Process permission configuration method and device based on multi-domain transfer, equipment and medium

Abstract

The invention discloses a process permission configuration method and device based on multi-domain transfer, equipment and a medium, and relates to the technical field of operating systems, the process permission configuration method comprises the following steps: creating a target process associated with a target operation request sent by a target management user side, placing the target process in a preset initial domain, and taking the initial domain as a current domain of the target process; and performing security verification on the current domain, if a verification result represents that the current domain is safe, judging whether a preset domain transfer termination condition is met currently, if not, determining a target transfer path according to a domain transfer strategy, and transferring the current domain corresponding to the target process to the next domain according to the target transfer path. Taking the next domain as a new current domain and skipping to the step of carrying out security verification on the current domain, and if yes, taking the current domain corresponding to the target process as a final domain; and according to the final domain, granting a target permission required for executing the request to the target process, so that the target process executes a target operation by using the target permission. The security of the operating system is improved.

Description

Technical Field

[0001] This application relates to the field of operating system technology, and in particular to a method, apparatus, device, and medium for configuring process permissions based on multi-domain transfer. Background Technology

[0002] With the rapid development of information technology, operating systems play a central role in cloud computing environments. However, operating system security has always been a focus of attention for users and developers. In traditional operating system security models, the root administrator has complete control over the system, including the ability to access and manipulate all files, directories, and executable files. Simultaneously, the root user is divided into privileged users such as system administrator, audit administrator, and security administrator. However, this separation of permissions management model has certain security risks. Once privileged user accounts are compromised or abused, attackers can gain control of the entire system, leading to serious consequences such as data breaches and system damage. Furthermore, even legitimate administrator users can compromise system security due to accidental or malicious operations. Summary of the Invention

[0003] In view of this, the purpose of this application is to provide a method, apparatus, device, and medium for configuring process permissions based on multi-domain transfer. Through an innovative process-level domain transfer mechanism, it enables fine-grained management of privileged user permissions, significantly improving operating system security. The specific solution is as follows:

[0004] Firstly, this application provides a process permission configuration method based on multi-domain transfer, including: The system acquires a target operation request sent by the target management client, creates a target process associated with the target operation request, places the target process in a pre-defined initial domain, and uses the initial domain as the current domain of the target process; the management users include system administrators, audit administrators, and security administrators, and the domain is the security context of the process; The current domain corresponding to the target process is subjected to security verification based on a preset security function. If the verification result indicates that the domain is safe, it is determined whether the current domain transfer termination condition is met. If not, the target transfer path is determined according to a predefined domain transfer strategy, and the current domain corresponding to the target process is transferred to the next domain according to the target transfer path. The next domain is used as the new current domain, and the process jumps to the step of performing security verification on the current domain corresponding to the target process based on the preset security function. If the current domain transfer termination condition is met, the current domain corresponding to the target process is used as the final domain. Grant the target process the target permissions required to execute the target operation request based on the final domain, so that the target process can use the target permissions to execute the target operation.

[0005] Optionally, the process permission configuration method based on multi-domain transfer further includes: The original super users are divided into different categories of management users, and the permissions corresponding to the original super users are divided to obtain multiple independent sets of permissions; wherein, each set of permissions corresponds to the permission range of a category of management users. Each management user is associated with a set of source types; the set of source types contains at least one source type, each source type has specific operation permissions within the permission scope of the power set corresponding to its management user, and there is no intersection between different sets of source types.

[0006] Optionally, for any two different first power sets and second power sets, the intersection of the first power set and the second power set is empty, and the union of all power sets is all permissions corresponding to the original super user; the operation permissions corresponding to any source type set do not exceed the permission range of the power set corresponding to the management user.

[0007] Optionally, the process permission configuration method based on multi-domain transfer further includes: Divide the source type set corresponding to any type of management user into at least one source type subset, and establish a domain transfer path between the source type subset and the source type subset associated with the target authority set, so that the process of any management user can use the domain transfer path to perform a domain transfer in order to obtain permissions within the authority set corresponding to another type of management user; the target authority set is the authority set corresponding to other types of management users excluding the authority set corresponding to any type of management user.

