【作者】 谭良；

【导师】 周明天；

【作者基本信息】 电子科技大学 ， 计算机应用技术， 2007， 博士

【摘要】 操作系统安全是信息系统安全的基石。40多年来，安全操作系统得到了长足的发展，并在访问控制框架和安全模型方面均取得了丰硕的成果。但是，纵观安全操作系统的发展历史，可以发现安全操作系统的主要应用范围仍然是在国防和军事领域，在商用和民用领域尚未有成熟的安全操作系统出现。迄今为止，在整个国际上，安全操作系统的应用并不成功，在实际应用中发挥作用的操作系统绝大部分不是安全操作系统。究其本质，一方面，安全操作系统还存在诸多不完善的地方。另一方面，随着基于互联网的应用系统不断增多，人们所面临的安全问题也与日俱增，传统的信息安全解决不了当前面临的复杂安全问题，需要构建新一代适应信息发展需求的可信计算环境。本论文回顾安全操作系统的发展历程，结合当前安全操作系统的现状，剖析了安全操作系统存在的主要问题。以可信计算技术为背景提出了可信操作系统概念。并对可信操作系统的体系结构、引导过程、自身完整性测量、用户登录过程、时间适应的通用动态多安全政策支持框架、用户行为可信及客体可信等问题进行了深入研究并取得了如下成果：1．对“可信操作系统”概念的研究以安全操作系统和可信计算技术为基础，明确定义了可信操作系统的概念，指出可信操作系统是能够通过支持多种安全政策来适应环境变化，并保证在系统中的本地或远程实体的行为总是以预期的方式和意图发生的，客体内容是真实、保密和完整的，以及自身完整性的操作系统。分析了可信操作系统的内涵和特点以及可信操作系统与安全操作的关系。从分析可以看出，可信操作系统和安全操作系统是有联系的，安全操作系统是可信操作系统的基础，安全操作系统中的安全模型和访问框架同样适合于可信操作系统。而可信操作系统与安全操作系统又是不同的，可信操作系统研究的是如何为用户提供一个可信的计算环境，而安全操作系统研究的是如何为用户提供一个基础安全平台。“可信”的内涵和外延均包括了“安全”[TAN2006a】。2．对可信操作系统完整性度量的研究在分析普通操作系统引导流程的基础上，研究了可信操作系统的可信引导过程。文中将可信操作系统的引导流程分成两个阶段：一是可信硬件引导流程：二是操作系统可信启动流程。并指出了可信操作系统整个引导流程中存在的问题。为此，提出了一种新的可信引导过程—并行可复原可信引导过程，即在主机CPU与可信硬件之间采用并行工作方式，并支持被验证组件代码的备份和恢复。然后利用通道技术设计和实现了这一引导过程。对此引导过程进行的安全性分析和性能分析表明，该引导过程可以使计算机获得更高的安全保障，为进一步建立可信计算环境提供了基础[TAN2006b，TAN2006c]。3．对可信操作系统用户登录认证方式的研究传统主流操作系统用户登录认证方式有如下缺陷：(1)存储不可信问题。口令、密钥或特征码等这些在认证过程中需要的数据信息存放在存在安全隐患的地方，如：操作系统的文件系统中，尽管实施了保护，但保护力度是不够的，(2)单向认证问题。即只能操作系统验证用户，而用户不能验证操作系统。文中提出了一种新的用户登录认证方式：基于可信硬件的用户登录可信认证。该认证方式将用户的身份信息、相关的密钥信息等存储在可信硬件中，并利用USBKEY技术、动态的口令技术来确保用户身份的真实可信。克服了操作系统用户登录传统认证方式的缺陷，支持双向认证。较好地解决传统主流操作系统面临的用户登录认证问题[TAN2007a]。4．对可信操作系统中用户行为监管的研究“开域授权”和“内部攻击”成为了各类信息流失事件的主要行为模式。内部用户利用“开域授权”和“内部攻击”形成Insider Threat的危害性远远大于Outsider Threat。可信操作系统必须考虑对内部用户行为的监管。文中分析了操作系统中用户行为的特征及其描述方法，提出了一种基于用户行为树的用户行为监管模型，该模型依据操作系统行为树来分析用户在操作系统中可能存在的“开域授权”和“内部攻击”行为踪迹，根据用户行为的层次性来实现对用户行为的监管。其间采用了基于行为树的不良行为过滤算法，可以有效防止合法用户的“开域授权”和“内部攻击”行为，保证用户行为的可信性，是传统访问控制理论的有益补充[TAN2006f]。5．对可信操作系统中可信客体的研究安全操作系统在处理客体时存在不足，而且不能保证客体内容的真实性，文中首先分析了操作系统中客体的类型，将客体分为静态客体和动态客体，提出可信静态客体、可信动态客体和可信客体的概念，并分析了可信客体的特点以及与安全客体的关系[TAN2007b】。为了保证可信静态客体内容的真实性，提出了基于可信硬件的静态客体可信验证系统(TASSOBT)。该系统通过可信静态客体的映像文件来记录可信静态客体的来源、处理行为和内容变化的签名，并存于可信硬件中。解决了安全操作系统对静态客体处理存在的缺陷。[TAN2007 c]。为了阻止黑客利用动态客体进行欺骗和中间人攻击，防止信息泄露，提出了基于可信硬件的可信动态客体监管系统(MSTDOBT)。该系统可以保证主体和可信动态客体之间进行双向身份认证。解决了安全操作系统在处理动态客体时存在的缺陷[TAN2007d】。TASSOBT和MSTDOBT为进一步建立可信计算环境提供了基础。除上述工作外，本论文还对可信操作系统的其他安全保障技术进行了研究和探讨，主要集中在以下两个方面：1．公开密钥基础设施证书撤消机制的研究网络中终端可信需要证明。可信计算的技术基础是公开密码技术，并采用了多种证书实现证明。随着证书规模增加，大规模证书撤消列表(CRL)的维护是一个最为棘手的问题。文中提出两个CRL发布新模型：CRL分段-过量发布综合模型和CRL增量-过量发布综合模型。分段-过量发布综合模型采用先将CRL(Certificate Revocation List)分段，然后各段独立过量发布的方式来实现。该方式既可以减少CRL的长度，使存储库以更快的速度提供请求服务，又可以降低峰值请求率、峰值带宽和平均负荷，减少时间碎片。虽然分段-过量模型的平均请求率比过量模型大，只要合理确定和调整参数D和S，就可以把平均负荷和峰值带宽控制在要求的范围内。增量-过量发布综合模型采用将Delta-CRLs的Base CRL过量发布来实现。该方式既可以减小信任方下载的CRL大小，改善了响应时间，减少时间碎片；又可以降低对Base CRL峰值请求率，从而降低对存储库的峰值带宽和平均负荷。而且，增量-过量发布综合模型优于传统模型和增量模型，但其发布性能依赖于PKI系统的证书有效期、证书吊销率、Delta CRL的颁发周期和时间跨度。Delta CRL的颁发周期越长，时间跨度越大，证书吊销率越高，证书有效期越短，过量发布Base CRL所带来的性能优化就越小。因此，增量-过量模型适合于在Delta CRL的颁发周期和时间跨度较短、证书吊销率不高、证书有效期较长的大型PKI系统中。[TAN2005a，TAN2005b]。2．对安全需求体系结构描述语言的研究传统的体系结构描述语言没有专门针对安全需求的构件、连接件和体系结构风格的描述，因此，在体系结构层次上描述安全需求还比较困难。文中提出了一种基于XML的安全需求体系结构描述语言—XSSRA/ADL，它引入了安全构件、半安全构件、安全连接件、半安全连接件等设计单元，不仅能够描述安全需求的体系结构，而且也较好地解决了软件系统中业务需求与安全需求在高层的交互和依赖关系。另外，XSSRA/ADL采用数据互操作标准XML作为元语言，这使得它具有与其他ADL的互操作性，并便于支持系统的精化和演化。[TAN2006e]。更多还原

