Abstract:Sensitive data leak can cause significant loss for some organizations, especially for technology intensive companies and country security departments. Traditional mandatory access control (MAC) can only control whether the user can access the sensitive data or not, and cannot prevent the user to leak or spread the data. So even designed impeccable access control policies, we still cannot prevent inside leak. A nature solution is using physical isolation to prevent sensitive data from being leaked outside network; however inside the physical isolated network, data still can be spread from one subnet to another. We present Secure Subnet System, a BLP model base security system that can provide more strong access control, which is called mandatory action control. In our system after a user read sensitive data, system will dynamically change security policies to prevent the user to leak these data or spread the data outside to another subnet. We use a state machine model to describe our system, and use secure transfer equations to dynamically calculate the system policies for each new state. Our model can be proved to be secure by formal methods. We implemented a demon of our system. In this paper we also show the design details of the demon and evaluate the demon both from security and performance. The evaluation results show that the output of the security tests case are under expected; and the performance test case show that, for the 64KB IO chunk size, IO read loss can be improved to 6.6%, IO write loss can be improved to 1.2% after optimization.

Design of a Secure Network Mirroring System for Data Sharing

Design and realization of information intercourse system for news center

Distributed Storage Cluster Design for Remote Mirroring Based on Storage Area Network.

A Design of Secure Community Healthcare Monitoring System Based on Wireless Sensor Networks

Research on Information Security Model and Security System Design

Communication Technology Distributed Monitoring and Fault Diagonisis Oriented System Based on IP Multicast Technology

Fuzzy Reliability Of Mirrored Storage System Based On Iscsi

Method for a dummy CD mirror server based on NAS

Design and Implementation of an SAN System Based on the Fiber Channel Protocol

Research and Implement of User Control and Redundant Storage Based on ISCSI

An Implementation of Storage-Based Synchronous Remote Mirroring for SANs

Design and Implementation of A Network Security Management System

A Collaborative Network Security Management System in Metropolitan Area Network

Application Research of CD Mirror Technique in Network Attached Optical Jukebox

THE DESIGN AND IMPLEMENTATION OF INFORMATION SECURITY-ORIENTED HIGH DATA STREAM MANAGEMENT SYSTEM

Storage Virtualization Based Asynchronous Remote Mirror.

The Architecture of Distributed Storage System under Mimic Defense Theory.

Design and Implementation of Secure Subnet Inside of Data Sensitive Network

IMPLEMENTATION AND OPTIMIZATION OF AN ISCSI-BASED CASCADING REMOTE COPY SYSTEM

Design and Implementation of the Distributed Audio and Video Digital Surveillance System

SHIS: secure healthcare intelligent scheme in internet of multimedia vehicular environment