计算机网络安全体系的一种框架结构及其应用

A Framework and it's Application for Security Architecture of Computer Networks

文章首先给出计算机网络安全体系结构相关概念的定义，然后从安全需求的角度提出了计算机网络安全体系的一种框架结构。通过分析各种安全服务之间的依赖关系，提出一种按照安全服务安全机制的强度对网络安全进行分类和分级的方法；结合 ＩＰＳｅｃ和 ＳＳＬ，分析了 ＴＣＰ／ＩＰ协议体系各层的安全机制，提出了实现安全服务和安全管理的协议层实体模型；最后给出了单元安全技术在安全体系结构中的位置，并论述了该框架结构在实际网络工程安全设计中的应用。

The definitions of some concepts related to security architecture for computer networks are presented firstly in this paper,and then, a framework is proposed from the aspect of security requirements. Based on the analysis of dependence among security services, a method is presented for classifying and rating network security according to se curity services and mechanisms. After the analysis of security mechanisms in TCP/IP protocol including IPSec and SSL, a protocol layered entity model is presented for implementation of security services and security management. From the aspect of entity unit,all kinds of security technologies are organized into to four layers. The place of security management in the architecture and content of management activities for large networks are described. At the end of this paper, further research directions are pointed about the security architecture.