###
DOI:
Journal of Software:2004.15(11):1700-1708

基于可信级别的多级安全策略及其状态机模型
谢钧,许峰,黄皓
(南京大学,计算机软件新技术国家重点实验室,江苏,南京,210093;解放军理工大学,指挥自动化学院,江苏,南京,210007)
Trust Degree Based Multilevel Security Policy and Its Model of State Machine
XIE Jun,XU Feng,HUANG Hao
()
Abstract
Chart / table
Reference
Similar Articles
Article :Browse 3054   Download 3180
Received:May 21, 2003    Revised:January 06, 2004
> 中文摘要: 虽然MLS(multilevel security)被广泛应用于各种安全系统,但是它不能实现信道控制等重要的安全策略.将可信级别的概念引入到MLS中,使其可以方便地实现各种信道控制策略.建立了一个实现这种基于可信级别的多级安全策略的访问控制状态机模型,并证明其对定义的策略是安全的,而且可以实现所有静态信息流策略.另外,还扩展了该模型,使其可以支持存储对象安全属性的动态改变.该模型克服了MLS不能解决安全降级问题以及不考虑完整性的缺点,同时又保留了传统分级策略模型易理解、易使用的优点.
Abstract:MLS (multilevel security) is being widely applied in many security critical systems, but it can’t implement many important security policies such as ‘channel-control’. In this paper, the concept of trust degree is introduced into the MLS to implement policies like ‘channel-control’ conveniently. An access control state machine model which enforces the trust degree based multilevel security policy is established, and is proved to be secure for this policy. It is also proved that this model can enforce all static information flow policies. An extension of the model is also offered to support the dynamic change of storage objects’ security labels. The model avoids the disadvantage of MLS’ not being able to resolve the problem of secure downgrading and not taking integrity into consideration, and at the same time it retains the advantage of easy understanding and use enjoyed by the traditional classified policy models.
文章编号:     中图分类号:    文献标志码:
基金项目:Supported by the Natural Science Foundation of Jangsu Province of China under Grant No.BK2002073 (江苏省自然科学基金) Supported by the Natural Science Foundation of Jangsu Province of China under Grant No.BK2002073 (江苏省自然科学基金)
Foundation items:
Reference text:

谢钧,许峰,黄皓.基于可信级别的多级安全策略及其状态机模型.软件学报,2004,15(11):1700-1708

XIE Jun,XU Feng,HUANG Hao.Trust Degree Based Multilevel Security Policy and Its Model of State Machine.Journal of Software,2004,15(11):1700-1708