网络空间公共基础设施体系及安全策略研究

doi:10.11959/j.issn.2096-109x.2021106

摘要/Abstract

摘要：

以物理空间与网络空间的映射关系为研究思路，面向网络空间的对象、资源、活动等关键要素，综合考虑了网络空间设备、系统、数据及环境等方面的发展需求，构建了一种科学的网络空间公共基础设施体系，并从管理认证和应用认证的双重认证角度出发，针对用户/设备认证和访问控制等方面给出了一些相应的安全策略和实施建议。

关键词: 网络空间, 公共基础设施, 网络安全, 认证

Abstract:

Considering the key elements, such as object, resources, activities, and other equipment, as same as system, data, environmental and other aspects of demand, the public infrastructure system and security policy between physical space and cyberspace were taken as a basic point.A scientific system of public infrastructure in cyberspace was constructed.From the perspective of dual authentication of management authentication and application authentication, some corresponding safety policies and implementation suggestions were given from the aspects of user/device management and identity authentication.

Key words: cyberspace, public infrastructure, cybersecurity, certification

中图分类号:

TP391

邱洁, 韩瑞, 魏志丰, 王志洋. 网络空间公共基础设施体系及安全策略研究[J]. 网络与信息安全学报, 2021, 7(6): 56-67.

Jie QIU, Rui HAN, Zhifeng WEI, Zhiyang WANG. Research of public infrastructure system and security policy in cyberspace[J]. Chinese Journal of Network and Information Security, 2021, 7(6): 56-67.

