计算机工程与应用 ›› 2011, Vol. 47 ›› Issue (34): 86-89.

• 网络、通信、安全 • 上一篇    下一篇

基于可信度的多级网络访问控制机制

曹利峰,陈性元,杜学绘,夏春涛   

  1. 解放军信息工程大学 电子技术学院,郑州 450004
  • 收稿日期:1900-01-01 修回日期:1900-01-01 出版日期:2011-12-01 发布日期:2011-12-01

Access control mechanism of multi-level network based trust evaluation

CAO Lifeng,CHEN Xingyuan,DU Xuehui,XIA Chuntao   

  1. Institute of Electronic Technology,the PLA Information Engineering University,Zhengzhou 450004,China
  • Received:1900-01-01 Revised:1900-01-01 Online:2011-12-01 Published:2011-12-01

摘要: 详细分析了BLP模型在网络应用方面存在的不足,提出基于可信度的多级网络访问控制机制。该机制通过收集同一安全域内安全审计系统提供的历史证据,计算主体访问行为在机密性安全属性方面的可信度,根据可信度限定主体对客体的访问违规行为,并合理调整主体安全标记以及客体的存在形式,从而提高了BLP模型在网络应用中的灵活性、可用性,同时也降低了BLP模型中由于可信主体滥用权限而带来的安全风险。

关键词: 安全标记, 安全级别, 可信度, 证据, 等级保护

Abstract: This paper analyzes problem of BLP model which is applied to multi-level network,and puts forward access control of multi-level network based on trust evaluation.The method collects evidences of access history of subject from audit systems in the same secure domain,then evaluates trust degree of subject about violating confidentiality rule by evidences,and adjusts secure label of subject and being of object,which can not only increase flexibility and availability but also reduce risk of information system by misuse of credible subject’s authority? in BLP model.

Key words: secure label, secure level, trust degree, evidence, classified security protection