Computer Network Technology and Application

Chapter 22 Fundamentals of Network Security (1)
The application of the network has penetrated into every corner of our study and life, but there are also security problems such as viruses.This chapter mainly introduces technologies that help improve network security and data resource security, including encryption technology, firewall technology, and intrusion detection technology.

【Main content of this chapter】

Cryptography.

digital signature.

firewall technology.

Intrusion Detection Technology.

data backup.

7.1 Fundamentals of computer network security
While Internet technology brings fun and convenience to human work and life, it also inevitably produces some technical negative effects.As the attacks of viruses and hackers show their harmfulness more and more, the security of computers and networks has been widely concerned.Preventing the harm of computer viruses and network attacks is a problem that the country, society, organizations and individuals must pay attention to.

7.1.1 Cases of Hacking Attacks
[Case 1] Online banking seems to be the focus of hackers.

At the beginning of June 2004, someone stole the mailbox of an online banking network administrator and sent emails to online banking customers under the guise of "upgrading the online banking system", asking for the user name (login card number) and password of the online banking registered customer.The bank has published an "important reminder" on a prominent position on its official website to warn its online banking customers.Coincidentally, almost at the same time, more than 6 banks and insurance companies in Europe and the United States around the world said that important information such as customer passwords and credit card numbers may have been stolen by hackers. The "monster" virus variant has begun to spread on the Internet, affecting more than 1200 countries.According to antivirus experts, this "monster" virus is constantly changing forms and can defeat antivirus or firewall software.What is more worthy of vigilance is that this virus will install a "trojan horse" program in the infected computer, so that hackers can secretly transmit the bank user's credit card number and password to a specific email address, thereby achieving the purpose of illegally stealing other people's funds .

The problem exposed in this case is that the computer network virus upgrade speed and spread far exceed people's expectations, and the resulting theft and other behaviors directly endanger the safety of individuals and enterprises.

[Case 2] The website of Hubei Education was continuously attacked by hackers.

On the morning of July 2002, 7, the police received a report that the education website in Hubei was continuously attacked by hackers, making it impossible for 25 candidates in the province to check the results of the college entrance examination in time.The police found that the IP address of the hacker's Internet access belonged to a computer and Internet access equipment on the attic of a store in Jianli, Hubei. It was interpreted that on July 28, the computer logged in and scanned the server of the Provincial Education Network, and the attack records of the Provincial Education Network showed that the time and IP address of the computer used the software.Facing the facts, Xiao Peng, a 7-year-old third-year computer student at a university in Jingzhou, had to admit that he attacked the provincial education website on July 24 and 21 because of his psychological imbalance.

[Case 3] The "Yongchuan Hotline" website of Chongqing Yongchuan Telecommunications Bureau was suddenly attacked.

At 2000:7 on July 23, 17, the "Yongchuan Hotline" website of Chongqing Yongchuan Telecommunications Bureau was suddenly "attacked"; on the 48th, "hackers" attacked again, "Yongchuan Hotline" was overwhelmed, and the entire network was paralyzed.According to statistics, in four consecutive days, the "Yongchuan Hotline" was bombarded by "hacker" data "bombs" five times successively. The data of the website server was massively destroyed, and the service was interrupted for 24 hours in total, resulting in direct economic losses of tens of thousands of yuan. .Investigators from the Science and Technology Communication Department of the Chongqing Municipal Public Security Bureau quickly found the phone number used by the "hackers" to attack, and found out that the phone number belonged to Shanghai Dongshi Software Company.According to the company's introduction, the company's software programmer Zhang Yong has been surfing the Internet from the 23rd to the 23th.

Subsequent investigations showed that the above two cases were all due to work mistakes of the telecommunications bureau, at least the weak awareness of network security led to hackers’ intrusion or destruction. If the telecommunications department actively added protective equipment (such as intrusion detection system) It is possible to avoid accidents or incidents.

[Case 4] U.S. hackers invaded the military computer system and could control missile launches.

According to Phoenix Satellite TV, on November 2005, 11, the US Los Angeles Prosecutor’s Office indicted a 8-year-old computer hacker, James Anchita, who successfully entered the computer system of the US Naval Aviation Center. Control the launch of military missiles.According to reports, the young man in Los Angeles is accused of causing viruses to 20 computers, including computer systems belonging to the US Department of Defense at the Naval Aviation Center in California.Anchita is suspected of implanting malicious software into thousands of computer systems, turning them into computer bots, and then using these viruses to launch devastating attacks on computer servers or send a large number of spam emails.Prosecutors described his one computer command as putting thousands of computers under his control.

