信息安全模型讲义.ppt

单击此处编辑母版标题样式,单击此处编辑母版文本样式,第二级,第三级,第四级,第五级,08 十一月 2026,信息安全模型讲义,信息安全模型,1 安全模型概念,2 访问控制模型,3 信息流模型,4 完整性模型,5 信息安全模型,1 安全模型概念,安全模型用于,精确地和形式地描述,信息系统的安全特征，以及用于,解释,系统安全相关行为的理由。,分类1：访问控制模型，信息流模型。,分类2：机密性要求，完整性，可用性,DoS,，等,现有的“安全模型”本质上不是完整的“模型”：仅描述了安全要求(如：机密性)，未给出实现要求的任何相关,机制,和方法。,1.1 安全模型,安全目标：机密性，完整性，DoS，,控制目标：保障（TCB Trust Compute Base,Reference Monitor），安全政策（Policy,DAC MAC,），审计,安全模型的形式化方法：,状态机，状态转换，,不变量,模块化，抽象数据类型（面向对象,）,1.2 安全模型作用,设计阶段,实现阶段,检查阶段（Review）,维护阶段,1.3 安全模型抽象过程,Step 1:Identify Requirements on the,External Interface,.(input,output,attribute.),Step 2:Identify,Internal Requirements,Step 3:,Design Rules,of Operation for,Policy Enforcement,Step 4:Determine,What is Already Known,.,Step 5:Demonstrate(论证),Consistency,and,Correctness,Step 6:Demonstrate,Relevance,（适当的）,1.4 Overview,机密性,访问控制,信息流,DAC自主,MAC强制,完整性,RBAC,BLP,Chinese Wall,（非干扰性，非观察性）,Biba,Clark-Wilson,the“Chinese Wall”Policy is a mandatory access control policy for,stock market analysts,.This organizational policy is legally binding in the United Kingdom stock exchange.,2 访问控制模型,2.1 自主访问控制（Discretionary Access Control-DAC）,机密性与完整性,木马程序,2.2 强制访问控制（Mandatory Access Control-MAC）,机密性,隐通道,2.3 基于角色访问控制(RBAC),管理方式,2.1 自主访问控制,特点,：,根据主体的,身份,和,授权,来决定访问模式。,缺点,：,信息在移动过程中，其,访问权限关系,会被改变。如用户A可将其对目标O的访问权限传递给用户B，从而使不具备对O访问权限的B可访问O。,状态机,Lampson 模型,模型的结构被抽象为状态机，,状态三元组,(,S,O,M,),，,S,访问,主体集,，,O,为访问,客体集,（可包含,S,的子集），,M,为,访问矩阵,，矩阵单元记为,M,s,o,，表示,主体,s,对客体,o,的访问权限。所有的访问权限构成一有限集,A,。,状态变迁,通过改变访问矩阵,M,实现。,该安全模型尽管简单，但在计算机安全研究史上具有较大和较长的影响，,Harrison,、,Ruzzo,和,Ullman,提出,HRU,安全模型以及,Bell LaPadula,提出,BLP,安全模型均基于此。,HRU,模型(1),系统请求的形式,if,a,1,in,M,s,1,;o,1,and,a,2,in,M,s,2,;o,2,and,.,a,m,in,M,s,m,;o,m,then,op,1,.,op,n,HRU,模型(2),系统请求分为,条件,和,操作,两部分，其中,a,i,A,，并且,op,i,属于下列六种元操作之一（元操作的语义如其名称示意）：,enter,a,into,(,s,o,),（,矩阵,）,delete,a,from,(,s,o,),create subject,s,（,主体,）,destroy subject,s,create object,o,（,客体,）,destroy object,o,。,HRU,模型(3),系统的安全性定义：,若存在一个系统，其初始状态为,Q,0,，访问权限为,a,，当从状态,Q,0,开始执行时，如果,不存在将访问矩阵单元不包含的访问权限写入矩阵单元的系统请求,，那么我们说,Q,0,对权限,a,而言是安全的。,系统安全复杂性基本定理：,对于每个系统请求仅含一个操作的单操作请求系统（,mono-operational system-MOS,），系统的安全性是,可判定的,；,对于一般的非单操作请求系统（,NMOS,）的安全性是,不可判定的,。,HRU,模型(4),基本定理,隐含的窘境,：,一般的,HRU,模型具有,很强的,安全政策,表达能力,，但是，,不存在,决定相关安全政策效果的,一般可计算的算法,；（递归可枚举）,虽然,存在,决定满足,MOS,条件的,HRU,模型的安全政策效果的一般的可计算的算法，但是，满足,MOS,条件的,HRU,模型的,表达能力太弱,，以至于无法表达很多重要的安全政策。,HRU,模型(5),对,HRU,模型进一步的研究表明，即使我们完全了解了扩散用户的访问权限的程序，在,HRU,模型中也,很难预测访问权限怎样被扩散,。,与此相关，由于用户通常不了解程序实际进行的操作内容，这将引起更多的安全问题。例如，用户甲接受了执行另一个用户乙的程序的权利，用户甲可能不知道执行程序将用户甲拥有的与用户乙完全不相关的访问权限转移给用户乙。类似的，这类表面上执行某功能（如提供文本编辑功能），而私下隐藏执行另外的功能（如扩散被编辑文件的读权限）的程序称为特洛伊,木马程序,。,2.2 强制访问控制,特点：,(1).将主体和客体分级，根据主体和客体的级别标记来 决定访问模式。如，绝密级，机密级，秘密级，无密级。,(2).其访问控制关系分为：上读/下写，下读/上写,（完整性）,（机密性）,(3).通过梯度安全标签实现单向信息流通模式,。,Ln Hi,Hn Hi,Hn Li,Ln Li,BLP模型,类似于HRU模型，BLP模型的组成元素包括访问主体、访问客体、访问权限和访问控制矩阵。但BLP在集合,S,和,O,中不改变状态,函数 F:S O L，语义是将函数应用于某一状态下的访问主体与访问客体时，导出相应的安全级别。,安全级别L构成不变格，,状态集V在该模型中表现为序偶（F，M）的集合，M是访问矩阵。,变迁函数T：VRV。R请求集合，在系统请求执行时，系统实现状态变迁。