图/表 9

图1

图2

表1

图3

图4

表2

图5

图6

图7

参考文献 38

[1]	CNNIC. Statistical report on internet development in China[R]. 2021.
[2]	ANBAR M , ABDULLAH R , AL-TAMIMI B N , ,et al. A machine learning approach to detect router advertisement flooding attacks in next-generation IPv6 networks[J]. Cognitive Computation, 2018,10(2): 201-214.
[3]	China Mobile Internet Development Report (2020)[R]. 2020.
[4]	TERRI MOON CRONK. White house releases first national cyber strategy in 15 years[R]. 2018.
[5]	Economic Research Office. Overview of the 2019 White Paper on Information and Communications in Japan[R]. 2019.
[6]	THOMAS B . Towards a common 5G strategy:the case for UK-Germany collaboration[R]. 2020.
[7]	POTO?NIK J . Recover today,lead for 2030:a future-fit industrial strategy for Europe[R]. 2021.
[8]	The Ministry of Finance. Government Standard No.5-Public Infrastructure[S]. 2017.
[9]	GEORGE K . IoT analytics[EB]. 2018.
[10]	GU Y , REN F J , JI Y S ,et al. The evolution of sink mobility management in wireless sensor networks:a survey[J]. IEEE Communications Surveys ＆ Tutorials, 2016,18(1): 507-524.
[11]	陈宗章 . 网络空间:概念、特征及其空间归属[J]. 重庆邮电大学学报(社会科学版), 2019,31(2): 63-71.
	CHEN Z Z . Cyberspace:conception,characteristics and its attribu-tion[J]. Journal of Chongqing University of Posts and Telecommu-nications (Social Science Edition), 2019,31(2): 63-71.
[12]	韩传峰 . 城市公共服务设施的一类价值评估计算模型[J]. 同济大学学报(自然科学版), 2004,32(9): 1239-1251.
	HAN C F . Computing model in evaluation on city public service Establishment[J]. Journal of Tongji University (Natural Science). 2004,32(9): 1239-1251.
[13]	徐翀崎, 李锋, 韩宝龙 . 城市生态基础设施管理研究进展[J]. 生态学报, 2016,36(11): 3146-3155.
	XU C Q , LI F , HAN B L . Progress in research on urban ecological infrastructure management[J]. Acta Ecologica Sinica, 2016,36(11): 3146-3155.
[14]	王坤岩 . 城市公共基础设施效益三维度评价研究[M]. 北京: 企业管理出版社, 2017.
	WANG K Y . Study on three-dimensional evaluation of urban public infrastructure benefit[M]. Beijing: Enterprise Management Pub-lishing House.
[15]	KITCHIN R M . Towards geographies of cyberspace[J]. Progress in Human Geography, 1998,22(3): 385-406.
[16]	郭莉, 曹亚男, 苏马婧 ,等. 网络空间资源测绘:概念与技术[J]. 信息安全学报, 2018,3(4): 1-14.
	GUO L , CAO Y N , SU M J ,et al. Cyberspace resources surveying and mapping:the concepts and technologies[J]. Journal of Cyber Security, 2018,3(4): 1-14.
[17]	张江, 孙治, 徐锐 ,等. 一种网络空间资源的测度方法研究[J]. 信息技术与网络安全, 2019,38(5): 7-11.
	ZHANG J , SUN Z , XU R ,et al. A research on measure method of cyberspace resource[J]. Information Technology and Network Se-curity, 2019,38(5): 7-11.
[18]	CHEN Z Z . Cyberspace:conception,characteristics and its attribution[J]. Journal of Chongqing University of Posts and Telecommunications (Social Science Edition), 2019,31(2): 63-71.
[19]	方滨兴 . 定义网络空间安全[J]. 网络与信息安全学报, 2018,4(1): 1-5.
	FANG B X . Define cyberspace security[J]. Chinese Journal of Network and Information Security, 2018,4(1): 1-5.
[20]	OLIVEIRA L B , DAHAB R , LOPEZ J ,et al. Identity-based encryption for sensor networks[C]// Proceedings of Fifth Annual IEEE International Conference on Pervasive Computing and Communications Workshops (PerComW'07). 2007: 290-294.
[21]	ROHBANIAN M R , KHARAZMI M R , KESHAVARZ-HADDAD A , ,et al. Watchdog- LEACH:a new method based on LEACH protocol to secure clustered wireless sensor networks[J]. Advances in Computer Science An International Journal, 2013,2(3): 105-117.
[22]	邹凯, 侯岚, 蒋知义 ,等. 智慧城市信息安全风险影响因素的三维结构框架与识别研究[J]. 现代情报, 2019,39(10): 15-23.
	ZOU K , HOU L , JIANG Z Y ,et al. Research on 3-D structure and recognition of influencing factors of information security risk in smart city[J]. Journal of Modern Information, 2019,39(10): 15-23.
[23]	ISO/IEC 29115-2013. Information technology-security techniquesentity authentication assurance framework[S]. 2013
[24]	ISO/IEC TS 29003:2018. Information technology-security techniques -Identity proofing[S]. 2018
[25]	董发志, 丁洪伟, 杨志军 ,等. 基于遗传算法和模糊C均值聚类的WSN分簇路由算法[J]. 计算机应用, 2019,39(8): 2359-2365.
	DONG F Z , DING H W , YANG Z J ,et al. WSN clustering routing algorithm based on genetic algorithm and fuzzy C-means cluster-ing[J]. Journal of Computer Applications, 2019,39(8): 2359-2365.
[26]	危蓉, 赵德正 . 基于身份的无线传感器网络层簇式密钥管理方案[J]. 武汉大学学报(工学版), 2015,48(4): 580-583,590.
	WEI R , ZHAO D Z . Key-management scheme based on identity and cluster layer for wireless sensor network[J]. Engineering Jour-nal of Wuhan University, 2015,48(4): 580-583,590.
[27]	田野, 张玉军, 张瀚文 ,等. 移动 IPv6 网络基于身份的层次化接入认证机制[J]. 计算机学报, 2007,30(6): 905-915.
	TIAN Y , ZHANG Y J , ZHANG H W ,et al. Identity-based hierar-chical access authentication in mobile IPv6 network[J]. Chinese Journal of Computers, 2007,30(6): 905-915.
[28]	张彬, 广晖, 陈熹 . 基于智能合约的无线Mesh网络安全架构[J]. 计算机工程, 2019,45(11): 16-23,31.
	ZHANG B , GUANG H , CHEN X . Smart contract-based security architecture for wireless mesh network[J]. Computer Engineering, 2019,45(11): 16-23,31.
[29]	CAO J W , YANG M B . Energy Internet:towards smart grid 2.0[C]// Proceedings of 2013 Fourth International Conference on Networking and Distributed Computing. Piscataway:IEEE Press, 2013: 105-110.
[30]	XU G Q , CAO Y , REN Y Y ,et al. Network security situation awareness based on semantic ontology and user-defined rules for Internet of Things[J]. IEEE Access, 2017,5: 21046-21056.
[31]	H?NISCH T , ROGGE S . IT-Sicherheit in der Industrie 4.0[M]. Wiesbaden,Germany: Springer, 2017.
[32]	European Commission EU cyber security strategy[R]. 2018.
[33]	董亚南, 赵改侠, 谢宗晓 . 关键信息基础设施保护及其实践探讨[J]. 网络空间安全, 2018,9(8): 84-89.
	DONG Y N , ZHAO G X , XIE Z X . The practice of critical infor-mation infrastructure protection analysis[J]. Cyberspace Security, 2018,9(8): 84-89.
[34]	郭朝先, 刘艳红 . 中国信息基础设施建设:成就、差距与对策[J]. 企业经济, 2020,39(9): 143-151.
	GUO C X , LIU Y H . The construction,achievements,gaps and countermeasures of information infrastructure in China[J]. Enter-prise Economy, 2020,39(9): 143-151.
[35]	SANI A S , YUAN D , JIN J ,et al. Cyber security framework for Internet of Things-based Energy Internet[J]. Future Generation Computer Systems, 2019,93: 849-859.
[36]	TECHNOLOGY N I O S A . Framework for improving critical infrastructure cybersecurity:version 1.0[EB]. 2014.
[37]	STINE K , BARRETT M . Portuguese translation of the framework for improving critical infrastructure cybersecurity version 1.1 (cybersecurity framework)[R]. National Institute of Standards and Technology, 2021.
[38]	European Network and Information Security Agency. EU network and information security directive[R]. 2019.

国家/组织	应用领域	主要内容及要素	管理对象
ISO/IEC	商业领域电子交易活动	身份的可信度、认证过程的可信度划分	人、设备、软件及应用、组织
美国	电子政务	身份的可信度、存在的安全风险划分	人、组织
英国	电子政务	身份的可信度划分	人、活动
欧盟及成员国	商业及公共服务领域	身份的可信度、认证过程的可信度划分	人
韩国、日本	电子商务及政务领域	电子签名的种类及效力划分	人
中国	电子政务、商务及公共服务领域	身份服务过程中存在的风险划分	人、组织

保护级分类	访问控制		身份鉴别	标记	数据防纂改		系统可重置	可信路径/恢复
保护级分类	自主访问控制	强制访问控制	身份鉴别	标记	数据防纂改		系统可重置	可信路径/恢复
用户自主保护级	√		√		√
系统审计保护级	√		√		√	√	√
安全标记保护级	√	√	√	√	√	√	√
结构化保护级	√	√	√	√	√	√	√	√
访问验证保护级	√	√	√	√	√	√	√	√