Protecting system for access control system in virtual domain

Abstract

The invention discloses a protecting system for an access control system in a virtual domain, which comprises a policy executing module, a policy decision buffering module, a policy server module and an internal memory protecting module. The policy executing module is used for intercepting low-level semantics, converting the intercepted low-level semantics into high-level semantics, transmitting the high-level semantics to the policy decision buffering module and acquiring policy decision results, the policy decision buffering module is used for receiving the high-level semantics from the policy executing module, transmitting the high-level semantics to the policy server module, acquiring the policy decision results from the policy server module, transmitting the policy decision results to the policy executing module and caching the policy decision results, and the policy server module is used for searching a safety policy library thereof according to the high-level semantics so as to generate policy decision results. The access control system in the virtual domain can be protected from being attacked by the protecting system, and the safety thereof is improved.

Description

technical field [0001] The invention belongs to the fields of computer resource virtualization and computer system security, and in particular relates to a protection system for an access control system in a virtual domain. Background technique [0002] Mandatory Access Control (MAC) is an effective method to prevent computer systems from being attacked. MAC can prevent malicious users or malicious codes that imitate legitimate users from abusing resources, because MAC access rules can only be modified by system administrators, and malicious codes cannot modify security policies without system permission. A variety of models and systems have been applied to different operating systems, such as SELinux, Trustees, and Security Enhanced Linux (SELinux for short), which is the most representative of them, with a flexible and mandatory The access control structure can improve the security of the Linux system, provide a strong security guarantee, and can defend against unknown at...

AI Technical Summary

Problems solved by technology

Malicious programs (such as rootkits, etc.) often run in the kernel mode, not only can see the memory information of all user programs, but also can bypass the inspection of the security system, and can also prevent the security system from starting normally

The traditional mandatory access control system cannot effectively guarantee its own security, and this problem cannot be solved under the traditional architecture

Images