安全操作系统中的权能管理模型

最小特权和责任分离原则要求安全操作系统能够提供细粒度的访问控制．基于权能的安全操作系统可以满足这种需求，但现有的权能管理模型不能同时解决权能控制的客体有限、权能撤销机制不够完善以及访问检查的速度太慢的问题.本文提出一种新的权能管理模型（GYC模型），较好的解决了上述三个问题．该模型已被应用到安全操作系统Minicore中，实验结果表明，与典型的Redell模型相比，GYC模型在整体性能上更好．

Capability Management Model in Capability-Based Secure Operating Systems

An essential design requirement for secure systems is the principle of least privilege and separation of duty. So the secure operating system must provide fine-grained access control which is suitable to capability-based secure operating system. But there are no perfect solutions to the following three questions up to now: (1) the limited object type which can be controlled by capability; (2) the imperfect capability revocation mechanism; (3) the large cost of checking permissions with capabilities. This paper presents a new capability management model (GYC model) which solves the three questions simultaneously. The model has been applied to Minicore which is a secure operating system we developed. The experimental results testify that the GYC model has the advantage over the Redell model in whole performance.