一种基于用户意愿的数据保护模型

A Data Protection Model Based on User's Intention

基于最小特权原理,从分析进程的访问权限出发,提出了一种防御恶意程序攻击的数据保护模型.该模型对DAC访问控制机制进行了增强,当进程实际访问用户数据时,进程必须先获得操作用户的意愿,用户根据进程的任务赋予进程访问系统最小必需数据集的权限,使进程无法访问任务之外的数据集,防止进程因权限过大破坏用户数据.测试结果表明,该模型可以有效地阻止进程的非法访问而确保数据不被窃取或破坏.

After analyzing the access rights of the processes, this paper presents a data-protection model which will prevent the attack of the malicious processes on the base of minimal privilege principle. This model has reinforced the DAC access control mechanism. When process accesses user＇s data, the process has to gain the user＇s intention. Based on the task of the process, the user will endow the process minimal rights to access the related data, which will prevent the process from accessing data that are not concerned with the task. Thus it will prevent process destroy user＇s data because of overusing access rights. The test result shows that this model can effectively stop the unauthorized access and protect data from destructing or stealing.