Method for detecting Solaris system fault by utilizing mandatory access control

Abstract

The invention provides a fault detection technology of a Solaris system, and a Solaris operating system fault is rapidly processed and a fault point is rapidly positioned through mandatory access control by the technology. Compared with a traditional minimum authority model safety measure, the technology for detecting the system fault by utilizing the mandatory access control rapidly detects and positions the fault caused by an attack for the Solaris system, including a known or unknown virus program, an ROOTKIT-level backdoor Trojan horse and the like. The mandatory access control (MAC) is divided into two parts: one part is the access control for a document on the basis of a user, the other part is the access control for the document on the basis of a process, and the user is bound when the process operates, so that the process per se is also a subject, and when an object is protected by a safety mark, even a root user can not access the object unless having the authority of the MAC.

Description

technical field [0001] The present invention relates to the field of Solaris system kernel reinforcement, especially the communication between the user layer and the system layer, specifically a method based on ROST (Reinforcement Operating System Technique), the core of which is to reconstruct the operation at the core layer of the Solaris system The system's permission access model is used to implement real mandatory access control to handle server failures, quickly locate the failure point and the cause. technical background [0002] The Solaris operating system runs a number of system processes with superuser privileges, giving programs the ability to read and modify things like other processes, memory, and I / O devices. While this gives system processes the permissions they need to perform their tasks, it also gives them unnecessary access to otherwise protected parts of the system. Hackers rely on this elevated privilege to gain superuser access to a computer by exploi...

AI Technical Summary

Problems solved by technology

[0009] Users get the right to use system files when they enter the system. File access is only controlled by setting file access permissions. The system has no mandatory security access control mechanism, which opens the door for attackers.

[0010] (4) A large number of processes have super user privileges

[0012] (5) The audit protection function is weak

[0013] Although Solaris provides auditing functions, there are almost no restrictions on the access to audit data, which can be freely queried and allowed to be modified, especially the lack of integrity protection for audit data

[0014] (6) Insecurity of network applications

[0021] (1) Some key files are missing or deleted by mistake, such as boot files

[0022] (2) The configuration file is maliciously changed, such as the network parameters of the server, etc.

[0023] (3) Load malicious driver

Images