Method and device for determining main body in access control process, equipment and storage medium

Abstract

The invention relates to a method and device for determining a main body in an access control process, equipment and a storage medium, and the method comprises the steps: when an access action of a process on a resource is detected, under the condition that the process determines a transformation main body, taking the transformation main body as the main body of the process; under the condition that the process does not determine the transformation main body, determining that the process is a dynamic library host process according to the classification identifier of the executable file of the process, and obtaining a first non-system built-in dynamic library file on the call stack as the main body of the process; and under the condition that the process does not determine the transformation main body and the process is not a dynamic library host process, taking the executable file of the process as the main body of the process. Therefore, when an access action occurs, the accurate, traceable and localizable main body file can be extracted, so that the access control is more effective in a practical application environment.

Description

technical field [0001] The present disclosure relates to the technical field of information security, and in particular to a method, device, device and storage medium for determining a subject in an access control process. Background technique [0002] Usually, in the field of information security, access control is one of the most basic and important technical means. Its main task is to determine whether the user (subject) has permission to access resources (objects) according to policies (rules), so as to protect designated resources. the goal of. [0003] At present, in the access control that comes with the operating system, the subject is the user account, and the process is the agent of the subject. When the access occurs, the operating system extracts the token of the process, and relies on the account, group and other information contained in the token to follow the rules attached to the object. Access control list on the control. However, from a security point of ...

AI Technical Summary

Problems solved by technology

However, from a security point of view, the granularity of this access control is too coarse to meet high-level security requirements, such as control by application (for example, it is reasonable for a document program to open a document file, but an instant messenger program to open Documentation files may mean uploading files)

[0004] In related technologies, in order to control the access of applications, the subject of access control is changed from user account to process, or in its access control policy, the process name or executable file path is used as the subject. However, the process is a difficult to identify Dynamic objects, simply taking the process name or the path of the process executable file as the main body, will cause deviations in the main body in the access control system, and the main body deviation will invalidate the access control

Images