Mandatory access control method and system loaded after system startup

Abstract

The invention provides a mandatory access control method loaded after the system starts, comprising initializing a subject-object mark list in the kernel after the system starts, the subject-object mark list is used to store the subject-object mark; A loadable module of mandatory access control logic; the linked list of subject and object tags is maintained through application layer tools. The present invention is based on the Linux LSM framework, does not need to modify the kernel in large quantities, and realizes the complete decoupling of the modules of the access control strategy from the kernel, and the module of realizing the access control strategy is loaded after the system is started, which is flexible in use, does not affect the system startup, and does not require service nodes. Compared with the kernel, the module compiles faster, debugs easier, and has a shorter development cycle. It can also implement a custom access control model. The invention also discloses a mandatory access control system loaded after the system starts.

Description

technical field [0001] The invention relates to the technical field of computer system security, in particular to a mandatory access control method and system loaded after system startup. Background technique [0002] Many commercial and research systems are developed based on the Linux kernel. The source code of the Linux kernel is very large, and there are many known vulnerabilities and the vulnerabilities are being continuously discovered. Operating system security issues are very important. A secure system needs to meet the corresponding technical requirements in more than ten aspects such as autonomous access control, mandatory access control, marking, identity authentication, etc. [0003] Among them, Linux mandatory access control is implemented based on the LSM framework. By adding a security domain to the kernel data structure and inserting a hook function into the system call invoked when the process, file and other subject and object access, a specific strategy i...

AI Technical Summary

Problems solved by technology

However, by adding subject-object tags and access control policy codes in the kernel, it is necessary to deeply understand the Linux kernel and add a lot of kernel codes. The development cycle is long and it is easy to introduce errors in the face of complex kernels; the modified kernel will prolong the startup time. Time; long kernel compilation time, complex debugging process at startup

The use of mandatory access control servers requires complex system design and implementation of communication mechanisms, which will result in additional server nodes, and the implementation of access control requires additional communication costs

Images