【作者】 黎忠文；

【导师】 熊光泽；

【作者基本信息】 电子科技大学 ， 计算机应用， 2001， 博士

【摘要】 软件的大量应用，使控制系统面临严峻的安全考验陷入了安全危机中，迫切需要新的安全技术。安全核就是应运而生的一种安全保障新概念。本论文以研究安全核在复杂分布式控制系统中的实施方案为目标展开了理论上与实践上的研究，取得了若干有用的成果，并有所突破。 论文首先从服务质量的高度较深入地揭示了安全性研究的本质，总结了近十年来的研究成果及发展趋势，理清了安全性研究和开发高可信计算机系统的思路。然后对分布式控制系统可信性评价的多层次和综合性进行了探索，并根据现场多机系统对可用性和可靠性要求突出的特点，提出了一种建立在系统功能级之上，把可用性和可靠性结合起来评估系统可信性的模型。 在上述基础上，论文从全新的视角（安全软件和引用监控器两个视角）深入地剖析了安全核概念，分析了现有安全核的实施方案不能移用于复杂分布式控制系统的原因。从而提出了建立分布式控制系统安全体系的创新设想、探讨了安全体系应具有的设计目标和实施的可行性，构建了安全体系SSBSK。然后围绕实现安全体系SSBSK所面临的三个主要困难进行了研究： 一是安全核一致性的验证。目前常用的方法是测试法。本文通过定义理想安全策略的概念和建立控制系统的抽象模型，提出了基于形式化的描述和验证的解决方案。并以交通灯控制系统为例进行了全过程的实现。 二是安全核机制的实施。由于目前采用的以应用软件的方式实现安全核的方法存在许多不足，本文提出了RTOS提供安全核机制的方案，并从安全核机制的构成、重用和支持环境三个重要方面分别对该方案进行了设计。在实验室中以RT-Linux为平台进行了SSBSK的原型实验，验证了安全核机制实施方案的有效性和SSBSK的有效性。 三是安全核的可靠性评价。论文对软件可靠性模型的选择及模型评价精度难以确定的问题进行了深入的研究。建立了一种实用的评估误差模型，用它来分析安全核的开发环境对可靠性评估结果产生的影响，从而对安全核的可靠性进行较为准确的预测。一 当前把安全核概念用于复杂分布式控制系统的研究几乎没有开展。作者创新性地提出了安全体系SSBSK，并深入地研究了实现SSBSK所面临的主要困难，提出了解决方案，以支持我国自主的安全关键系统的开发。更多还原

【Abstract】 Since software is being used largely in the control systems, the possibility of serious damage resulting from a software defect is considerable and growing, and then the control systems are plunging into safety crisis. In fact, control systems are in urgent need of new safety assurance technologies. Safety kernel is a new concept of safety assurance. It emerges, as the times require. This dissertation is devoted to the subject on how to bring the safety kernel into practice in the complex distributed control system, and has achieved several useful results, in addition to some breakthroughs in this field. From the perspective of the service quality, the present paper at first comprehensively discusses the nature of safety research, summarizes the research results of the decade, points out the trends in the future, and raises some ideas for safety research and developing high dependable computer systems. Then this paper explores the multi-layer and syntheses of the dependability evaluation of the distributed control system, and points out, in accordance with the fact that the field multiple-computer system has an obvious need for availability and reliability, a model for evaluating the system dependability. This model, based on the systematical function, can combine availability and reliability. Based on the analyses above, and from two new perspectives (software safety and introducing monitor), this paper comprehensively analyzes the concept of safety kernel. Furthermore, it analyses the reasons for which the current safety kernel project can抰 be applied to complex distributed control system, puts forward new ideas for setting up the safety structure of distributed control system, discusses the designing aims for the safety structure and the possibility of being put into practice, and sets up SSBSK (Safety Structure Based on Safety Kernel). The difficulties for the SSBSK to meet are also studied in this paper. The first difficulty is the proving of safety kernel consistency. The present method is test. By defining the concept of ideal safety policy and setting up abstract III models of control system, a solution based on formal description and proving has been put forward. Taking the control system in the traffic lights as example, the whole process has been achieved. The second difficulty is the realization of the safety kernel mechanism. Since there are a lot of shortcomings in the current methods of realizing safety kernel by applying software, this paper advances a program for RTOS to supply safety kernel mechanism, and designs it from three aspects of construction, reuse and supporting circumstances in safety kernel mechanism. Prototype experiment of SSBSK has been done on the RT-Linux platform in the lab, and this experiment has proved the validity of the realization program of the safety kernel mechanism and SSBSK. The third difficulty is the evaluation of the reliability of safety kernel. This paper does a comprehensive research and study on the choice of software reliability model and the problem that it is difficult to decide the model evaluation precision. A practical model of evaluating errors has been established, and by using it to analyze the influence which the safety kernel developing circumstances produces on reliability evaluating results, the reliability of safety kernel can be somewhat accurately predicted. The st更多还原