不同密级系统间基于BLP的访问控制机制  

BLP Based Access Control Mechanism in Multi-level Network Systems

作　　者：刘苏娜[1,2] 潘理[1,2,3] 姚立红[2] 

机构地区：[1]上海交通大学电子信息与电气工程学院,上海200240 [2]上海市信息安全综合管理技术研究重点实验室,上海200240 [3]信息网络安全公安部重点实验室,上海201204

出　　处：《上海交通大学学报》2012年第9期1387-1391,共5页Journal of Shanghai Jiaotong University

基　　金：国家自然科学基金(60903191);上海市自然科学基金(11ZR1418500)资助项目

摘　　要：将传统的BLP(Bell-La Padula)模型扩展,提出了一种适用于网络访问控制的N-BLP模型,通过定义网络元素和构造新的状态转换规则,实现了主体间通信行为的控制,并采用有限状态机理论验证了N-BLP模型的安全性,同时,基于LSM(Linux Security Modules)架构和TCP/IP协议构造了一个符合N-BLP模型的网络访问控制系统原型.结果表明,该系统能够精确控制连接的建立和数据流的传输,保障了不同密级网络系统之间信息交换的安全性.N-BLP model for network access control was proposed based on the traditional BLP model. The new model can control the communication behavior between subjects by defining network elements and constructing new states transition rules. Also, the security validation of the model was given using the finite state machine theory. Further, an N-BLP access control prototype system based on LSM architecture and TCP/IP protocol was implemented. The results show that this system can fine-grainedly control the connection establishment and data flow transmission, and guarantee the security of information exchanging between multi-level network systems.

关 键 词：网络访问控制 BLP模型 引用监视器 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]