【摘 要】 本文介绍了一个自行开发的外挂式多级安全数据库安全系统。该系统采用读写安全级分开的安全模型，对强制存取控制的传统模型——Bell Lapadula模型进行扩充，使用基于中国剩余定理的两阶段子密钥加密算法对数据进行加密，将加密与强制存取控制两种数据库安全技术相结合。该系统以属性作为数据的安全级划分粒度，并为每个属性提供一个密钥链用来产生读写密钥。通过读写密钥的产生规则和两阶段子密钥加密算法，可以实现强制存取控制中的读写安全策略，增强对数据的保护力度，提高数据库的安全性。本文还具体说明了该系统具体的实... 更多 >> 本文介绍了一个自行开发的外挂式多级安全数据库安全系统。该系统采用读写安全级分开的安全模型，对强制存取控制的传统模型——Bell Lapadula模型进行扩充，使用基于中国剩余定理的两阶段子密钥加密算法对数据进行加密，将加密与强制存取控制两种数据库安全技术相结合。该系统以属性作为数据的安全级划分粒度，并为每个属性提供一个密钥链用来产生读写密钥。通过读写密钥的产生规则和两阶段子密钥加密算法，可以实现强制存取控制中的读写安全策略，增强对数据的保护力度，提高数据库的安全性。本文还具体说明了该系统具体的实现方法，并对该系统的特点做出综合评价。This paper proposes a new multilevel database security system. This system is an out-layer put on the Microsoft SQL Server, which implements the access rule of Mandatory Access Control. An enhanced multilevel security model is adopted by this system, which divides users’ security information further into a reading part and a writing part; the reading part includes reading scope, reading level, and the writing part is composed of writing scope, the lowest writing level and the highest writing level. The two-phase encryption scheme with sub-keys employed by this system is based on the Chinese Remainder Theorem. In this encryption scheme，attribute is the unit for classifying security classes and each attribute has a key-chain to generate its writing key and the reading key of a user. This scheme also implements the access rule of Mandatory Access Control，and keeps the data which a user has no right to write in the encrypted form. The new scheme proposed by this paper enhances the database’s security. The characteristics of this system are also analyzed in this paper. << 收起