[0008] Optionally, the process permission configuration method based on multi-domain transfer further includes: Each management user is associated with a unique user role, and a corresponding set of source types is associated with each user role. A default source type is assigned to each user role. The default source type can be converted to any source type in the set of source types associated with the user role. Accordingly, creating a target process associated with the target operation request and placing the target process in a pre-defined initial domain includes: Determine the target user role corresponding to the target management client of the target operation request, and create a corresponding target process based on the target user role; Determine the target default source type corresponding to the target user role, set the initial domain corresponding to the target process to the target default source type, and place the target process in the initial domain.

[0009] Optionally, the process permission configuration method based on multi-domain transfer further includes: If the current domain corresponding to the target process is subjected to security verification based on the preset security function, and the verification result indicates that it is insecure and the preset domain transfer termination condition is not met, then the domain transfer is terminated and the target operation request sent by the target management client is rejected. If the security verification of the current domain corresponding to the target process is performed based on the preset security function, and the verification result indicates that it is insecure and the preset domain transfer termination condition is met, then the final domain authentication is determined to fail and the target operation request sent by the target management client is rejected.

[0010] Optionally, after the target process performs the target operation using the target permissions, it further includes: Revoke the additional privileges acquired by the target process through domain transfer, so that the target process can return to the pre-set initial domain; Based on the domain transfer information of the target process and the permission change information during the domain transfer process, corresponding operation records are generated and saved.

[0011] Secondly, this application provides a process permission configuration device based on multi-domain transfer, comprising: The process creation module is used to obtain the target operation request sent by the target management user terminal, create a target process associated with the target operation request, place the target process in a pre-set initial domain, and use the initial domain as the current domain of the target process; the management user includes system administrator, audit administrator and security administrator, and the domain is the security context of the process; The domain transfer module is used to perform security verification on the current domain corresponding to the target process based on a preset security function. If the verification result indicates that it is safe, it determines whether the current domain transfer termination condition is met. If not, it determines the target transfer path according to the predefined domain transfer strategy, transfers the current domain corresponding to the target process to the next domain according to the target transfer path, uses the next domain as the new current domain, and jumps to the step of performing security verification on the current domain corresponding to the target process based on the preset security function. If the current domain transfer termination condition is met, it uses the current domain corresponding to the target process as the final domain. An operation execution module is used to grant the target process the target permissions required to execute the target operation request based on the final domain, so that the target process can use the target permissions to execute the target operation.

[0012] Thirdly, this application provides an electronic device, comprising: Memory, used to store computer programs; A processor is used to execute the computer program to implement the aforementioned process permission configuration method based on multi-domain transfer.

[0013] Fourthly, this application provides a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the aforementioned process permission configuration method based on multiple domain transfers.

