源码缺陷检测资源访问控制研究与实施  

Study and Implementation of Resources Control in the Process of Source Code Defect Detection

作　　者：郝永乐[1] 商海芳 

机构地区：[1]中国信息安全测评中心,北京100085 [2]北京启明星辰信息安全技术有限公司,北京100193

出　　处：《信息安全与通信保密》2011年第11期77-79,共3页Information Security and Communications Privacy

摘　　要：现有的源代码缺陷检测工具,大多都是单用户或单机版工具。对于这些工具的使用者来说,整个源代码缺陷检测过程中涉及到的各种资源,包括检测源代码、检测工具、检测结果等,都是完全透明和可以完全支配的。而现实中,这些资源对于检测机构或被检测机构都是具有较高保密性的,这些资源一旦流失出去,都有可能对某行业或社会造成一定的危害。可以采用业务管理系统与源代码缺陷检测工具集成的方式,在业务管理系统端引入角色管理机制,采用角色、权限和用户的三权分立机制,通过控制用户的资源访问权限,从而达到控制整个源代码缺陷检测过程中资源访问控制的目的。文中将在这方面对该方法的研究和实施进行阐述,同时也说明如何将业务管理系统和检测工具进行集成。Most of current source code defect analysers are of single-user or personal edition. For those users,all resources involved in the detecting process,such as source code,detection tools and detection results,are completely transparent and disposable. But in reality,these resources are highly confidential to the testing agency or testing organizations,any loss of these resources would result in some harm to the industry or the society. So,for the industry or the society,this is an important problem demanding prompt solution. To achieve access control of the resources in the process of source code defect detection,a combination of service management system and source code defect detection tools is required. The introduction of role management into the service management system could realize the control on access authority of resources based on separations of role,authority and user. Study and implementation of this method are described in this paper,including the integration of service management system and detection tools.

关 键 词：源代码缺陷检测 角色管理 资源访问控制 系统集成 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]