BÀI GIẢNG TƯỜNG LỬA CHƯƠNG IIII

Phm Minh Thun Khoa An ton thng tin

Chng 3Kin trc tng la

Phm Minh Thun Khoa ATTT 1

Kin trc tng la

Screening Router1

Dual Homed Host2

Screened Host3

Screened Subnet4


Multiple Screened Subnet5

Ch mt i tng hot ng ng vai tr tng lau im:

D trin khai Qun l tp trung d dng

Nhc im: Khng c s bo v theo chiu su (Defense in - depth)

Kin trc tng la n l


KIN TRC TNG LA N L

ScreeningRouter

Dual-HomedHost

S dng cng ngh tng la lc gi tin tch hp vo trong b nh tuyn (Router)

Thc hin vic nh tuyn hay chn gi tin da vo chnh sch an ninh

Screening Router


Screening Router (Cont)


Mng ni bInternet

Bn ngoi Bn trong

Packet Filter Router

u im: Tc x l nhanh D dng trin khai

Nhc im: Mc an ninh thp a ra cc chnh sch cu hnh phc tp => D mc li



S dng trong cc trng hp: H thng mng c bo v bi mt lp bo v bn

trong S lng giao thc s dng khng nhiu v khng cn

kim sot ni dng cc giao thc ny Cn tc cao, kh nng d phng



KIN TRC TNG LA N L

Dual-HomedHost

ScreeningRouter

c xy dng da trn mt thit b c t nht 2 giao din mng

s dng mt dual-homed host nh mt tng la cn loi b tnh nng chuyn tip gi tin

Hai my A v B c th trao !i thng tin thng qua d" liu chia s# trn my dual - homed.

Cc h thng bn trong v bn ngoi dual homed khng th giao tip trc tip vi nhau.

Dual Homed Host (Cont)


Dual homed c th tch mt mng bn trong kh i mng khng tin cy

Dual homed khng chuyn bt k$ mt lu%ng d" liu TCP/IP no => chn hon ton lu%ng d" liu IP gi"a mng bn trong v mng khng tin cy bn ngoi



Dual homed khng c kh nng routing v con ng duy nht gi"a cc phn on mng l thng qua chc nng tng ng dng.

D" liu ng dng i qua tng la cn c phn mm c bit chuyn cc yu cu ng dng gi"a hai mng c ni vi nhau (Application forwarder)



S dng trong cc trng hp: D" liu gi ra Internet t v khng quan trng Khng cung cp dch v cng cng H thng mng c bo v khng cha cc thng tin, h

thng nhy cm v quan trng



S dng nhiu thnh phn hot ng ng vai tr tng la

Nng cao kh nng an ninh cho h thngBo v h thng c chiu su (defense in depth)

Kin trc tng la kt hp


KIN TRC TNG LA KT HP

ScreenedHost

ScreenedSubnet

Phi hp Screening Router (Packet Filter Router) v Bation Host

Trin khai theo hai m hnh: Single-homed bastion Dual-homed bastion

Screened Host


Bation Host, thut ng" chung ch mt h thng c xc nh bi ngi qun tr tng la nh l mt im an ninh cc k$ quan trng v rt v"ng chc trong h thng mng

Thng thng trn bation host ci t c!ng ng dng hoc c!ng chuyn mch hoc c hai

Dual homed host l mt v d in hnh v bation host

Bation Host


Bation Host (Cont)


M hnh Single Homed Bation Host:G%m mt b lc gi tin v mt bastion hostThc hin bo v mng tng mng v tng ng

dngCu hnh b lc

i vi lu%ng thng tin t& Internet, ch cc gi tin IP vi a ch ch l bastion host mi c php i vo trong

i vi lu%ng thng tin t& bn trong, ch cc gi tin IP xut pht t& bastion host mi c php i ra ngoi

Screened Host (Cont)


Single Homed Bation Host


Bng d'n ng c(a router phi cu hnh sao cho gi tin bn ngoi u c chuyn n bastion host.

