软件系统的可信降密述评  

Review of Trust Declassification for Software System

作　　者：朱浩[1,2] 陈建平[1] ZHU Hao1,2, CHEN Jian -ping(1School of Computer Science and Technology,Nantong University,Nantong,Jiangsu 226019 ,China;2 Computer Science and Technology, Nanjing University of Aeronautics and Astronautics, Nanjing 21001G ,Chin)

机构地区：[1]南通大学计算机科学与技术学院,江苏南通226019 [2]南京航空航天大学计算机科学与技术学院,南京210016

出　　处：《计算机科学》2018年第B06期36-40,共5页Computer Science

基　　金：江苏省博士后科研资助计划(1401022C);南通大学博士科研启动基金(14B22)资助

摘　　要：无干扰模型是信息流控制中的基础性安全模型,能确保敏感信息的零泄露,但其安全条件的限制性过强。软件系统由于功能的需要不可避免地需要违反无干扰模型,释放合适的信息。为了防止攻击者利用信息释放的通道获取超额的信息,需要对释放的通道进行控制,建立信息可信降密的策略和实施机制。基于不同维度对现有的降密策略进行归类,大致归并为降密的内容、主体、地点和时间维度;并对现有降密策略的实施机制进行分类,大致可分为静态实施、动态实施和安全多次执行;对这些机制的特点和不足之处进行比较,并探讨了后续研究面临的挑战,展望了未来的研究方向。Non-interference model is the baseline security model of information flow control.It ensures zero leakage of secret information,but its restrictiveness of security condition is too strong.Software system inevitably violates non-interference model and releases proper information for its requirement of function.In order to prevent attacker obtain extra information from the channel of information release,the channel should be under control and trusted declassification policy and enforcement mechanisms should be established.Existing declassification policies are classified into WHAT,WHO,WHERE and WHEN dimensions,and existing enforcement mechanisms are classified into static enforcement,dynamic enforcement and secure multi-execution.The characteristics and deficiencies of these mechanisms were compared,the challenge of following study was discussed,and the direction of future study was out-looked.

关 键 词：可信降密 信息流控制 无干扰 机密性 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]