Bo co kt thc mn An Ninh Mng Bo mt trong SSL VPN

Bo co kt thc mn An Ninh Mng Bo mt trong SSL VPN

MC LCMC LC1LI NI U3CHNG 1 GII THIU V SSL VPN41.1 Khi nim v VPN41.2. IPSec VPN v SSL VPN41.2.1 IPSec VPN41.2.2 SSL VPN61.2.3 So snh IPSec v SSL VPN71.3 Khi nim mng tin cy v m hnh kt ni SSL VPN71.3.1. Khi nim mng tin cy71.3.2 Khi nim vng cch ly DMZ7Chng 2 HOT NG CA SSL VPN102.1 Thit b v Phn mm102.2 Giao thc SSL112.2.1 Lch s ra i112.2.2 Tng quan cng ngh SSL142.3 Thit lp ng hm bo mt s dng SSL172.3.1 Cc ng hm bo mt182.3.2 SSL v m hnh OSI19CHNG 3: BO MT TRONG SSL VPN213.1 Nhn thc v Xc thc213.1.1 Nhn thc213.1.2 ng nhp mt ln243.1.3 Xc thc243.2 Cc vn bo mt u cui253.2.1 Vn d liu nhy cm trong vng khng an ton v gii php263.2.3 Vn ngi dng qun ng xut v gii php333.3.2 Vn virus xm nhp vo h thng mng cng ty qua SSL VPN373.2.4 Vn su xm nhp vo mng cng ty qua SSL VPN v gii php383.2.5 Vn ca cc vng khng an ton403.2.6 Cc hacker kt ni ti mng cng ty433.2.7 Vn r r thng tin mng ni b v gii php433.2.8 u cui tin cy453.2.9 Phn cp truy cp da trn tnh trng im cui463.3 Vn bo mt pha my ch483.3.1 Vn tng la v cc cng ngh bo mt khc b tn cng v gii php483.3.2 Vn yu im ca mc ng dng v gii php533.3.3 M ha553.3.4 Cp nht cc my ch SSL VPN553.3.5 So snh Linux v Windows553.3.6 Mt vi khi nim bo mt khc ca thit b SSL VPN55KT LUN57TI LIU THAM KHO58

LI NI UNgy nay, s pht trin ca khoa hc cng ngh lm thay i nhiu b mt thng mi, ng gp vo s pht trin ca kinh t th gii. Trong , cng ngh thng tin v truyn thng c mt vai tr rt quan trng.Cng vi s pht trin ca thng mi, nhu cu trao i thng tin gia cc chi nhnh cc vng khc nhau dn ti s ra i ca cng ngh mng ring o VPN. Mng VPN tn dng c u im ca c s h tng Internet sn c, thit lp kt ni ring o vi chi ph rt thp so vi ng truyn knh ring. V vy, VPN l mt gii php ti u cho cc doanh nghip.Cc gii php VPN ph bin trc y u da trn nn IPSec. Tuy nhin, gii php IPSec VPN c nhiu nhc im nh ngi dng phi cu hnh client, khng tng thch vi giao thc phn gii a ch NAT, thc hin kt ni mng m khng quan tm n im kt ni. Do vy, IPSec VPN thch hp cho cc kt ni vng vng. Nhng vi s pht trin ca thng mi ngy nay, ngy cng nhiu cng ty mun nhn vin cng nh i tc ca h c th kt ni ti mng ni b t bt k u. SSL VPN l mt gii php ton din cho trng hp ny. SSL VPN tr thnh mt trong nhng gii php VPN hu hiu nht, hin nay, n c th h tr kt ni mng, kt ni ng dng web, non-web,

CHNG 1 GII THIU V SSL VPN1.1 Khi nim v VPNnh ngha c bn ca VPN l mt kt ni bo mt gia hai hoc nhiu a im qua mt mng cng cng. C th hn VPN l mt mng d liu c nhn c xy dng da trn mt nn tng truyn thng cng cng. VPN c th cung cp truyn dn d liu bo mt bng cch to ra ng hm d liu gia hai im, bng cch s dng m ha chc chn rng khng c h thng no khc ngoi im cui ca n c th hiu c d liu. Hnh 1.1 l mt v d c bn.

Hnh 1.1. M hnh c bn VPNNgi dng t xa s kt ni ti Internet qua mt nh cung cp dch v, nh cung cp ny c th l VPNT, Viettel, EVN, Hnh trn m t khi nim ca VPN, VPN n v m ha d liu, do d lm cho hacker khng th bt c gi d liu ngi dng.1.2. IPSec VPN v SSL VPN1.2.1 IPSec VPNIPSec s m ha tt c d liu i ra v gii m d liu vo, v vy n c th s dng mt mng cng cng, nh Internet lm phng tin trung chuyn. IPSec VPN thng tn dng cc giao thc lp 3 ca m hnh OSI, c thc hin bi cc k thut khc nhau: Authentication Header (AH) hay mo u nhn thc. Encapsulating Security Payload (ESP) hay ng gi d liu bo mt.AH cung cp hai cch nhn thc, n c th thc hin bi phn cng hoc phn mm, v trong nhiu trng hp cung cp kh nng nhn thc ngi dng qua cp nhn thc chun tn ng nhp v mt khu. N cng c th nhn thc qua mt Token, hoc theo chun X.509.Giao thc ESP cung cp kh nng m ha d liu. Hu ht thc hin da trn cc thut ton h tr nh DES (Data Encryption Standard Chun m ha d liu), 3DES (Triple Data Encryption Standard Chun m ha d liu ba mc), hoc AES (Advanced Encryption Standard Chun m ha d liu m rng). Trong hu ht cc trng hp, IPSec s thc hin mt qu trnh bt tay trong cn mi im u cui trao i kha v sau chp nhn cc chnh sch bo mt.IPSec c th h tr hai kiu m ha: Transport: m ha phn d liu ca mi gi, nhng phn header khng c m ha. Thng tin nh tuyn ban u trong gi tin khng c bo v khi nhm ngi dng khng nhn thc. Tunnel: M ha c header v d liu. Thng tin nh tuyn ban u c m ha, v mt chui cc thng tin nh tuyn c thm vo gi nh tuyn d liu gia hai im cui.IPSec h tr mt giao thc gi l ISAKMP/Oakley (Internet Security Association and Key Management Protocol/Oakley Giao thc t hp bo mt Internet v qun l kha/Oakley). Giao thc ny cho php ngi nhn c c mt kha cng cng v nhn thc ngi gi bng cch s dng ch k k thut s. Qu trnh u tin ca mt h thng mt m da trn kha l trao i mt kha ca mt cp kha. Mt khi cc kha c trao i, th lu lng c th c m ha. IPSec c m t trong nhiu RFC, bao gm 2401, 2406, 2407, 2408, v 2409. Nhc im ca VPN da trn client (nh IPSec) l cn phi cu hnh hoc ci t mt vi phn mm c bit. C nhiu phn mm c tch hp sn VPN trong h iu hnh (nh Windows hay Linux), nhng ngi dng vn cn phi cu hnh client. Trong mt vi trng hp, thm ch ngi dng cn phi ci t c chng thc client. Thm na, c th phi dng n tng la, phn mm dit virus v mt vi cng ngh bo mt khc. Cu hnh c bn cho mt IPSec VPN l mt thit b hub trong tm v mt my tnh client t xa. Khi kt ni c thit lp th sau mt ng hm c to ra qua mng cng cng hoc mng ring. ng hm m ha ny s bo mt phin truyn thng gia hai cc im cui, v hacker s khng th c c phin truyn thng.1.2.2 SSL VPNMt phng thc khc bo mt d liu qua Internet l SSL (Secure Socket Layer Lp socket bo mt). SSL l mt giao thc cung cp kh nng m ha d liu trn mng. SSL l mt giao thc mng c kh nng qun l knh truyn thng c bo mt v m ha gia server v client. SSL c h tr trong hu ht cc trnh duyt thng dng nh Internet Explorer, Netscape v Firefox. Mt trong nhng chc nng chnh ca SSL l m bo b mt bn tin. SSL c th m ha mt phin gia client v server v do cc ng dng c th truyn v xc thc tn ng nhp v mt khu m khng b nghe trm. SSL s kha cc phin nghe trm d liu bng cch xo trn n.Mt trong nhng chc nng quan trng ca SSL l kh nng cung cp cho client v server c th nhn thc c chng qua vic trao i cc chng thc. Tt c lu lng gia SSL server v SSL client c m ha bng cch s dng mt kha chia s v mt thut ton m ha. Tt c iu ny c thc hin qua qu trnh bt tay, ni bt u khi to phin. Mt chc nng khc ca giao thc SSL l SSL m bo bn tin gia h thng gi v h thng nhn khng b gi mo trong sut qu trnh truyn. Kt qu l SSL cung cp mt knh bo mt an ton gia client v server. SSL c thit k c bn cho vic bo mt m trong sut i vi ngi dng. Thng thng mt ngi dng ch phi s dng a ch URL kt ni ti mt server h tr SSL. Server s chp nhn kt ni trn cng TCP 443 (cng mc nh cho SSL). Khi n kt ni c ti cng 443 th qu trnh bt tay s thit lp phin SSL.S kt hp ca SSL v VPN to ra cc u im sau: S kt hp gia k thut m ha SSL v cng ngh proxy lm cho vic truy cp ti ng dng Web v cc ng dng cng ty tr nn thc s d dng. S kt hp ca cc cng ngh c th cung cp qu trnh xc thc client v server vi d liu c m ha gia cc cp client-sever khc nhau. Trn ht, l n c th thit lp SSL VPN d dng hn nhiu so vi thit lp IPSec VPN.Trong mt vi trng hp, vic thc thi SSL VPN tng t nh i vi IPSec. SSL VPN cng cn phi c mt s thit b hub. Cc client cng cn phi c mt s phn mm giao tip, c gi l cc trnh duyt h tr SSL. Hu ht cc my tnh u c mt trnh duyt h tr SSL, bao gm c mt chng thc SSL root t CA (Certificate Authorities Chng ch nhn thc) cng cng. Thit b hub trung tm v phn mm client s m ha d liu qua mt mng IP. Qu trnh ny s bo mt d liu chng cc cuc tn cng ca hacker.1.2.3 So snh IPSec v SSL VPNThng thng IPSec VPN s s dng mt phn mm chuyn bit u cui, thit b hub v client. iu ny cung cp kt ni bo mt cao. Mi im cui cn mt vi bc thit lp cu hnh, v cn phi c nhiu s can thip ca con ngi vo qu trnh x l.SSL VPN thng khng cn thit phi c cc phn mm client c bit. SSL VPN c ton b chc nng bo mt nh IPSec VPN. Hn na, nu trnh duyt c cp nht thng xuyn th qu trnh cu hnh c t ng x l.C IPSec v SSL VPN c th cung cp truy nhp t xa an ton cho ng dng thng mi. C hai cng ngh ny u h tr nhiu giao thc nhn thc, bao gm chng thc X.509. V c bn, IPSec khng th b tt cng, tr khi s dng chng thc. Server SSL VPN lun lun xc thc vi mt chng thc s, SSL s quyt nh server ch no c xc thc bng CA tng ng. SSL cung cp kh nng mm do trong trng hp gii hn ngi dng tin cy hoc rt kh ci t chng thc ngi dng (v d nh cc my tnh cng cng).1.3 Khi nim mng tin cy v m hnh kt ni SSL VPN1.3.1. Khi nim mng tin cyMt mng tin cy ca mt cng ty l mt mng m cng ty s dng qun l hot ng. Trong nhiu trng hp, mt mng tin cy thng c nh ngha nh mt vng an ton. Mng tin cy thng c cc h thng u cui, cc trang web ni b, x l d liu, tin nhn ni b. Trong nhiu cng ty, mng tin cy c cho php trc tip tc ng qua li vi cc h thng m khng cn m ha. C mt vn vi nh ngha trn l c qu nhiu mng tin cy c to ra bi cc cng ty. Mng tin cy i khi khng phi lun ng tin cy. Tc l trong mt s trng hp mng tin cy khng c tin cy. L do l n c kt ni qu nhiu ti bn ngoi. Do , trn thc t l mt mng tin cy c xem nh mt mng m cc nhn vin ni b cng ty s dng khi c quan hoc u qua mt ng truyn bo mt. 1.3.2 Khi nim vng cch ly DMZDMZ (Demilitarized zone) l mt mng cch ly, c t nh l mt vng m gia mt mng tin cy ca cng ty v cc mng khng tin cy (Internet lun c xem nh l mt mng khng tin cy). Mc ch ban u ca DMZ s ngn chn ngi dng bn ngoi trc tip kt ni vo mt mng tin vy. Hnh 1.2 m t mt DMZ thng thng.Hu ht cc DMZ c cu hnh thng qua mt tp hp cc lut c xc nh bng cc chnh sch v sau c thc hin thng qua cc th tc ca cng ty. Mt trong cc lut c bn l mt cng n l (nh cng 80) khng c DMZ cho php truy cp. V vy nu bn th truy cp mt ng dng trn mt DMZ qua HTTP trn cng 80 th bn s khng truy cp c. y chnh l cch DMZ thc hin, n gi li cc lu lng khng tin cy ang c i vo mng tin cy. DMZ s lc lu lng v gii hn truy cp ti mng tin cy thng qua b lc v qu trnh nhn thc, v trong mt vi trng hp DMZ s chn ton b lu lng nu cn thit. Di y l mt vi chc nng m DMZ c th thc hin: Chn cc cuc qut cng vo mng tin cy. Chn cc truy cp vo mng tin cy qua mt cng TCP n l. Chn DOS (Denial of Service Attack Tn cng t chi dch v). Qut vius, ni dung, kch c cc e-mail. Chn cc cuc nghe trm / thay i gi.