[0014] In this application, a target operation request sent by a target management user terminal is obtained, a target process associated with the target operation request is created, the target process is placed in a pre-defined initial domain, and the initial domain is used as the current domain of the target process. The management user includes a system administrator, an audit administrator, and a security administrator, and the domain is the security context of the process. A security check is performed on the current domain corresponding to the target process based on a preset security function. If the check result indicates security, it is determined whether a preset domain transfer termination condition is met. If not, a target transfer path is determined according to a predefined domain transfer strategy, and the current domain corresponding to the target process is transferred to the next domain according to the target transfer path. The next domain is used as the new current domain, and the process jumps to the step of performing a security check on the current domain corresponding to the target process based on the preset security function. If the preset domain transfer termination condition is met, the current domain corresponding to the target process is used as the final domain. The target process is granted the target permissions required to execute the target operation request according to the final domain, so that the target process can use the target permissions to execute the target operation. As shown above, when a privileged user wants to perform an operation, the system does not directly grant the user permissions. Instead, it creates a process for the operation and places that process in an initial domain with minimal permissions matching the user's identity. In this way, the user themselves lacks permissions; only a user-initiated, strictly monitored process has the opportunity to request permissions, thus separating permissions from the user. Process permissions are not static, nor are they acquired all at once. The process needs to follow a pre-defined target transfer path, jumping from one domain to another, acquiring only the necessary permissions at each step, achieving on-demand and minimal allocation of permissions. Before each domain transfer, the system calls a security function to check if the current domain is secure. If the check fails, the entire process terminates immediately, and the permission request fails. Only when the process successfully completes the entire pre-defined secure path and reaches the final domain will the system grant the process the permissions corresponding to the target operation. This prevents attackers from exploiting the domain transfer mechanism to escalate the privileges of malicious processes, thus improving operating system security. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort. Figure 1 This is a flowchart of a process permission configuration method based on multi-domain transfer disclosed in this application; Figure 2 This is a schematic diagram of a three-tiered system administrator privilege separation model disclosed in this application; Figure 3 This is a topology diagram of a domain transfer technology disclosed in this application; Figure 4 This is a schematic diagram of a multi-domain transfer technology disclosed in this application; Figure 5 This application discloses a schematic diagram illustrating a security administrator's execution of the ausearch process to obtain audit log permissions. Figure 6 This is a schematic diagram of a process permission configuration device based on multi-domain transfer disclosed in this application; Figure 7 This is a schematic diagram of the structure of an electronic device disclosed in this application. Detailed Implementation

[0016] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0017] In traditional operating system security models, the root administrator has complete control over the system. The root user is further divided into privileged users such as system administrator, audit administrator, and security administrator. However, this separation of permissions presents certain security risks. If privileged user accounts are compromised or abused, attackers can gain control of the entire system, leading to serious consequences such as data breaches and system damage. Furthermore, even legitimate administrator users can compromise system security due to accidental or malicious operations. To address these issues, this application provides a process permission configuration method based on multi-domain transfer. Through an innovative process-level domain transfer mechanism, it enables fine-grained management of privileged user permissions, significantly improving operating system security.

[0018] See Figure 1As shown in the figure, this application discloses a process permission configuration method based on multi-domain transfer, including: Step S11: Obtain the target operation request sent by the target management user terminal, create a target process associated with the target operation request, place the target process in a pre-set initial domain, and use the initial domain as the current domain of the target process; the management user includes the system administrator, audit administrator, and security administrator, and the domain is the security context of the process.

[0019] In this embodiment, the original super user can be divided into different types of management users, i.e. privileged users, and the permissions corresponding to the original super user can be divided to obtain multiple independent sets of permissions; wherein, each set of permissions corresponds to the permission range of a type of management user.

[0020] For example, based on SELinux policies, the privileges of the original superuser root can be managed in a more granular way, and granted to different administrative users, such as... Figure 2 In the diagram illustrating the separation of powers model for operating system administrators, the system administrator (sysadm), security administrator (secdam), and audit administrator (auditadm) possess only the minimum necessary privileges. Furthermore, the root power set C = {Csy, Cse, Cau} is split, where Csy represents the power set of sysadm, Cse represents the power set of secdam, and Cau represents the power set of audittadm. The permissions corresponding to the three power sets are as follows:

[0021] The Csy set of powers manages system-related resources, including user identity management, system resource configuration, system loading and startup, and handling of system operation exceptions.

[0022] Cse: Formulates system security policies, is responsible for uniformly marking subjects and objects in the system, authorizing subjects, configuring consistent security policies, and ensuring the data integrity of marking, authorization, and security policies.

[0023] Cau Capabilities: Sets auditing options to audit security-related events, including monitoring system activity and log processing, providing auditing and monitoring functions, and creating and maintaining access audit trails for protected objects.

[0024] For any two distinct first and second sets of authority, the intersection of the first and second sets of authority is empty, and the union of all authority sets is all the permissions corresponding to the original superuser. That is, each authority set is unique if and only if for any m, n U, U={Csy, Cse, Cau}, c d, has , , ,in .

