基于可信度的多级网络访问控制机制  

Access control mechanism of multi-level network based trust evaluation

作　　者：曹利峰[1] 陈性元[1] 杜学绘[1] 夏春涛[1] 

机构地区：[1]解放军信息工程大学电子技术学院,郑州450004

出　　处：《计算机工程与应用》2011年第34期86-89,共4页Computer Engineering and Applications

基　　金：国家高技术研究发展计划(863)(No.2009AA01Z438)~~

摘　　要：详细分析了BLP模型在网络应用方面存在的不足,提出基于可信度的多级网络访问控制机制。该机制通过收集同一安全域内安全审计系统提供的历史证据,计算主体访问行为在机密性安全属性方面的可信度,根据可信度限定主体对客体的访问违规行为,并合理调整主体安全标记以及客体的存在形式,从而提高了BLP模型在网络应用中的灵活性、可用性,同时也降低了BLP模型中由于可信主体滥用权限而带来的安全风险。This paper analyzes problem of BLP model which is applied to multi-level network,and puts forward access control of multi-level network based on trust evaluation.The method collects evidences of access history of subject from audit systems in the same secure domain,then evaluates trust degree of subject about violating confidentiality rule by evidences, and adjusts secure label of subject and being of object,which can not only increase flexibility and availability but also reduce risk of information system by misuse of credible subject＇s authority in BLP model.

关 键 词：安全标记 安全级别 可信度 证据 等级保护 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]