Operating system kernel mandatory access control method and system based on TEE extension

Abstract

The invention discloses an operating system kernel mandatory access control method and system based on TEE extension. According to the invention, the method comprises the steps: when the access behavior is detected in the REE system, calling an interface of an access control enhancement verification framework in a TEE system; enabling the access control enhancement verification framework to call acorresponding processing function according to the access operation type in the call request; enabling the processing function to judge whether access control enhancement verification is passed or not according to the access operation type, the subject information and the object information in the call request; if the access behavior passes the access control enhancement verification, matching apreset kernel access control rule base for the access behavior in the REE system, and if a matched rule is found, allowing the access behavior to continue to be executed; otherwise, denying the accessbehavior. According to the invention, the forced access control mechanism of the TEE-based security extension operating system can be enhanced, and the method has the advantages of comprehensive protection, high verification level, security, reliability, good universality and strong expansibility.

Description

Technical field [0001] The invention relates to the information security field of a computer operating system, in particular to a method and system for compulsory access control of an operating system kernel based on TEE extension. Background technique [0002] The operating system is the basis of information security protection. Whether the system can dynamically protect the security of system resources during operation has become a problem that must be solved. Mandatory access control is one of the important technologies to realize the security protection of the operating system. Based on the access control rules, the kernel-level access control is implemented on the access behaviors between various subjects and system objects in the operating system to protect the security of system resources. The Linux system provides LSM mandatory access control framework support for operating system mandatory access control, which divides mandatory access control into two parts: implementat...

AI Technical Summary

Problems solved by technology

At the same time, the implementation of the mandatory access control mechanism is based on the security policy configuration as the guiding principle. If the security policy configuration is tampered with, it is tantamount to modifying the "legal basis" for safe operation in the operating system world, resulting in the failure of the access control mechanism. The integrity of access control core data becomes one of the problems that must be solved

Images