【Abstract】 Security of the Operating System (OS) is the foundation for that of the information systems. Move than 40 in the last yeares, the Secure Operating System (SOS) had been developing greatly, and had achieved plentiful and substantial achievements. But viewed the developing history of the SOS, there is no mature SOS yet in commercial and civil fields, and the SOS is still used in the national defense and the military affairs fields. Until now, the SOS does’t succeeds in the whole world. What are the reasons on earth? One is that the SOS is incomplete and has some problems; the other is that the traditional information security technologies can’t resolve the currently complex secure problems which grow day by day with the increasing application systems in Internet.In this thesis, we have reviewed the post progress of the SOS and the important achievements in this research area. According to the current state of the SOS, the main problems about the SOS are analyzed, and depended on the Trusted Computing (TC), the concept of the Trusted Operating System (TOS) is firstly put forward. After that, the properties, the connotation of the TOS, and the relationship to the SOS are addressed. Moreover, this thesis lucubrates on the architecture, booting, self-integrity measure, login, the framework of dynamic multi-policies with time character, the behaviors creditability and the object creditability of the TOS and results in the following innovative achievements:1. Proposing firstly the concept of the TOSBased on the technologies of the SOS and the TC, the concept of the TOS is firstly defined. The TOS is the OS which can fit for the environment changes by supporting the flexible and adaptive multi-policies, and can guarantee the inside user behaviors are always in ways their advocates predict, and can assure the confidentiality, the integrity, and the creditability of the object and the self-integrity. Then, we have addressed some relationships between the TOS and the SOS: on the one hand, the SOS is the foundation of the TOS, the security models and the access frameworks in the SOS are fit for the TOS too; on the other hand, the TOS is different to the SOS, the object of the SOS is providing a basic secure platform to users, but that of the TOS is providing a trusted computing environment to users. [TAN2006a]2. Proposing a new parallel recovery trusted startup process based on the Trusted Hardware for self-integrity of the TOSBased on the analysis of the common startup process in the traditional OS, the trusted startup process is analysed, which is divided into two phases, the former phase is the startup of the TH, the later phase is the startup of the OS kernel, and some problems about the trusted startup process are addressed. For resolving those problems, a new trusted boot process, called a Parallel Recovery Trusted Startup Process (PRTSP), which makes a parallel working between CPU and TPM, and supports backup and recovery, has been put forward. The PRTSP has been implemented by channel technology. It is shown by analysis of the security and performance of the PRTSP that high assurance of system security has been gained, thus the basis for building the trusted computing environment has been provided [TAN2006b, TAN2006c].3. Proposing a trusted login authentication projectThere are some deficiencies about the login authentication in the traditional OS as follows: (1) the untrusted storage. The important data, such as the passwords, the keys or the character codes, and so on, which must be verified when the user logins, are saved insecurely, for example, the passward is saved in the file system, the protection supplied