高安全级信息系统中的特权控制机制及其模型研究

Research on the privilege control mechanism and modeling of a high level information system

为满足高安全级信息系统最小特权需求,提出一种强制访问控制模型EPMM。该模型采用三权分立机制对系统中的特权管理进行改进,将原有的超级用户划分为系统管理员、安全管理员和审计管理员,将其中任一个管理员的权限控制在其职责范围内。建立了模型公理系统并对主要定理进行了证明,使非法用户或异常操作对系统所造成的损失降为最小。

In order to satisfy the least privilege requirement of a high level information system,a mandatory access control model EPMM is proposed.The privilege of system is divided into three parts： system manager,security manager and audit manager,and none of the managers can destroy the whole system.Formal description for authorization division is presented,and the main theorems of EPMM are proven,so it can reduce the system loss caused by disabled users and abnormal operations.