It can be seen from this example that the issue of network security is particularly prominent in the military, which directly endangers the security of the world and the stability of international relations.

The following conclusions can be drawn from the above four cases:
Technology has brought fun and convenience to work and life, but the negative impact of technology cannot be avoided. Computers and networks are becoming more and more insecure, and attacks from viruses and hackers are becoming more and more harmful.How to prevent the harm of computer viruses and network attacks is a problem that the country, society, organization and individual must pay attention to.This chapter introduces some security technologies from a technical point of view.

7.1.2 Internet security situation and problems

On July 2007, 7, China Internet Network Information Center (CNNIC) released the "No. 18 Statistical Report on Internet Development in China", pointing out that as of June 19, the number of Internet users in China had reached 2007 million, second only to The number of Internet users in the United States is 6 million, ranking second in the world.

According to public surveys, the two most disgusting aspects of the Internet are network viruses and network attacks. Several consecutive surveys have shown very stable and consistent results. Network security has become a focus of the information society.Network viruses and network attacks have become urgent problems for the Internet.From the perspective of national interests, each country needs to base itself on its own country, research its own network security technology, train its own specialized talents, develop its own network security industry, and further build its own network and information security prevention system.The current very serious network security problems exist in the following aspects.

(1) Firewall: It does not work for internal personnel, especially if there is the possibility of "internal rape" committing crimes, it is necessary to strengthen the internal prevention and control mechanism.

(2) Identity authentication and digital signature: they are all expedient measures. It is difficult to prevent real hackers. Such preventive measures have potential safety hazards.

(3) Security database: It is the basic defense line of network security, but there are still many loopholes.

(4) Intrusion product detection: most of the data in the intrusion database is plagiarized or copied, and it is difficult to prevent the substantive intrusion and destruction of real hackers.It should be said that we are still not prepared enough to resist the malicious intrusions of network hackers, especially the "malicious intrusions" with the nature of terrorist attacks.

(5) Off-site data backup: Insufficient preparation and emergency plan.

(6) E-commerce: depends on the full support and stability guarantee of security products and technologies.

From a development perspective, China's information security still has a long way to go.

7.1.3 Understand the definition and connotation of network security

1. Definition of computer network security
Computer network security means that computer network system resources and information resources are not threatened and harmed by natural and man-made harmful factors.Specifically, it is to protect the hardware and software of computers, network communications, and data in communications from being damaged, changed, or leaked due to accidental or malicious reasons, to ensure the continuous, reliable and normal operation of the system, and to ensure that network services are not compromised. was interrupted.

2. Network security issues are becoming increasingly serious and complex

In just over ten years, the Internet has developed very fast. At the same time, system security vulnerabilities have also appeared frequently. Incidents such as network worms and hacker attacks have occurred from time to time, and network security issues have become increasingly prominent.The computer systems under attack include not only ordinary user hosts, but also systems of important departments such as government, scientific research, finance, and social security, posing a great threat to national interests, public interests, and the legitimate rights and interests of the public.How to ensure the safe operation of the network has become one of the focuses of the country and society, and will even become a permanent problem in the development of the Internet and network applications.

(1) The existence and continuous discovery of a large number of various network security vulnerabilities is the biggest hidden danger of network security.

(2) The time between the announcement of a vulnerability and the appearance of the attack code exploiting the corresponding vulnerability has been shortened to a few days or even a day, which greatly increases the time pressure for developing relevant patches, installing patches, and taking preventive measures.

(3) Network attacks are becoming more and more complex, and the integration of various methods makes network security defense more difficult. Network security equipment such as firewalls and intrusion detection systems are no longer sufficient to completely block network security attacks.

(4) The organization of hacker attacks has been enhanced, and the target of attacks has shifted from simply pursuing "sense of glory" to obtaining practical benefits in many ways. Flooding is a testament to this trend.

(5) The improvement of the processing capability and general-purpose performance of wireless terminals such as mobile phones and handheld computers makes them closer to personal computers. Network attacks against these wireless terminals have begun to appear and will further develop.

In short, network security issues have become more complex and their impact will continue to expand, making it difficult to fully resolve them in the short term.

3. Domestic and foreign laws and regulations and international cooperation in response to network security

To deal with computer network security issues, in addition to necessary and effective technical means, it is also necessary to establish sound laws and regulations and increase efforts to combat cybercrime.

(1) Foreign network security regulations

The following will introduce respectively.

