
[14] M. Beck, H. Bhme, M. Dziadzka, U. Kunitz, R. Magnus, and D. Verworner, Linux Kernel Internals Second Edition, 2nd ed: Addison Wesley, 1998.
[15] Dave Cinege, Linux Router Project.
http://www.linuxrouter.org/
[16] Kaleem Anwar, Muhammad Amir, Ahmad Saeed, Muhammad Imran, “The Linux Router”, Linux Journal, August 2002, Issue 100. http://www.linuxjournal.com/article.php?sid=5826&mode=thread&order=0&thold=0
[17] SELinux
http://www.nsa.gov/selinux/index.cfm
[18] P. Loscocco and S. Smalley, “Integrating flexible support for security policies into the Linux operating system.” Technical report, National Security Agency, Jan. 2, 2001.
[19] XU Ke WU Jian-ping YU Zhong-chao XU Ming-wei, “HEROS: Highly Efficient Router Operating System”, IEEE International Conference on Telecommunications, June 2001.
[20] Dawson R. Engler and M. Frans Kaashoek., “Exterminate all operating system abstractions.”, In the Proceedings of the 5th Workshop on Hot Topics in Operating Systems (HotOS-V), Orcas Island, Washington, May 1995, pages 78-83.
[21] Zhao Jiong, “A Heavy Commented Linux Kernel Source Code Linux Version 0.11”, Oct 2002.
http://www.oldlinux.org
[22] J. Chu. “Zero-copy TCP in Solaris.”, In Proceedings of the 1996 Usenix Technical Conference, San Diego, CA, USA, Jan. 1996, pages 253--64.
[23] David Seal, ARM Architecture Reference Manual Second Edition, Addison-Wesley, 2001
[24] M. Handley, C. Kreibich and V. Paxson,” Network Intrusion Detection: Evasion,Traffic Normalization, and End-to-End Protocol Semantics”, Proc. USENIX Security Symposium 2001.
[25] Andrew S. Tanenbaum, Albert S. Woodhull, Operating Systems: Design and Implementation, Second Edition, Prentice-Hall
[26] Debian GNU/Hurd
http://www.debian.org/ports/hurd/
[27] The L4 μ-Kernel Family
http://os.inf.tu-dresden.de/L4/
[28] MINIX INFORMATION SHEET
http://www.cs.vu.nl/~ast/minix.html
QRCODE
 
 
 
 
 
                                                                                                                                                                                                                                                                                                                                                                                                               
第一頁 上一頁 下一頁 最後一頁 top