TEE-based mandatory access control security enhancement framework performance evaluation method and system

Abstract

The invention discloses a TEE-based mandatory access control security enhancement framework performance evaluation method and system, and the method comprises the steps: 1) carrying out the testing of a test single item i specified on target performance testing software, the running time Ri of a test single item i and the total HOOK function calling frequency ni in a HOOK function set S achieved for the assessed mandatory access control security enhancement framework are obtained in a common world REE; and 2) calculating according to Ti = t * ni + Ri to obtain the overhead Ti of the test single item i, wherein t is the single world switching overhead of triggering the HOOK function to switch to the safety world TEE to carry out the safety strategy decision under the ordinary world REE and then returning to the ordinary world REE. According to the method, the performance evaluation of simulation evaluation can be realized on the premise that the TEE-based mandatory access control security enhancement framework is not specifically realized, and the expandability and the universality are good.

Description

technical field [0001] The invention relates to the field of information security of computer operating systems, in particular to a performance evaluation method and system of a TEE-based mandatory access control security enhancement framework. Background technique [0002] With the development of cloud computing, the Linux operating system running on the terminal server manages far more sensitive data than before, so stronger security is required. In the traditional method, mandatory access control can manage the authority between the subject and the object in a unified way to control the system authority, which is an important aspect of protecting the kernel security. LSM is the specific implementation of mandatory access control in Linux, which is divided into two parts: implementation and decision-making. The implementation part inserts the HOOK function at key kernel codes such as system calls, and after obtaining the decision result, implements the behavior of allowin...

AI Technical Summary

Problems solved by technology

However, the current performance evaluation is mainly carried out after the system is implemented. Although it can provide feedback and guidance for the system framework design, the cost of system implementation cannot be avoided.

Images