安全操作系统授权撤销机制的研究

Research of Revoking Mechanism of Authorization in Secure Operating System

1引言 为保障系统的安全性,现代信息系统都采用了基于访问控制的安全机制.访问控制包含身份认证、授权和审计等功能,其基本思想一般是采用引用监视器来拦截用户进程的系统调用操作,通过安全策略匹配检查,授予或拒绝用户访问敏感信息的权限.

Revoking operation is a very important component of access control. The lack of effective revoking operation impinges on supporting dynamic security policies in secure operation system. Analyzing authorization system,this paper presents a revoke policy which supports cascade and noncascade revocation. The policy adopts Hash authorization list and critical-based callback function to implement revocation of point to point and point to plane. Our experiments in security kernel show the mechanism is feasible,which provides the basis of further researching dynamic security policies in secure operation system.