一种基于TE技术实现Clark-Wilson模型的方法  

An Approach to Enforcing Clark-Wilson Model Based on Type Enforcement

作　　者：何建波[1] 郭新[2] 卿斯汉[1] 

机构地区：[1]中国科学院信息安全技术工程研究中心,北京100080 [2]北京城市学院计算机实验教学中心,北京100083

出　　处：《电子学报》2008年第2期216-223,共8页Acta Electronica Sinica

基　　金：国家973重点基础研究发展规划基金(No.G1999035802);国家自然科学基金(No.60573042);北京市自然科学基金(No.4052016)

摘　　要：分析了当前Clark-Wilson完整性模型实现机制的不足,提出了一种基于TE实现Clark-Wilson模型的方法.首先讨论了TE对Clark-Wilson模型的支持能力,然后给出了用TE实现Clark-Wilson模型的配置规则和约束.在实现中,扩展了模型的(userid,TP,list of CDIs)三元组,引入了角色层,以更实用的方式实现了职责隔离.同时,实现机制实现了对TP的保护,有效地保障了TP功能的正确性,提高了系统正确控制TP操作的可信度,减少了对Clark-Wilson模型验证规则的依赖.This paper analyzes the limitations of cunent implementation technologies to Clark-Wilson integrity model,and presents an approach to enforcing Clark-Wilson model based on Type Enforcement. Firstly, the advantages of this approach are dis- cussed.Secondly, the configuration rules and constraints that implement Clark-Wilson model based on TE are given. The triple （userid,TP,list of CDIs） of Clark-Wilson model is extended and replaced by the quarter-tuple （ userid, role, TP, list of CDIs）, which implement the separation of duty principle more practically. In addition, the pavtection of TP is covered by the TE, which en- sues the correct functionality of TP, enhances the degree of confidence that TP function conectly,and releases the dependency on the certification procedure.

关 键 词：CLARK-WILSON模型 完整性 TE机制 职责隔离 

分 类 号：P309[天文地球—地球物理学]