服务器系统安全内核研究与实现  

RESEARCH AND IMPLEMENTATION OF SECURITY KERNEL SYSTEM FOR SERVER SYSTEM

作　　者：陈伟东[1,2] 王超 张力[2] 徐峥 邢希双 

机构地区：[1]浪潮嘉信信息技术有限公司,北京100085 [2]清华大学软件学院,北京100084

出　　处：《计算机应用与软件》2013年第3期304-307,329,共5页Computer Applications and Software

摘　　要：服务器信息安全面临日益严重的安全威胁。病毒和蠕虫、木马等恶意程序对服务器系统的安全造成威胁。操作系统需要从内核层对安全威胁的主题和客体等加以鉴别控制。在内核层对文件、注册表、进程等作强制访问控制。从系统资源和网络隐蔽通信方面,研究和论述了操作系统安全内核的实现。系统已应用于企业网站、各类服务器等网络安全要求较高的应用场所。强制访问控制,系统地对每个进程、文件、注册表、网络通信等都被赋予了相应的安全属性。安全属性由管理员按照严格的规则来设置。结合最小特权原则和安全审计,在应用层对服务器或集群作安全控制。Information security of server is encountering increasingly serious security menace.Viruses,worms,Trojans and other malicious programs impose the threat on the security of server system.The operating system has the needs to identify and control from kernel layer the subjects and objects imperilling the security.Mandatory access control has to be executed on files,registry,process,etc.in kernel layer.We study and address the implementation of operating system security kernel in terms of system resources and networks covert communication in this paper.The system has been applied to the corporate websites,various types of servers and other network security applications that have higher security requirement.The mandatory access control and each process,file,registry and network communications,etc.are all endued the appropriate security attributes systematically.Security attributes are set by the administrator strictly in accordance with the rules.Combined with the principle of least privilege and security auditing,security control is conducted at the application layer on the server or server cluster.

关 键 词：安全内核 文件驱动 网络安全 隐蔽通信 

分 类 号：TP301[自动化与计算机技术—计算机系统结构]