嵌入式操作系统安全机制研究与扩展实现

【作者】 江维；

【导师】 熊光泽；

【作者基本信息】 电子科技大学 ， 计算机系统结构， 2006， 硕士

【摘要】 随着普适计算时代的到来,越来越多的嵌入式设备接入了互联网,计算资源的共享跨越了空间和时间的限制,信息安全的问题显得越来越重要。操作系统是嵌入式系统的核心,是系统信息安全的最后一道防线。如果缺乏这个安全的根基,构筑在其上的应用系统以及整个嵌入式系统的安全性将得不到根本保障,因此构造一个高可靠、高安全的嵌入式操作系统势在必行。本文研究了操作系统的安全机制及实现技术,然后以一个嵌入式安全操作系统基本原型为研究与实践基础,深入地研究了操作系统层面的信息安全保障机制,并对该原型安全功能进行了相应的扩展实现。文中着重对以下几个方面进行探索和创新:1)、研究安全操作系统的安全标准并结合嵌入式系统资源有限等特征,界定了B1级安全嵌入式操作系统应提供的安全保障功能;2)、研究了嵌入式网络安全的重要性及其保护措施,识别出了嵌入式操作系统层面最后一道网络安全门槛,在socket层实现了强制访问控制。3)、研究了传统的文件保护措施,结合嵌入式文件系统的特点,提出了一种基于文件描述符的文件安全机制,从文件操作API级实现了对文件的保护。4)、研究了传统的审计机制,根据嵌入式系统的资源有限性和运行环境特殊性等特点,提出了一种多层次的安全审计系统。通过灵活的审计存储方法,提高了审计信息的可信度;同时,通过审计的两级实时报警和对审计信息的事后分析,提高了审计信息的利用率。更多还原

【Abstract】 With the advent of pervasive computing era, more and more embedded devices can access to Internet. The computing resource can be shared beyond the limit of time and space. Information security becomes more and more important. As a core facility of embedded systems, an operating system is the security base of the applications and other security systems. The operating system is also the last defence line of system information security. If it is weak in security, the application system based on it and the security of the whole embedded systems will not be guaranteed. Therefore, it is necessary for us to constructe the embedded operating system with high relibility and high security.The security mechanism and implementation method of operating systems are firstly researched in detail. Based on a typical embedded security operation system, mechanisms of information security in operating system level are deeply researched on, and some security functions are enlargely implemented. To sum up, there are several innovative researches in this paper as follows:1. This paper researches on the standard of security operating system. With the features of the embedded system such as resource limit, security safeguard functions of embedded operating sysmtem are defined in terms of B1 level.2. The importance of network security is introduced. By analysing traditional measurements taken on network security, we find out that the last network security gate should be established on operating system level. A MAC mechanism on socket layer is implemented in the paper.3. The tradional measuments on file protection are introduced. Comparing with feathure of embedded filesystem, the paper presents a new file security mechanism. Based on the descriptor of the file, file resources are protected in the API level of an operating system.4. The tradional audit mechanism are introduced. Comparing with feathure of embedded filesystem, the paper presents a multiple-level security audit system. Flexible method of the audit storing enhances the dependability of audit information.更多还原