Hnh 1.2. M hnh DMZChng 2 HOT NG CA SSL VPNCc sn phm SSL VPN cho php ngi dng thit lp cc phin truy cp t xa an ton t trnh duyt kt ni Internet. Cho php ngi dng truy cp e-mail, h thng thng tin khn cp, v nhiu ti nguyn mng khc t bt k ni no. Mc d thit b SSL VPN thot nhn rt n gin nhng n l mt cng ngh phc tp v tin tin.Ti thi im hin nay, khng c mt chun no cho cng ngh SSL VPN (tr SSL, HTTP, v cc thnh phn khc ca SSL VPN). Mt vi SSL VPN ca t chc th ba, ch yu m t cc chc nng, khng phi l cc k thut c th thc hin cc chc nng . Vi s cnh tranh cao trong th trng SSL VPN, cc nh sn xut thit b cng khng cng khai cc k thut bn trong s dng trong cc sn phm. Tuy nhin, mc d khng c cc thng tin t nh sn xut, ta vn c th hiu c cng ngh SSL VPN. Tt c cc cc n t hng t khc hng u yu cu cung cp dch v da trn truy cp web t xa. V kt qu l, cc cng ngh c bn s dng trong cc sn phm SSL VPN c nhiu c im chung. 2.1 Thit b v Phn mmTrong th trng hin nay, cc sn phm bo mt nh SSL VPN thng c bn di dng thit b, thit b thng c xem nh l mt hp en, c ngha l ngi qun tr mng khng cn thit phi hiu cch chng thc hin. V l thuyt, cc thit b gim chi ph trong vic ci t, cu hnh, v bo tr mt h thng cng ngh thng tin.Mc d c mt vi s khc bit trong cc cng ngh bn trong, hu ht cc thit b bao gm cc my tnh chy phn mm SSL VPN trn mt h iu hnh. Do , ng trn quan im bo mt, thc cht khng c cc im khc bit khi thc hin SSL VPN bng thit b so vi SSL VPN bng phn mm, phn mm ny c th c ci t trn cc my ch ca ngi mua.Tuy nhin, trn phng din thc t, cc thit b thng thng c ng gi cng vi h iu hnh iu khin, phn mm SSL VPN v mt vi cu hnh c bn. Kt qu l n gim c cc sai st ca con ngi trong qu trnh ci t v cu hnh thit b, v chc chc khng c xung t gia phn cng v phn mm. Do trong nhiu trng hp, thit b c nhiu u im bo mt hn phn mm. Cc t chc vi cc chun d liu trung tm khuyn ngh rng cc my ch thch hp vi sn phm da trn phn mm hn, y l mt trng hp c bit khi m ngi qun tr c kinh nghim trong cc h thng phn cng.Hnh 2.1 m t cc thit b SSL VPN, t tri qua phi l cc thit b ca Safenet, Juniper Networks v Whale Communications.

Hnh 2.1. Mt s thit b SSL VPNBt chp nhiu c nhiu thit b khc nhau v hot ng bn trong ca chng cng khc nhau, cng ngh c bn ca SSL VPN vn c xc nh r rng.2.2 Giao thc SSLGiao thc SSL l thnh phn chnh ca cng ngh SSL VPN. Do , vic hiu c SSL s gip chng ta hiu c cch lm vic ca SSL VPN.2.2.1 Lch s ra iCc trang web s dng giao thc HTTP (Hypertext Transfer Protocol Giao thc truyn siu lin kt). Bn thn HTTP khng c m ha hay cc bin php bo v d liu c truyn gia ngi dng v my ch web. Vi s pht trin ca World Wide Web trong nhng nm u ca thp k 90, v s m rng trong cc hot ng thng mi s dng web bao gm truyn cc thng tin b mt qua mng Internet, cn phi loi tr kh nng b nghe trm bi nhm ngi khng xc thc trn cc cuc giao tip gia cc my tnh qua mng Internet.Mt vi cng ngh c pht trin thc hin iu ny, tt c chng s dng m ha bo v d liu nhy cm. Giao thc chng t c nhng u im vt tri v n nhanh chng tr thnh chun cho giao tip web an ton l SSL.SSL phin bn 1.0 c gii thiu trong trnh duyt Mosaic nm 1994, v phin bn ci tin (SSL phin bn 2.0) c thng mi ha vo cui nm khi nhng ngi to ra Mosaic thnh lp Netscape Communication v tch hp vo trnh duyt Navigator ca h.V trong trng hp ny, bng cch nhn vo a ch URL ca trang web trong trnh duyt, ngi dng c th xc nh trang web no s dng SSL trong phin giao tip. Cc trang web m ha SSL c tin t l HTTPS trong khi trang web bnh thng c tin t l HTTP. (Ngy nay, cc trnh duyt thng th hin SSL di dng biu tng, nh mt ng kha hay mt cha kha,).HTTPS l mt giao thc web s dng SSL m ha HTTP, n c s dng rng ri cho cc phin truyn thng bo mt. HTTPS khng phi l S-HTTP, mt giao thc m ha hai chiu phin giao tip trang web, S-HTTP l mt m rng ca giao thc HTTP, c s dng h tr bo mt d liu truyn qua World Wide Web. S-HTTP c thit k truyn cc bn tin mt cch an ton trong khi SSL c thit k thit lp mt kt ni bo mt gia hai my tnh. S-HTTP cnh tranh vi HTTP trong nhng ngy u, nhng v c bn tht bi so vi HTTPS trong lnh vc thng mi in t (do khng m ha cc thng tin phin), v khng c s dng na.Ngy nay, cc my ch thng cung cp dch v web (HTTP) trn cng 80 v lu lng web m ha SSL (HTTPS) trn cng 443.Hnh 2.2 l mt trang web m ha HTTPS. Lu https u a ch URL v biu tng kha cn pha trn bn phi ca hnh.

Hnh 2.2. V d v HTTPSNm 1995, Microsoft a ra mt phin bn Internet Explorer, vi mt cng ngh m ha ring gi l PCT (Private Communications Technology Cng ngh giao tip c nhn). PCT c mt vi u im so vi SSL phin bn 2.0. Tuy nhin, ngay sau khi phin bn Internet Explorer c a ra, Netscape a ra phin bn SSL 3.0, bao gm cc u im ca PCT, sau SSL 3.0 a truyn thng web bo mt trong thng mi tr v vi SSL.Nm 1996, s pht trin ca World Wide Web tr thnh mt knh thng mi ln v cng ngh truyn thng tr nn c m bo, vi s pht trin ca SSL, t chc IETF (Internet Engineering Task Force Nhm c trch v k thut Internet) bt u chun ha giao thc SSL. Nm 1999, IETF hon thnh xong v thit lp SSL nh l mt chun ca truyn thng web vi tn gi TLS (Transport Layer Security Lp bo mt trung chuyn).Bn cnh vic bo v d liu thng qua m ha, SSL s dng k thut bm (hashing) chc chn ni dung phin giao tip khng b thay i trong sut qu trnh mt my tnh gi mt tin nhn v bn nhn c c n.Mt gi tr bm l mt s c to t mt chui vn bn bng cch p dng thut ton ton hc. Gi tr bm thng nh hn text v c to bi mt cng thc, cng thc ny m bo rng gi tr vn bn ngun khc nhau th gi tr bm s khc nhau. Cng thc bm l mt hm mt chiu, c ngha l khng th xc nh on vn bn ban u t gi tr bm. Hashing l qu trnh thc hin cng thc bm vo on vn bn a ra gi tr bm.Cng cn lu rng mc d thnh cng trn lnh vc bo mt web, SSL VPN tht bi trn mt lnh vc khc. Mc ch th hai ca SSL l trnh gi mo website t hacker trm d liu ngi dng bng cch gi mo trang web m ngi dng mun trao i ti chnh. Mc d cng ngh SSL cho ngi dng mt phng thc xc nhn nhn dng my ch, nhng s phc tp ca n lm cho phng thc ny khng c chp nhn. Sau khi SSL tr nn ph bin, c chun ha v trin khai rng ri, vn cc website gi mo tr nn khng th chp nhn c. Thut ng phishing l mt loi hnh ti phm trong ngi dng b la mt cc thng tin b mt vo tay cc t chc mu li. Hng thng, phishing lm thit hi khong hng triu la. Hin nay, s thit ht ny ca SSL l mt vn ln cho thng mi trc tuyn dn ti vic thc thi SSL VPN.SSL cng c cc k thut xc thc my trm. Bng cch to ra cc chng thc my trm, ngi dng c th chng minh c mnh i vi my ch. Mc d chc nng ny ca SSL him khi c s dng, n c tm quan trng ln trong SSL VPN do n cho php my ch nhn din mc tin tng ca my trm.Vy tm li, SSL c cc mc ch sau: Bo mt truyn thng. m bo ton vn d liu. Xc thc my ch. Xc thc my trm.2.2.2 Tng quan cng ngh SSLSSL s dng thut ton mt m (cryptography) m ha d liu, v vy ch c hai my tnh c kh nng c bn tin v hiu c n. iu ny gi l bo v d liu tin cy. SSL h tr nhiu thut ton mt m khc nhau, cc thut ton ny c kh nng m ha nhiu phin lm vic chuyn bit da trn phin bn SSL, chnh sch bo mt cng ty v hn ch ca chnh quyn.C hai loi thut ton mt m c s dng trong mi phin SSL, i xng v bt i xng. Trong khi mt m i xng c s dng m ha tt c cc giao tip trong mt phin SSL th thut ton mt m bt i xng c s dng chia s kha phin i xng mt cch an ton gia ngi dng v SSL VPN.a) Thut ton mt m i xng: m bo tin cy d liuThut ton i xng s dng cng mt kha m ha v gii m, v do c hai bn i thoi cn phi chia s kha nh hnh 2.3. Qu trnh x l thut ton mt m i xng cn t vng CPU hn qu trnh x l bt i xng. Tuy nhin, thut ton mt m i xng c mt nhc im ln l lm th no mt bn chia s kha b mt vi bn kia nu nh phi truyn qua mi trng Internet khng tin cy.

Hnh 2.3. Thut ton mt m i xngMt kha l mt on d liu (thng l mt s ln), n gip cho mt thut ton mt m m ha vn bn thng thng thnh vn bn mt, hoc gii m vn bn mt thnh vn bn ban u. S dng cng mt thut ton vi cc kha khc nhau th s cho ra kt qu khc nhau.b) Thut ton mt m bt i xng: m bo tin cy d liuThut ton mt m bt i xng gii quyt vn chuyn i kha ni trn. N s dng mt cp kha, mt kha gi l kha b mt v mt kha gi l kha cng cng. Kha cng cng khng phi l b mt v n c chia s ti tt c trong khi kha b mt th thuc quyn s hu ca mt my tnh no . D liu c m ha vi mt kha ch c th c m ha vi kha cn li ca cp. V d, khi Tom mun gi mt tin nhn ti Joe v mun ch c Joe mi c th c c tin nhn, Tom s m ha tin nhn vi kha cng cng ca Joe. V tin nhn ch c m ha vi kha b mt ca Joe v ch c Joe x l kha ny th Joe mi c c tin nhn. Tng t, khi Joe tr li li cho Tom, anh ta s m ha bn tin vi kha cng cng ca Tom. V ch c mt kha cn phi c chia s trong kiu thut ton bt i xng ny l cc kha cng cng, v cc kha cng cng ny khng phi l b mt, v vy thut ton bt i xng khng gp phi vn chia s kha. Cc kha cng cng c th d dng c truyn i qua mng Internet nh m t hnh 2.4.

Hnh 2.4. Thut ton mt m bt i xngTuy nhin, thut ton mt m bt i xng cn mt b x l phc tp v khng th m ha khi lng d liu ln. N khng th c s dng m ha tt c phin SSL. Do , ngi ta ngh n vic dng thut ton mt m bt i xng truyn kha b mt. V SSL s dng tng ny, SSL s dng thut ton mt m bt i xng truyn kha b mt gia ngi dng u xa v my ch, v sau thc hin thut ton mt m i xng truyn d liu trong sut phin lm vic SSL nh hnh 2.5.

Hnh 2.5. Kt hp hai thut tonc) Thut ton mt m bt i xng: Nhn thc my chBn cnh vic m ha, thut ton mt m cng cung cp kh nng nhn thc my ch. Nu mt ngi dng m ha mt bn tin vi kha b mt ca ngi , bt k ngi dng gii m bn tin bng cch s dng kha cng cng ca ngi gi th c th m bo c rng bn gi ng l ngi gi bn tin. Khng c ai khc c kh nng to ra bn tin m c th c gii m bi kha cng cng tr ngi s hu kha b mt.Chng thc SSL l mt k thut trong mt my ch web c th chng thc n i vi ngi dng thng qua kha cng cng m my ch a ti. Mt bn th ba s dng chng thc theo cch chng minh t chc ng tht s l n. Do , khi ngi dng nhn c mt chng thc t mt cng ty ABC v khi dng kha gii m giao tip thnh cng th tng ng vi vic cng ty l ABC. iu ny cho php ngi dng bit c h ang giao tip vi cng ty ABC ch khng phi l gi mo ca cng ty ABC. Mt chng thc SSL l phng tin trong cc my ch c th truyn cc kha cng cng ca h ti ngi dng lc bt u phin SSL.Nh m t trn, mc d c kh nng nhn thc ca SSL, phishing vn tn ti ph bin. Do , cn phi c kh nng chng la o ca SSL. Trong sut qu trnh thit lp mt phin giao tip SSL bo mt, my tnh ngi dng s cnh bo ngi dng nu chng thc ht hn, hoc khng tin cy hoc khng ph hp vi my ch hoc min m n nhn c. Tuy nhin, hu ht ngi dng khng hiu c cc cnh bo trn v thng nhn OK hoc Accept khi c hp thoi v cc vn chng thc.d) Thut ton mt m: Nhn thc my trmNh gii thiu trn, SSL cung cp kh nng nhn thc my trm thng qua chng thc. Cc my trm c mt chng thc i din my ch c th nhn thc c. Mc d SSL him khi thc hin hai cng ngh nhn thc ny, chng c ngha quan trng i vi SSL VPN, cho php my ch SSL VPN nhn din my trm nhng mc tin cy khc nhau.e) Kch c kha thi im hin ti, SSL thng m ha vi kha phin c di 128 bit ngu nhin. Do , s l khng thc t s dng cc cng ngh phn cng gii m d liu v di kha ny thay vo ngi ta s dng my tnh. Trc y, t c cc tiu chun ca US Export, SSL thng c s dng vi kha 40 bit. Nhng ngy nay, 40 bit khng th mnh chng li cc chng trnh gii m v do khng th m ha cc thng tin nhy cm.2.3 Thit lp ng hm bo mt s dng SSL2.3.1 Cc ng hm bo mtMt ng hm bo mt gia cc my tnh c th c hiu nh mt knh bo mt truyn thng gia hai my qua mt mi trng khng an ton. Knh bo mt tng t nh mt ng hm di sng cho php cc phng tin i li gia hai im u cui ng hm v trnh cc yu t mi trng nh nc nh hng ti giao thng.ng hm truyn thng cho php giao tip gia hai my tnh qua cc mng cng cng mt cch an ton, v vy cc my tnh khc trn cc mng ny khng th truy cp vo giao tip gia hai my tnh ny.Tuy nhin, khng ging nh v d ng hm di sng, ng hm mng khng thc hin mt ng truyn vt l gia hai my tnh v cc my tnh khc. Hn na, k thut ng hm my tnh c bao gm m ha tt c cc giao tip gia hai my tnh, v vy thm ch nu mt my tnh khc nhn c phin truyn thng th n cng khng th gii m c ni dung tht s ca bn tinh gia hai my tnh nh m t hnh 2.6.

