典型安全网关的形式化设计与证明-计算机科学.pdfVIP

Vo1. 44 No. 9 第 44 卷第9 期 计算机科学 2017 年 9 月 COMPUTER SCIENCE Sep.2017 典型安全网关的形式化设计与证明 王瑞云赵国磊常朝稳王雪健 (中国人民解放军信息工程大学密码工程学院 郑州 450001) 摘 要 传统上依靠经验设计的安全网关侧重于功能实现，缺少严格的安全模型。对此，针对一种典型安全网关，首 先根据其安全需求给出相应的安全策略，然后利用 BLP 模型对给出的安全策略进行形式化建模并对安全模型的内部 一致性进行证明，最后对安全网关的功能规约和安全模型的一致性进行验证。为保证推理过程的正确性，使用定理证 明器 Isabelle/HOL 对上述过程进行描述和推理，保证了安全网关顶层设计的安全性。研究结果为安全网关的形式化 设计提供了一定的借鉴意义。 关键词 典型安全网关，形式化设计，BLP 模型，功能规约，一致性验证，Isabelle/HOL 中图法分类号 TP309.1 文献标识码 A 001 10. 11896/j. issn. 1002-137)立 2017.09.028 Fonnal Design and Verification for Typical Security Gateway WANGRui 归n ZHAO Guo-lei CHANG Chao-wen WANG Xue-jian (Ðepartment of Password Engineering ,The PLA Information Engineering University ,Zhengzhou 450001 ,China) Abstract Security gateway which is designed in experience usually focuses on function implementation and is usually not designed according to security model. To solve this problem ,we proposed a method of formally designing and verif ying a typical security gateway. Firstly ,we designed the typical security gateway s security policy according to its secu rity requirements. Secondly ,we formally modeled the security policy and verified the security model s intemal consis tency by means of BLP model. In the end ,we verified the consistency between the security gateway s functional specifi cations and its security mode l. To make sure the reasoning procedure s correctness ,we used the theorem prover Isa belle/HOL to formally describe the above work and help us deduce. Our work ensures the security of a typical security gate