严格自主访问控制的研究与设计  

Research and Design of Strict Discretionary Access Control

作　　者：张强[1] 魏立峰[1] 

机构地区：[1]国防科学技术大学计算机学院,湖南长沙410073

出　　处：《计算机技术与发展》2012年第4期219-222,226,共5页Computer Technology and Development

基　　金：国家核高基项目(2010ZX01045-001-002-5)

摘　　要：传统自主访问控制机制虽有授权自主性的优点,但是在实际使用中由于超级用户的存在,其权限过大,可不受自主访问控制的限制,用户不能确保对自身数据的绝对控制。针对这一问题,文中提出基于白名单用户链表的严格自主访问控制机制,在操作系统内核中维护一个实施严格自主访问控制的白名单用户链表,由用户自主决定是否需要以及哪些文件需要进行严格的自主访问控制,实现了真正意义上的用户自主决定权,使得属主用户能够对文件的访问授权做到完全控制。Although the traditional Discretionary Access Control（DAC） Mechanism has an advantage that a subject can discretionarily decide who can access his own object,the super-user in Linux is unrestricted because of its full privilege.To address the problem,a new mechanism called Strict Discretionary Access Control（SDAC） based on the white user linked list is proposed.User can decide whether it can be implemented or not and which files need to be strictly protected by a white user linked list for users who carry on strict access control in operating system kernel.This mechanism can implement that the file owner could completely control the access authorization of the file;Consequentially,any other users including the privilege-user cannot access files if they are not allowed.

关 键 词：严格自主访问控制 访问控制列表 权能 用户链表 授权 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]