进程内细粒度保护域模型及其实现

Fine-grained protection domain model in a process and its implementation

提出了一种利用细粒度保护域方法实现进程权限动态改变的机制。根据进程的不同执行阶段对系统资源和程序地址空间访问方式的不同,将其划分为多个保护域。设置各个保护域对程序地址空间的访问方式,使之能有效地防御用户态代码注入攻击;保护域对系统资源访问的控制通过一个强制访问控制框架来实施,以此满足系统的安全策略。

A fine-grained protection domains method was proposed to address the problem of dynamically changing a proeeas＇s capabilities. According to a precess＇s different access mode of its address space and system resources in its different executing phases, this model partitions it into multiple protection domains. Then it sets up access mode of address space for each of them, which makes it feasible to resist code injection attacks. Meanwhile, it integrates Mandatory Access Control （MAC） framework into it to provide the access control of system resources, which meets the security requirement of the system.