,BLP模型 (1),定义,4.1,：,状态,(F,M),是,“,读安全,”,（也称为,“,simple security,”,）的充分必要条件是,定义,4.2,：,状态,(F,M),是,“,写安全,”,（也称为,“,*,-property,”,）的充分必要条件是,定义,4.3,：,状态是,“,状态安全,”,（,state secure,）的充分必要条件是它既是,“,读安全,”,又是,“,写安全,”,。,定义,4.4,：,系统,(,v,0,R,T,),是安全的,充分必要条件是,初始状态,v,0,是,“,状态安全,”,的，并且由初始状态,v,0,开始通过执行一系列有限的系统请求,R,可达的每个状态,v,也是,“,状态安全,”,的。,BLP模型 (2),定理,4.3,：,系统,(,v,0,R,T,),是安全的,充分必要条件,是,其中，,T,为转移函数，是指由初始状态,v,0,通过执行一系列有限的系统请求,R,到达可达状态,v,。,BLP模型 (3),“,读安全,”,禁止低级别的用户获得高级别文件的读权限。,“,写安全,”,防止高级别的特洛伊木马程序把高级别文件内容拷贝到低级别用户有读访问权限的文件。,自主vs.强制,1.自主式太弱,2.强制式太强,3.二者工作量大，不便管理,例，1000主体访问10000客体，须1000万次配置。如每次配置需1秒，每天工作8小时，就需,10，000，000/（3600*8）=347.2天,自主vs.强制,2.3 RBAC模型,角色的概念,：,角色的抽象定义是指相对于特定的工作活动的一系列行动和职责集合，角色面向于用户组，但不同于用户组，角色包含了,用户集和权限集。,2.3 角色控制与DAC、MAC,角色控制相对独立，根据配置可使某些角色接近DAC，某些角色接近MAC,2.3 RBAC模型,基本模型RBAC0,角色分级模型RBAC1,角色限制模型RBAC2,统一模型RBAC3,RBAC3,RBAC1 RBAC2,RBAC0,2.3 RBAC模型,2.3 RBAC模型,2.3 RBAC模型,2.3 RBAC模型,2.3,角色控制优势,便于授权管理,便于角色划分,便于赋予最小特权,便于职责分担,便于目标分级,强制vs.信息流,隐通道：,访问控制模型通过对访问主体与访问客体的控制实施安全策略，但恶意的用户仍然可能利用系统的副作用（边界效应）形成从高安全级别到低安全级别的,隐通道。,信息流模型：不对访问主体与客体实施控制，而是直接控制用户间的信息流,例如：if,a=0,then,b:=c,information flows,explicitly,from c to b(when a=0)and,implicitly,from a to b(when b=,c).,3 信息流模型,信息流概念：,信息流可表述为,“,从对象,a,流向对象,b,的信息（信息流）是指对象,b,的值,按某种方式依靠,对象,a,的值,”,。,3 信息流模型,对于程序语言代码我们可以通过枚举所有程序变量间的信息流，从而验证是否存在不合法信息流。,信息流模型的形式化是,状态机,模型，因此可以形成一系列信息流,“,断言,”,，信息流,“,断言,”,也称为安全性质，安全性质包括非干扰性(non,interference)和非观察性(nonobservability)等,描述工具使用,Hoare,逻辑的,SPA,语言（,Security Process Algebra,SPA,）（trace）,3 信息流模型,4 完整性模型,数据完整性,信息保护，DATABASE（,域，实体，引用，应用语义，并发控制,）,系统完整性,系统保护，硬件保护，容错技术,完整性目标,Preventing Unauthorized Users From Making Modifications,(机密性),Maintaining Internal and External Consistency,(一致性),Preventing Authorized Users From Making Improper Modifications,(逻辑一致性),完整性原理,1 IDENTITY,2 CONSTRAINTS,3 OBLIGATION(职责),4 ACCOUNTABILITY,5 AUTHORIZATION,6 LEAST PRIVILEGE,7 SEPARATION,8 MONITORING,9 ALARMS,10 NON-REVERSIBLE ACTIONS,11 REDUNDANCY,12 MINIMIZATION.,Variable Minimization,Data Minimization,Target Value Minimization,Access Time Minimization,BIBA模型,完整性策略,BIBA认为内部威胁已经由程序测试与验证技术作了充分地处理；BIBA;模型仅针对外部威胁。,低限策略,Low-Water Mark Policy,针对客体的低限策略,Low-Water Mark Policy for Objects,低限的完整性审计策略,Low Water Mark Integrity Audit Policy,环策略,Ring Policy,严格的完整性策略,Strict Integrity Policy,低限策略,for_all s element_of S,o element_of O,s,m,o=il(o),leq,il(s),for_all s1,s2 element_of S,s1,i,s2=il(s2),leq,il(s1),For each observe access by a subject s to an object o:,il(s)=,min,il(s),il(o),where il(s)is the integrity level of s immediately following the access.,Clark-Wilson模型,Clark-Wilson模型定义的四个要素:,constrained data items(,CDIs,),unconstrained data items(,UDIs,),integrity verification procedures(,IVPs,),and transformation procedures(,TPs,).,There are nine,certification,(C),and,enforcement,(E),rules that govern the interaction of these model elements.,Certification,is done by the security officer,system owner,and system custodian with respect to an integrity policy;,enforcement,is done by the system.,Clark-Wilson完整性原理,The principle of,separation of duty,states no single person should perform a task from beginning to