[0025] Each management user is associated with a set of source types; the operation permissions corresponding to any source type set do not exceed the permission range of the corresponding power set of the management user. Each source type set contains at least one source type, and each source type has specific operation permissions within the permission range of the corresponding power set of the management user, with no overlap between different source type sets.

[0026] For example, define three sets of source types ST, STsy, STse, and Stau, where each set of source types satisfies the following condition:

[0027] STsy = {Stsy_a, Stsy_b, ...}; STse = {Stse_a, Stse_b, ...}; STau = {Stau_a, Stau_b, ...}, where STsy is the source type set for the system administrator, STse is the source type set for the security administrator, and STau is the source type set for the audit administrator. Based on SELinux's Type Enforcement (TE) model and the above definition of the power sets, the following three sets of TE policy models can be obtained:

[0028] 1. Psy = STsy OPT TT, where Psy is the system administrator's TE policy set, OPT is the set of allowed operations, containing the specific actions the system administrator can perform on target objects, and TT is the target type set. The target type is the security context label of the object being operated on, such as the target type of a system configuration file being sys_config_t, the target type of a user database being user_db_t, and the target type of an audit log being auditd_log_t. TT only contains target object types operable within the system administrator's power set Csy. This is a Cartesian product, representing the ordered combination of elements from three sets to form a triple of "source type-operation-target type". And Psy Csy, which stands for the system administrator's permissions for each source type, is a subset of the system administrator's power set Csy.

[0029] 2. Pse = STse OPT TT, where Pse is the security administrator's TE policy set, OPT is the set of allowed operations, containing the specific actions the security administrator can perform on the target object, and TT is the target type set. TT only contains the target object types operable within the security administrator's authority set Cse. This is a Cartesian product, representing the ordered combination of elements from three sets to form a triple of "source type-operation-target type". And Pse Cse, which refers to the permissions granted to security administrators for each source type, is a subset of the security administrator's power set Cse.

[0030] 3. Pau = STau OPT TT, where Pse is the audit administrator's TE policy set, OPT is the set of allowed operations, containing the specific actions the audit administrator can perform on the target object, and TT is the target type set. TT only contains the target object types operable within the audit administrator's Cau power set; This is a Cartesian product, representing the ordered combination of elements from three sets to form a triple of "source type-operation-target type". And Pau... Cau, which stands for the permissions granted to each source type by the audit administrator, is a subset of the audit administrator's Cau power set.

[0031] At the same time, satisfy STsy STse= STse STau= STsy STau= .

[0032] The aforementioned TE strategy model clarifies the execution permission boundaries for each type of management user through a triple mapping of "source type-operation-target type", thereby achieving fine-grained control over their permissions.

[0033] Each administrator is associated with a unique user role, and a corresponding set of source types is associated with each user role. A default source type is assigned to each user role. It is permissible to convert the default source type to any source type within the set of source types associated with the user role. For example, three administrator roles are defined: system administrator role sysadm_r, security administrator role secadm_r, and audit administrator role audittadm_r.

[0034] Associate the role with the source type set: role sysadm_r types STsy={STsy_a, STsy_b,…} role secadm_r types STse={STse_a, STse_b,…} role auditadm_r types STau={STau_a, STau_b,…}

[0035] Accordingly, creating a target process associated with the target operation request and placing the target process in a pre-defined initial domain may include: first, determining the target user role corresponding to the target management client for the target operation request, and creating a corresponding target process based on the target user role; then, determining the target default source type corresponding to the target user role, setting the initial domain of the target process to the target default source type, and placing the target process in the initial domain.

