摘要： 针对系统服务中的特权用户问题，提出一种面向服务进程的用户权限隔离模型，依据安全级别将用户、隔离域、程序模块进行映射关联，利用虚拟化技术为不同用户构造相互隔离的运行环境，形式化定义用户隔离域，给出虚拟化构建隔离域的关键技术及实现方法，从而实现用户权限的隔离，消除系统中潜在的特权用户。
关键词:
最小权限,
虚拟化,
隔离,
特权用户,
域,
系统服务
Abstract: In order to solve the unnecessary root users in the operating system services, a user permission isolation model is proposed. Based on the mapping link among users, isolated domains and program modules according to the security level, associated with the use of virtualization, isolated runtime environments are constructed for different users. The model gives formal definition of user isolated domain and the key mechanisms for its implementation. The model realizes least privilege principle for the isolated domain, and the paper gives the conclusion that potential root users are eliminated in the isolated domains.
Key words:
least permission,
virtualization,
isolation,
privileged user,
domain,
system service
中图分类号:
李瑜, 赵勇, 梁鹏. 面向服务进程的用户权限隔离模型[J]. 计算机工程, 2011, 37(23): 141-143,146.
LI Yu, DIAO Yong, LIANG Feng. User Permission Isolation Model Oriented to Service Process[J]. Computer Engineering, 2011, 37(23): 141-143,146.