end,but that the task should be divided among two or more people to prevent fraud(,欺骗,)by one person acting alone.,The principle of,well-formed transaction,(合式事务),is defined as a transaction where the user is unable manipulate data arbitrarily,but only in constrained(limitations or boundaries)ways that preserve or ensure the,integrity of the data,.A security system in which transactions are well-formed ensures that only,legitimate actions,can be executed.Ensures the internal data is accurate and consistent to what it represents in the real world.,验证性规则,C1(IVP Certification),-The system will have an,IVP,for validating the integrity of any CDI.,C2(Validity),-The application of a,TP,to any CDI must maintain the,integrity,of that CDI.CDIs must be certified to ensure that they result in a valid CDI,C3,-A CDI can only be changed by a,TP,.TPs must be certified to ensure they implement the principles of,separation of duties,&,least privilege,C4(Journal Certification),-,TPs,must be certified to ensure that their actions are,logged,C5,-,TPs,which,act on UDIs,must be certified to ensure that they result in a valid CDI,强制性规则,(,Amoroso,),E1(Enforcement of Validity),-,Only certified TPs can operate on CDIs,E2(Enforcement of Separation of Duty),-,Users must only access CDIs through TPs for which they are authorized.,E3(User Identity),-,The system must authenticate the identity of each user attempting to execute a TP,E4(Initiation),-,Only administrator can specify TP authorizations,The CW model,differs from,the other models that allow subjects to gain access to objects,directly,rather than,through programs.The,access,triple is at the heart of the CW model,which prevents unauthorized users from modifying data or programs.,NT安全模型概要,基本组件,:,Logon process,which accept logon request from users.It is the process that accepts the users initial interactive logon,password,authenticates it,and grants entry into the system.,LSA,(Local Security Authority).,is the,heart,of the security subsystem.It verifies the logon information from the SAM database and ensures that the user has permission to access the system.It generates,access token,administers the local security policy defined in the system and is responsible for auditing and logging security events.,Security Account Manager(SAM),is the database that contains information for all user and group account information and validates users.,Security Reference Monitor,provides real-time services to validate every object access and action made by a user to ensure that the access or action is authorized.This part enforces the access validation and audit generation policy defined by the Local Security Authority.,Security Identifiers(SIDs),Each user of Windows NT has a unique security ID(SID).When a user logs on,Windows NT creates a security access token.,Resources,such as processes,files,shares,and printers are represented in Windows NT as objects.,Users never access these objects directly,but Windows NT acts,as a proxy,to