基于有限状态机的用户权限隔离模型  

User permission isolation model based on finite state machine

作　　者：李健俊[1] 蒋一翔[2] 钱杰[3] 李威[1] 李瑜 

机构地区：[1]浙江中烟工业有限责任公司信息中心,杭州310009 [2]浙江中烟工业有限责任公司宁波卷烟厂,浙江宁波315040 [3]浙江中烟工业有限责任公司杭州卷烟厂,杭州310008 [4]国家保密科技测评中心,北京100044

出　　处：《计算机应用》2013年第1期149-152,共4页journal of Computer Applications

基　　金：国家核高基项目(2010ZX01037-001-001)

摘　　要：针对操作系统中的权限问题,提出了基于有限状态机(FSM)的用户权限隔离模型,将用户的授权访问行为刻画为一个有限状态机,任意用户的有限状态机都只能识别该用户的合法操作序列;同时,模型证明在用户权限交集的部分,即用户访问发生共享的点,容易出现权限窃取或者非法提升等安全问题。最终,利用有限状态机实现了对用户权限隔离的有效识别与判定。For privilege escalation problem in operating system, a user permission isolation model based on Finite State Machine （FSM） was proposed in this paper, which depicted the users＇ permissions as a FSM. A user＇s permission was mapped to a FSM, which was able to distinguish the legality of user＇s operation sequence. Besides, the model proved that it easily leaded to .permission escalation at the shared permission points. Ultimately, through FSM, the model achieves effective identification and judgment of user permissions isolation.

关 键 词：最小特权 隔离 有限状态机 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]