基于BLP的虚拟机多级安全强制访问控制系统设计与实现

Design and Implementation on Multilevel Security Mandatory Access Control System for Virtual Machine Based on BLP

多级安全是一种支持不同权限的用户和资源同时访问系统,同时确保用户和资源都只能访问其有权访问的信息的机制。在云计算中,不同用户或企业的虚拟机可能运行在同一台物理主机上,它们通常具有不同的安全等级,因此实现多级安全访问控制对保护虚拟机间的通信非常有意义。针对这一问题,文章通过对传统的BLP安全模型的模型元素、安全公理和状态转换规则进行修改,构建了适用于虚拟机环境的强制访问控制安全模型,借助SELinux技术,通过共享内存和授权表的方式实现了虚拟环境中的多级安全强制访问控制,有效增强了虚拟机之间、虚拟机与宿主机之间的访问的安全性。

Multileve l security is a mechanism that supports the simultaneous access o f users and resources w ith different privileges, w hile ensuring that both users and resources can access the inform ation that they have access to. In the cloud computing, the virtual machines that belonging to different users or enterprises may run on the same physical host, usually they have different levels o fsecurity. So it is very meaningful to implement m ultilevel secure access control policy to protect thevirtual machine communication. In reaction to the phenomenon, mandatory access control security modelthat suitable fo r the virtual machine environment was b u ilt by m odifying the model elements, security axioms and state transition rules o f the traditional BLP security model. By using SELinux technology through shared memory and authorization table way, the m ultilevel security mandatory access control in the virtual environment was realized, that effectively enhance access security between the virtual machine and virtual machine w ith the host machine.