Bng d'n ng phi c bo vNu thng tin trong bng d'n ng b sa !i th gi

tin khng chuyn n bastion host m gi trc tip vo mng bn trong



Mng bn trong: 199.245.180.0 Bastion host: 199.245.180.10

Destination = 192.245.180.0Forward to = 192.245.180.10



Kin trc ny an ton h)n kin trc )n l# bi: Kt hp c lc gi tin v lc ng dng => mm d#o trong

vic a ra cc chnh sch an ninh K# tn cng phi i qua hai mng lp an ninh trc khi gy

t!n hi ti h thng bn trongTuy nhin, kin trc ny c nhc im l cho php

k# tn cng tip xc vi mng bn trong khi kim sot c packet filter router



Khc phc nhc im c(a kin trc single homed bation host

Ngn cn tip xc vi mng bn trong b*ng kin trc vt l

Cu hnh router t)ng t nh single homed bastion host

Dual Homed Bation Host


Dual Homed Bation Host


Cc trng hp nn s dng kin trc screened host: S lng kt ni n t& mng Internet vo bn trong

khng nhiu Mng bn trong c bo v tt

Screened Host (Cont)


KIN TRC TNG LA KT HP

ScreenedSubnet

ScreenedHost

Phn tch nhc im an ninh c(a screened host!y l m hnh kin trc tng la an ton nht trong

cc m hnh kin trc trnh by trn.To thnh mng con bit lp, mng bn ngoi hay

mng bn trong u c th truy cp vo song lu%ng d" liu i qua DMZ s+ b chn

Screened Subnet


Screened Subnet (Cont)


InternalS

c

r

e

e

n

e

d

s

u

b

n

e

t

(

D

M

Z

)

Isolated Network

Network traffic cannot flow accross

External

To thnh 3 lp an ninhBn ngoi ch nhn thy DMZ, khng nhn thy mng

bn trong (che du)Bn trong ch nhn thy DMZ, khng kt ni trc tip

ra bn ngoi



Mng vnh ai (perimeter network) Mng vnh ai l mt lp an ninh, c thm vo gi"a

mng bn ngoi v mng bn trong cn bo v Trong mt mng, mt my bt k$ c th thy lu%ng d" liu

trao !i trong mng K# tn cng chim c bastion host, lu%ng d" liu trao !i gi"a my bn trong v'n an ton



Router pha trong (Interior router) Bo v mng bn trong kh i mng Internet v mng vnh ai Thc hin chc nng lc gi: cho php chn dch v t& bn

trong ra InternetRouter bn ngoi (Exterior router)

Bo v c mng bn trong l'n mng vnh ai Trn thc t, router bn ngoi cho php hu ht cc kt ni ra

bn ngoi t& mng vnh ai v hu nh thc hin rt t vic lc gi tin.

Chng vic thay !i a ch ngu%n trong gi tin i ra bn ngoi



Split Screened Subnet

Multiple Screened Subnet

Independent Screened Subnet

V'n s dng hai router (router bn trong v router bn ngoi)

Cc mng (multiple network) c t gi"a hai router ny

Cung cp nhiu lp bo v

Split Screened Subnet


Split Screened Subnet (Cont)


S dng nhiu mng vnh ai tch ring cc dch v bn trong ra kh i cc dch v bn ngoi

m bo tnh cht d phng v tng hiu nng mng

Independent Screened Subnet


Independent Screened Subnet (Cont)


S dng nhiu Bastion hostKt hp Router trong vi Router ngoiKt hp Bastion host vi Router ngoiS dng nhiu Router ngoi

Cc phng php kt hp


Kt hp Bastion v Router trongS dng nhiu Router trongS dng %ng thi c Screened Subnet v Screened

host

Khng nn s dng


S dng nhiu Bastion host


Kt hp Router trong vi Router ngoi


Kt hp Bastion host vi Router ngoi


Kt hp Bastion v Router trong


S dng nhiu Router trong


BÀI GIẢNG TƯỜNG LỬA CHƯƠNG IIII

Documents

Transcript of BÀI GIẢNG TƯỜNG LỬA CHƯƠNG IIII