Hnh 2.6. ng hm bo mtK thut ng hm khng phi l khi nim c gii thiu vi cng ngh SSL VPN. N c s dng trong mt s cng ngh c trin khai trc y, m ni ting l IPSec VPN.Mt ng hm m ha gia hai my tnh qua mt mng khng tin cy nh Internet thng c gi l VPN, do vic thit lp mt ng hm kt ni hai my tnh ny tng ng vi mt kt ni VPN. Hai my tnh c th giao tip vi nhau m khng lo lng cc my khc c th c c phin giao tip. Mc d khng hon ton trnh khi nguy c cc gi tin b bt nh trn ng truyn ring chuyn bit nhng VPN qua mng Internet c nh gi cao v kh nng bo mt v c chp nhn nh l mt chun truyn thng trong thng mi hin nay.SSL VPN to ra cc ng hm bo mt bng cch thc hin hai chc nng sau: Bt buc ngi dng phi nhn thc trc khi cho php truy cp, v vy ch c cc nhm nhn thc mi c thit lp ng hm. M ha tt c lu lng truyn qua v ti ngi dng bng cch thc hin ng hm thc s s dng SSL.Qu trnh thit lp mt ng hm SSL cn nhiu chuyn i cc thng tin cu hnh khc nhau gia cc my tnh u cui ca kt ni. Cc thng tin chi tit lin quan n phin truyn thng, cc giao thc m ha, chuyn i kha, khng c cp chi tit trong Tiu lun ny. Tuy nhin, hiu c cng ngh SSL VPN, chng ta cn phi hiu mt cht v giao thc SSL VPN v v tr ca SSL VPN trong m hnh OSI.2.3.2 SSL v m hnh OSINm 1984, t chc kt ni h thng m Open System Interconnect, mt nhm chuyn a ra cc tiu chun quc t, a ra mt khung tm tt cc cng ngh phn lp trong vic giao tip cc my tnh gi l m hnh OSI.N bao gm by lp: Lp 7: Lp ng dng Lp 6: Lp trnh din Lp 5: Lp phin Lp 4: Lp vn chuyn Lp 3: Lp mng Lp 2: Lp lin kt d liu Lp 1: Lp vt lThng thng, ng hm VPN c thc hin lp mng hoc lp thp hn (v d, IPSec thc hin lp mng). Truy nhp t xa c thc hin thit lp kt ni mng m ha gia mt nt mng t xa v mt mng bn trong, to ra kt ni t xa m cc lp trn lp 4 khng th hiu c. Cc ng dng thc hin c cc chc nng khi ngi dng c quan v khi h mt im t xa, ngoi tr rng khi yu cu c chuyn xung lp di, chng b thay th qua cc kt ni mng tng ng cc a im xc nh ca ngi dng. Thnh thong, kt ni l cc b v thnh thong n bao gm ng hm qua mng Internet. Vic thit lp cc kt ni ny cn phi ci t v cu hnh cc phn mm client trn my tnh ngi dng. Phn mm client ny s iu khin ng hm lp mng.SSL VPN th li thc hin khc. N thit lp cc kt ni s dng SSL, cc chc nng lp 4 v 5. N cng ng gi thng tin lp 6 v 7 v giao tip lp cao nht ca m hnh OSI. Ngy nay, mt vi SSL VPN cng c th to ng hm lp mng, v tr thnh cng ngh truy cp VPN linh hot nht.Mt iu quan trng na l SSL khng hon ton l mt giao thc web. N thc hin lp phin v lp vn chuyn ca m hnh OSI v c th thit lp cc ng hm giao tip cho nhiu giao thc lp ng dng v c th c xp trn lp ng dng. V d, mc d SSL m ha phin web (HTTPS), SSL cng c th m ha POP3 v FTP trong nhiu mi trng, cng c th s dng SSL m ha tt c cc giao thc lp ng dng.

