高级检索
    曹 珲, 熊胜超, 张焕国, 严 飞. Flume系统的隐蔽信道搜索问题研究[J]. 计算机研究与发展, 2013, 50(11): 2367-2374.
    引用本文: 曹 珲, 熊胜超, 张焕国, 严 飞. Flume系统的隐蔽信道搜索问题研究[J]. 计算机研究与发展, 2013, 50(11): 2367-2374.
    Cao Hui, Xiong Shengchao, Zhang Huanguo, Yan Fei. Study on Detection of Covert Channel in Flume System[J]. Journal of Computer Research and Development, 2013, 50(11): 2367-2374.
    Citation: Cao Hui, Xiong Shengchao, Zhang Huanguo, Yan Fei. Study on Detection of Covert Channel in Flume System[J]. Journal of Computer Research and Development, 2013, 50(11): 2367-2374.

    Flume系统的隐蔽信道搜索问题研究

    Study on Detection of Covert Channel in Flume System

    • 摘要: Flume系统不仅可以为处于不同安全级别的进程传输信息提供安全保障,还可以通过显式标签机制解决在隐式标签系统中进程间通信连接超时导致的隐蔽信道问题.但是其系统中的部分不合理标签分配机制可能会导致信息在传递过程中同样存在泄露问题.针对这个问题提出一种隐蔽信道搜索模型(covert channel detection model, CCDM),将隐蔽信道的搜索问题抽象为有向图联通问题.最后结合回溯算法的思想提出IniaPathSearch算法和QuickPathSearch算法来对隐蔽信道进行自动搜索.实验结果表明,IniaPathSearch算法和QuickPathSearch算法可以正确有效地对Flume系统中隐蔽信道进行检测,并能为信息传递提供合法最短路径,其结果可以用于指导提高系统的安全性.

       

      Abstract: Flume system can not only provide security protection for processes in different security level transmit information, but also use explicit label mechanism for solving the problem of covert channel caused by the timeout when processes transmit information. And this problem cannot be figured out by other security systems based on DIFC that use implicit label mechanism. But the mechanism of label allocation system may also cause information leakage by a special covert channel when processes transmit information in Flume system. In this paper, a covert channel detection model (CCDM) is introduced by analyzing the reason of information leakage in Flume system. The problem of covert channel searching is abstracted as the problem of directed graph linking by CCDM. And two algorithms that can auto-search covert channel in Flume system are presented based on CCDM and the idea of backtracking algorithm. The results of experiment show that CCDM and the proposed algorithms not only can effectively detect covert channel in Flume system, but also provide the shortest path for processes to transmit information. Thus, the results of experiment can provide some guidance for improving system security.

       

    /

    返回文章
    返回