存取矩阵的设计使得机制与策略相分离.ppt

Chapter 18: Protection 第十八章保护 概述 保护是一种控制机制,　该机制通过限制用户的文件访问类型许可提供受控制访问。 保护必须确保只有那些从操作系统获得了恰当授权的进程才可以操作内存段、处理器和其它资源。 安全要确保系统用户的验证，以保护系统的物理资源和系统存储的住处的整体性。 Chapter 18: Protection第十八章保护 Goals of Protection Domain of Protection Access Matrix Implementation of Access Matrix Revocation of Access Rights Capability-Based Systems Language-Based Protection Protection A computer system is a collection of processes and objects. By objects, we mean both hardware objects and software objects. Each object has a unique name and can be accessed through a well-defined set of operations. Protection problem - ensure that each object is accessed correctly and only by those processes that are allowed to do so. Domain Structure Access-right = object-name, rights-setwhere rights-set is a subset of all valid operations that can be performed on the object.  Domain = set of access-rights  Domain Implementation 一个域可以通过以下几种不同的途径来实现。 每个用户一个域。 每个进程一个域。 每个过程一个域。 域切换 仅有标准双模式（监控－用户模式）不够的 Domain Implementation (UNIX) System consists of 2 domains:双模式 User Supervisor UNIX Domain = user-id　域和用户相关联。域切换会配合用户身份的临时切换。 Domain switch accomplished via file system. Each file has associated with it a domain bit (setuid bit). When file is executed and setuid = on, then user-id is set to owner of the file being executed. When execution completes user-id is reset. Domain Implementation (Multics) Let Di and Dj be any two domain rings. If j I ? Di ? Dj Access Matrix View protection as a matrix (access matrix) Rows represent domains Columns represent objects Access(i, j) is the set of operations that a process executing in Domaini can invoke on Objectj Access Matrix Use of Access Matrix If a process in Domain Di tries to do “op” on object Oj, then “op” must be in the access matrix. Can be expanded to dynamic protection. Operations to add, delete access rights. Special access rights: owner of Oi copy op from Oi to Oj control – Di can modify Dj access rights transfer – switch from domain Di to Dj