上海交通大学学报

上海交通大学学报（自然版） ›› 2012, Vol. 46 ›› Issue (09): 1387-1391.

• 自动化技术、计算机技术 • 上一篇    下一篇

不同密级系统间基于BLP的访问控制机制  

（1.上海交通大学 电子信息与电气工程学院， 上海 200240；2.上海市信息安全综合管理技术研究重点实验室， 上海 200240；3.信息网络安全公安部重点实验室, 上海 201204）   

  • 收稿日期:2011-09-27 出版日期:2012-09-28 发布日期:2012-09-28
  • 基金资助:

    国家自然科学基金（60903191），上海市自然科学基金(11ZR1418500)资助项目

BLP Based Access Control Mechanism in Multi-level Network Systems

(1. School of Electronic, Information and Electrical Engineering, Shanghai Jiaotong University, Shanghai 200240, China; 2. Shanghai Key Laboratory of Information Security Synthesis Management Technique Research, Shanghai 200240, China; 3. Key Laboratory of InformationNetwork Security, Ministry of Public Security, Shanghai 201204, China)   

  • Received:2011-09-27 Online:2012-09-28 Published:2012-09-28

摘要： 将传统的BLP (Bell-La Padula)模型扩展，提出了一种适用于网络访问控制的N-BLP模型，通过定义网络元素和构造新的状态转换规则，实现了主体间通信行为的控制，并采用有限状态机理论验证了N-BLP模型的安全性，同时，基于LSM (Linux Security Modules)架构和TCP/IP协议构造了一个符合N-BLP模型的网络访问控制系统原型.结果表明，该系统能够精确控制连接的建立和数据流的传输，保障了不同密级网络系统之间信息交换的安全性.    

关键词: 网络访问控制, BLP模型, 引用监视器

Abstract:  N-BLP model for network access control was proposed based on the traditional BLP model. The new model can control the communication behavior between subjects by defining network elements and constructing new states transition rules. Also, the security validation of the model was given using the finite state machine theory. Further, an N-BLP access control prototype system based on LSM architecture and TCP/IP protocol was implemented. The results show that this system can finegrainedly control the connection establishment and data flow transmission, and guarantee the security of information exchanging between multi-level network systems.  

Key words: network access control, BellLa Padula (BLP) model, reference monitor

中图分类号: