基于私有目录容器的用户数据文件保护方法

由于管理员等特权用户的存在,用户私有数据文件难以得到有效的保护。为真正做到用户的私有数据文件被用户自身所控,包括管理员在内的其他任何人均不能访问,建立包括用户令牌属性的私有目录容器,并在操作系统内核强制访问控制框架下设计实现基于用户令牌的私有目录容器访问控制机制,为用户自身私有数据文件的安全访问提供保护。只有私有目录容器属主才能访问该目录容器内的数据文件,任何其他用户均无权访问。进程的用户令牌只能通过身份认证获取,可有效防止通过用户身份仿冒获取容器属主身份,从而有效保护用户私有数据文件的安全。

A method for protecting user data files based on private directory container

Because of the existence of privilege users such as the administrator, user data files are difficult to protect. In order to make sure that only the file owner can access these data files, we create a private directory container (PDC), which includes token attributes of user. The PDC access control mechanism can be realized under the OS kernel mandatory access control (MAC) framework, thus protecting user private data files. Only the owner of the PDC can access the files in the PDC, no exception, including administrators. User’s token can only be got by identity authentication, so the owner’s PDC identity cannot be got by others, and private files can be protected effectively.