网络与信息安全学报 ›› 2023, Vol. 9 ›› Issue (5): 21-32.doi: 10.11959/j.issn.2096-109x.2023074

• 学术论文 • 上一篇    

基于标签的数据流转控制策略冗余与冲突检测方法

谢绒娜1, 范晓楠2, 李苏浙2, 黄宇欣2, 史国振1   

  1. 1 北京电子科技学院密码科学与技术系，北京 100070
    2 北京电子科技学院网络空间安全系，北京 100070
  • 修回日期:2023-08-18 出版日期:2023-10-01 发布日期:2023-10-01
  • 作者简介:谢绒娜（1976− ），女，山西永济人，博士，北京电子科技学院教授，主要研究方向为网络与系统安全、访问控制、密码工程
    范晓楠（1997− ），女，河北邢台人，北京电子科技学院硕士生，主要研究方向为信息安全、访问控制
    李苏浙（1999− ），女，浙江绍兴人，北京电子科技学院硕士生，主要研究方向为访问控制
    黄宇欣（1999− ），女，湖南长沙人，北京电子科技学院硕士生，主要研究方向为信息安全、访问控制
    史国振（1974− ），男，河南济源人，北京电子科技学院教授、博士生导师，主要研究方向为密码信息安全、信息论与编码理论
  • 基金资助:
    国家自然科学基金(61932015);国家重点研发计划(2017YFB0802705)

Redundancy and conflict detection method for label-based data flow control policy

Rongna XIE1, Xiaonan FAN2, Suzhe LI2, Yuxin HUANG2, Guozhen SHI1   

  1. 1 Department of Cryptography and Science Technology, Beijing Electronic Science and Technology Institute, Beijing 100070, China
    2 Department of Cyberspace Security, Beijing Electronic Science and Technology Institute, Beijing 100070, China
  • Revised:2023-08-18 Online:2023-10-01 Published:2023-10-01
  • Supported by:
    The National Natural Science Foundation of China(61932015);The National Key R＆D Program of China(2017YFB0802705)

在线阅读

19

pdf下载

83

摘要：

基于标签的数据流转控制机制通过主客体标签实现数据流转控制，具有轻量级、延伸控制的优势，引起了广泛关注。数据流转时，标签变更不可避免，而在标签变更时，新标签与已有标签难免存在冗余或者冲突。如何对标签进行冗余与冲突检测是基于标签的数据流转控制中急需解决的问题。针对上述问题，提出了基于原子操作的标签描述方法。客体标签由多个原子标签的逻辑组合生成。其中，原子标签用于描述最小的安全需求，解决了标签描述简洁性和丰富性问题。为降低标签冗余与冲突检测难度、提高检测效率，基于标签中不同集合的相关性，提出了基于标签的数据流转控制策略冗余与冲突检测方法。该方法通过分析原子标签中各要素的集合关系对原子标签进行冗余与冲突检测，基于原子标签检测结果和逻辑关系对客体标签进行检测，提高了检测效率；基于不同原子标签中包含操作的关系对原子标签进行冗余与冲突检测，对于包含相同操作的不同原子标签，通过分析不同原子标签中主体属性、环境属性以及规则类型之间关系进行检测，对于包含不同操作的原子标签，如果不同操作之间没有关系，那么原子标签不存在冗余与冲突，如果不同操作之间存在偏序关系，则通过分析不同原子标签中操作的偏序关系、主体属性、环境属性以及规则类型之间关系进行检测。从理论和实验两个角度对提出的冗余与冲突检测方法性能进行分析，通过实验验证了原子标签数量和复杂度对检测性能的影响。

关键词: 标签, 数据流转控制, 原子标签, 集合相关性, 策略冗余与冲突检测

Abstract:

To address the challenge of redundancy and conflict detection in the label-based data flow control mechanism, a label description method based on atomic operations has been proposed.When the label is changed, there is unavoidable redundancy or conflict between the new label and the existing label.How to carry out redundancy and conflict detection is an urgent problem in the label-based data flow control mechanism.To address the above problem, a label description method was proposed based on atomic operation.The object label was generated by the logical combination of multiple atomic tags, and the atomic tag was used to describe the minimum security requirement.The above label description method realized the simplicity and richness of label description.To enhance the detection efficiency and reduce the difficulty of redundancy and conflict detection, a method based on the correlation of sets in labels was introduced.Moreover, based on the detection results of atomic tags and their logical relationships, redundancy and conflict detection of object labels was carried out, further improving the overall detection efficiency.Redundancy and conflict detection of atomic tags was based on the relationships between the operations contained in different atomic tags.If different atomic tags contained the same operation, the detection was performed by analyzing the relationship between subject attributes, environmental attributes, and rule types in the atomic tags.On the other hand, if different atomic tags contained different operations without any relationship between them, there was no redundancy or conflict.If there was a partial order relationship between the operations in the atomic tags, the detection was performed by analyzing the partial order relationship of different operations, and the relationship between subject attribute, environment attribute, and rule types in different atomic tags.The performance of the redundancy and conflict detection algorithm proposed is analyzed theoretically and experimentally, and the influence of the number and complexity of atomic tags on the detection performance is verified through experiments.

Key words: label, data flow control, atomic tag, set correlation, policy redundancy and conflict detection

中图分类号: 

No Suggested Reading articles found!