[0036] For example, assigning default source types to different user roles: role sysadm_r types sysadm_t role secadm_r types secadm_t role auditadm_r types auditadm_t

[0037] The relationship between the source type ST for managing users and the source type set is explained below:

[0038] Taking a security administrator as an example, the default source type of `secadm_r` is `secadm_t`. This source type `ST` can be converted to any source type {`STse_a`, `STse_b`, ...} in the set of source types associated with the role `secadm_r`. In the TE policy model implementation, corresponding permissions are assigned to each source type. Taking loading a security policy as an example, the source type `secadm_t` is converted to the source type `load_policy_t`, granting the administrator the permission to load policy rules.

[0039] Step S12: Perform security verification on the current domain corresponding to the target process based on a preset security function. If the verification result indicates that the domain is secure, determine whether the current domain transfer termination condition is met. If not, determine the target transfer path according to the predefined domain transfer strategy, transfer the current domain corresponding to the target process to the next domain according to the target transfer path, use the next domain as the new current domain, and jump to the step of performing security verification on the current domain corresponding to the target process based on the preset security function. If the current domain transfer termination condition is met, use the current domain corresponding to the target process as the final domain.

[0040] This embodiment introduces multi-domain transfer technology and designs and implements a process-level permission management scheme. Through this multi-domain transfer technology, the principle of minimizing the permissions of management users in the system is guaranteed, thus solving the problem of permission acquisition for management users in the system.

[0041] A domain, typically referring to a process's security context, is an associated domain that determines the operations and resources a process can access during execution. Domain transfer is the process of switching a process from one domain to another under specific conditions. When a process performs a specific operation, a decision based on security policy rules can be made regarding whether the process is allowed to transfer to another valid domain. SELinux's domain transfer technology can be modeled as a directed graph, such as... Figure 3 As shown, nodes represent different domains (D1, D2, ..., Dn), i.e., the security contexts of different processes or objects. Edges represent the transition relationships between domains. The existence of an edge indicates the possibility of transitioning from one domain to another. Let G = (V, E), where V is the set of domains, E is the set of transition relationships, and each edge (Di, Dj) represents the security context of a process or object. E represents a valid transfer from domain Di to domain Dj.

[0042] The transfer can be done using a function Let T(Di, a) = Dj, where A is a set of operations, such as system calls, file access, etc., and T(Di, a) = Dj means that after performing operation a, domain Di can be transferred to domain Dj.

[0043] To ensure system security, a security function is introduced. Where S(D)=1 indicates that domain D is secure and access is allowed, and S(D)=0 indicates that domain D is insecure and access is prohibited.

[0044] like Figure 4 As shown, the specific steps to implement the multi-domain transfer technique are as follows:

[0045] 1. Initial state, initial domain authentication. Assume there are N(N 3) Given three fields (D1, D2, D3, ..., Dn), and an initial field D1, check if S(D1) is 1, i.e., whether D1 is safe. If S(D1) = 1, proceed to the next step; if S(D1) = 0, proceed to the next step. 1. Access will be denied.

[0046] 2. First domain transfer. Operation a1 is executed from D1. According to the transfer function T12(D1, a1) = D2, the next domain is determined to be D2. It is then checked whether S(D2) is 1, i.e., whether D2 is safe. If S(D2) = 1, proceed to the next step; otherwise, proceed to the next step. 1. Access will be denied.

[0047] 3. Second domain transfer. Operation a2 is performed from D2. According to the transfer function T23(D2, a2) = D3, the next domain is determined to be D3. It is then checked whether S(D3) is 1, i.e., whether D3 is safe. If S(D3) = 1, proceed to the next step; otherwise, proceed to the next step. 1. Access will be denied.

[0048] 4. The k-th domain transfer. Execute operation ak from Dk. According to the domain transfer function Tk-1,k(Dk, ak) = Dk, determine the next domain as Dk. Check if S(Dk) is 1, i.e., whether Dk is safe. If S(Dk) = 1, continue to the next step; if S(Dk) = 1, proceed to the next step. 1. Access will be denied.

[0049] 5. N-1th domain transfer. Execute operation an-1 from Dn-1. According to the transfer function Tn-1,n(Dn-1, an-1)=Dn, determine the next domain as Dn. Check if S(Dn) is 1, i.e., whether Dn is safe. If S(Dn)=1, continue to the next step; if S(Dn)=1, proceed to the next step. 1. Access will be denied.

