进程内细粒度保护域模型及其实现  

Fine-grained protection domain model in a process and its implementation

作　　者：王志强[1] 黄皓[1] 夏磊[1] 

机构地区：[1]南京大学计算机科学与技术系

出　　处：《计算机应用》2007年第6期1356-1359,共4页journal of Computer Applications

基　　金：国家自然科学基金资助项目(60473093)

摘　　要：提出了一种利用细粒度保护域方法实现进程权限动态改变的机制。根据进程的不同执行阶段对系统资源和程序地址空间访问方式的不同,将其划分为多个保护域。设置各个保护域对程序地址空间的访问方式,使之能有效地防御用户态代码注入攻击;保护域对系统资源访问的控制通过一个强制访问控制框架来实施,以此满足系统的安全策略。A fine-grained protection domains method was proposed to address the problem of dynamically changing a proeeas＇s capabilities. According to a precess＇s different access mode of its address space and system resources in its different executing phases, this model partitions it into multiple protection domains. Then it sets up access mode of address space for each of them, which makes it feasible to resist code injection attacks. Meanwhile, it integrates Mandatory Access Control （MAC） framework into it to provide the access control of system resources, which meets the security requirement of the system.

关 键 词：保护域 访问控制 flask安全体系结构 信息安全 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]