Research And Implementation Of An Extened DTE Model

In China, the country has established a suite of national standard to mostlyprotect the computer information system security, which explicitly requires highsecurity level information system using mandatory access control mechanism.Mandatory access control technology limits the behavior ability of the subject of thesystem in the system scope, supplying a strong protection for the computer systems.However, it is not easy to understand and configure the security policy of the presentmandatory access control mechanisms, for the theoretical ideas are highly pure, andthe policy configuration tasks are tedious, and so on. Meanwhile，the securityprotection of the security operating system requires to be sustained, but because of avariety of reasons, the existing security systems can t satisfy this requirement, forexample, the classic SELinux connivance mode (permissive), does not actuallyenforce the access control operations, which leaves a security risk to the system. Inaddition, there are also highly centralized user privileges problems in most existingsecurity systems in recent, which provides privileged users the opportunity ofperforming illegal destruction activities.In this paper, aiming at the demands of work and security, and specificrequirements for mandatory access control security level of production informationsystem protection standards, and to solve the above problems, I use the general designprinciples and methods of the security systems, and draw lessons from the ideas andmethods of software engineering, and refer to SELinux subsystem, subtly mergeimproved two-dimension access control model and DTE model, designed and builtthe including BLP and Biba, extended DTE model, for short BBED model. Thesecurity model solves the above problems, and provides a simple method to configureand manage the security policy, ensuring the system security as well as providingexcellent ease of use.This paper has done lots of works surrounding the system security model, now Ican summarize them into the following four points:First, on the base of DTE access control model and the two-dimensional accesscontrol model, meditating the management requirements of the security levelprotection, on the base of linux prototype system, I design a security policy modelwhich lives up to the requirements of security level protection and mandatory accesscontrol, and use easily. Second, deeply analysising the linux environment typical applications, and onthe base of the mechanism of separation of powers, I design the security policyconfiguration method, which considers both safety and easy use.Third, on the base of the security policy and security policy format, takingadvantage of system security audit mechanisms, I design a set of automatic policyconfiguration tools in the user space to implement automatic policy configuration.Forth, with the help of the laboratory project the enhanced high security leveloperating system, that is to say, security easy operating system, simply SecEOS forshort design and build, examine the enhanced security module and related tools.