Kylin安全审计子系统的研究和实现  

Research and Implementation of the Audit Subsystem in the Kylin Operating System

作　　者：罗钰[1] 何连跃[1] 

机构地区：[1]国防科技大学计算机学院,湖南长沙410073

出　　处：《计算机工程与科学》2007年第3期30-32,共3页Computer Engineering & Science

基　　金：国家863计划资助项目(2002AA1Z2101)

摘　　要：研究操作系统的安全防护技术,预测分析操作系统的安全行为,是操作系统安全的重要内容。预测行为是通过分析系统的审计数据完成的,必须要求安全操作系统具备记录用户行为的功能。然而,在很多情况下,恶意用户攻破了操作系统,意味着拥有系统管理员的权限,它可以破坏审计数据,改变系统审计行为,以达到隐藏自己恶意行为的目的。因此,Kylin操作系统研究并实现三权分立的管理员管理模型,该模型要求审计数据的产生和存储不受除审计管理员之外的任何用户控制。本文研究并设计了内核线程完成审计功能的软件结构,避免了以往通过内核审计模块和审计进程实现的审计系统的脆弱性,保证了审计管理的独立。To study the protection technology and predict and analyze the behaviors of an operating system is the important content of the security of the operating system.The action of prediction is achieved by analyzing the audit data of the system,so the secure operating system must be provided with the function of recording users＇ actions.In many cases,however,malicious users＇ attack the OS successfully,which means the malicious users have the privilege of an administrator,he can destroy audit data,change the behaviors of the audit data so as to hide the aim of his malicious action.So the Kylin operating system implements the management model of power separation,and the model requires that producing and storing audit data cannot be controlled by any user but the audit administrator.This paper studies and designs the software architecture of the kernel audit function,and avoid the fragibility of the previous audit system implemented by the kernel audit module and the audit process,and then guarantee the independence of audit management.

关 键 词：审计 系统日志 记帐 内核线程 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]