针对RTOS的轻量级强制访问控制技术的研究与实现  

Research and Implementation of Light-weight Mandatory Access Control Technology for RTOS

作　　者：杨霞[1] 杨姗[1] 郭文生[1] 孙海泳 赵晓燕[2] 张杨[2] 

机构地区：[1]电子科技大学信息与软件工程学院,成都610054 [2]中国航天科工集团第二研究院706所,北京100854

出　　处：《计算机科学》2018年第3期138-143,共6页Computer Science

基　　金：国家科技支撑计划(2012BAH44F00);电子科技大学-中国航天科工二院706所联合实验室项目:嵌入式安全操作系统相关技术研究(2016000228);中央高校基金(ZYGX2016J094)资助

摘　　要：强制访问控制技术可以控制系统中所有主体对客体的访问操作,是系统安全增强的有效措施之一。在实时操作系统中,增加强制访问控制机制可以有效地提高系统的安全性,使其通过较高安全等级的认证。针对实时操作系统资源少、开销小、实时性要求严格等特点,首先提出了一种针对RTOS的轻量级强制访问控制模型;然后提供了可配置的访问监控器,并提出了基于DTE的任务权限集安全模型,设计了轻量级安全策略;最后基于RTEMS系统实现了一个原型系统,并实现了安全策略配置工具。通过功能测试和性能测试验证了该轻量级强制访问控制模型的有效性和可行性。Mandatory access control(MAC)technology can control the accesses of all subjects to objects in the system,which is an effective method to enhance the system security.Implementing the mandatory access control mechanism in a real-time operating system(RTOS)can effectively improve the system security,and make the RTOS pass the high-level certification.Aiming at the problem that the real-time operating system has the characteristics of less resources,low overhead and hard real-time,this paper presented a light-weight mandatory access control(L-MAC)mechanism.The LMAC technology consists of an L-MAC model,a configurable access monitor and a light-weight security policy model with task permission set based on DTE.Finally,this paper implemented a prototype system based on RTEMS system and a security policy tool that can conveniently add,modify or delete a security policy according to user's requirements.The results of multiple tests about function and time overload show that L-MAC mechanism is effective and feasible.

关 键 词：实时操作系统 轻量级强制访问控制 任务权限集 RTEMS 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]