摘要
针对系统服务中的特权用户问题,提出一种面向服务进程的用户权限隔离模型,依据安全级别将用户、隔离域、程序模块进行映射关联,利用虚拟化技术为不同用户构造相互隔离的运行环境,形式化定义用户隔离域,给出虚拟化构建隔离域的关键技术及实现方法,从而实现用户权限的隔离,消除系统中潜在的特权用户。
In order to solve the unnecessary root users in the operating system services,a user permission isolation model is proposed.Based on the mapping link among users,isolated domains and program modules according to the security level,associated with the use of virtualization,isolated runtime environments are constructed for different users.The model gives formal definition of user isolated domain and the key mechanisms for its implementation.The model realizes least privilege principle for the isolated domain,and the paper gives the conclusion that potential root users are eliminated in the isolated domains.
出处
《计算机工程》
CAS
CSCD
北大核心
2011年第23期141-143,146,共4页
Computer Engineering
基金
国家"863"计划基金资助项目(2009AA01Z437)
国家"973"计划基金资助项目(2007CB311100)
信息安全国家重点实验室(中国科学院软件研究所)开放课题基金资助项目
关键词
最小权限
虚拟化
隔离
特权用户
域
系统服务
least permission
virtualization
isolation
privileged user
domain
system service
