第二讲
网络与系统安全缺陷分析
第二讲的主要内容
•互联网体系结构
•局域网相关协议风险分析
•TCP/IP协议层协议风险分析
•域名、路由系统安全
•应用系统安全
–Email、Web
•软件系统的安全问题
•常见攻击方法
2
1.互联网体系结构
互联网的发展过程
ARPANET December 1969
From ARPANET Completion Report, BBN, 1978 4
互联网的发展过程
5
无结构、
Ad Hoc?
6
7
Putting on weight …Mid Life crisis …IP over IP Tunnel …An accident (NAT&ALG…
Anything in
Anything
8
OSI /RM 对Internet 产生重大影响?
Application Presentation
Session
Transport
Network Data Link Physical OSI/RM TCP/IP
Application
TCP
IP
Host to network
(Data Link + Physical
9
关于OSI 体系结构的批评
•How the 7-layer reference model
was invented
–/homes/de
c/yers.html
•THE ORIGINS OF OSI
–/Extras/OSI .html
•关于GOSIP
•Douglas E. Comer William Stallings
10
Design principles of Internet ?•E nd to End •Stateless
•Best Effort
•Keep it Simple and Stupid (KISS •Distributed process •….
11
Internet 设计思想/指导原则•包交换,分组交换(Packet Switch ,存储转发•端到端(End-to-end ,保持简单性(KISS ,•尽力而为(Best effort ,No QoS •分布式、没有集中控制
•足够的冗余
•不要等待找到完美的解决方案。•可扩展性,IP over everything
•只有当实现了几个能够运行的程序实现后,Internet的协议才能成为标准。
12
互联网的这些设计思想从哪里来•David D. Clark,The Design
Philosophy of the DARPA Internet Protocols ,1988
–设计之初,目标、动机都是很模糊的,许多所谓的设计思想在互联网发展过程中总结的。–比如,无连接的思想在一开始并没有充分强调。–与OSI 参考模型相比,IP 层和TCP 层分层的思想,在一开始也不是当初计划书的一部分
13
TCP/IP 协议有严格的分层吗?•IP 中ICMP 、TCP 、OSPF 都有protocol number •OSPF 有TCP port D Header
0VERS HLEN Type of Service Total Length Identification Frag Offset TTL Protocol Source IP Address
Destination IP Address
IP Options
Data F M
F 16Checksum U A S T S I 03116Source Port Dest. Port Sequence Number Ack. Number
HLEN Reserved R G Window Checksum Urgent
Option
Data...
C K P H R S Y N F
N
ICMP 第3层?TCP 第4层?OSPF 在TCP 层之上?14
分层原则?
•Fred Baker :Cisco DAI 技术
15
Lixia Zhang’s opinion •2007年夏在清华的报告
–体系结构原则是谁制定的?
–系统的结构是由它的功能决定的–功能复杂了,结构也随之复杂化•对地址转换(NAT 的回顾与反思
–IAB 和IETF 无视NAT 的需求
–错过了NAT 标准化的时机
——“我要强调的是,以下只是我个人的观点,我对历史的回顾可能不全,可能出错,而且就像我们对于互联网的理解不断变化一样,我的观点也不是一成不变的。”
16 17 18 6
19 互联网的体系结构原则 (RFC1958 The Internet and its architecture have grown in evolutionary fashion from modest beginnings, rather than from a Grand Plan. This is intended for general guidance and general interest, and is in no way intended to be a formal or invariant reference model. Its evolution depends on rough consensus about technical proposals, and on running code. 20 Architectural Principles of the Internet (RFC1958 Engineering feed-back from real implementations is more important than any architectural principles. Principles that seemed inviolable a few years ago are deprecated today. Principles that seem sacred today will be deprecated tomorrow. 21 7
The only principle of the Internet The principle of constant change is perhaps the only principle of the Internet that should survive indefinitely. 22 Internet philosophy We reject kings, presidents, and voting; we believe in rough consensus and running code. 23 互联网的"原则"和"指导思想" 列宁:没有革命的理论,就没有革命的行动? 互联网今天的现状是个演进的过程,不是伟人的设计适应需求的不断变化,是Internet生存下来的关键没有什么理论,指导思想过去的成功原则只满足过去的需求, 可以作为参考,但不应该成为教条 Running Code,或者说实践的检验是评价技术优劣的唯一标准用户的需求,市场的选择是一项技术成功的关键 24 8
网站注册 /blog 请使用你姓名的汉语拼音作为用户ID 25 9
