基于有色Petri网的SELinux安全策略自动化分析  

Automation Analysis of SELinux Security Policy Based on Colored Petri-net

作　　者：郭涛[1] 翟高寿[1] 

机构地区：[1]北京交通大学计算机与信息技术学院,北京100044

出　　处：《信息安全与技术》2013年第11期35-40,共6页

基　　金：中央高校基本科研业务费专项资金资助(课题编号:2009JBM019)

摘　　要：SELinux是嵌入到Linux内核中并得到推广应用的安全增强模块。由于其安全策略配置复杂且工作量较大,故而研究相关的安全策略辅助配置手段及SELinux安全策略的自动化分析方法与技术很有必要。本文基于有色Petri网建立了SELinux安全策略的自动化分析模型,给出了原型实现和测试结果。相关结果表明,有色Petri网分析方法和对应原型能较好地完成SELinux安全策略的有效性分析,并可实现带有中间过滤类型的信息流查询且更加方便简洁。SELinux is a typical security-enhanced module in Linux. But it is hard to configure SELinux for large amounts of security policies. Therefore it＇ s necessary to develop a tool to analyze the security policies automatically, which can be potentially used for SELinux security policy configuration. In this paper, a model for automatic analysis of SELinux security policies based on colored petri-net is build and corresponding prototype is designed and implemented. Test results show that the prototype can perform effectiveness analysis task very well. Moreover, it can do queries about information flows including in-between filtering types simply and conveniently.

关 键 词：SELINUX 安全策略 有色PETRI网 自动化分析 

分 类 号：TP316[自动化与计算机技术—计算机软件与理论]