Mandatory Access Control (MAC), which is used to manage the information in the system according to the security classification, so as to ensure that each user can only access these information which is marked by him. This is the highest intensity of access constraint mechanism in the system. Mandatory access control mechanism determines whether the user has permission to access the file by checking the user and file for pre-set security properties, so as to provide users with a sound privacy information protection.
The system adopts the pluggable authentication module Linux-PAM, so that the local system administrator can select the authentication method of the program at will. In other words, you can change the authentication mechanism without recompiling (or rewriting) an application that contains PAM functionality. In this way, even if the local authentication mechanism is upgraded, there is no need to modify the program.
When the server was hacked, in most cases, hackers may modify the system files and other important documents. In this regard, the system uses the Tripwire to establish a data integrity monitoring system that can monitor whether a file has been modified and which files have been modified, so as to quickly locate the damaged files and provide a reference for subsequent solutions
The system uses the Secure Sockets Layer (SSL) to implement the communication encryption function on the transport layer. Secure Sockets Layer is the secure communication protocol that is established on the transport layer, which uses the certificate authentication method with the public key system to ensure the communication security between the client and the SSL server.
The SSL client sends a message (including the algorithm list supported by the client) to the server after the TCP connection is established. Then the server returns a packet (which determines the algorithm for this communication required) and the certificate of SSL server (which contains the public key) to the client. The client then encrypts the message with the received public key, which can only be decrypted with the SSL server private key, and that encrypted message cannot be learned even if it is intercepted.
SSL is implemented by the OpenSSL module. This module is compatible with the current mainstream CPU which has the hardware encryption function. And it uses hardware-accelerated encryption performance that is 5-10 times higher than the performance that is achieved by the pure software, so that it can provide more efficient information encryption services and stronger anti-attack capability.