以 OpenStack 建置攻防搶旗賽 CTF 的雲端測驗平台

Establish Cloud Test Platform of Capture the Flag(CTF) by OpenStack

林家煜(Jia-Yu Lin)

指導教授 ： 王德譽

朝陽科技大學/資訊學院/資訊工程系/碩士(2016年)

摘要

傳統對於伺服器的定義都是一機多服務制,如此一來不僅會讓機器應付太繁雜的工作,且有硬體上的限制。在雲端運算出現後,將繁雜的計算服務個別獨立一台,並透過網路將服務串聯起來形成大型的平台,提供 IT 服務。雲端分為分散式運算和分散式檔案系統,都是在學術研究中應用了很久的技術,這兩樣技術本在如超級電腦、叢集電腦等高價格配備上執行的專屬運算環境,隨著個人電腦的運算能力不斷增強,且配備大量生產讓價格持續下探,因此雲端也逐漸進入個人電腦,讓一般使用者可以建立環境。而雲端運算使用的是「虛擬」資源,不僅增加計算效率,也降低主機的負載,且能同時提供給使用者更快速的服務。

由於網際網路相關資訊技術越來越重要,資訊安全的重要性也隨之增加,而Capture the flag (CTF) 競賽在國內外是相當盛行的資安競賽,透過系統安全、演算法、密碼學以及程式設計功力設計競賽題目,藉此培訓資安人才,許多大學或資安團隊皆會透過此競賽進行資安技術的競賽來增加資安相關實務經驗。
基於上述兩點,本研究利用開放原始碼(Open Source)的 IaaS 雲端平台 ─ Open-stack,設計線上資攻防練習平台,介紹 CTF 的形式與所需具備的技術,接著與實際網路環境中較容易遭受攻擊之威脅做競賽題目。

平台採用弱點或漏洞分析(Pwnable)、密碼學(Crypto)、鑑識(Forensics)以及綜合題(Misc)作為題目類
型,透過CTF學習資訊安全相關知識,既可避免真實攻擊別人時觸犯法律,也可達到學習目的。

關鍵字

雲端運算 ； OpenStack ； 奪旗競賽 ； 虛擬資源 ； 資訊安全

並列摘要

Traditional servers are defined lots services in a machine, this way not only make the machine work too complicated, but have restrictions on the hardware. The complicated compute services are separate into single service, and combine the service through internet be a large platform to provide IT services.

The cloud is divided into distributed computing and distributed file systems, both are used in academic research in technology for a long time, these two techniques such as supercomputers, clusters computer are useing in high-priced device. As personal PC computing capabilities has been rising, with mass production make prices edge lower, so the cloud is gradually entering the PC, and normal users can set up the environment. cause cloud computing is use ”virtual” resources, not only increase the computational efficiency, but also reduce host’s load, and can also provide most fast service to users. Because internet information technology is increasingly important, the importance of information security have increased, and Capture the flag(CTF) contest at domestic and overseas is more popular information security contest, many universities and security team are through the contest to increase information security-related practical experience.

For these, in this study, we are use of open source IaaS cloud platform - OpenStack, designing online information security offensive and defensive practice platform (CTF), introduced with the desired form of CTF technology and related technology, then we use more vulnerable, to the threat of attack as contest topic. The platform also uses and the platform use Pwmable, Ccryptography,Forensics and Miscellaneous as the contest topic for general user to join, and through CTF to learn information securityrelated knowledge, not only can avoid breaking the law when the real attack, but to achieve the purpose of learning.

並列關鍵字

Cloud Computing ； OpenStack ； Capture The Flag ； Virtual Resource ； Informa- tion Security

參考文獻

[3] V. P. Raghu Raman, Sherin Sunny, “Framework for evaluating capture the flag(ctf) security competitions,” International Conference for Convergence of Technology, pp. 1–5, 2014.

[7] “Openstack - documentation for juno.” http://docs.openstack.org/juno/

[10] “Ruby on rails 實戰聖經.” https://ihower.tw/rails4/installation.html.

[13] F. A. Abdul Razzaq, Khalid Latif, “Semantic security against web application at-tacks,” Information Sciences, vol. 254, pp. 19–38, 2014.

[1] “Cloud computing.” https://en.wikipedia.org/wiki/Cloud_computing.