安全的網路嵌入式作業系統核心設計與實作｜國立清華大學博碩士論文庫

簡易檢索 / 詳目顯示

回結果列表

研究生：	高迦南 Canaan Kao
論文名稱：	安全的網路嵌入式作業系統核心設計與實作 The Design and Implementation of Canix: A Secure Operating System Kernel for Embedded Networking Systems
指導教授：	黃能富 Nen-Fu Huang
口試委員:
學位類別：	碩士 Master
系所名稱：	電機資訊學院 - 通訊工程研究所 Communications Engineering
論文出版年：	2004
畢業學年度：	92
語文別：	英文
論文頁數：	44
中文關鍵詞：	安全、作業系統、嵌入式網路系統
外文關鍵詞：	Secure, Operating System, Embedded Networking System
相關次數：	點閱：70 下載：0
分享至:	分享至facebook 分享至twitter

查詢本校圖書館目錄查詢臺灣博碩士論文知識加值系統勘誤回報

網路設備上的嵌入式系統我們簡稱為ENS(Embedded Networking System)，如Cisco公司的IOS就是一套相當有名的ENS。ENS最主要的功能除了管理裝置本身的資源與處理封包外，還包含了其他的加值服務，例如網路頻寬管理與網路存取控制等等。我們這個研究的目的是要設計一個安全的ENS 核心，這個核心我們稱之為Canix，它除了具有一般ENS的功能外，我們特別加強它的彈性與安全性，因為隨著網際網路攻擊工具的普及，使得一般不具網路專業知識的使用者，也可以輕易地成為網路入侵者，而網路設備往往也是被攻擊的標的之一，因此新一代的ENS也必須要有自我防衛的功能。
在整個核心的架構上我們採用封包驅動模組化設計，這種設計方便我們變更封包的處理流程與加入新的功能。而當封包通過每個模組的時候，我們採用Zero-Copy這樣可以降低複製封包的行為進而提升處理效率。為了避免造成緩衝區溢位的弱點，整個核心對於記憶體的存取特別增加邊界檢查。另外我們也設計了自衛模組，當設備本身遭受網路攻擊的時候它可以保護自己不受入侵。自衛模組主要由三個子模組所組成，第一個是IP位址過濾器，第二個是封包完整性測試，第三是動態調整網路資源老化的時間。由於我們只實作一個 ENS 必要的部份，所以整個核心顯得精簡並且容易移植。基於我們的研究經驗，實作一個全新的ENS，並不是一件遙不可及的事，並且我們可以徹底掌握整個系統的架構。

The main function of most network devices is to forward packets selectively and purposely. Moreover, the operating system inside a network device, namely embedded networking system (ENS), plays an important role in treatment of incoming packets. Canix is a secure operating system kernel for embedded networking systems. Our goal is to design a simple and elegant monolithic kernel. It provides the suitable packet-processing flows and reserves the value-added function for further system extending. The major task of an embedded networking system kernel is packet processing so that we keep the kernel to dedicate its processing power to networking. For surviving under network attacks, we introduce the self-protection mechanisms. It will reduce the performance slightly but gain more security for whole system. Based on our developing experience, it is not hard to develop a whole new customizing ENS kernel and we have maximal flexibility of the kernel architecture.

Contents
1.    Introduction    6
1.1    Embedded Networking System    6
1.2    Kernel Concepts    8
1.3    Network Attack Techniques    10
1.3.1    Buffer Overflows    11
1.3.2    TCP/IP Attacks    14
1.4    Related Works    17
1.4.1    Linux Router    17
1.4.2    SELinux    18
1.4.3    Heros    18
2.    The Design of Canix    20
2.1 The limitation of Embedded Operating Systems    20
2.2 Architecture    21
2.3 Packet-Processing Flows    23
2.3.1  Flow-through Path    25
2.3.2  Application Packet Input Path    26
2.3.3  Application Packet Output Path    27
2.4 Design Goals    27
2.4.1 Simplicity    27
2.4.2 Efficiency    28
2.4.3 Security    29
2.4.4 Flexibility    29
2.4.5 Portability    31
3.    The Implementation of Canix    32
3.1 Development Environment    32
3.2 Booting    32
3.3 Exceptions Handling    33
3.4 Packet Related Data Structures    35
3.4.1 PacketBuffer    35
3.4.2 ConnectionTrack Structure    36
3.4.3 Connection Structure    36
3.5 Packet Processing    37
3.5.1  FlowThrough() Function    38
3.5.2  ApInput() Function    39
3.6 Self-protection    40
4.    Conclusion    41
5.    References    42





































Figures
Figure 1.1 The general framework of ENS.    7
Figure 1.2 The system architecture of monolithic kernel.    8
Figure 1.3 The system architecture of microkernel.    9
Figure 1.4 The Number of Intruders Able to Execute Attacks.    10
Figure 1.5 Intruder Knowledge VS. Attack Sophistication.    11
Figure 1.6 Memory arrangement of a process.    12
Figure 1.7 A simple program and its stack in run time.    12
Figure 1.8 A cracked stack.    13
Figure 1.9 Ping of Death Attack.    15
Figure 1.10 Teardrop attack.    16
Figure 1.11 Effect of Increase in Data on Bandwidth of Linux Router. ([16])    17
Figure 1.12 Variation in Bandwidth of LRP with Increasing Time. ([16])    17
Figure 1.13 Overhead of SELinux. ([18])    18
Figure 1.14 Architecture of HEROS. ([19])    19
Figure 1.15 Throughputs of HEROS. ([19])    19
Figure 2.1 The architecture of Canix.    21
Figure 2.2 The flow-trough path.    22
Figure 2.3 The application path.    22
Figure 2.4 The general packet journey.    24
Figure 2.5 Flow-through path.    25
Figure 2.6 Application packet input path.    26
Figure 2.7 Application packet output path.    27
Figure 2.8 Linux source code line count.    28
Figure 2.9 IDS device powered by Canix.    30
Figure 2.10 QoS device powered by Canix.    30
Figure 2.11 IDS+QoS device powered by Canix.    30
Figure 3.1 AXD Debugger.    32
Figure 3.2 The booting procedure of the Canix.    33
Figure 3.3 ARM exception processing modes ([23])    34
Figure 3.4 IRQ_Handler() function.    34
Figure 3.5 PacketBuffer Structure.    35
Figure 3.6 ConnectionTrack Structure    36
Figure 3.7 Connection Structure    36
Figure 3.8 PacketDispatcher() function.    37
Figure 3.9 FlowThrough() function.    38
Figure 3.10 ValueAddedFunction() function.    38
Figure 3.11 An improved ValueAddedFunction() function.    39
Figure 3.12 ApInput() function    39