CHNG 3: BO MT TRONG SSL VPNSSL VPN thc hin nh mt gateway vo cu trc mng ca cng ty, v do vn bo mt l mt thnh phn quan trng ca SSL VPN. V kh nng bo mt ca thit b SSL VPN l mt trong nhng yu t quan trng cng ty s chn sn phm no thc hin.Bo mt trong SSL VPN chia thnh ba phn chnh: Nhn thc (Authentication) v xc thc (Authorization): Ngi dng c th truy cp ti cc thng tin v h thng qua SSL VPN. V vy, phi chc chn rng ch c cc ngi dng nhn thc c th truy cp ti nguyn qua SSL VPN v cc ngi dng c lp ch c th truy cp ti ti nguyn ca h c php truy cp. Bo mt u cui: Bo mt u cui thng c bit n nh l bo mt bn my trm (Client-Side Security) hoc bo mt bn trnh duyt (Browser-Side Security). y l mt cng ngh thc hin trnh cc vn lin quan n bo mt xy ra trn cc thit b c s dng truy nhp cc ti nguyn qua SSL VPN. Mt iu quan trng na l khng ging nh cc cng ngh truy cp t xa trc y, cng ngh SSL VPN cho php truy cp t cc my khng c xem l an ton v do , khi nim im u cui khc vi khi nim im u cui trong cc h thng truy cp t xa trc y. Bo mt bn my ch: Bo mt bn my ch, thng c gi l bo mt mng (Network Security), tng ng vi vic bo v ngun ti nguyn ni b ca cng ty bao gm bn thn my ch SSL VPN t cc cuc tn cng t my tnh nn nhn.3.1 Nhn thc v Xc thcNh m t trc, SSL VPN thng cn ngi dng xc thc bn thn h trc khi c php truy cp vo ti nguyn ni b.3.1.1 Nhn thcNhn thc thng thc hin bng mt trong cc cch sau: Mt ci g m ch mt ngi bit. Mt ci g m ch mt ngi c. Mt ci g m ch ngi l (v d nh c im vt l ca ngi s dng).Cc sn phm SSL VPN h tr nhiu phng thc bo mt khc nhau. Thng thng nht, nhn din ngi dng thng s dng tn ng nhp v mt trong cc nhn t sau:a) Mt khuNgi dng c cp mt mt khu b mt m ch ngi dng bit v n kt hp vi thng tin nhn din ca ngi dng (tn ng nhp). SSL VPN so snh mt khu vi mt khu c lu tr trong c s d liu hoc thc hin thut ton bm v so snh vi gi tr bm ca mt khu vi mt khu lu trong c s d liu. Nu hai gi tr ny ging nhau, ngi dng c xc thc.b) Mt khu mt lnNgi dng c cp mt vi mt khu m ch c th dng mt ln. Sau khi ngi dng nhp tn ng nhp cng vi mt khu mt ln, ngi dng c th ng nhp h thng. Tuy nhin, mt khu c bit c s dng truy cp s khng th c dng truy cp cc ln tip theo. Mt khu mt ln c thc hin bng cc cch sau: Danh sch cc mt khu mt ln c xc nh t trc: Mt danh sch cc mt khu mt ln c to bi h thng nhn thc v gi ti ngi dng khi h c quan. thi im ngi dng mun ng nhp t xa, ngi dng s dng mt khu tip theo trong danh sch v xa n khi danh sch. Khi danh sch ht, mt danh sch mi s c to ra v gi ti ngi dng. Phn cng hoc phn mm c th to ra mt khu mt ln: Cc sn phm nh Vasco DigiPass hoc RSA SecurID kh ph bin trong lnh vc ny. Mt thit b phn cng nh hoc mt phn ca phn mm chy trn mt my tnh cm tay hoc mt my tnh xch tay c s dng to ra mt mt khu mt ln bng cch tnh ton da trn thi gian h thng, mt t hp kha, v thng tin khc. My ch nhn thc c thng tin v t hp kha v c th to mt khu ngi mt ln ging nh th bt k thi im no m ngi dng th kt ni. Gi tr ca ngi dng nhp vo c so snh vi gi tr c to bi my ch nhn thc v nu chng trng nhau, ngi dng s c php truy nhp. Tr li da trn cc h thng th bi phn cng hoc phn mm: My ch nhn thc nh du ngi dng vi mt s (hoc mt chui cc k t) m ngi dng nhp vo h thng phn mm hoc h thng th bi phn cng. Th bi hoc phn mm s to ra mt m da trn thng tin nhp vo. M ny s c gi ti my ch nhn thc. My ch so snh gi tr nhn c vi gi tr n t to ra da trn m ban u v nu trng khp th ngi dng c php truy cp.c) Thng tin sinh trc hcSinh trc hc l cch ngi ta dng cc c im sinh hc ca con ngi nhn din ngi dng, phng php ny thng khng c dng ph bin trong truy nhp SSL VPN. Cc b c sinh trc thng khng c nhiu ni v do , nhn thc bng sinh trc hc ch gii hn mt s a im. Tuy nhin, sinh trc hc c th c s dng nhn thc ngi dng cho phin c quyn, phng php tn ng nhp v mt khu cho php ngi dng truy nhp, nhng ngi dng s dng phng php nhn thc sinh trc h s c php truy cp nhiu ti nguyn hn. Khi nim ny s c m t nhiu hn phn sau ca chng ny.d) Cc chng thc my trmCc chng thc my trm (l mt v d ca trng hp mt ci g m ngi dng c) c th c s dng nhn thc ngi dng vo SSL VPN. Tuy nhin, cn phi lu rng vic s dng ca h thng b gii hn ch trn cc my tnh m ci t sn chng thc. R rng l khng th s dng phng php ny cho cc trm Internet cng cng, do cc trm ny thng khng cho php ngi dng truy nhp vo a mm/CD hoc USB. Hn na, nu chng thc ny chng t mt mt ti nguyn g m mt ngi dng c trong khi ngi khc khng c php c, s l khng thn trng nu cho php ti mt chng thc ln mt my tnh mn hoc my tnh cng cng, m cc my tnh ny c th d dng b cc t chc khc s dng. Do , chng thc my trm thng c s dng t cc thit b bo mt c bit.e) Th thng minh hoc USB TokenL cc thit b vt l nh c thit k c bit cho vic s dng vi cc h thng nhn thc, thng th cc chng thc my trm hoc mt khu m ha c lu tr trn cc thit b ny.f) Nhn thc da trn hai nhn tCc sn phm SSL VPN thng cho php s dng hai yu t nhn thc. Nhn thc da trn hai nhn t tc l qu trnh nhn thc s dng c hai phng thc nhn thc khc nhau, v d, cung cp mt mt khu m ch ngi dng bit v mt mt m t mt th phn cng m ch c ngi dng c. Nhn thc da trn hai nhn t thng mnh hn nhn thc mt nhn t thng thng, tuy nhin, mt phng php nhn thc mnh mt nhn t s hiu qu hn l nhn thc hai nhn t yu.Mt im ng ch l mt vi ngi dng ngh nhn thc da trn a ch IP ca thit b ngi dng s dng truy cp. Trong trng hp cng ngh SSL VPN,th iu ny s dn ti mt vi vn . Mc tiu ca SSL VPN l cung cp mt truy cp t xa t nhiu loi my khc nhau. Do ngi qun tr khng mun gii hn s my tnh m t ngi dng c th truy cp qua SSL VPN. Do , chng ta khng mun s dng a ch IP s dng nhn din ngi dng. Ngi dng c th s dng SSL VPN t mt my tnh mi hon ton hoc my tnh s dng trc y. H cng c th s dng cc my tnh cng cng hoc my tnh mn thc hin truy cp t xa. Hn na, s ph bin ca NAT (Network Address Translation Giao thc phn gii a ch) dn ti trng hp nhiu ngi dng s dng cc my tnh khc nhau trong cng mt mng LAN, trong khi my ch SSL VPN th li hiu hc cng mt a ch IP, v vic s dng rng ri DHCP v cc giao thc gn a ch IP ng khc dn ti mt vn l a ch IP c th thay i d dng gia cc phin SSL VPN.Bt chp cc vn k trn, a ch IP c th c s dng kt hp vi thng tin da trn my tnh nhn din cc my (s c m t sau trong chng ny). cng mt thi im, r rng rng a ch IP khng th s dng nhn din cc ngi dng ca mt SSL VPN.3.1.2 ng nhp mt lnNh m t phn trn, SSL VPN thng cho php kh nng ng nhp mt ln SSO (Single Sign On), iu ny c ngha l khng cn ngi dng phi nhn thc cho mt ng dng trong mi phin. ng hn l h tn dng mt vi k thut gom cc chng thc m ngi dng nhp vo. Chi tit v phng php ny c m t chi tit phn trn.3.1.3 Xc thcTrong cng ngh SSL VPN, xc thc i din cho kh nng mt ngi dng nhn thc c php truy cp cc ng dng c th v c, thay i hoc xa cc file hoc d liu c th. Xc thc c thc hin theo nhiu cch khc nhau:a) S cho php ca h iu hnhS truy cp ti mt vi ng dng hoc file c th c iu khin bi s cho php ca h iu hnh (v d nh danh sch iu khin truy cp Access Control List hay ACL), n nh ngha ngi dng no c th c truy cp ti nguyn c th. Khi ngi dng th truy cp ti nguyn, h iu hnh xc nh ti nguyn no h c php truy cp v khng c php truy cp, t quyt nh cho php hay t chi truy cp.b) S cho php ca h thng fileCc my tnh c h thng file c truy cp c th iu khin truy nhp ti cc th mc v cc file qua cc ACL chun hoc cc iu khin file h thng khc c cho php truy cp ng ti nguyn ca ngi dng hoc nhm ngi dng c th. H thng thng c thc hin nh l mt phn ca h iu hnh, nhng mt vi trng hp c th l mt gi b sung.c) S cho php ca ng dngMt vi ng dng cn phi xc thc trc khi cho php truy cp. Da vo chc nng nhn din ngi dng trong ng dng, m n c th cho php hoc chn hot ng ca ngi dng. Chc nng ny khng phn bit ngi dng t xa hay ngi dng trong c quan ca h.d) Cc giao din hn chMt SSL VPN cng c th chn mt ngi dng khi h truy cp mt ti nguyn c th bng cch da trn giao din hn ch ngi dng. Mt giao din hn ch c th c tn dng qua SSL VPN trnh ngi dng thy cc cng c m h khng c s dng. Khi thc hin giao din hn ch ny s gim c cc cuc gi gip , ngi dng s khng gi v hi lm sao h thy cc ng dng c th nhng khng th truy cp chng.e) Thng tin xc thc c qun l bi SSL VPNKhi ngi dng truy cp t xa, quyn truy cp ca h c th khc khi h truy cp t trong c quan. H thng ny c gi l h thng truy cp phn cp (Tiers-of-Access) (s c m t trong phn sau ca chng ny). Khi thng tin xc thc khc vi cc phin t xa, d liu lin quan ti ngi no c th truy cp t xa thng c lu tr trong d liu cc b ca my ch SSL VPN. Ngi dng khng c php truy nhp vi cc ti nguyn qua SSL VPN (thm ch nu h c th truy cp ti nguyn khi h vn phng) s khng c SSL VPN cho php truy cp ti nguyn .f) C s d liu xc thc nhm th baMt ni c th lu tr thng tin xc thc cho ngi dng ni b v ngi dng t xa c th c lu tr trong cc c s d liu xc thc nhm th ba. Cc sn phm thc t trong cc nm gn y c tch hp cc h thng ny.3.2 Cc vn bo mt u cuiCc vn bo mt u cui bao gm cc vn sau: D liu nhy cm trong vng khng an ton Ngi dng qun ng xut Cc virus n cc mng ni b qua SSL VPN Cc on m c hai ti mng ni b qua ng hm to bi SSL VPN Cc hacker truy nhp ti mng tp on bng cch r cc mng qua SSL VPN3.2.1 Vn d liu nhy cm trong vng khng an ton v gii php3.2.1.1. Vn Trong sut phin truy nhp t xa, ngi dng c th ti v cc thng tin nhy cm ti thit b m h ang s dng truy cp. Trong thi k u ca cc cng ngh truy cp t xa, mc d d liu c nhn c lu tr trn cc thit b truy cp nhng khng phi l vn nghim trng do ngi dng ch c th truy cp t cc thit b ca cng ty, thit b ny c cng ty cung cp cho h. Tuy nhin, vi s pht trin ca SSL VPN v ngi dng bt u truy cp ti nguyn ca cng ty t cc my tnh cng cng hoc my tnh mn, lu tr d liu trn cc thit b c th dn ti cc vn bo mt.Mt vi thng tin lu tr trn mt thit b truy nhp c th c lu tr tm thi trn my tnh. V d, mt ngi dng tn dng kh nng truy cp file ca SSL VPN v ti v mt bng g m c th lu li trn a. Nu file ny bao gm cc thng tin c nhn, v d nh k hoch bn hng trong mt vi nm ti, th tt hn ht l chng ta nn xa bng ny khi phin truy cp kt thc.Vn ny l cc k nghim trng khi mt s lng ln d liu nhy cm c lu tr trn thit b truy nhp m ngi dng khng h bit.a) Vn b nh m trnh duyt ci thin hiu qu hot ng, cc trnh duyt thng lu tr bn sao cc trang web, nh v file a phng tin m ngi dng truy nhp. Bng cch cho php trnh duyt ti cc thnh phn nhanh hn khi ngi dng quay tr li trang trc (hoc thm ch l trang khc m c s dng cc thnh phn ny). Tuy nhin, iu cng dn n mt vn bo mt cho ngi dng SSL VPN, l ngi s dng tip theo c th truy cp SSL VPN cho php ti cc thng tin truy cp trong sut phin SSL VPN trc .b) Vn b nh m ca cc chng trnhMt vi ng dng khng s dng cc b nh m h thng chun lu tr d liu tm thi ca chng. Thay vo , chng tn dng cc h thng b nh m ca ring chng v lu tr nhng ni khc trong h thng file ni b. D liu ghi trn cc b nh m s b xa khi kt thc phin lm vic SSL VPN. Phn ny s c m t chi tit phn sau trong chng ny, cc cng c nhm th ba c th c s dng truy nhp mt SSL VPN cng c th to cc phin bn b nh m ca cc file truy cp trong cc b nh m ca chng.c) Cc file tm thi: Xem cc file nh km E-mailTng t nh vy, cc file tm thi c to ra trn thit b truy nhp khi ngi dng truy nhp file nh km e-mail qua mt giao din Webmail. Trong nhiu trng hp, cc file khng t ng xa bi h thng e-mail khi ngi dng kt thc phin lm vic do ngi dng tip theo c th xem c ni dung ca bt k file nh km no m ngi dng m ra. Vic m ha cc file nh km e-mail s lm cho cc file ny l khng th c vi nhm th ba, thng khng th gii quyt c vn ny do c hai l do sau: Cc file c lu m khi chng c truy cp trong cc ng dng truyn thng nh vn bn trong Microsoft Word. iu ny thng xy ra sau khi chng c gii m. Kh nng gii m ha thng khng c trong cc giao din Web-mail.Mt khu bo v tt c cc file nh km (v d nh kh nng s dng mt khu bo v c trong Word, Excel,) cng khng gii quyt c vn ny do: Khng phi tt c cc ng dng cho php bo v d liu qua mt khu. C ch mt khu trong mt s ng dng qu yu, c th d dng b b kha. Vic cn thit phi bo v tt c cc file nh km bng mt khu l khng thc t, ngi dng khng thch s dng chng trong tt c cc file.Chng ta cn mt gii php tt hn i vi vn b m cc file nh km.d) File tm thi: Cc c ch ti v v c ch khcVn ny ng nht vi vn file nh km ch khc cch a thng tin ban u ti thit b truy nhp.e) Ni dung cc trng c nh cho chc nng AutoCompleteKhi ngi dng in cc trng trong form trc tuyn, h thng thy cc gi tr m trnh duyt khuyn ngh, l cc gi tr m ngi dng nhp trc . iu ny l do trnh duyt thng lu m d liu cc trng h tr trong cc form trong tng lai. Mt ngi dng nhp mt a ch e-mail trn mt trang web m ni dung cc form tng t nh trang web trc y th chc nng AutoComplete s t ng in vo cc trng ny bng cc gi tr trc y. Tuy nhin, nh trng hp nh m cc thnh phn web, chc nng ny dn ti mt vn bo mt i vi ngi dng SSL VPN. Cc d liu m ngi dng nhp vo cc trng trong sut mt phin SSL VPN nh s CMTND c th b ngi khc thy.f) URL c nh m do chc nng AutoCompleteTng t nh ni dung c nh, cc URL c truy cp bi ngi dng c lu tr m trn cc thit b truy nhp. iu ny cho php ngi dng bt u nhp mt vi t vo thanh a ch v my tnh s h tr cc phn cn li ca a ch, gip cho ngi dng thun tin khng phi g li nhiu ln. Cng ging nh trng hp cc trng form, iu ny cng c th dn ti trng hp cc thng tin c nhn trong URL c th b thy bi ngi khc. y cng l mt vn c nhn, nhiu ngi khng mun ngi khc bit v cc ti nguyn mng m h xem. V vy cc a ch URL truy cp trong mt phin truy cp t xa phi c xa trong cc my tnh cng cng hoc my tnh mn, ngi khc khng th thy.g) To cookie trong sut cc phin ngi dngCookie l mt trng vn bn nh c trong thit b truy nhp trong sut phin web, n cho php cc thng tin c th c nh, nh thng tin ngi dng cho phin lm vic hoc phin tip theo. Cc cookie thng lu tr thng tin tn ng nhp (v i khi l cp nhn thc tn ng nhp v mt khu) cho cc website m ngi dng mun truy nhp m khng cn phi nhp ton b cc thng tin ng nhp mi ln h mun truy cp. Cc cookie cng thng c s dng lu tr cc ty chn, ty bin c nhn cho cc trang web c th. Do vy, cookie c th cha thng tin nhy cm, v trong khi chng to ra nhng u im ln v h tr ngi dng v ci thin cc chc nng th chng cng dn ti vn bo mt khi chng c th b mt trn cc my tnh cng cng hoc my tnh mn khi phin lm vic SSL VPN kt thc.h) Cc bn ghi lu giCc trnh duyt thng h tr lu gi cc trang web truy cp v vy ngi dng c th d dng truy cp li cc trang ny m khng cn phi truy cp li. Nhng cc thng tin ny cng c th d dng b mt khi ngi tip theo c th xem c. Cc thng tin ny cng cha cc thng tin nhy cm, do vy cng d dng b mt trn cc my tnh cng cng hoc my tnh mn.i) Cc chng thc ngi dng c nh bi trnh duytMt vi trnh duyt web cho php ngi dng nh cc thng tin chng thc nh tn ng nhp v mt khu, do ngi dng s khng cn phi nhp bng tay cc thng tin ny ln ng nhp tip theo. R rng l khi ngi dng SSL VPN trn my tnh mn hoc my tnh cng cng s khng mun lu tr cc thng tin nh vy trn thit b h mun truy cp. Tuy nhin, nu mt ngi dng sai st v cho php trnh duyt lu tr chng thc ca ngi th s dn ti mt vn bo mt nghim trng. Hn na, mt vi chng thc c lu tr m khng hi ngi dng! V d nh h thng s dng phng php bo mt HTTP n gin lu tr mt khu ca ngi dng trong sut phin lm vic ( trnh c hi ngi dng nhp li ID v mt khu i vi mi yu cu ti my ch). Cc chng thc ny s c lu gi m cho ti khi trnh duyt tt hoc ngi dng khc ng nhp v nhp vo mt khu mi.R rng rng iu ny s dn ti cc thng tin nhy cm c th b mt trn cc thit b khng m bo khi ngi dng kt thc phin SSL VPN ca h.3.2.1.2 Gii phpC nhiu cch gii quyt cc vn d liu nhy cm lu tr trn cc thit b truy nhp, cc sn phm SSL VPN khc nhau c cch gii quyt khc nhau. Tuy nhin, hu ht l cc gii php sau: Khng lm g c: Phng thc ny l khng th chp nhn i vi hu ht cc t chc, nhng mt vi sn phm SSL VPN cp thp khng th gii quyt c vn d liu thit b u cui. Cnh bo ngi dng: Mt vi thit b SSL VPN cp thp khng lm g bo v d liu nhy cm nhng cnh bo ngi dng nn ng xut hoc loi b cc d liu nhy cm ca phin lm vic. Phng php ny thng khng hiu qu do: Xa b thng tin b m khng phi l mt vic lm n gin nh m t trn, c nhiu vng trong thng tin nhy cm c lu tr. Mt ngi dng cn phi c hiu bit nhiu v k thut mi c th xa cc thng tin ny. Thm ch hiu bit k thut ca ngi dng cng khng thc hin xa ht cc thng tin nhy cm khi cng. Mt lnh h thng nh Del hoc rm l khng bo v cc thng tin nhy cm khi cc truy cp khng ph hp (s c m t phn sau trong chng ny). iu g s xy ra nu ngi dng khng bao gi ng xut v khng c cnh bo no xut hin? Tn dng lnh NOCACHE: Hu ht cc trnh duyt ph bin hin nay u hiu lnh NOCACHE c gi t my ch web khng cho php lu m d liu truy cp. V mt l thuyt, nu my ch SSL VPN thc hin lnh NOCACHE trn tt c cc trang d liu n gi ti my tnh ngi dng th vn d liu nhy cm c lu tr m s c gii quyt. Tuy nhin, thc t n li khng gii quyt c vn do mt s l do sau: Khng phi tt c cc trnh duyt h tr NOCACHE. Mt vi ng dng cn b nh m mi thc hin c cc chc nng ca n. Vic loi b b nh m s dn