强制访问控制

title: 历史背景和对多层安全的影响.
content: 历史上,MAC与作为保护美国等级信息的多层安全(MLS)手段密切相关。可信计算机系统评估标准(TCSEC)就是就这一主题的开创性工作,其中将MAC定义为“基于对象中包含信息的敏感性(由标签表示)来显示对对象的访问途径以及对象访问这种敏感信息的授权”。MAC的早期实现有Honeywell的SCOMP、USAF SACDIN、NSA Blacker,以及的波音MLS LAN。  术语MAC中的“强制性”已经因其在军事系统中的使用而获得了特殊含义。在这方面,MAC意味着非常高的抵抗性,确保控制机制能够抵抗任何类型的破坏,从而使他们能够执行由政府命令授权的访问控制,诸如面向美国等级信息的第12958号行政命令 。强制施行的保证性要求要高于商业应用,因此这不允许采用“尽力而为”的机制。MAC只接受能够绝对或者几乎绝对地保证任务执行的机制。这点对于不熟悉高保证策略的人来说可能很困难或者被假定为不切实际。
title: 系统强度.
title: 强度等级.
content: 在某些系统中,用户有权决定是否向其他任何用户授予访问权限。为允许这点,所有用户都必须有所有数据的审查许可。这不是MLS系统所需必要条件。如果个人或进程可能被拒绝访问系统环境中的任何数据,则系统必须可信以强制执行MAC。由于可能存在各种级别的数据等级和用户许可,这也显示了健壮性的量化指标。例如,一个包含等级为最高机密的信息和等级为未批准的用户的系统相较于一个包含等级为绝密的信息和等级为秘密的用户的系统具有更高的健壮性。为了维持健壮性量化指标的一致性以及尽可能地消除主观人为因素,一项针对该问题的大规模科学分析和风险评估提出了标志性的测试标准,用以量化系统的安全健壮性,并根据其能够保证的安全等级为其分级。该结果记录于CSC-STD-004-85。健壮性的两个相对独立的组成部分可以被定义为保障等级和功能性,两者都可以被阐述为一个系统在特定标准下能够保证的其审查的精确性。
title: 强度评估.
content: The Common Criteria is based on this science and it intended to preserve the Assurance Level as EAL levels and the functionality specifications as Protection Profiles. Of these two essential components of objective robustness benchmarks, only EAL levels were faithfully preserved. In one case, TCSEC level C2 (not a MAC capable category) was fairly faithfully preserved in the Common Criteria, as the Controlled Access Protection Profile (CAPP). Multilevel security (MLS) Protection Profiles (such as MLSOSPP similar to B2) is more general than B2. They are pursuant to MLS, but lack the detailed implementation requirements of their Orange Book predecessors, focusing more on objectives. This gives certifiers more subjective flexibility in deciding whether the evaluated product’s technical features adequately achieve the objective, potentially eroding consistency of evaluated products and making it easier to attain certification for less trustworthy products. For these reasons, the importance of the technical details of the Protection Profile is critical to determining the suitability of a product.  Such an architecture prevents an authenticated user or process at a specific classification or trust-level from accessing information, processes, or devices in a different level. This provides a containment mechanism of users and processes, both known and unknown (an unknown program (for example) might comprise an untrusted application where the system should monitor and/or control accesses to devices and files).
title: 实现.
content: A few MAC implementations, such as 优利系统' Blacker project, were certified robust enough to separate Top Secret from Unclassified late in the last millennium. Their underlying technology became obsolete and they were not refreshed. Today there are no current implementations certified by TCSEC to that level of robust implementation. However, some less robust products exist.

Summary: 强制访问控制(英语:mandatory access control,缩写MAC)在计算机安全领域指一种由操作系统约束的存取控制,目标是限制主体或发起者访问或对对象或目标执行某种操作的能力。在实践中,主体通常是一个进程或线程,对象可能是文件、目录、TCP/UDP端口、共享内存段、I/O设备等。主体和对象各自具有一组安全属性。每当主体尝试访问对象时,都会由操作系统内核强制施行授权规则——检查安全属性并决定是否可进行访问。任何主体对任何物件的任何操作都将根据一组授权规则(也称策略)进行测试,决定操作是否允许。在数据库管理系统中也存在访问控制机制,因而也可以应用强制访问控制;在此环境下,对象为表、视图、过程等。

Mandatory access control: In computer security, mandatory access control (MAC) refers to a type of access control by which the operating system constrains the ability of a "subject" or "initiator" to access or generally perform some sort of operation on an "object" or "target". In practice, a subject is usually a process or thread; objects are constructs such as files, directories, TCP/UDP ports, shared memory segments, IO devices, etc. Subjects and objects each have a set of security attributes. Whenever a subject attempts to access an object, an authorization rule enforced by the operating system kernel examines these security attributes and decides whether the access can take place. Any operation by any subject on any object is tested against the set of authorization rules (aka "policy") to determine if the operation is allowed. A database management system, in its access control mechanism, can also apply mandatory access control; in this case, the objects are tables, views, procedures, etc.