                                

[1] Abraham Silberschatz, Peter Baer Galvin, Greg Gagne, Applied Operating System Concepts First Edition, John Wiley & Sons,2000
[2] IOS from Wikipedia, the free encyclopedia.
http://en.wikipedia.org/wiki/IOS
[3] N.F. Huang and Shi-Ming Zhao, “A Novel IP Routing Lookup Scheme and Hardware Architecture for Multi-Gigabit Switch Routers,” IEEE Journal of Selected Areas on Communications (IEEE JSAC), Vol. 17, No.6, June 1999, pp.1093-1104.
[4] Cheng-Shang Chang, Performance guarantees in communication networks, SpringerVerlag, 2000.
[5] Heady, R., Luger, G., Macabe, A., Servilla, M., ”The architecture of a network level intrusion detection system”, Technical Report CS90-20, Department of Computer Science, University of New Mexico, Aug. 1990
[6] Eric S. Raymond,” The Jargon File, version 4.4.7”
http://www.catb.org/~esr/jargon/
[7] Aleph One,” Smashing The Stack For Fun And Profit”, Phrack Magazine Volume Seven, Issue forty-nine.
http://www.cs.ucsb.edu/~jzhou/security/overflow.html
[8] Linux kernel patch from the Openwall Project.
http://www.openwall.com/linux/
[9] Vendicator, Stack Shield.
http://www.angelfire.com/sk/stackshield/

[10] Crispin Cowan, Calton Pu, David Maier, Heather Hinton, Peat Bakke, Steve Beattie, Aaron Grier, Perry Wagle, and Qian Zhang, ” Automatic Detection and Prevention of Buffer-Overflow Attacks”, in the 7th USENIX Security Symposium, San Antonio, TX, January 1998.
[11] Malachi Kenney, “Ping of Death”.
http://www.insecure.org/sploits/ping-o-death.html
[12] Port scanning from Wikipedia, the free encyclopedia.
http://en.wikipedia.org/wiki/Port_scanning
[13] Fyodor, ”The Art of Port Scanning”.
http://www.insecure.org/nmap/nmap_doc.html
[14] M. Beck, H. Bhme, M. Dziadzka, U. Kunitz, R. Magnus, and D. Verworner, Linux Kernel Internals Second Edition, 2nd ed: Addison Wesley, 1998.
[15] Dave Cinege, Linux Router Project.
http://www.linuxrouter.org/
[16] Kaleem Anwar, Muhammad Amir, Ahmad Saeed, Muhammad Imran, “The Linux Router”, Linux Journal, August 2002, Issue 100. http://www.linuxjournal.com/article.php?sid=5826&mode=thread&order=0&thold=0
[17] SELinux
http://www.nsa.gov/selinux/index.cfm
[18] P. Loscocco and S. Smalley, “Integrating flexible support for security policies into the Linux operating system.” Technical report, National Security Agency, Jan. 2, 2001.
[19] XU Ke WU Jian-ping YU Zhong-chao XU Ming-wei, “HEROS: Highly Efficient Router Operating System”, IEEE International Conference on Telecommunications, June 2001.
[20] Dawson R. Engler and M. Frans Kaashoek., “Exterminate all operating system abstractions.”, In the Proceedings of the 5th Workshop on Hot Topics in Operating Systems (HotOS-V), Orcas Island, Washington, May 1995, pages 78-83.
[21] Zhao Jiong, “A Heavy Commented Linux Kernel Source Code Linux Version 0.11”, Oct 2002.
http://www.oldlinux.org
[22] J. Chu. “Zero-copy TCP in Solaris.”, In Proceedings of the 1996 Usenix Technical Conference, San Diego, CA, USA, Jan. 1996, pages 253--64.
[23] David Seal, ARM Architecture Reference Manual Second Edition, Addison-Wesley, 2001
[24] M. Handley, C. Kreibich and V. Paxson,” Network Intrusion Detection: Evasion,Traffic Normalization, and End-to-End Protocol Semantics”, Proc. USENIX Security Symposium 2001.
[25] Andrew S. Tanenbaum, Albert S. Woodhull, Operating Systems: Design and Implementation, Second Edition, Prentice-Hall
[26] Debian GNU/Hurd
http://www.debian.org/ports/hurd/
[27] The L4 μ-Kernel Family
http://os.inf.tu-dresden.de/L4/
[28] MINIX INFORMATION SHEET
http://www.cs.vu.nl/~ast/minix.html

全文公開日期本全文未授權公開 (校內網路)
全文公開日期本全文未授權公開 (校外網路)
全文公開日期本全文未授權公開 (國家圖書館：臺灣博碩士論文系統)

簡易檢索 / 詳目顯示

相關論文