these objects,controlling access to and usage of these objects.,A subject,in Windows NT is the combination of the users access token plus the program acting on the users behalf.Windows NT uses subjects to track and manage permission for the programs each user runs.,Rule 1.,The system will have an IVP for validating the integrity of any CDI.,In Windows NT there is a,local security authority,(,LSA,)which checks the security information in the subjects access token with the security information in the objects security descriptor,Rule 2.,The application of a TP to any CDI must maintain the integrity of that CDI,In Windows NT,most subjects cannot change the attribution of the objects,but some subjects have this privilege,such as administrator But this is only limited to some special users.So this rule is,not,applied to Windows NT,strictly,Rule 3.,A CDI can only be changed by a TP,As mentioned above some special users can change attribution of the objects,and no other methods can be applied to change objects,Rule 4.Subjects can only initiate certain TPs on certain CDIs,In windows NT,the subjects access token includes what kinds of operations are permitted.Only when information of the access token is consistent with the information in the objects security descriptor,the operation is allowed,C-W 模型的NT解释,Rule 5.,CW-triples must enforce some appropriate separation of duty policy on subjects,In Windows NT,administrator,can do anything.So this rule is,not applied,Rule 6.,Certain special TPs on UDIs can produce CDIs as output,In Windows NT,users can change the object from without,ACL state,to with ACL state.Generally,this operation is performed by,Administrator,Rule 7.,Each TP application must cause information sufficient to reconstruct the application to be written to a special append-only CDI,In Windows NT,audit services can collect information about how the system is being used,Rule 8.,The system must authenticate subjects attempting to initiate a TP,In Windows NT,any user has her or his SID,and any process in behalf of this user copies the same SID.By this way,Windows NT can authenticate subjects attempting to initial a TP,Rule 9.The system must only permit special subjects(i.e.,security officers)to make any authorization-related lists.,In Windows NT,only administrator can do and view some high security events,5 信息安全模型,主要参考文献,A Guide to Understanding Security Modeling in Trusted Systems NCSC-1992,Integrity in Automated Information Systems NCSC-1991,1给计算机系统的资产分配的记号被称为什么？,C,A安全属性B安全特征,C安全标记D安全级别,2ITSEC标准是不包括以下哪个方面的内容？,D,A功能要求B通用框架要求,C保证要求D特定系统的安全要求,3以下哪些模型可以用来保护分级信息的机密性？,B,ABiba模型和BellLapadula模型,BBellLapadula模型和信息流模型,CBellLapadula模型和ClarkWilson模型,DClarkWilson模型和信息流模型,4桔皮书主要强调了信息的哪个属性？,B,A完整性 B机密性 C可用性D有效性,5ITSEC的功能要求不包括以下哪个方面的内容？,D,A机密性B完整性C可用性 D有效性,6OSI中哪一层不提供机密性服务？,D,A表示层B传输层 C网络层 D会话层,7在参考监控器的概念中，一个参考监控器不需要符合以下哪个设计要求？,B,A必须是TAMPERPROOFB必须足够大,C必须足够小 D必须总在其中,8在以下哪种安全模型中，系统的访问至少在最高层是安全的？C（301页）,A多级安全模型 BDedicated安全模型,CCompartmented模型 D受控模型,