ti gim hiu nng h thng v mt vi ng dng c bn s khng thc hin c, c bit l trn ng truyn modem chm. Lnh NOCACHE khng trnh c vic lu AutoComplete, lu history v mt s chc nng khc. N ch bt trnh duyt khng lu m cc thnh phn web nhn c. Cc file tm thi vn c to ra khi m file nh km e-mail v kt qu l cc vn bo mt vn tn ti.Tuy c cc nhc im nghim trng trn, mt vi SSL VPN cp thp vn dng lnh NOCACHE thc hin bo mt. Cc gii php ny c th s dng cho cc d n c th v trong cc mi trng thc t, nhng nhn chung, mt trong hai phng php k trn s c s dng xa cc d liu nhy cm. Xa tt c cc d liu b m sau phin lm vic ca ngi dng: Khi mt ngi dng kt thc mt phin lm vic, SSL VPN s xa tt c cc thng tin b m c to ra trong sut phin lm vic . Mt iu quan trng l thng tin tm thi cn phi c xa khi thit b truy nhp khng ch khi ngi dng ng xut, m c khi ngt phin lm vic v mt s trng hp cc. Cc phin lm vic c th kt thc khi mt trong cc l do sau: Ngi dng ng xut Sau mt khong thi gian m ngi dng khng thc hin g c Sau mt thi gian nh trc, hoc sau khi xut hin s kin nhn thc li ( nh trc) nhng ngi dng khng thc hin nhn thc th phin lm vic cng t ng kt thc Trnh duyt b hng Trnh duyt tt H iu hnh thit b truy nhp b hng H iu hnh tt hoc khi ng li Thit b truy nhp b tt do mt inKhi bt k mt trong cc trng hp trn xy ra, SSL VPN cn phi xa cc thng tin nhy cm trn thit b truy nhp. Tuy nhin, trong trng hp h iu hnh hng hoc mt in, th vic xa b thng tin s c thc hin sau khi h thng khi ng li. S dng khng gian lu tr o m ha, khng gian ny s b xa sau khi phin lm vic kt thc: SSL VPN s dng mt phn ca b nh v a cng (v bt cc cng c khc trn thit b truy nhp phi s dng chng) lu tr tt c cc thng tin tm thi cho phin lm vic ca ngi dng. Ni dung ca phn b nh v a ny c m ha. Khng gian lu tr o ny c th b xa khi kt thc phin lm vic, nhng thm ch nu khng b xa th cc thng tin ny cng rt kh b mt vo tay cc nhm khng nhn thc. Gii php ny dng nh l mt gii php n gin gii quyt vn thng tin b m, nhng khng gian o ny li khng tng thch vi tt c ng dng, y l nhc im chnh phng php ny khng c thc hin.Cc h iu hnh mi tn dng cc h thng b nh o cha cc file swap. Cho php ngi dng c kh nng s dng nhiu hn dung lng b nh ca my tnh, b nh ny nm trn cng. V vy, trong trng hp d liu m b xa hoc khng gian lu tr o c s dng, th c th mt vi thng tin nhy cm c lu gi trong file swap v c th khng b xa sau khi kt thc phin lm vic ngi dng. Thng thng, ngi dng khc khng th c c n. Tuy nhin, trong trng hp c c th cc chuyn gia ip bo c th c c thng tin nhy cm ny.3.2.2 Vn cng c tm kim ca nhm th ba v gii php3.2.2.1. Vn Mt vn bo mt na l cc cng c tm kim ca nhm th ba (v d nh Google Desktop Search Tool) chy trn cc my tnh s dng truy nhp SSL c th to ra cc phin bn m ca cc trang web v cc ti liu truy cp trong sut phin lm vic SSL VPN.Thm ch cc trang SSL m ha c th c lu tr dng khng m ha! iu ny dn ti mt vn bo mt nghim trng thm khi i vi ngi dng s dng SSL VPN xa cc d liu tm thi sau khi kt thc mi phin SSL VPN. Cc d liu c lu m bi cc cng c tm kim v thng tin ch mc c to bi cc cng c ny c th tip tc c lu gi ngay c khi cc thng tin trong b m b xa. S rt kh xa b nh m trong cc cng c tm kim ny v thng khng th xa cc bn ghi ring l t b nh m. iu ct yu l, cc cng c tm kim c th to cc b nh ca n m khng th truy nhp bi SSL VPN.3.2.2.2. Gii phpC nhiu cch gii quyt vn trn: Chn truy nhp: SSL VPN phi chn truy nhp nu xc nh c cc cc cng c tm kim (hoc cng c to ch mc) chy trn thit b truy nhp. Vic ny s gii hn truy nhp, nhng trnh c vic lu m d liu. Tt nhin SSL VPN phi bit c cng c tm kim no ang c s dng v lm th no xc nh n. Tt chc nng to ch mc: SSL VPN phi tt chc nng to ch mc v khi ng li n khi kt thc phin lm vic SSL VPN. Tng t nh phng php trn, SSL VPN cn phi c nhng hiu bit v cc cng c tm kim. S dng khng gian lu tr o m ha (c th xa c): Phin SSL VPN khng bao gi lu cc file khng m ha trn a thay vo , n s dng mt khng gian lu tr o, v s xa khng gian ny sau khi kt thc phin lm vic. Tuy nhin, iu ny khng bo v c d liu m trc tt c cc cng c tm kim, v c th khng bo v c cc thng tin nhy cm b ghi vo cc cng c to ch mc (thm ch ngay c trng hp bn copy d liu l khng th truy nhp c i vi cng c to ch mc).Cc yu cu ca vn phng bo v (DoD Department of Defense)Vic xa cc thng tin tm thi khi thit b truy cp khng phi l mt nhim v n gin nh vic gi h iu hnh xa cc file thng thng. iu ny l do ba l do sau: Cc h u hnh hin nay u c chc nng trnh vic xa cc thng tin quan trng. Mt trong s cc chc nng ny l Trash Can hoc Recycle Bin m thc cht sau khi xa cc file th cc file b xa s c lu tr y cho ti khi khng gian m chng chim cn phi c gii phng lu tr cc file khc. Bi v cc file c th c phc hi t nhng th mc c bit ny v cc cng c phc hi h thng khc, SSL VPN khng nn gi cc lnh h iu hnh Del xa cc thng tin nhy cm trn cc thit b truy nhp. Thm ch khi Trash Can/Recycle Bin khng c s dng, cc h iu hnh thng khng xa hn cc file khi a khi chng thc hin deleted. Thay vo , chng xa cc lin kt ti file b xa trong calalog ni dung a, v do cc file khng truy cp c na mc d ni dung ca n vn c lu d vt l cho ti khi chng b ghi ln bi d liu mi. Tr khi chng b ghi th cc file ny vn c th d dng khi phc bng cc phn mm c bit. Thm ch khi b xa logic trong a v ghi bi d liu mi th cc vt tch in t thng tin ban u vn c gi li. Bng cch s dng cc cng c c bit, ngi ta vn c th khi phc c d liu b xa. trnh c iu ny th cc my tnh c th ghi cc d liu b xa nhiu ln bng cc chui ngu nhin 1 v 0. Khi b ghi li ngu nhin nhiu ln th rt kh c th khi phc c d liu ban u.Vn phng bo v lin bang M quy nh tiu chun xa file cn t nht l ba ln v thng th file b xa khng th khi phc. Mt vi SSL VPN ngy ny s dng tiu chun ny khi s dng mt trong hai phng thc trn xa d liu tm thi.3.2.3 Vn ngi dng qun ng xut v gii php3.2.3.1. Vn Mt vn na l ngi dng qun ng xut (logout) phin lm vic. iu ny thng xy ra trong mi trng web, trong mt ngi dng c th nhn thc mt h thng v c th s dng n, nhng sau li duyt mt website khc m khng nhn ra rng phin lm vic nhn thc t trc vn hot ng. Cc phin lm vic ny trn cc my tnh ri c th c s dng bi ngi khc v h thc hin cc mc ch xu nhm ly cc thng tin nhy cm. Vn ny khng ch xy ra cng ngh SSL VPN m thng xy ra tt c cc h thng nn web khc. trnh vn ny th cc ng dng web thng a ra mt thi gian t ng thot h thng khi khng c tc v no thc hin. Nu n xc nh rng khng c tc v no ang thc hin bi ngi dng trong mt thi gian nh trc th n s kt thc phin lm vic nh l ngi dng ng xut.Thi gian t ng thot h thng r rng l rt cn thit, n bo v cc t chc khi cc phin lm vic bi cc nhm khng nhn thc sau khi ngi dng h thng qun ng xut. Tuy nhin, thi gian t ng thot h thng ny trong mi trng SSL VPN c th dn ti mt s rc ri sau: Mt SSL VPN tnh c thot phin lm vic ca ngi dng v c th dn ti hy b cc cng vic ang lm. Vn ny c th l khi ngi dng nhp cc thng tin vo form ca trnh duyt, h khng truyn bt k thng tin no ti my ch SSL VPN cho ti khi h thc s gi n bng cch nhp chut vo nt Submit. V kt qu l nu ngi dng nhp form qu di, SSL VPN c th xc nh rng ngi dng khng lm g c trong mt khong thi gian kh di. Nu thi gian ny qu thi gian t ng thot h thng m ngi dng vn khng nhp chut nt Submit th h thng s t ng thot ra. iu ny dn ti ngi dng s mt d liu h ang nhp (v tt c nhng th khc trong phin SSL VPN). Mt kiu khc ca vn ny ngi dng vit mt e-mail qu di v tng t nh trn, h c th mt d liu e-mail h ang vit d. Mt vi hot ng khng thc s l ngi dng ang lm (non-activity) c th c xem nh l hot ng ca ngi dng, v phin lm vic s khng b kt thc. Vn trn l hon ton c th xy ra, mt vi chng trnh c chc nng t ng refresh, iu c ngha l n t ng cp nht trang web trong mt khong thi gian nh trc. V d nh, cc phn mm e-mail ph bin thng c mt thi gian nh trc cp nht hp th ca ngi dng, v cc ng dng qun l thng tin c nhn (PIM Personal Information Manager) thng c mt thi gian nh trc cp nht lch lm vic. Mc dng cc chc nng trn r rng l rt cn thit nhng n dn ti vn khi thc hin chc nng t ng tt phin lm vic SSL. Cc chc nng t ng cm nht ny c thc hin bng cch chn cc m vo trang web trnh duyt thc hin t ng gi cc yu cu cp nht ti my ch, tuy nhin, i vi my ch SSL VPN th n c xem nh mt hot ng ca ngi dng. Tt c my ch SSL VPN xem d liu c truyn t trnh duyt ngi dng n SSL VPN nh l du hiu bit ngi dng ang thc hin tc v. Do , nu cc ng dng thc hin chc nng t ng cp nht th chc nng t ng thot khi h thng sau mt thi gian ca SSL VPN s khng th thc hin c, v cc phin lm vic ny s mi c duy tr. (Vn ny cng c th xy ra nu mt SSL VPN c s dng thit lp mt kt ni dng network qua SSL v s dng k thut t ng ping hoc cc k thut tng t). Cc phin lm vic ngi dng c th mt trc khi ht thi gian timeout: Mt s ngi xu vn c mt c hi trong h c th li dng cc phin b ngi dng b qun trc khi thi gian t ng ng xut ht. Cc h thng timeout da trn phng thc i mt khong thi gian xc nh thot phin lm vic. iu ny cho php k xu s dng thit b ng nhp trc khi khong thi gian kt thc v do , chng c th s dng cc phin lm vic ny nh mt ngi dng bnh thng.3.2.3.2 Gii phpMt vi k thut c s dng trong SSL VPN gii quyt cc vn nu trn:a) Thi gian timeout luTrc khi tm hiu mt vi k thut gii quyt vn trn, bo co ny s m t mt phng php n gin nhng khng th thc hin c.Mt cch m cc nh qun tr h thng c th trnh vn ngi dng hp php lm phin bi thi gian timeout khng hp l l tng ngng thi gian timeout ln, lu hn thi gian m ngi dng thng x l cc tc v nh l hon thnh form hay l vit e-mail. Tuy nhin th phng php ny c nhiu nhc im nghim trng.Vic cho php cc phin lm vic ri bng cch tng thi gian timeout lm tng nguy c cc ngi dng khng nhn thc c th truy cp trong khong thi gian m phin vn hot ng khi my tnh khng c ngi dng. Hu qu l thi gian timeout lu lm mt i mc ch ban u ca chnh n.Th hai, trong mt mi trng web mt ngi dng c th bt u lm vic trn mt form hoc bn tin e-mal v sau xem cc website khc, trong khi li d nh thc hin li cng vic ban u mt thi im sau . Do , khng th xc nh c thi gian bao lu vit mt e-mail v cc c lng l khng thc t.Tt nhin rng, ngng thi gian lu s khng lm c g gii quyt vn trn nu cc ng dng h tr chc nng t ng cp nht.Do , ngng thi gian timeout lu khng c s dng gii quyt cc vn bo mt trn.b) Cc h thng timeout cnh boMt cch thch hp t c vn ngi dng qun ng xut l s dng thi gian cnh bo.Cc h thng thi gian cnh bo l cc h thng timeout da trn vic khng hot ng trong ngi dng c nhn mt cnh bo trc khi t ng thot khi h thng. Hai mc thi gian cnh bo c s dng - mt cnh bo ngi dng sp t ng thot, v mt thot hn phin lm vic. V d l, mt SSL VPN c th c cu hnh cnh bo mt ngi dng c mi 8 pht khng thc hin g c v sau hai pht nu ngi dng vn khng lm g c th phin lm vic s b ngt. Trn thng bo c th c mt nt ngi dng c th click vo to cho ngi dng mt hot ng (v d, click OK chp nhn nhn bn tin cnh bo). Nu ngi dng khng phn hi hoc to ra mt hot ng khc th phin lm vic s ngt sau hai pht (vy l sau 10 pht s ngt nu khng c bt k hot ng no).Cnh bo c th di dng pop-up vi dng cnh bo n gin: Bn ang y? Vi cc nt bm C v Khng (hoc thm ch ch nt C). Nu ngi dng tr li, SSL VPN bit ngi dng ang hot dng v reset b m thi gian. Nu ngi dng khng tr li, th trong khong thi gian nh trc, phin lm vic s b ngt.c) Buc nhn thc li theo chu kBuc nhn thc li theo chu k (FPA Forced Periodic Re-authentication) bt buc ngi dng nhn thc phi nhp chng thc ca h sau mt khong thi gian nh trc (c xc nh bi ngi qun tr) tip tc c lm vic.Kt hp vi cc ngng cu hnh cp trc, mt SSL VPN h tr FPA cho php mt chc nng bo mt khc i vi ngi dng thng qun ng xut n cn ngi dng nhp chng thc ca mnh theo chu k ty thuc vo mc hot ng. Sau mt thi gian xc nh, ngi dng s c c yu cu chng thc. Nu ngi dng nhp chng thc, phin lm vic s khi phc li nh lc bt u yu cu, thm ch l c th khi phc khi ngi dng ang nhp form d, nu ngi dng khng nhp chng thc th phin lm vic s kt thc.Mc d y l mt gii php khng hon ho cho lm, nhng FPA vn l cch tt nht gii quyt vn ngi dng khng nhn thc th truy cp ti mt phin SSL VPN qua thit b truy cp khng c ngi s dng v bt u phin lm vic bt hp php trc khi thi gian timeout kt thc. FPA khng trnh c ngi dng xu th truy cp, tng t nh SSL VPN khng c cch no phn bit ngi dng khng hp php vi ngi dng trc cho ti khi FPA xy ra. Tuy nhin, n gim thit hi bng cch gii hn thi gian ngi dng khng hp php c th s dng phin.d) B qua cc hot ng gi mo cc k thut timeout hot ng chnh xc trong mt mi trng trong cc my tnh t ng refresh cc yu cu hoc lu lng khc (cc hot ng ny l khng th phn bit c vi hot ng ngi dng), SSL VPN cn phi c mt s k thut trong n bit c x l th no i vi lu lng c t ng to ra v b qua cc lu lng khi xc nh c thi im cui din ra hot ng ngi dng. iu ny c th thc hin bng cch thm vo cu hnh mt chui cc danh sch yu cu s b b qua khi kim tra yu cu ngi dng. Trong trng hp ng dng web (to ra hu ht cc vn ) th thng kh n gin, v bi v thng c mt gii hn s cc a ch URL trn mi ng dng nn d dng c th to mt danh sch cc a ch URL ny. i vi cc ng dng non-web, vic xc nh cu to ca cc yu cu t ng refresh s phc tp hn mt t, nhng hon ton c th xc nh c do cc yu cu t ng thng khc xa so vi cc yu cu thc s ca ngi dng.e) Cc ngng TimeoutNh m t trn, iu quan trng l cc nh qun tr SSL VPN cu hnh SSL VPN ca h nh th no c th tn dng c cc cnh bo, timeout, hoc nhn thc li. Mt vi SSL VPN c gi tr mc nh cho cc ngng ny, mt vi SSL VPN th li khng c, thm ch mt vi sn phm ban u cn khng bt h thng timeout. Trong bt k trng hp no th cu hnh ca h thng timeout cng cn phi c thit lp li cho ph hp vi chnh sch cng ty.3.3.2 Vn virus xm nhp vo h thng mng cng ty qua SSL VPN3.3.2.1. Vn Mt vn na l vic cho php cc truy cp t xa t cc my c th dn ti vic cc virus c truyn qua t mt my tnh ti mng cng ty. Kh nng ti ln cc file ti cc h thng file t bt k my tnh no cng lm tng ln ng k kh nng file cha mt virus, v virus ny s nm trong mt my tnh ca mng cng ty. Vn ny li cng nghim trng hn trong trng hp SSL VPN cho php cc truy cp t xa ti e-mail, cc h thng qun l lin quan n khch hng CRM (Customer Relationship Management), v nhiu h thng khc, do cc h thng ny cho php ngi dng nh km cc file vo bn tin hoc c s d liu, hoc c th cho php ti cc file vo c s d liu cng ty.3.3.2.2. Gii phpC nhiu gii php gii quyt vn virus qua SSL VPN. Nhng c ba phng php thng dng l: Kim tra vic s dng cng ngh chng virus trn my trm Chn vic ti ln Thc hin mt h thng chng virus trn mng ni ba) Kim tra phn mm chng virus trn thit b ngi dngMt phng php thng thng trnh vn virus xm nhp mng cng ty qua SSL VPN l my ch SSL VPN kim tra thit b ngi dng xem tnh trng ca phn mm chng virus nh th no trc khi cho php truy cp mt vi hoc tt c chc nng ca SSL VPN. Qu trnh kim tra c th thc hin xc nhn rng phn mm chng virus c ci t, chy, s dng d liu cp nht hay khng, Nu cc my tnh ny t c cc chun m cng ty cho php th c php truy cp, nu ton b h thng khng t c cc chun th c th ch c truy cp ti mt phn con ca h thng qua SSL VPN, hoc cm tt c cc truy cp. Nu mt ngi dng b cm, SSL VPN c th m t l do ti sao cm truy cp trong ni r cc phn mm cn thit (hoc cc bn cp nht cn thit) m my trm phi ci t c th c quyn truy cp.b) Cm ti lnMt phng php na c s dng trnh cc virus xm nhp mng cng ty qua kt ni SSL VPN l cm ngi dng ti cc file ti cc mng ni b t cc my tnh t xa. Kiu cm ny c th l cm hon ton hoc cm trong phm vi rng v n c th c ni lng ra nu my tnh ngi dng s dng chng trnh chng virus thch hp.c) Thc hin chng virus trn mng ni bPhng php th ba c s dng trnh virus xm nhp vo mng cng ty qua kt ni SSL VPN l thc hin cc cng ngh chng virus trn mng LAN ca cng ty. Vic chng virus ny c thc hin bin ca SSL VPN.Cc file c ti ln t mt ca s truy cp file SSL VPN cn phi c qut trn cc my ch file trc khi chng c thm vo. Cc file nh km vo cc bn tin e-mail gi t mt phin SSL VPN cn phi thc hin qut virus trn my ch e-mail.Mc d phng php ny v l thuyt l c th chng c tt c cc loi virus, nhng n nhiu nhc im. Cc virus trong e-mail c th c nh km di dng m ha ( trnh b cc phn mm chng virus ca cng ty pht hin) hoc c th c gi vo mt my ch ni b v chy trc khi h thng chng virus ni b c th xc nh v xa chng. Tuy nhin, nhn chung, y l phng php tt trnh virus tn cng vo mng ni b.3.2.4 Vn su xm nhp vo mng cng ty qua SSL VPN v gii php3.2.4.1. Vn Cc virus v su thng b nhm ln vi nhau, nhng chng khng ng nht vi nhau. Virus l cc m c hi m chng c th nh km bn thn n vo mt vi on m khc (host code) v c kch hot khi cc on m ny (host code) c chy. Trong khi su l cc chng trnh c lp m khng tm cch nh km n vo cc chng trnh khc, thay vo , chng t nhn bn qua cc kt ni mng.Do , vn cc loi su xm nhp vo cc mng cng ty qua kt ni SSL VPN khc vi virus. Cc h thng chng virus c th chn c mt s loi su, nhng do su khng cn phi c hot ng ca con ngi kch hot n, v do chng c kch hot nhanh hn virus, do chng gy ra nhiu nguy him hn i vi SSL VPN.Mt su nm trn mt