by the file system to these important data is insufficient; (2) the login authentication in the traditional OS is the one-way authentication, that is to say, only the OS can verify the user, but the other way round can’ t. So a new identity authentication, called the Trusted Login Authentication Based on the TH (TLABT), has been put forward. The TLABT can be come true by USB interface which joints the TH, and stores the users’ identities and the keys in the TH. The TLABT can overcome the traditional deficiencies and support the bidirectional authentication technology [TAN2007a].4. Proposing an insider behavior monitoring model based on the user behavior tree to preventing from the "open authority behavior" and the "insider threat behavior"The "open authority behavior" and the "insider threat behavior" have become the main behavior mode which lets the inside information out. The Insider Threat caused by the "open authority behavior" and the "insider threat behavior" is more serious than the Outsider Threat, so the TOS should monitor the insider behavior. For solving that, the characters of the insider behaviors and the formal description are analyzed firstly, and then, an insider behavior monitoring model based on the user behavior tree has been put forward. This mode can acquire the "open authority behavior" and the "insider threat behavior" traces by the OS behavior-tree, and make use of the behavior-tree hierarchy to monitor the insider behaviors. In all, this model, which uses the algorithm based on the user behavior-tree for filtering the user vice-behavior, can effectively prevent from the "open authority behavior" and the "insider threat behavior", guarantee the user behaviors creditability, and is an available complementarity for the traditional access control theory [TAN2006f].5. Proposing the concept of the trusted objectThe SOS can’ t guarantee authenticity of the objects. For resolving that, the object types in the operating system have been analyzed firstly, the concepts of the trusted static object, the trusted dynamic object, and the trusted object have been put forward, and then the characters of the trusted object, the relationship between the secure object and the trusted object are addressed[TAN2007b]. To guarantee creditability of the trusted static object in the TOS, the Trusted Authentication System for the Static Object Based on the TH (TASSOBT) has been brought forward. The TASSOBT will create the mapping file for each trusted static object, which records the original, the actions and the signature for the content changes and is saved into the TH [TAN2007c]. For preventing the dynamic object in the TOS from leaking the information out, the Monitor System for the Trusted Dynamic Object based on the TH (MSTDOBT) has been presented, which can guarantee identity authentication between the subject and the trusted dynamic each other[TAN2007d]. The TASSOBT and the MSTDOBT are the foundation for the trusted computing environment.Besides those works, this paper has done some works in exploring the other security mechanism which has positive effects for the trused operating system:1. Proposing the Segmented and Over-Issued CRL synthesis mode and the Delta and Over-Issued CRL synthesis modelThe client needs the identity authentication in the network, and the technology foundation of the TC is PKI which comes true the identity authentication by some certifications. With the