基于隔离区的信息保护模型研究  

Research on information protection model based on process isolation

作　　者：胡雨霁[1,2] 黄皓[1,2] 

机构地区：[1]南京大学软件新技术国家重点实验室,江苏南京210093 [2]南京大学计算机科学与技术系,江苏南京210093

出　　处：《计算机工程与设计》2010年第21期4550-4554,4723,共6页Computer Engineering and Design

基　　金：江苏省高技术基金项目(BE2008124)

摘　　要：通过分析以主机为管理对象的涉密信息保护技术的特点,提出了一种基于隔离区的信息保护模型。该模型在保证涉密信息可用性不受影响的同时,加强了对涉密信息的保护。实现该模型的关键在于实现进程资源访问的隔离,通过分析Windows操作系统中进程信息可能的泄漏点,结合过滤驱动和程序组件校验的机制构造了涉密信息隔离区来实现进程资源访问的隔离。Traditional I/O-oriented information protection technique has some disadvantages. An information protection model based on process isolation is developed as an improvement. Under this model, the usability of information maintains while protection is improved. The key factor in its implementation is the isolation of process information accesses. By analyzing potential information leakage threats in the Windows operating system, an information isolation zone is constructed to realize the isolation of process information access, which features filter driver and program component verification.

关 键 词：隔离区 过滤驱动 内核完整性 可信启动 程序组件校验 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]