my tnh c s dng kt ni SSL VPN c th c kh nng li dng kt ni SSL VPN tn cng vo mng ni b ca cng ty. Bi v su khng cn kch hot bi con ngi. mt thit b c th b nhim trong khi kt ni mt phin SSL VPN v qua lan nhim ti nhiu my tnh trn mng ni b. iu ny c th xy ra trc khi cc phn mm chng virus c th xc nh ra chng.3.2.4.2. Gii phpCi t mt chnh sch trong khng cho php truy cp t cc my tnh khng an ton c th lm nh bt tc hi ca su, nhng vic thc hin cc lut ny c th lm gim i cc chc nng ca SSL VPN v lm gim gi tr ca SSL VPN. Hn na, n c th trnh c truy cp ca ngi dng t cc my tnh khng an ton, nhng li khng trnh c cc su t cc kt ni SSL VPN mc mng. iu ny s c m t chi tit phn sau trong chng ny.Thm na, c hai cng ngh cho php chng s xm nhp ca su l tng la c nhn v tng la ng dng. Mc d hai cng ngh ny c tn kh ging nhau nhng chng thc s khc nhau.Tng la c nhnCc gi phn mm hoc thit b ny nm trc cc my ch (my ch ny phc v ni dung cho cc ngi dng Internet). Chng c cc kh nng ca reverse proxy, nhng chng ch phc v cc hot ng c chp nhn. C nhiu cng ngh c s dng trong tng la cc nhn v s l rt hu ch khi nghin cu v bo mt SSL VPN khi tm hiu k cc cng ngh ny. B lc da trn logic ph nh cc yu cu ngi dngB lc logic ph nh lm vic tng t nh cc b my chng virus. N so snh cc yu cu u vo vi du hiu ca cc cuc tn cng bit, bt k yu cu m trng khp vi cc du hiu tn cng bit s b chn khi kt ni vi cc my ch. Mc d b lc da trn logic ph nh thc s c hiu qu trong vic trnh cc cuc tn cng bit, n li khng cn thit i vi bn thn SSL VPN, hay n khng mnh khi i u vi cc cuc tn cng mi m khng c du hiu trong c s d liu. T khi cc cuc tn cng zero day (tn cng vo cc vng khng c bo v, hoc khng c cp nht) ngy cng tng th nhc im ny ngy cng tr nn trm trng. Logic ph nh cn cc hot ng bo tr thng xuyn, do cc du hiu cn phi c cp nht lin tc.B lc da trn logic khng nhB lc da trn logic khng nh li hot ng theo cch khc. Tt c cc yu cu c so snh vi du hiu ca cc yu cu an ton s c x l, iu c ngha l cc loi giao tip c h tr ti cc my ch c bo v. Bt k yu cu no khng ph hp vi cc du hiu s b chn li. B lc logic khng nh cn cn nhiu cng sc hn b lc logic ph nh (nh cc b lc ny cn phi c bt nhn din cc yu cu ph hp) nhng cn t bo tr hn cc h thng ph nh, nh khng cn phi thng xuyn cp nht. Hn na, b lc logic khng nh c th bo v h thng khi cc cuc tn cng zero-day v cc loi su mi, cc cuc tn cng khng th s dng cc yu cu hp php v do khng th vt qua b lc ny.B lc da trn cc lut ngCng ngh lc ng bao gm qut ng lu lng web i ra, v thit lp cc chnh sch thi gian thc, cc chnh sch ny tng ng vi yu cu ngi dng hin ti. Tr li yu cu ngi dng sau thc hin nh b lc logic khng nh chc chn chng tha mn l mt tr li mong i. Thnh thong lut cho cc trang web tnh c thit lp trc ( tng hiu qu h thng). Mc d v l thuyt n l ti u nhng b lc ng li tht bi khi i ph vi nhiu vn quan trng v iu ny lm cho n khng c ng dng thc t. Mt v d, qu trnh x l cn phn tch cc trang web v ch ra cc tr li ph hp c th dn ti vic gim hot ng h thng. Hn na, s l rt kh thnh cng to ra mt tp hp cc lut i vi cc ng dng bin i lin tc nh ngy nay, v cc lut ny ch c th chn khong 99% cc hot ng c hi hoc cho php t c mc an ton tng i.Kt hp cc phng thcS kt hp cc phng thc k trn c th c s dng kt hp cc u im v gim nhc im ca tng phng thc c lp. V d, mt b lc c th tn dng cc lut da trn logic khng nh nhng cho php cc lut bao gm nhiu lut c thit lp ng trong sut cc phin ngi dng da trn ci g ang c truy cp v ai ang yu cu truy cp. Tng t, logic khng nh c th c s dng kt hp vi cc lut logic ph nh. Trong SSL VPN, cc ng dng tng la c th t trn my ch SSL VPN hoc t trn mt proxy trc SSL VPN. Trong c hai trng hp, cc tng la ng dng kim tra yu cu ngi dng v trc khi chuyn tip d liu ti qu trnh x l SSL VPN, n kim tra an ninh d liu mt cch nghim ngt.3.2.5 Vn ca cc vng khng an tonNhiu vn khc lin quan n truy cp t cc vng khng an ton. Mt vi chng l vn chung, trong khi cng c mt vi vn ch SSL VPN mi c.a) Phn mm gin ipPhn mm gin ip l cc phn mm c ci t m ngi dng khng c bit theo di hot ng ca ngi dng trn my tnh b nhim. Thng tin m phn mm gin ip thu thp c c th c s dng cho cc hot ng phm php nh chim dng s th tn dng v s dng n tr tin, hoc cc mc ch khc nh mua hng trc tuyn v s dng chng qung co hay nhiu mc ch thng mi khc. Trong bt k trng hp no, iu quan trng l ta phi ngi dng truy cp cc h thng nhy cm m cc hot ng ca h khng b theo di. Mt vi SSL VPN c th kim tra phn mm gin ip trn thit b truy nhp v mt vi phn mm chng virus c th pht hin phn mm gin ip . Tuy nhin, vic kim tra cc phn mm gin ip thng da trn du hiu ca cc phn mm gin ip bit v mt vi phng thc khc, v n c nhiu yu im. Do , tt hn l ta nn a ra cc cnh khi truy cp t cc my tnh c du hiu b nhim cc phn mm gin ip.b) Thit b ghi li thao tc bn phm Mt cch bn xu c th thc hin ly thng tin nhy cm t ngi dng l tn dng cc thit ghi li thao tc bn phm trn cc my tnh m nn nhn s dng. C hai kiu thit b ghi li thao tc bn phm c s dng ngy nay l phn cng v phn mm.Phn cng ghi li thao tc bn phmPhn cng ghi li thao tc bn phm l cc thit b nh c cm vo mt cng bn phm ca my tnh (hoc cng USB nu mt bn phm USB c s dng). Thit b thng ging nh mt dy cm nh hoc mt cp m rng, lu li tt c cc thao tc bn phm c g vo b nh m. Do , ngi ci t n c th ly li n, ti cc bn ghi ti my tnh, reset li n v ci t cho ln theo di tip theo.Phng thc n gin nht chng li phn cng ghi li thao tc bn phm l kim tra my tnh xem thit b ghi li c ci t trn n khng. iu ny l c th khi ai ci t phn cng ny trn my tnh c nhn, tuy nhin iu ny l khng thch hp khi ngi ci t n lm vic cc tim cafe internet hoc tng t nh th. Tt nhin, nu thng tin c nhn b l th dn ti vn cc k nghim trng. Trong bt k trng hp no, vn ca cc phn cng ghi li bn phm thng xy ra trn cc phin truy nhp t xa t cc v tr cng cng. L vn chung ca SSL VPN, IPSec VPN hoc cc cng ngh khc c s dng.Phn mm ghi li thao tc bn phmPhn mm ghi li thao tc bn phm l mt kiu ca phn mm gin ip, chng l cc phn mm ghi l cc thao tc ngi dng v t ng gi thng tin n ngi ci t. Gii php cho phn mm ny cng tng t nh i vi phn mm gin ip.c) Shoulder Surfing y l mt kiu la o ging nh xem thng tin b mt t pha sau ca ngi s dng. Bn xu thng li dng cc a im cng cng c th bit c cc thng tin nhy cm.d) Cc my quay phim t cc my tnhCc v la o shoulder surfing ngy cng tng, gi thnh cc thit b gim st v bo mt cng tr nn r i rt nhiu. Cc my quay phim c th ghi li cc hnh ng ca bt k ai lm vic trong sn bay, hnh lang khch sn, hoc thm ch l cng ra ca cng vin. Do , bt k loi cng ngh truy cp t xa no c s dng (IPSec, SSL) th ni dung ca mn hnh c s dng cn phi c bo v khi bt k thit b theo di no. Thit b gim st thnh thong c che giu i, thng tin cc k nhy cm s khng c truy cp cc a im m c lp t cc thit b nh trn thm ch nu ngi dng khng thc s pht hin ra cc thit b ny. Nh gii thiu trn, d liu c th c truy cp s phi ph thuc vo cp cho php ca vn an ninh.e) Pht x in tMt s ngi s dng cc thng tin nhy cm mt cch thng thng cng dn ti mt vn ng cp l pht x in t. Khi cc thit b in c s dng, chng to ra cc sng in t pht x. Cc chun ca cc quc gia l khc nhau (theo mc pht x c chp nhn), nhng bi v c th mc pht x ny l an ton i vi con ngi, nhng iu khng c ngha l an ton i vi d liu. Ni tm li, bng cch s dng cc thit b c bit, mt ngi c th chn cc pht x t thit b my tnh v ghi li cc thng tin ang truyn trn h thng.C nhiu cng ngh c th c lp thit b my tnh khi cc thit b nghe trm kiu ny ( M, cc thit b c lp cn phi t cc tiu chun TEMPEST), nhng cc trm Internet cng cng v cc my tnh mn thng khng c bo v theo cch ny. Cng nh cc my tnh xch tay ca cng ty khi s dng cc im cng cng cng khng c bo v theo cch ny. Do , mt ngi c th s dng cc cng c c bit theo di my tnh ngi dng m khng cn dng kiu shoulder surfing hoc s dng my quay phim. V vy, cc b mt qun s hoc cc thng tin cc k nhy cm m cc t chc xu mun trm khng th c truy cp t cc my tnh m khng c xem l an ton cc im m mt ngi khc c th theo di thit b.3.2.6 Cc hacker kt ni ti mng cng tyMt vn na ca truy cp SSL VPN l cc t chc khng nhn thc c th truy cp ti mt mng cng ty bng cch kt ni cu (bridging) ti mng cng ty qua my tnh ngi dng SSL VPN. Mt ngi dng my tnh thng c kt ni ti mt mng ni b. ng thi, khi ngi dng ang truy cp mt phin SSL VPN, my tnh c th c kt ni ti mt mng cng ty t xa khc. Do , my tnh c th ng thi c kt ni ti hai mng. V vy c th c trng hp mt ngi s dng mt mng (trong trng hp ca bo co ny l mng cc b LAN) kt ni ti mng cng ty qua my tnh ngi s dng.Cng c mt vn bo mt khc i vi mng cc b h thng trn mng my ch SSL VPN c th kt ni ti mng cc b qua ng hm SSL VPN. y khng phi l mt vn i vi tp on cung cp truy nhp SSL VPN, nhng c th phi chu trch nhim php l nu SSL VPN b li dng kiu ny. Hn na, vn ny c th khin cc t chc cm ngi dng thit lp kt ni SSL VPN ti cc thit b ca h tr khi cc thit b khng cho php kt ni mc mng. iu ny tng t nh trong cng ngh IPSec hin ti.3.2.7 Vn r r thng tin mng ni b v gii php3.2.7.1. Vn Hacker chun b tn cng mt mng thng xem xt ti nguyn ca mng xc nh kiu k thut tn cng no t hiu qu nht. S hiu bit v tn cc my, cu trc th mc, a ch IP, ca mng ni b c th h tr rt nhiu trong vic vt qua h thng an ninh ca mng ni b.Tht khng may mn l SSL VPN thng c li trong vic cung cp cc thng tin nh vy ti cc t chc bn ngoi. Nh m t chng 2, mt chc nng ca SSL VPN l chuyn i thng tin ni b ti cc nh dng d liu m bn ngoi c th truy cp c. S chuyn i ny thng khin cc thng tin ni b trnh c cc t chc bn ngoi nhng tham s (bao gm cc thng tin ni b) c th c c bi bt k ai ang xem phin SSL VPN. iu ny l ng i vi cc thnh vin, cc khch hng hoc khch hng tng lai ca cng ty ang s dng SSL VPN.3.2.7.2. Gii phpGii php cho vn ny thc s n gin, SSL VPN khng cho php cc thng tin ni b c biu din di dng vn bn thng thng i vi cc nhm t xa. Thng tin ny c biu din trong URL di dng m ha, nh tham s m ha hoc lu tr trn my ch SSL VPN c m ha di dng s thm vo a ch URL gi ti ngi dng. Mt s gii php khc c th c s dng t c mc ch n kin trc thng tin ni b khi ngi dng bn ngoi.3.2.7.3. In n v faxNgi dng c th s dng SSL VPN in n trn cc my in cc b (v d cc my in t ti ni h ang lm vic) hoc c th mun in trn cc my in t trn vn phng ca h (cc b ti SSL VPN). Cc vn bo mt ca kiu ny l: My in cc b vi ngi dngC hai vn i vi ngi dng in trn my in cc b l:1. Nu my in chia s c s dng, c th mt ngi dng khc s xem c bn in (thm ch nhn bn in) trc ngi dng. Thng tin nhy cm c th b cc nhm khng nhn thc xem nh kiu ny, v nu cc nhm khc c cc thng tin ny m khng thc s trm chng, ngi dng c th khng bao gi bit cc thng tin ny b a ra ngoi.2. Cc h iu hnh ngy nay nhm (spool) d liu trc khi gi chng ti cc my in chng lu tr mt nh, nh ny c in vo trong a v sau chuyn n my in hn l c cc ng dng giao tip trc tip vi my in. Mc d qu trnh nhm d liu lm cho hiu qu in n cao hn (cc my in c th d dng chia s) v d s dng hn (ngi dng c th tr li lm vic trc khi qu trnh in n xy ra), nhng iu ny s dn ti mt s vn bo mt. Vi SSL VPN vn l thng tin nhy cm c in ra, n c gi trong mt nh c lu tr trn my tnh khng thuc quyn qun l ca cng ty. Ngi dng c th khng bit c ai truy cp ti cc nh ny v n c lu tr u. Do , thnh thong tt hn ht l tt chc nng nhm khi in cc thng tin nhy cm qua SSL VPN.Cc my in t cc b i vi my ch SSL VPNR rng rng, nhm (spooling) khng to ra vn no khi mt ngi s dng mt SSL VPN t bn trong ni b vn phng. (Nu nhm trong vn phng khng c bo m, th c mt vn nghim trng i vi tt c ngi s dng, khng ch l ngi s dng SSL VPN). Tuy nhin, vn in n trong vn phng khi ngi dng thc s xa l mt vn nghim trng. Ngi dng thc hin in n khng th bit c ai ang ng gn my in v n gin cng khng bit ai ang bn trong vn phng nhn c bn in ny. Do , mc d chc chn phi s dng nhiu ln in n t xa, nhng ngi s dng phi cn thn khi thc hin cc tc v ny.3.2.7.4. Xa fileMt vn khc trong cc chc nng h iu hnh c th dn ti vn bo mt ca mt phin SSL VPN l xa d liu.Trong nhiu trng hp, cc file m ngi dng kch hot sao chp t cc a t xa (hoc cc ni khc) ti mt my cc b s khng b xa khi ngi dng kt thc phin SSL VPN v do ngi dng cn phi chc chn xa cc file ny.Nh m t trn, cc h iu hnh ngy nay thng khng xa d liu khi ngi dng xa chng. Thay vo , h iu hnh thng s dng cc th mc c bit gi d liu cho ti khi cn khng gian phi lu tr d liu mi. Thm ch khi cc file b ghi th cng khng xa hon ton file. xa file hon ton th ngi dng phi thc s xa khng gian a ny nhiu ln. Thng th khng d lm c iu ny, nhng mc ca vn ny thng khng quan trng. Vn ln hn i vi ngi dng thng thng l bn xu c th vo cc th mc rc c th th phc hi d liu s dng cc phn cng c bit.3.2.8 u cui tin cySSL VPN cho php cc cng ty c kh nng cu hnh mt s my tnh chc chn chng tin vy, ngi dng c th s dng cc thit b ny truy cp nhiu ti nguyn hn so vi cc thit b thng thng. Cc thit b tin cy thng l cc my tnh ca cng ty hoc c qun l bi cng ty, v thnh thong c bit nh l cc thit b iu khin. Khi thit b tin cy c s dng, thng th cc kim tra bo mt l khng cn thit, v d cc file tm thi khng cn phi xa trn cc my my tnh xch tay ca cng ty, cc thng tin nhy cm (nh cc vn bn thng mi) c c tnh lu li. Ngng thi gian timeout khc nhiu so vi khi ngi dng s dng thit b truy cp thng thng.Cc chng thc thng c s dng nhn din my tnh l ng tin cy. Cc nh qun tr SSL VPN to ra cc chng thc c bit cho cc my SSL VPN s tin tng v cc chng thc ny ci t trn cc thit b tng ng ca ngi dng. Mc d cc chng thc ny thng c ci t bi bn thn cc nh qun tr, SSL VPN cho php ngi dng yu cu cc chng thc trc tuyn, v cung cp qu trnh ti xung v ci t t ng cc chng thc ny mt khi ngi qun tr mng chp nhn yu cu ngi dng.Ci tin kh nng u cui tin cy bao gm c kh nng cho php qut cc thit b truy cp ly thng tin chng thc my trm, chng thc ny c dng xc nh mc tin cy v d, xc nh s c mt ca mt USB c bit vi ni dung c th, mt phn mm c th vi cu hnh c bit, hoc mt t hp kha registry c cu hnh vi gi tr c th. Mi mt ln qut c th c thc hin thay th hoc kt hp vi vic kim tra chng thc my trm. Tt nhin, cc mc tin cy khc nhau s c cc chnh sch khc nhau.3.2.9 Phn cp truy cp da trn tnh trng im cuiSSL VPN c truy cp t cc my tnh nh my tnh xch tay ca cng ty, my tnh nh, trm Internet cng cng, cc thit b cm tay. Tt c s khc nhau ca cc my tnh dn ti cc mc bo mt khc nhau v cc mc tin cy khc nhau, s truy cp t cc thit b ny chc chn phi khng ging nhau. V d, khng nn cho php ti ln file t mt my c du hiu nhim virus, nhng cho php ti ln t cc my an ton nh my tnh xch tay ca cng ty m c phn mm dit virus ci t. Vy th mc truy cp no m SSL VPN cn phi cung cp t cc thit b khc nhau?R rng rng khng nn thc hin phng php gii hn vi truy cp SSL VPN, m thay vo l xc nh mc bo mt ca thit b truy cp v to ra mt phin truy cp c th vi chnh sch ph hp. Mc truy cp ti a c th c t mt thit b c th no , ngi dng thit b ny c th truy cp ti a ti mng cng ty.Cc chnh sch bo mt cng ty iu chnh thit b truy cp thng da trn tnh trng thit b cho php ngi dng thc hin cc chc nng c th. Trong v d trc, mt chnh sch cho php qu trnh ti ln ch c th thc hin t cc thit b c chy cc phn mm dit virus. SSL VPN cng c th c thit lp thc hin hon ton cc chnh sch ny v chn truy cp t cc ng dng hoc mt phn ng dng c th nu khng tha mn cc chnh sch bo mt.Mc truy cp cho php i vi mt phin lm vic c th thng c xc nh khi ngi dng ng nhp. Mt applet nh gi ti thit b truy cp thc hin n, xc nh xem lm th no thit b tha mn cc tiu chun khc nhau c thit lp bi cc nh qun tr SSL VPN da trn cc chnh sch bo mt ca cng ty. N cng th ci cc m lin quan n bo mt khc nhau vo cc thit b truy cp v gi bo co v my ch SSL VPN nu thnh cng. Da trn vic thc hin cc applet, mc bo mt ca thit b c thit lp v mc truy cp cng ph thuc vo . Cch khc l tn dng cc phn mm t trc trn thit b truy cp thc hin kim tra. Qu trnh kim tra mi trng bo mt trn thit b truy cp gi l kim tra host hoc kim tra thit b truy cp.Mt iu quan trng l iu khin truy cp khng ch c th gii hn ton b ng dng m c th gii hn chc nng trong mt ng dng. Bng 3.1 biu din cc chnh sch i vi truy cp e-mail t cc thit b vi cc tnh trng bo mt khc nhau.Cc thnh phn nh hng ln mc truy cp ca mt ngi s dng bao gm: Phn mm dit virus: N ang chy? Phn mm dit virus no ang c s dng? Phin bn ca n? Ngy cp nht ca n? Tng la c nhn: N ang chy? Tng la c nhn no ang c s dng? Phin bn ca n? Chnh sch no ang c tc dng? K thut nhn thc: Mt ngi dng c h tr mt tn ng nhp v mt khu c th c truy cp ti nguyn t hn mt ngi dng c mt mt khu dng mt ln hoc th USB cm vo my tnh nhn thc, H iu hnh: H iu hnh no m ngi s dng my tnh ang s dng? Kha Registry: Cc t hp gi tr kha c th no? Cc chng thc my trm: Mt vi a ch IP c th c tin cy (nu nh chng trong mng ni b). Nh cung cp dch v: C phi ngi dng s dng dch v ca mt nh cung cp cho php cc chc nng bo mt khc nhau trong khi kt ni?Bng 3.1. Chnh sch i vi cc my c tin cy khc nhauTnh trng ca thit b truy cpiu khin truy cp

