一种虚拟机系统中关于多级安全的强制访问控制框架Ⅰ:理论(英文)

作者：刘谦; 王观海; 翁楚良; 骆源; 李明禄

来源：China Communications, 2010, 7(04): 137-143.

• Virtual Machine System
• Mandatory Access Control
• Multi-level Security
• Virt-BLP

At present,there are few security models which control the communication between virtual machines (VMs).Moreover,these models are not applicable to multi-level security (MLS).In order to implement mandatory access control (MAC) and MLS in virtual machine system,this paper designs Virt-BLP model,which is based on BLP model.For the distinction between virtual machine system and non-virtualized system,we build elements and security axioms of Virt-BLP model by modifying those of BLP.Moreover,comparing with BLP,the number of state transition rules of Virt-BLP is reduced accordingly and some rules can only be enforced by trusted subject.As a result,Virt-BLP model supports MAC and partial discretionary access control (DAC),well satisfying the requirement of MLS in virtual machine system.As space is limited,the implementation of our MAC framework will be shown in a continuation.

• 单位
  上海交通大学