ERMF:基于扩展引用监控实现文档防泄漏  

ERMF: Preventing Document from Leakage Via Extended Reference Monitor

作　　者：马俊[1] 伍江江[1] 程勇[1] 梅松竹[1] 任江春[1] 王志英[1] 

机构地区：[1]国防科学技术大学计算机学院,长沙410073

出　　处：《武汉理工大学学报》2010年第20期27-31,共5页Journal of Wuhan University of Technology

基　　金：国家自然科学基金青年基金(60903204)

摘　　要：如何防止敏感电子文档被内部人员泄露出去是当前很多企业面临的一个重要安全问题。现有的分域控制方法以及终端系统中从应用层和内核层的监控方案,都很难同时兼顾系统的可用性和安全性。针对上述问题,提出了一种扩展引用监控框架,将应用层的用户操作行为监控与内核层的文件访问监控相关联,既避免了由于内核层无法感知上层操作导致的泄露问题,又可以缓解对用户操作行为约束过于严格的问题,提高了系统的可用性和灵活性。给出了基于Windows平台实现的关键技术和实现效果,验证了框架的有效性。Leakage prevention of sensitive electronic document has become a serious security problem.The existed methods such as sub-domain control,terminal monitor solution implemented from application layer or kernel layer,hardly consider the availability and security simultaneously.In view of this reality,an extended reference monitor framework is proposed.Under the framework,the monitor of user operations and file accesses are combined together,which could avoid the leakage caused by insufficiency of kernel layer on user actions and reduce the constraints of user actions in application layer.The key technologies and the effectiveness of the implementation on Windows platform are given to show the validity of the framework.

关 键 词：数据泄漏防护 进程控制 文件系统过滤驱动 钩子函数 引用监控器 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]