安全操作系统审计的设计与实现

审计子系统作为安全操作系统的一个重要组成部分,对于监督系统的正常运行、保障安全策略的正确实施、构造计算机入侵检测系统等都具有十分重要的意义。给出了一个基于Linux资源,拥有自主版权,符合GB17859－1999第三级“安全标记保护级”的审计子系统的设计和实现。在此审计系统中,通过在核内及应用程序中设置审计点,以全面地收集数据;通过在主体和客体两方面设置审计标准,使审计标准的配置更加灵活、全面;通过优化缓冲区的管理,提高了整个子系统的效率。

DESIGN AND REALIZATION OF AUDITING IN SECURE OS

As a very important component of secure operation system, audit subsystem plays a key role in monitoring the system, insuring proper implementing of security policy, and building intrusion detection system. The design and realization of an audit subsystem are presented, which is Linux based and copyrighted, and accords with the third level, "Security Label Protection", GB17859 1999. This audit subsystem can collect data all around by mounting audit points in the kernel and applications, make configuration more flexible by configuring audit mask in subjects and objects and enhance the subsystem's performance by optimizing buffer management.