My tin cy ci t phn mm chng virusC kh nng xa cc file tm thiCho php ngi dng c e-mail (vn bn)Cho php ngi dng gi e-mail (vn bn)Cho php ngi dng m file nh kmCho php ngi dng gi file nh km

KhngCCCCCC

KhngCKhngCCKhngC

KhngKhngCCCCKhng

KhngKhngKhngCCKhngKhng

C-Tin cy mc 2CC/KhngCCCC

C-Tin cy mc 2KhngC/KhngCCCKhng

C-Tin cy mc 1C/KhngC/KhngCCCC

Cc gi phn mm chng phn mm gin ip: Chng ang chy? Gi no? Cc file tm thi: Cc file tm thi ca SSL VPN thng c xa trn my tnh ny?Nh cung cp dch v iu khinV c l do bo mt ln kinh t, cc cng ty thng yu cu ngi dng thc hin tt c cc kt ni t xa qua cc nh cung cp vin thng c th. Cc nh cung cp ny c th gim bt t l kt ni i vi s ngi dng ln, hoc cho php thc hin bt buc cc chnh sch c th (nh lc cc t xu hoc chn kt ni chia s file ngang hng). Mt vi k thut SSL VPN c th xc nh thuc tnh kt ni ngi dng, a ch IP ngi dng v cc thng tin nh tuyn v chn cc ngi dng khng s dng nh cung cp dch v cn thit khi truy cp ti nguyn cng ty qua SSL VPN.3.3 Vn bo mt pha my chNh vy l ta bit cc vn bo mt bn pha my trm, Bo co ny s tip tc m t cc vn bo mt pha my ch khi thc hin SSL VPN. Bo mt pha my ch bao gm cc vn lin quan n bo v mng ni b khi cc hnh ng c hi bi s c mt ca SSL VPN v cc kt ni ca n, v bo v bn thn my ch SSL VPN.3.3.1 Vn tng la v cc cng ngh bo mt khc b tn cng v gii php3.3.1.1. Vn i vi ngi dng giao tip vi SSL VPN v i vi SSL VPN c th chuyn tip cc yu cu ti cc h thng ni b, vic giao tip cn phi s dng giao thc TCP/IP (v c th l UDP/IP v ICMP). Cc tng la (chn cc cng giao tip) cn phi c cu hnh bo v bi SSL VPN, nhng li to ra cc vn bo mt. Bo co ny s s dng hai tnh hung thng xy ra m t k hn vn ny.Trong mt cng ty c thc bo mt, my ch SSL VPN s khng t ngoi tm bo v ca tng la, n s c t trong mt DMZ hoc mt mng ni b.a) SSL VPN trong mt DMZNu SSL VPN c t trong mt DMZ, tng la bn ngoi cho php cng 443 (v thng cng l cng 80) m lu lng bn ngoi (bao gm c yu cu ngi dng ti SSL VPN). iu ny bn thn n khng phi l mt vn bo mt nghim trng, tuy nhin, trong trng hp SSL VPN, y l mt vn thc s. Hnh 3.1 m t mt SSL VPN t trong mt DMZ. Kin trc ny s to ra mt s vn bo mt.Bi v cc ng hm SSL VPN thc hin cc giao thc khc nhau qua cc tng la bn ngoi v xy dng li chng trong SSL VPN:

Hnh 3.1. SSL VPN trong DMZ Cc kha m ha SSL c lu gi trong mt mi trng khng an ton (DMZ): Nu cc kha SSL b tn cng, k tn cng c th gi dng cng ty. K tn cng c th tn dng cc tr la o trm cc thng tin nhy cm t ngi dng. V vy tt hn ht l khng nn a cc kha ny vo vng khng an ton hoc na tin cy. M ha c thc hin trong mt vng khng an ton: Vic truyn cc thng tin nhy cm di dng vn bn thng thng qua vng mng DMZ khng an ton c th l mc tiu cho cc chng trnh bt gi tin. Do , trong kin trc trn, SSL VPN khng cho php m ha thc s u cui - u cui, m n thc hin m ha u cui mt na u cui (end-to-middle). Do ni dung ca phin SSL VPN c gii m trong mt vng khng an ton bn ngoi mng ch. Cc tng la bn ngoi b gy hi bi SSL VPN: Nu mt ngi dng t xa c cho php thit lp kt ni mng qua SSL, v sau ngi dng c bn c th truyn cc giao thc yu cu trong cc gi mng (cc gi ny c truyn ng hm trong giao thc HTTPS ti SSL VPN). iu ny c ngha l cc giao thc b chn bi cc tng la bn ngoi c th c thc hin qua ng hm ha trong HTTPS ti DMZ. Khi cc nh qun tr cu hnh cc tng la bn ngoi chn cc cng c th, cng c ngha l khng cho php mt dch v c th no t Internet, v cng c ngha l h mun dch v ny phi b chn. Cc cng cn phi c m trong tng la bn trong: iu ny to ra kt ni khng cn bng gia DMZ v mng ni b. Vic m cc cng nh hng n hiu qu ca tng la bn trong, lm lu m khong cch mi trng DMZ v Internet, v to ra cc vn bo mt nghim trng. Thm na, vic m cc cng ny thng lm tn hi n cc chnh sch bo mt. Cc nt t xa c th l cc cu ni n cc mng khc: Nu mt ngi dng t xa cho php thit lp kt ni mng qua SSL VPN, th c th xy ra trng hp mng ni b ca ngi dng c th kt ni ti mng ni b cng ty qua thit b truy cp s dng kt ni SSL VPN. y l mt vn ln nh hng n kt cu mng. Cc nhm bn ngoi c th c cho php tr thnh cc nt trong mng cng ty: Hu ht cc cng ty quan tm n bo mt ngn cm bt k my tnh no khng thuc cng ty tr thnh mt nt trong mng ca cng ty. Nu mt SSL VPN c s dng i vi cc vn phng, cc khch hng v cc khch hng tng lai cho php truy cp ti ti nguyn cng ty v nu SSL VPN cho php ngi dng t xa thit lp kt ni mng qua SSL VPN, chnh sch ny c th khng th thc hin c.b) SSL VPN trn mng ni bMt trng hp khc l t my ch SSL VPN trn mng ni b m khng t trn DMZ. Hnh 3.2 m t mt SSL VPN t trn mt mng ni b, s ny dn ti cc vn bo mt nghim trng, cc vn ny khc vi cc vn to bi vic s dng m hnh da trn DMZ: Ton b kin trc tng la b tn cng: Cc giao thc m tng la h tr chn b ng hm ha trong SSL ti mng ni b. Ti thi im my ch SSL VPN t chc li dnh dang giao tip cho ph hp, ni dung ca phin giao tip sn trong mng ni b - trong khi chng khng thuc ni ! Cc nhm khng nhn thc c php gi cc gi mng ti mng ni b: Cc gi cn phi c gi bi ngi dng t xa ti mng ni b th ngi dng phi c nhn thc. Hacker v su khng c php truy cp ti bt k ti nguyn no ca cng ty. Vic cho php chng truy cp c th dn ti vn tn cng t chi dch v DoS, map mng cng ty hoc qut cc im yu bo mt trm d liu hoc iu khin cc my tnh. Bt k h thng pht hin xm nhp (IDS Intrusion Detection System) da trn mng trn DMZ s khng c hiu qu: Cc IDS lm vic bng cch qut cc gi mng khi chng qua mt mng, vic t cc IDS trn mt DMZ l mt k thut tt dng lu lng xu vo mng cng ty. Tuy nhin, trong trng hp mt SSL VPN trn mt mng ni b, tt c cc yu cu c m ha vi SSL VPN nu cc yu cu qua DMZ dng m ha th cc IDS s khng th c c chng. V do , IDS s khng c tc dng g trong mng.

