一种具有可信度特征的多级安全模型.pdfVIP

一种具有可信度特征的多级安全模型 谭智勇,刘 铎,司天歌,戴一奇 (清华大学计算机科学与技术系,北京 100084) 摘要：为解决现有多级安全系统中存在的可信主体安全隐患和系统可用性较差的问题,本文提出一种 具有可信度特征的多级安全模型.通过在BLP模型中增加主客体的可信度标记和可信度评估函数,该模型可 以准确地评估访问请求的可信度以及主客体可信度随访问行为变化的情况.以此可信度评估机制为基础,该 模型建立了对可信主体的约束机制,使系统可以赋予更多主体有限程度的特权,增加了系统的灵活性和可用 性. 关键词：多级安全; 可信度; BLP安全模型; 访问控制 中图分类号: TP309 文献标识码: A 文章编号: A Multilevel Security Model with Credibility Characteristics TAN Zhi-yong, LIU Duo, SI Tian-ge, DAI Yi-qi (Department of Computer Science and Technology, Tsinghua University, Beijing 100084, China) Abstract: A multilevel security (MLS) model with credibility characteristics was proposed to solve the problem of trusted subjects’ hidden security flaw and poor system usability in present MLS systems. By introducing credibility labels of subjects and objects and credibility evaluation functions in original BLP model, it can evaluate credibility of access requests as well as corresponding credibility variation of subjects and objects. Since this model establishes restriction mechanism against trusted subjects and assigns limited privileges to all subjects, it is more flexible and practicable than present security-label based MLS models. Key words: multilevel security; credibility; BLP security model; access control 1 引言 BLP模型是实现多级安全(Multilevel Security, MLS)的经典安全模型,该模型强制要求所 有非可信主体对客体的访问均满足三个基本安全属性：ss-属性,*-属性和ds-属性[1,2,3].模型同 时定义允许违反*-属性但不会由此破坏系统安全性的主体为可信主体[1],通过可信主体的违 规操作保证实际系统的正常运行.但这种处理方式存在两个问题：首先,系统缺乏针对可信主 体的约束机制,使其能随意进行违反*-属性的违规操作;其次,约束机制的缺失致使系统必须 严格控制可信主体的数量,导致系统中绝大部分主体是访问行为严格受限的非可信主体,系统 收稿日期:2007-07-09 ;修回日期:2008-04-28 基金项目:国家自然科学基金(No 1 的可用性很差. 针对可信主体的约束机制问题,研究者设计出多种