[0050] 6. Domain Authentication. Given a final domain Dn. If S(Dn) = 1, then grant permissions; otherwise, grant permissions. 1. Access will be denied.

[0051] It should be noted that if, after performing a security check on the current domain corresponding to the target process based on the preset security function, the check result indicates insecurity and the preset domain transfer termination condition is not met, then the domain transfer is terminated and the target operation request sent by the target management client is rejected. Conversely, if, after performing a security check on the current domain corresponding to the target process based on the preset security function, the check result indicates insecurity and the preset domain transfer termination condition is met, then the final domain authentication is deemed to have failed and the target operation request sent by the target management client is rejected.

[0052] To enable a certain type of administrator user to acquire the permissions of another type of administrator user through a specific process, a process-level permission model is proposed. This model divides the source type set corresponding to any type of administrator user into at least one source type subset. A domain transfer path is established between the source type subset and the source type subset associated with the target permission set. This allows a process of any administrator user to use the domain transfer path to transfer permissions within the permission range of the permission set corresponding to the other type of administrator user. The target permission set is the permission set corresponding to other types of administrator users, excluding the permission set corresponding to any one type of administrator user.

[0053] For example, the source type set ST = {STsy, STse, STau} can be managed with finer granularity, where STsy represents the system administrator's source type set, STse represents the security administrator's source type set, and STau represents the audit administrator's source type set. The three sets of source type ST, STsy, STse, and STau, satisfy the following conditions:

[0054] The source type set Stsy: STsy = {STsy_a, STsy_b, ...}; where STsy_a = {Stse_a, Stse_b, ...}, STsy_b = {Stau_a, Stau_b, ...}, STsy contains source types related to system management resources, including user identity management (useradd_t, userdel_t, passwd_t), system resource management (rpm_t, fs_t), system loading and startup (systemctl_t, reboot_t). At the same time, the process STsy_a can be transferred to domains such as Stau_a or Stse_a to obtain audit or security policy related permissions. For example, the process systemctl_t has the function of starting the auditd service, while sysadm does not have the right to directly obtain audit or security policy related permissions.

[0055] Source type set STse: STse = {STse_a, STse_b, ...}; where STse_a = {Stau_a, Stau_b ...}; STse_b = {Stsy_a, Stsy_b ...}. STse contains source types related to system security policies, including system tags (chcon_t), policy compilation (checkmodule_t), and policy loading (load_policy_t). At the same time, the process STse_a can move to domains such as Stau_a or Stsy_a to obtain audit or system management related permissions. For example, the process auserach_t has the permission to view audit logs, while the secadm user does not have the right to directly obtain the permission to view audit logs.

[0056] Source type set STau: STau={STau_a, STau_b, ...} where STau_a={Stse_a, Stse_b...}, Stau_b={Stsy_a, Stsy_b...}, STse contains source types for audit management, including log viewing (auditd_log_t), audit policies (auditctl_t), and audit services (auditd_t). At the same time, the process STau_a can be transferred to domains such as Stse_a or Stsy_a to obtain security policy and system management related permissions. For example, the process audit2why_t has the function of viewing security policies, while the auditadm user does not have the right to directly obtain security policy related permissions.

[0057] like Figure 5 The diagram illustrates the process by which a security administrator executes the ausearch process to gain access to audit logs.

[0058] (1) Security administrators can view audit logs through the ausearch process, but do not have direct access permissions to view audit logs:

[0059] Step 1: Initial state, initial domain authentication. The security administrator's initial domain is secadm_t, S(secadm_t)=1, then proceed to step 2.

[0060] Step 2: First domain transfer. Starting from secadm_t, according to the transfer function T12(secadm_t, a1)=ausearch_t, the next domain is determined to be ausearch_t. Check whether S(ausearch_t) is 1, that is, whether ausearch_t is feasible. If S(ausearch_t)=1, then continue to the next step.

