ISCAS OpenIR  > 中科院软件所  > 中科院软件所
Author: 孙亚楠
Issued Date: 2004
Major: 计算机软件与理论
Degree Grantor: 中国科学院软件研究所
Place of Degree Grantor: 中国科学院软件研究所
Degree Level: 博士
Keyword: 安全操作系统 ; 自主访问控制 ; 访问控制表 ; 扩展属性 ; LSM通用安全框架
Alternative Title: Research and Implementation of Discretionary Access Control Mechanism in Secure Operating System
Abstract: 自主访问控制机制(Discretionary Access control)是安全操作系统必不可少的、应用最广泛的安全机制之一。其基本原理是在身份鉴别机制的基础上,用户可以按自己的意愿决定谁可以对资源进行何种访问。综合国际上已有的研究成果来看,随着越来越高的实际安全需要,自主访问控制在安全性和实用性方面都存在着可改进之处。本论文首先对自主访问控制的原理和实施机制进行研究分析,然后给出SECIMOS安全操作系统的自主访问控制机制的设计与实现。论文的主要成果有:一,结合Li~系统现有自主访问控制机制,进行安全增强。在遵循OSIXl003,le标准的基础上,扩展了访问控制表语法规则,增加了用于全局设置的访问控制表规则项。设计了访问控制表有效性判断策略和访问控制规则检查策略。并采用同步策略使并存于系统中的自主访问控制的两类实施机制(文件保护位模式和访问控制表)兼容。二、针对不同类型的客体,根据实际需要,将访问控制权限由原来的读、写、执行细化到创建、删除、读取属性和修改属性等12种。提出、设计并实现了基于LSM安全框架的可动态加载的ACL模块,包括插入在内核中的12个用于细化的权限访问检查的钩子函数。协调自主访问控制机制与系统中其他安全策略实施机制的关系。三、对文件系统的扩展属性机制进行研究,并利用文件系统的扩展属性胆A)机制传递、存储和保护访问控制表。四、设计了自主访问控制整体框架和安全检查策略。根据用户指定方式或默认方式,阻止主体对客体的非授权访问,并控制访问权限扩散。五、提供了功能较全的用户层管理工具,包括命令行工具、图形化工具和可扩展库,提高了自主访问控制机制的实用性。实践证明,本论文基于Linux内核和LSM框架设计和实现的自主访问控制机制遵循国家标准GB17859一1999第四级要求,在SECIMOS安全操作系统中运转良好,为系统提供了可靠的、更细粒度的资源访问控制手段,达到了系统的安全性和易用性的平衡。因而本文可作为将来在自主访问控制方面进一步深入研究和发展的基础。
English Abstract: Discretionary Access Control (DAC) is one of necessary and most common secure mechanisms in the secure operating system. DAC is a means of restricting access to objects based on the identity of subjects and /or groups to which they belong. The controls are discretionary in the sense that a user or process given discretionary access to information is capable of passing that information along to another subject. Based on various research results and practical experiences, we found that there is much to be done to improve DAC mechanism in usability and security aspects. The thesis overview the DAC theory and the most commonly used DAC mechanisms firstly. Then, compatible with the remaining simple yet powerful file permission model, the ACL introduced. Main achievements include: first, supporting the POSIX family of standards, the thesis adds two new ACL entries in to Access Control List for global uses. And design the ACL valid check algorithm and ACL Access Check Algorithm. Second, in according to the application security needs, the set of discretionary access permissions has been extended to twelve permissions, such as create/delete/getattr/setattr. These additional permissions have been added and implementation defined for different objects. The thesis implements ACL mechanism in the kernel for r, w and x permission, and a loadable kernel module with the hooks inserted into kernel by the Linux Security Module (LSM) for the extended permission. Third, presents a method to put ACL on the abstract layer of Extended Attribute (EA) Mechanism. The ACLs are passed in the EA system calls. Fourth, design the whole Access Check strategy and the DAC frame. Fifth, to advance the system usability, provides functional user managing interface, including DAC management GUI tools and two shell commands. The idea put forward by this thesis intends to open a new approach to build DAC with fine-grained permission and access control. The effectiveness of the DAC mechanism design and implemented in this thesis is proved in the SECIMOS secure operating system which meets the class four criteria of the Chinese National Standard GB17859-1999. This DAC mechanism works well in the SECIMOS system, making it a solid ground for future research and development in DAC direction.
Language: 中文
Content Type: 学位论文
Appears in Collections:中科院软件所

Files in This Item:
File Name/ File Size Content Type Version Access License
LW014090.pdf(2463KB)----限制开放-- 联系获取全文

Recommended Citation:
孙亚楠. 安全操作系统自主访问控制机制的研究与实现[D]. 中国科学院软件研究所. 中国科学院软件研究所. 2004-01-01.
Recommend this item
Sava as my favorate item
Show this item's statistics
Export Endnote File
Google Scholar
Similar articles in Google Scholar
[孙亚楠]'s Articles
CSDL cross search
Similar articles in CSDL Cross Search
[孙亚楠]‘s Articles
Related Copyright Policies
Social Bookmarking
Add to CiteULike Add to Connotea Add to Add to Digg Add to Reddit
所有评论 (0)
内 容:
Email:  *
验证码:   刷新
标 题:
内 容:
Email:  *
验证码:   刷新

Items in IR are protected by copyright, with all rights reserved, unless otherwise indicated.



Valid XHTML 1.0!
Copyright © 2007-2022  中国科学院软件研究所 - Feedback
Powered by CSpace