【作者】 龚雷；

【导师】 沈昌祥；

【作者基本信息】 解放军信息工程大学 ， 密码学， 2013， 博士

【摘要】 伴随着全球信息化建设的不断发展，信息安全日益引起包括中国政府在内的各国政府的高度重视。从上个世纪九十年代起，我国陆续出台了一系列有关信息安全等级保护的条例、法规和标准，经过十几年的不断完善和发展，目前等级保护制度正在全国范围内全面贯彻和落实。在等级保护工作开展过程中，如何在不修改现有应用系统的前提下，为应用系统的安全运行提供可靠而有力的支撑，是信息安全等级保护工作中所要解决的最为关键的问题之一。本文以等级保护工作实际需求为牵引，从构建应用系统安全运行环境的角度出发，研究了应用安全透明支撑平台的体系结构与相关安全模型。应用安全透明支撑平台以可信计算技术和安全操作系统为基础，通过硬件平台和系统软件的安全增强，实现对上层应用的安全、透明、可靠支撑。具体来说，本文的研究成果包括以下几个方面：1.提出了应用安全透明支撑平台的体系结构。该体系结构从高等级信息系统三层防护体系架构入手，针对应用系统面临的典型安全问题，重点研究安全计算环境的构建，充实和完善了信息系统保护环境框架。文中描述了应用安全透明支撑平台的定义，并深入分析该平台的体系架构。通过与等级保护相关标准的比对表明，应用安全透明支撑平台体系结构能够为应用系统提供全面的、切实可行的安全保障。2.研究了面向安全计算环境的应用隔离模型。应用隔离模型根据最小权限原则，将不同应用程序及其对应的应用资源划分到各自的域中。通过强化对应用程序启动过程的约束，实现了应用程序的可信启动；通过制定域间信息隔离规则，确保了域中应用程序在运行过程中的动态安全。该模型具备沙箱模型的特点，其隔离监视器位于操作系统层，克服了应用层隔离机制可靠性不高的缺点；同时充分利用了虚拟化模型的优势，针对部分公共资源进行虚拟化，在保证系统安全稳定运行的前提下，提高了系统运行效率。3.研究了面向安全计算环境的信息交互模型。信息交互模型是对应用隔离模型研究的深化，该模型以无干扰理论为基础，通过细化域中应用进程对资源访问的安全规则，实现域间合法信息的正常交互。针对无干扰理论本身具有高度的抽象性，且安全条件难以直接指导实践的状况，信息交互模型将无干扰理论的构成要素置于应用系统计算环境中，强化其与计算环境组成元素的对应关系，确保在信息交互规则的约束下，应用进程对资源的访问不会受到恶意干扰。4.研究了面向安全计算环境的语义传递模型。语义传递模型将应用层访问控制语义清晰明确的优势，与操作系统层安全机制强度较高的特点相结合，通过在应用层与内核层建立安全管道，实现访问控制语义的无歧义安全传递。在此基础上，由内核层访问监控器对应用层语义进行解析，将应用服务实际用户的访问请求与内核层安全策略相关联，进而做出最终的判决。与单一的应用层访问控制相比，在该模型中，即使应用层访问控制被旁路或篡改，内核层访问控制仍然能够安全可靠地运行。5.设计并实现了应用安全透明支撑平台原型系统。该原型系统以上述体系结构和安全模型为指导，通过在硬件平台和系统平台上增加相应的安全模块，来实现可信初始化、横向安全、纵向安全以及安全集中管理，从而验证理论研究的合理性与可实施性。综上所述，应用安全透明支撑平台的研究能够满足等级保护工作的实际需求，为等级保护工作的全面、深入、可持续性开展，提供切实可行的理论依据和技术保障，对国家的信息安全建设具有重要的现实意义。更多还原

【Abstract】 With the fast development of informatization construction in the world, information securityproblems are being paid more and more attention by most governments including the Chinesegovernment. Since the1990s, the Chinese government has been issuing a series of ordinances,laws and criteria about information security classified protection. After decades of continuousimprovement and development, information security classified protection scheme is beingcarried out in the whole country nowadays. In the process of that work, it is the most urgent issuethat how to support the application system to operate safely and reliably without modifying theexisting application system itself.According to the actual requirement of information security classified protection scheme,the paper researches on the Application Security Transparent Supportive Platform (or ASTSP forshort) architecture and related security models from the perspective of constructing a safeoperation environment for the application system. ASTSP is based on trusted computingtechnology and security operating system, which enhances the safety of hardware platform andsystem software. ASTSP is capable of giving safe, transparent and reliable support to theapplication system. Specifically, some research results have been achieved as follows:1. Propose the ASTSP architecture. In order to solve the typical security problems ofapplication systems, ASTSP architecture focuses on how to establish security computingenvironment which origins from three arrangements protection architecture for high levelinformation system. The definition of ASTSP is described and the ASTSP architecture is givenout, which enriches and perfects the information system protection environment framework.Compared with some related information security classified protection criteria, ASTSParchitecture is able to provide comprehensive and practical safeguard for application systems.2. Study the application isolation model oriented to security computing environment. Themodel is based on the least privilege principle and separates different programs and relatedresources into their own domains. The model sets application program starting rules so that thestartup process can be trusted, and sets isolation rules so that the dynamic security for applicationprogram can be ensured. Compared with typical isolation models, the application isolation modelhas many advantages. On one hand, application isolation model has the feature of sandboxmodel, but the isolation monitor which is built on operating system layer has better reliability.On the other hand, the model uses the merit of virtualization model to virtualize some publicresources in order to satisfy the security requirement, but it has better operation efficiency.3. Study the information interaction model oriented to security computing environment. The model, which deepens the research on application isolation model, is based on non-interferencetheory. The model refines security rules between application process and resource in domains, sothat legitimate information can be transferred among domains. Although non-interference theoryis very abstract and its security conditions are not practical, the model reasonably combines theelements of non-interference theory with that of security computing environment. Therefore,under the restricted conditions of the information interaction rules, application process couldaccess resources without evil interference.4. Study the semantic transmission model oriented to security computing environment. Themodel utilizes merits that the access control semantic on application layer is very clear and thesecurity mechanism on operating system layer is much stronger. Then the model establishessecurity pipe between application layer and operating system kernel, which is used to transmitaccess control semantic unambiguously. After that, access control monitor in the kernel parsesthe semantic, associates the real user request for application server with the security policy andfinally make a judgment. Compare with the single access control mechanism on the applicationlayer, which could easily be bypassed or tampered, the access control mechanism in the kernelimplements more reliably.5. Design and realize the ASTSP prototype system. With the help of ASTSP architecture andsecurity models, the prototype adds some corresponding security modules to hardware andsoftware platform. The prototype realizes trusted initialization, landscape orientation security,portrait orientation security and security centralized management, which validates the rationalityand practice of ASTSP architecture and security models.In conclusion, ASTSP can meet the requirement of classified protection work and providethe work with practical theory basis and technical support. The research on ASTSP has realisticmeaning to the information security construction in our country.更多还原