[0061] Step 3: Second domain transfer. Starting from the execution of ausearch_t, according to the transfer function T23(ausearch_t, a2) = ausearch_exec_t, the next domain is determined to be ausearch_exec_t. Check whether S(ausearch_exec_t) is 1, that is, whether ausearch_exec_t is feasible. If S(ausearch_exec_t) = 1, then continue to the next step.

[0062] Step 4: Third domain transfer. Starting from the execution of ausearch_exec_t, according to the transfer function T34(ausearch_exec_t, a3)=auditd_log_t, the next domain is determined to be auditd_log_t. It checks whether S(auditd_log_t) is 1, that is, whether auditd_log_t is feasible. If S(auditd_log_t)=1, then the process source type corresponding to ausearch_exec_t can read the auditd_log_t file.

[0063] Step 5: Domain Authentication. Given the final domain auditd_log_t, if S(auditd_log_t)=1, the security administrator can obtain permission to read the auditd.log file through the ausearch process.

[0064] Ultimately, the security administrator can read audit log files with source type auditd_log_t through the ausearch process, while those with source type secadm_t do not have direct access to the audit logs.

[0065] Step S13: Grant the target process the target permissions required to execute the target operation request according to the final domain, so that the target process can use the target permissions to execute the target operation.

[0066] In this embodiment, the target process can be granted the target permissions required to execute the target operation request based on the final domain, so that the target process can use the target permissions to execute the target operation. Furthermore, additional permissions acquired by the target process through domain transfer can be revoked, allowing the target process to return to the pre-defined initial domain. Then, corresponding operation records can be generated based on the target process's domain transfer information and permission change information during the domain transfer process, and these operation records can be saved.

[0067] As shown above, this embodiment divides the original super user into different types of management users and assigns corresponding permissions to them. Even if a management user account is attacked or abused, the attacker can only obtain the permissions of the corresponding set of permissions and cannot completely control the entire system, significantly reducing the risk of "a single account being compromised leading to a complete loss of system control". The source type set is further subdivided, and precise permissions are assigned to each source type, achieving a four-layer precise mapping of "user-role-source type-permission". This fine-grained control avoids the "security vulnerabilities caused by broad permissions" in traditional permission management, reducing the permission entry points that attackers can exploit and narrowing the attack surface of security vulnerabilities. A clear mapping relationship of "source type-operation-target type" is established through the TE policy model, ensuring that each permission corresponds to a clear operation object and scope, thus preventing the problem of permission overreach. At the same time, the principle of least privilege is implemented through "process-level permission acquisition", eliminating the need to configure redundant permissions for users, significantly reducing the management cost of permission allocation and modification, and improving permission management efficiency. By employing multi-domain transfer technology, permissions are acquired through multiple rounds of domain transfer and security verification. Each step must meet predefined transfer conditions. This "multi-stage verification + process-oriented permission acquisition" design makes the permission granting process traceable and controllable, significantly enhancing the legality and controllability of permission acquisition and further improving the system's security level.

[0068] See Figure 6 As shown in the figure, this application also discloses a process permission configuration device based on multi-domain transfer, including: The process creation module 11 is used to obtain the target operation request sent by the target management user terminal, create a target process associated with the target operation request, place the target process in a pre-set initial domain, and use the initial domain as the current domain of the target process; the management user includes system administrator, audit administrator and security administrator, and the domain is the security context of the process; Domain transfer module 12 is used to perform security verification on the current domain corresponding to the target process based on a preset security function. If the verification result indicates that it is safe, it determines whether the current domain transfer termination condition is met. If not, it determines the target transfer path according to the predefined domain transfer strategy, transfers the current domain corresponding to the target process to the next domain according to the target transfer path, uses the next domain as the new current domain, and jumps to the step of performing security verification on the current domain corresponding to the target process based on the preset security function. If the current domain transfer termination condition is met, it uses the current domain corresponding to the target process as the final domain. The operation execution module 13 is used to grant the target process the target permission required to execute the target operation request according to the final domain, so that the target process can use the target permission to execute the target operation.

