基于密码隔离的信息泄漏防御方案  

Information leakage defendable scheme based on crypto-isolation

作　　者：王浩[1] 陈泽茂[1] 黄碧翼[1] 李铮[1] 

机构地区：[1]海军工程大学信息安全系,湖北武汉430033

出　　处：《计算机工程与设计》2013年第5期1579-1583,共5页Computer Engineering and Design

基　　金：国家863高技术研究发展计划基金项目(2009AA01Z437);中国博士后特别基金项目(201003757)

摘　　要：针对传统访问控制模型受限于访问控制策略的高效性和完整性问题,提出一种基于密码隔离的信息泄漏防御方案,方案包含一个信息泄漏防御模型和一个密钥分配方案。信息泄漏防御模型基于密码学原理,克服了逻辑隔离易被旁路的脆弱性,通过引入安全通道部件,为出入单级域的信息进行加解密,以实现不同安全级别信息之间的密码隔离。为达到密码隔离的目的,通过构建安全标签树,基于安全等级和安全范畴分别设计了一套密钥分配方案,实现了对敏感信息的双重加密,分析表明,两种密钥分配方案安全性较高。Traditional access control model is limited by the efficiency and integrity of access control policy, for these, an crypto- based information leakage defendable scheme is proposed which include a information leakage model and a key distribution scheme. The model encrypted and decrypted the in and out information by secure channel component, and made the crypto-isola tion between different security level information came true. According to build security label tree, two key distribution schemes are designed： one based on security classification, the other based on security category. Analysis indicates, the two key distribution scheme had a high security and low cost.

关 键 词：安全模型 密码隔离 安全标签树 双重加密 密钥分配 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]