基于SNMP的安全设计方案研究

The Security Facilities of Simple Network Management Protocol

在网络管理领域,由于历史原因和SNMPv3的复杂性,相对安全的SNMPv3一直都没有得到广泛应用,现有的网络设备仍然有很多仅仅支持SNMPv1、v2,这使得网络的正常运行受到很大的威胁。由于没有强健的安全机制,SNMP在实际中不能发挥其最大潜能。因此在实际应用中,为了在安全性和简单性上寻求一个平衡点,文章在对SNMP各版本的协议内容及安全特性进行了详细的分析后,借鉴了SNMPv2的简单特性和SNMPv3的安全模型,根据实际安全需求对现实应用版本做了修改,通过这个改进的基于SNMPv2消息和基于用户安全模型的安全协议,设计并实现出一套局域网环境下在安全性、经济性和扩展性上基本满足要求的解决方案,并在实际中取得了成功。

In the field of network management, due to historical reasons and SNMPv3 complexity, the relatively secure SNMPv3 has not been widely used. Now there are still many existing network equipments only support SNMPv1 ,v2, which is the major threat to maintain normal network. ,Due to lack of strong security mechanisms, SNMP can not exert its highest potential in practice. Thus, in order to keep balance between security and simplicity in practical application, this article analyses the content and security features of each version of SNMP in details. And then, referring to the simplicity of SNMPv2 and the security model of SNMPv3, it modifies present version of this protocol based on actual security needs. Through the improvement of the protocol based on SNMPv2 information and user security model, it designs and realizes a scheme which can basically meet the requirement of security, economy and expansibility, and gains success in practice.