第四讲访问控制.ppt

RBAC For a Bank 强制访问控制（Mandatory Access Control——MAC 用于将系统中的信息分密级和类进行管理，以保证每个用户只能访问到那些被标明可以由他访问的信息的一种访问约束机制。 用户（或其他主体）与文件（或其他客体）都被标记了固定的安全属性（如安全级、访问权限等） 在每次访问发生时，系统检测安全属性以便确定一个用户是否有权访问该文件。 。 Bell-La Padula 机密模型 When is it OK to release information? Two Properties Simple security property A subject S may read object O only if C(O) ? C(S) *-Property A subject S with read access to O may write object P only if C(O) ? C(P) In words, You may only read below your classification and only write above your classification 简单安全特性：主体s要能读对象O, 主体的安全许可等级不得低于对象的安全等级。 仅当C(o) ≤C(s) ,主体s才能对对象o有读访问权 *— 特性：将一个敏感对象写入另一个敏感对象时，要求被写入对象的敏感度至少不低于要写入的对象 仅当C(o) ≤C(p),对对象o有访问权的主体才可以对对象p有写访问权 适用于信息安全，用于识别那些可能导致信息被不适当修改的模型 S Public Proprietary Read below, write above S Public Proprietary Read above, write below Biba完整性模型 Rules that preserve integrity of information Two Properties Simple integrity property A subject S may write object O only if C(S) ? C(O) (Only trust S to modify O if S has higher rank …) *-Property A subject S with read access to O may write object P only if C(O) ? C(P) (Only move info from O to P if O is more trusted than P) In words, You may only write below your classification and only read above your classification 简单完整性特性：仅当I(s)≥I(o) 主体s能够修改对象o 完整性*—特性：如果主体s有权读对象o，仅当I(o) ≥I (p),s有权写对象p S Public Proprietary Read above, write below S Public Proprietary Read below, write above Problem: Models appear contradictory Bell-LaPadula Confidentiality Read down, write up Biba Integrity Read up, write down Want both confidentiality and integrity Contradiction is partly an illusion May use Bell-LaPadula for some classification of personnel and data, Biba for another Otherwise, only way to satisfy both models is only allow read and write at same classification In reality: Bell-LaPadula used more than Biba model, e.g., Common Criteria Summary introduced access control principles subjects, objects, access rights discretionary access con