IMPLEMENTATION OF AUDIT IN SECURE OPERATING SYSTEM BASED ON CC

摘要

It is very important for a secure operating system to detect potential attack and security breach. The audit subsystem of a computing system can collect many kinds of events in the system and can hence help to decide if a user ever tried to violate the security policies enforced in the system and therefor make users be accountable for their actions. Many secure operating systems implement audit subsystem in their own way. The common criteria for IT security evaluation (CC) provides the functional requirements for audit in its part 2. In this paper we suggest some methods to meet these requirements. Some of the methods have been used in our secure Linux system.