①美国TCSEC（橘皮书）：该标准是美国国防部制定的，它将安全分为4个方面，即安全政策、可说明性、安全保障和文档。这4个方面又分为7个安全级别，从低到高依次为D、C1、C2、B1、B2、B3和A级。上述内容在美国国防部虹系列（Rainbow Series）标准中有详细的描述。

② American Federal Standard (FC): This standard refers to CTCPEC and TCSEC, and its purpose is to provide an upgraded version of TCSEC while protecting existing investments.However, FC has many defects and is a transitional standard, which was later developed into a joint public standard combined with ITSEC.

③Combined Common Criteria (CC): The purpose of CC is to combine existing security criteria into a unified standard.The plan began to be implemented in 1993, and the first version was launched in 1996, but it has not yet been implemented. CC combines the main features of FC and ITSEC, emphasizes the separation of security functions and guarantees, and divides functional requirements into 9 categories and 63 families, and divides guarantees into 7 categories and 29 families.

④ European ITSEC: Different from TCSEC, it does not directly link security measures with computer functions, but only describes the requirements of technical security, and uses security as a security enhancement function.It also differs from TCSEC in that TCSEC regards confidentiality as the focus of security, while ITSEC regards integrity, availability and confidentiality as equally important factors. ITSEC defines 0 security levels ranging from E6 (unsatisfactory quality) to E7 (formal verification). For each system, security functions can be defined separately. ITSEC predefines 10 functions, the first 5 of which are very similar to the C1-B3 levels in the Orange Book.

⑤Canada CTCPEC: This standard divides security requirements into four levels, namely confidentiality, integrity, reliability and explicability.

⑥ISO security system structure standard: In terms of security system structure, ISO has formulated the international standard ISO7498-2-1989 "Information Processing System Open System Interconnection Basic Reference Model Part 2 Security Architecture".This standard describes the basic reference model for Open Systems Interconnection (OSI) and establishes a framework for the coordinated development of existing and future system interconnection standards.Its task is to provide a general description of security services and related mechanisms, identifying where within the reference model these services and mechanisms can be provided.

(2) Chinese regulations
1997年12月11日经国务院批准，公安部于1997年12月30日发布了《计算机信息网络国际联网安全保护管理办法》。2000年3月30日，公安部部长办公会议通过《计算机病毒防治管理办法》，并发布施行。

(3) Regulations on international cooperation
At present, computer network crimes have a trend of internationalization, and international computer criminals take advantage of the differences between the legal systems of different countries to wait for opportunities to commit crimes.

Palmer, general secretary of the all-party parliamentary network group, said the solution to the problem was to create a United Nations body.Speaking at the Webroot Spyware Summit in London, Palmer said a United Nations agency could put pressure on ISPs to shut down servers hosting malicious Web sites.For example, the United Nations needs a body that requires ISPs not to connect to servers hosting child pornography from Colombia or Guyana.Palmer said pressure needs to be put on countries that are tolerant of cybercriminals, and that it is in the interest of all nations to fight cybercriminals - making it clear to cybercriminals that their internet connections will be cut off if they commit crimes .

Howard, coordinator of the US National High Technology Crime Team, said that if criminals are involved in complex international cybercrime activities, it is quite difficult to collect evidence.Jurisdiction is extraordinarily complex, he said.

The police agencies of the United Kingdom, Canada, Australia, and the United States have cooperated in combating online child molestation cases.

7.1.4 Causes of potential safety hazards in computer systems
1. The vulnerability of the computer operating system

(1) Whether it is the Miscrosoft operating system or the open-code Linux system, there are loopholes in the design, and patching will bring more threats.

(2) The defect of the operating system itself is that the program can be dynamically connected, and the I/O driver and system services can be dynamically connected in the form of patching.

(3) The system supports transferring files, loading and installing programs on the network, including executable files.

(4) The operating system can create processes, and even create and activate processes on network nodes.The so-called "server" software can be installed on a certain computer and remotely invoked by illegal users, but the corresponding security verification function is limited.

(5) The problem of the daemon program of the system itself. For example, there is a connection in the FTP service that uses the daemon program to wait for the request to establish a file transfer connection, which is often used by hackers to attack the computer.

(6) The operating system provides remote procedure calls, but the security verification function is limited.

(7) The operating system provides file service system NFS based on remote procedure calls. If there is a problem, it means losing the system management right.

(8) DEBUG (debugging) and WIZARD functions of the operating system.

(9) The passwordless entry provided by the operating system is often used to attack computers.

(10) The hidden port of the operating system is originally for the convenience of users, but it is used by illegal users as a means of attacking computers.

(End of this chapter)