Hnh 3.2. SSL VPN trong mng ni b3.3.1.2. Gii phpKhng c gii php n gin no cho cc vn trn. Tuy nhin, vic s dng cc phng php da trn cc cng ngh thch hp c th lm gim nh tc hi ca cc vn k trn.Mt my ch SSL VPN cn phi chc chn rng n kt hp chnh xc vi cc tng la b sung to thnh mt kin trc mng cng ty. Do cc vn k trn, vic s dng SSL nh l mt k thut ng hm cho cc kt ni mng thc s v c bn l cn nhiu vic phi xem xt.Vic thit lp mt kt ni mng qua SSL VPN cn phi c hon thnh i vi cc my m bn s cho php kt ni ti mng tp on, nh cc my tnh ca cng ty. Thm ch khi bn cho php cc my tnh an ton tuy cp ti mng cng ty theo cch ny, cn phi bit c rng cc tng la c nhn trn cc my tnh ny c bin i hiu qu vo trong tm kim sot ca tng la trong cng ty, y l mt nhim v n khng c trang b trc thc hin. V vy, vic thit lp mt kt ni mng qua SSL (y l mt chc nng mnh ca cng ngh SSL VPN) khng phi l mt tng tt ng trn quan im bo mt.May mn thay, vic thit lp mt kt ni mng qua SSL l khng thng xuyn (v thng khng c khuyn ngh).C th t c truy cp ti cc ng dng v file m khng cn thit lp kt ni mc mng. Vic cho php truy cp thng an ton hn khi ng hm ha thng tin mng v lm gim nh tc hi cc vn k trn (tr vn a ch IP ni b ca mt thit b u cui).Hn na, nu ch cc lp trn ca m hnh OSI thc s truyn ti SSL VPN, do c th c cc kin trc tng la thng thng thc hin bo mt mc mng v SSL VPN thc hin bo mt lp ng dng. SSL VPN c th kim tra chc chn rng ch cc giao thc ng dng c th c s dng, v do ch cc yu cu ph hp vi cc giao thc ny c php qua.Nhiu cch lc truy cp c thc hin. V d nh: Ai c th truy cp (v d tn ng nhp nhn thc: JosephSteinberg). ng dng no (v d: Telnet). Trn my ch no (v d: My ch 1). T cc thit b no (v d: T cc thit b tin cy v cc my tnh vi cc tng la c nhn v cc chng trnh chng virus).Mt vi ty chn tt thc hin lu tr cc chng thc SSL trong mt vng khng an ton l: S dng mt b tng tc SSL, cho php cc chng thc SSL c lu tr trong vng an ton ca b tng tc. S dng cng ngh Air Gap (s c m t sau), n cho php di chuyn chng thc ti mng ni b c bo v bi Air Gap. S dng cng ngh Air Gap kt hp vi mt b tng tc SSL, lm tng mc bo v chng thc.3.3.2 Vn yu im ca mc ng dng v gii php3.3.2.1. Vn Cc yu im trong phn mm my ch c ch nhiu trong mt vi nm qua. Cc l hng trong cc sn phm khc nhau dn ti s tng nhanh ca cc su, v dn ti thit hi hng t la.Hu ht cc SSL VPN tn dng cc my ch nh l mt phn ca kin trc. Do , bt k yu im no trn my ch web (hoc bt k u trong phn mm SSL VPN) c th dn ti cc vn bo mt nghim trng. K thut hardening (l qu trnh x l ti u cu hnh h thng bo mt hn) mt thit b SSL VPN c th gii quyt thch hp vn ny, tuy nhin, hardening khng bao gi l hon ho, v cc thit b SSL VPN hardening vn c nhiu yu im d b tn cng. Hn na, cc yu im ny c th trong h iu hnh c bn ca thit b.Thm ch nu bn thn thit b SSL VPN vn bo mt th bi v n gi cc yu cu ngi dng ti cc my ch ni b, nn cc yu im trong h thng ni b c th c tn dng bng cch tn cng my ch SSL VPN, v thm ch trong trng hp my ch SSL VPN khng b tn thng th n s chuyn tip yu cu (cc cuc tn cng) ti cc my ch ni b.3.3.2.2. Gii php

Hnh 3.3. B lc lp ng dng trnh SSL VPN tr thnh nn nhn cho cc su, cn phi thc hin cc b lc lp ng dng. B lc c th l sn phm ca hng th ba trn proxy t trc SSL VPN nh m t trong hnh 3.3 (d liu truyn theo th t A,B,C,D,E) hoc c th c tch hp vi bn thn my ch SSL VPN.Vic lc cc yu cu gi ti SSL VPN c xem nh l mt chc nng ca my ch SSL VPN thc s hoc nh l mt chc nng ca mt tng la lp ng dng (t trc SSL VPN) c th gii quyt cc vn yu im ca lp ng dng. Cc loi khc nhau ca b lc c m t trc v chng c th chn cc yu cu xu t SSL VPN yu.3.3.3 M haVic m ha c thc hin khi thng tin b mt c truyn qua Internet. Trong trng hp cc SSL VPN, SSL l cng ngh c tn dng m ha tt c cc giao tip. Ngy nay, cc trnh duyt hu ht h tr m ha 128 bit, c nhiu l do hu ht cc cng ty u chuyn sang m ha 128 bit c cung cp bi SSL. Thng tin chi tit c m t trong chng 2.3.3.4 Cp nht cc my ch SSL VPNMt im na cn ch khi tm hiu SSL VPN l khng c sn phm phn mm (hoc phn mm chy trn thit b) no l hon ho. Cc bug (thng to ra cc yu im bo mt) thng c trong cc gi phn mm ngy nay. SSL VPN khng trnh khi nh hng bi cc li lp trnh, cc sn phm SSL VPN c th cha cc bug, cc bug ny cn phi c sa bng cc gi cp nht. Mi sn phm SSL VPN c mt chui cc cp nht theo th t, nh mt vi sn phm cn cc cp nht trc trc khi thc hin mt gi cp nht no , mt vi sn phm cho php cng ngh tng la ng dng logic khng nh bn trong my ch SSL VPN lm gim cc yu cu cp nht, mt vi sn phm tn dng cc sn phm hng th ba v cn cc cp nht ca hng th ba.3.3.5 So snh Linux v WindowsCc my ch SSL VPN ngy nay thng chy trn Microsoft Windows Server hoc cc h iu hnh my ch Linux. Mc d Microsoft nhn c nhiu li khen ngi v tnh bo mt ca h iu hnh v cc sn phm phn mm, nhng Linux cng pht trin mnh trong thi gian gn y v c nhiu li th bo mt.3.3.6 Mt vi khi nim bo mt khc ca thit b SSL VPNCc my ch SSL VPN thc hin nh l cc cng t Internet y ry cc k nguy him vo cc mi trng c bo v ca cng ty. Do , chng phi c kh nng bo v khi cc cuc tn cng bao gm cc k thut chc chn bn thn chng c kh nng phc hi, cng c bc tng bo v. Cng vi cc cng ngh bo co ny m t trn, nhiu khi nim ang quan tm lin quan n bo mt my ch SSL VPN s c m t trong cc phn sau y.a) HardeningHardening l qu trnh x l ti u cu hnh ca mt my tnh hoc mt mng chng an ton nht c th. N thng thc hin tt cc dch v khng cn thit, thay i cc mc nh h iu hnh, tt cc kh nng mng khng cn thit, loi ra cc truy cp t ngi dng khi c ngi cn iu khin thit b, v xa cc phn mm khng cn thit. Nhiu SSL VPN c vn chuyn trn cc my tnh tin hardened, thnh thong c gi l cc thit b (nh m t trn). Hardening thng gim nhy cm ca mt SSL VPN i vi cc cuc tn cng, v l mt phng thc kinh t hin nay. Tuy nhin, mt im quan trng cn nhn thy l hardening khng c kh nng phc hi, nu c mt sai st trong m h iu hnh, tt c cc th tc hardening c th tr nn v ngha.b) Air GapAir Gap l mt cng ngh tn dng hai my ch - mt t bin mng ni b, trn tt c cc chng nng SSL VPN chy, v mt t bin Internet. Gia chng c mt b nh nh. My ch t bin Internet c hardened v ch chy m cho php nhn cc kt ni IP. N gi ti ng dng t cc gi n nhn c ti b nh nh, t my ch ni b c cc yu cu vo. Air Gap cho php bo mt tt hn phng thc hardening n gin do chng phc hi kt ni mng, gim cc vn mc h iu hnh, v trnh c cc my kt ni Internet th nhn a ch SSL VPN. Nhc im ca Air Gap l n c gi thnh cao hn hardening do n cn hai my ch. Do , Air Gap thng ph hp hn vi mng ln, trong vn bo mt c t ln hng u.c) Bo v t cc h thng ni b v mng ni bMy ch SSL VPN cn phi c bo v khi cc tn cng t ngi dng ni b. Cc mt khu l cn thit truy cp bt k cng c qun tr no. Hn na, tt hn l c mt vi tng la c bn trn my ch SSL VPN chng cc su v phn mm c hi c th tn cng t mng ni b v chn chng khi tn cng my ch SSL VPN.d) ASICCc ASIC (Application Specific Integrated Circuit Mch tch hp ng dng c th) l cc chip c thit k chy cc ng dng c th. Chng thng c trong t v nhiu thit b in t, v by gi chng xut hin trong mt vi sn phm SSL. Nu cc chc nng bo mt c tch hp vo cc chip ASIC, th cc chip ny c th tng chc nng bo mt web v gim thit hi ca SSL VPN khi b tn cng.

KT LUNCng ngh SSL VPN l mt cng ngh c p dng nhiu nc, mang li nhiu li ch cho cc doanh nghip. N tn dng c cc u im v gi thnh, s linh hot v qun tr tr thnh mt trong nhng cng ngh VPN ph bin nht hin nay. Trong tng lai, SSL VPN s c tip tc pht trin v ngy cng hon thin hn, nn ng dng ca n trong tng lai s l trong nhiu lnh vc hn, hiu qu hn, bo mt hn,Bo co ny ny tm hiu v hot ng v cc vn bo mt ca SSL VPN. Ni dung chnh Bo co ny trnh by bao gm: Khi nim v VPN v SSL VPN, a ra mt s khi nim lin quan n SSL VPN. Qua chng ta c th nhn thy u im ca cng ngh ny. Giao thc SSL v vic s dng SSL to nn VPN, cc cng ngh tin thn ca SSL VPN. Hot ng ca SSL VPN, cc ci tin quan trng trong SSL VPN, cc dch v trong SSL VPN v cc thnh phn ca n. Qua chng ta c th c mt ci nhn su hn v hot ng ca SSL VPN. Phng php bo mt trong SSL VPN, cc khi nim, v vn bo mt xy ra vi SSL VPN cng nh cch gii quyt cc vn ny. Qua chng ta c th hiu r hn v bo mt trong SSL VPN Cc bc cn tin hnh xy dng mt SSL VPN cho mt mi trng c th, qua a ra cc gii php cho tng mi trng c th.Do cc u im r rt ca n, gii php SSL VPN khng ngng c ci tin trong thi gian gn y. Bi vy, hng nghin cu tip theo ca Bo co ny l tm hiu cc ci tin mi c a ra trong thi gian gn y. Ngoi ra, hng pht trin chng trnh m phng s l s dng cc cng c trong m phng xy dng mt SSL VPN ton din hn, vi nhiu dch v hn,

TI LIU THAM KHO[1]. SSL VPN, Understanding, evaluting, and planning secure, web-based remote acess. Joseph Steiberg and Timothy Speed. Packt Publishing, 2005.[2]. SSL Remote Access VPNs, Jazib Frahim and Qiang Huang. Cisco Press, 2008.[3]. SSL and TLS Essentials, Stephen Thomas. Wiley Computer Publishing John Wiley & Sons, Inc, 2000.[4]. Cisco Security Appliance Command Line Configuration Guide, chapter 34: Configuring Easy VPN Services on the ASA 5505, Cisco Press, 2005.[5]. Jupiter Networks Secure Access SSL VPN. Syngress Publishing, Inc, 2007

TS. Nguyn Chin TrinhTrang 50

Internet

DMZ

LDAPDNS

My ch Proxy

My ch Web

Router

Router

PC

My trm web

My ch bn tin

My ch SQL

Mng tin cy

Truy cp web qua DMZ

Nhiu cng b chn c hai hngTruy cp t bn ngoi c iu khin qua proxy

Mt vi cng b chn theo c hai hng

Tom

Joe

Cng mt kha

Bn tin m ha

M ha vi kha

M ha vi kha

Bn tin m ha

Gii m ha vi kha

Gii m ha vi kha

Tom

Joe

Kha c nhn ca Tom

Bn tin m ha vi kha cng cng ca Tom

Bn tin m ha vi kha cng cng ca Joe

Kha c nhn ca Joe

Tom

Joe

M ha vi kha cng cng ca Joe

Kha i xng

My tnh A

My tnh B

Internet

ng hm o

D liu khng m ha

Internet

Tng la

SSL VPN

Kha SSL

IDS

Tng la

My ch d liu

My ch file

My ch e-mail

My ch IM

My ch ng dng

ICA

RPC

SMB

HTTP

UDP

Mng DMZ

Nhiu cng c m

Mng ni b

Cng 80 v 443 c m

HTTPS (v cc giao thc n bn trong HTTPS)

HTTPS (v cc giao thc n bn trong HTTPS)

IDS

Mng DMZ

My ch c s d liu

HTTPS (v cc giao thc n bn trong)

Tng la

Tng la

HTTPS (v cc giao thc n bn trong)

Internet

My ch fle

My ch e-mail

My ch IM

My ch ng dng

SSL VPN

Mng ni b

Ngi dng

Ngi dng

Ngi dng

Tng la ng dng

Cc chc nng khc ca SSL VPN

SSL VPN

Internet

A

B

C

D

E

DMZ

Mng ni b

My ch

My ch

My ch

My ch

Laptop10.10.10.11

My ch10.10.10.2

VPN

Internet

Dng

Gi tin

Gi tin

Mng hacker

My tnh Hacker