一种增强自主访问控制安全性的方案

A Safety Strengthening Scheme for Discretionary Access Control System

提出的自主访问控制系统的安全增强方案在修改客体的访问控制属性时,操作系统和被授权主体对修改进行评估和监控。采用数字双签名方案对授权主体和被授权主体进行身份鉴别,在不破坏自主访问控制的自主性的前提下,使访问控制属性的修改在安全、明确、受控的状态下进行,从而消除恶意程序对系统的攻击基础和环境,使采用DAC工作机制的操作系统的安全性得到增强。

This paper represents a safety strengthening scheme for DAC (Discretionary Access Control) system,in which the system operation and an authorized subject evaluate and monitor the modification of object' access control table. The digital dual signature is applied in order to authenticate a subject and an authorized subject' identity. On the premise of the discretionary characteristic not being spoiled, the modification of the access control property is completed in a state of safety, explicitness, and being controlled. The scheme eliminates the attacking potentiality of malicious programs so that the safety of OS which adopts DAC scheme is strengthened.