increasing scale of the certification, the maintenance of CRL is becoming a hot potato. So the Segmented and Over-Issued CRL synthesis mode and the Delta and Over-Issued CRL synthesis model are brought forward.The Segmented and Over-Issued CRL synthesis mode is realized by that CRL is segmented first, and then over-issued. Compared to other models, the improved model minimizes the size of CRL which can accelerate to request serve, as well as the peak request rate, peak bandwidth, average loads and time piece on CRL repository. Though the average request rate of the improved model is bigger than over-issued model, as long as the parameters of O and S are acquired and adjusted properly, the peak request rate, peak bandwidth ,average request rate and average loads of the improved model can be controlled to fit for the large-scale PKIs according to the requirements [TAN2005a].The Delta and Over-Issued CRL synthesis model is realized by that Base CRL of Delta-CRLs is over-issued. Compared to other models, the improved model minimizes the size of CRL which can accelerate to response time and time piece, as well as the peak request rate for Base CRL, the peak bandwidth and average loads on CRL repositories. Simultaneously it is presented in this paper that the improved model is better than traditional model and Delta-CRLs, but the issuance performance of the improved model depends on the rate of certificate revocation, period of certificate validity , time span and issue periods on Delta CRL. Rate of certificate revocation is more higher, time span and issue periods on Delta CRL is more longer and period of certificate validity is more shorter, the performance improvement by over -issued Base CRL is more less. So the improved model is fit for the large-scale PKIs whose rate of certificate revocation is not high, period of certificate validity is more longer, time span and issue periods on Delta CRL is more shorter [TAN2005b].2. Proposing an XML-based software security requirements architecture description language (XSSRA/ADL) is presentedIt is imperative to considerate the functional requirements and the security requirements on architecture level when developing the large and complex software systems in Internet, and the security requirements architecture description language (SADL) is the foundation for researching and implementing the security requirements architecture. Because traditional architecture description languages have no direct component, connector and style for the security requirements, it is difficult to descript these security requirements on the architecture level. In this paper, an XML-based software security requirements architecture description language (XSSRA/ADL) is presented, which, based on the traditional software architecture, puts forward some new fundamental units, such the security component, the security connector, the half-security component and the half-security connector, and so on. XSSRA/ADL not only can descript the security architecture of software systems, but also can resolve the interaction and dependency between security requirements and other functional requirements on the architecture level of software systems. On the other hand, XSSRA/ADL adopts XML, the data inter-operation standard, as the meta-language, this enables it to have inter-operability with other ADLs, and is convenient for supporting refinement and evolution of the system [TAN2006e].更多还原