[0069] In some specific embodiments, the process permission configuration device based on multi-domain transfer further includes: The permission partitioning unit is used to divide the original super user into different types of management users and to partition the permissions corresponding to the original super user to obtain multiple independent sets of permissions; wherein, each set of permissions corresponds to the permission range of a type of management user. The source type determination unit is used to associate a corresponding source type set with each of the management users; the source type set contains at least one source type, each source type has a specific operation permission within the permission scope of the power set corresponding to the management user, and there is no intersection between different source type sets.

[0070] In some specific implementations, for any two different first power sets and second power sets, the intersection of the first power set and the second power set is empty, and the union of all power sets is all permissions corresponding to the original super user; the operation permissions corresponding to any source type set do not exceed the permission range of the power set corresponding to the managing user.

[0071] In some specific embodiments, the process permission configuration device based on multi-domain transfer further includes: The domain transfer path establishment unit is used to divide the source type set corresponding to any type of management user into at least one source type subset, and establish a domain transfer path between the source type subset and the source type subset associated with the target capability set, so that the process of any management user can use the domain transfer path to perform a domain transfer in order to obtain permissions within the permission range of the capability set corresponding to another type of management user; the target capability set is the capability set corresponding to other types of management users excluding the capability set corresponding to any type of management user.

[0072] In some specific embodiments, the process permission configuration device based on multi-domain transfer further includes: The role association unit is used to associate a unique user role with each of the management users, associate a corresponding set of source types with the user role, and assign a default source type to the user role; wherein, it is allowed to convert the default source type to any source type in the set of source types associated with the user role.

[0073] Accordingly, the process creation module 11 includes: The process creation unit is used to determine the target user role corresponding to the target management user terminal corresponding to the target operation request, and to create a corresponding target process based on the target user role. An initial domain determination unit is used to determine the target default source type corresponding to the target user role, set the initial domain corresponding to the target process to the target default source type, and place the target process in the initial domain.

[0074] In some specific embodiments, the process permission configuration device based on multi-domain transfer further includes: The first processing unit is configured to terminate the domain transfer and reject the target operation request sent by the target management client if the verification result obtained after performing security verification on the current domain corresponding to the target process based on a preset security function is insecure and the current domain transfer termination condition is not met. The second processing unit is configured to determine that the final domain authentication has failed and reject the target operation request sent by the target management client if the verification result obtained after performing security verification on the current domain corresponding to the target process based on a preset security function is insecure and the current domain transfer termination condition is met.

[0075] In some specific embodiments, the operation execution module 13 further includes: The permission revoke unit is used to revoke the additional permissions acquired by the target process through domain transfer, so that the target process can return to the pre-set initial domain; The record storage unit is used to generate corresponding operation records based on the domain transfer information of the target process and the permission change information during the domain transfer process, and to save the operation records.

[0076] Furthermore, embodiments of this application also disclose an electronic device, Figure 7 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0077] Figure 7This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the process permission configuration method based on multi-domain transfer disclosed in any of the foregoing embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0078] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0079] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0080] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the process permission configuration method based on multi-domain transfer disclosed in any of the foregoing embodiments, the computer program 222 may further include computer programs capable of performing other specific tasks.

[0081] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned process permission configuration method based on multi-domain transfer. For the specific steps of this method, please refer to the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0082] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0083] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0084] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0085] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0086] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A process permission configuration method based on multi-domain transfer, characterized in that, include: Obtain the target operation request sent by the target management client, create a target process associated with the target operation request, place the target process in a pre-defined initial domain, and use the initial domain as the current domain of the target process; Management users include system administrators, audit administrators, and security administrators; the domain is the security context of the process. The current domain corresponding to the target process is subjected to security verification based on a preset security function. If the verification result indicates that the domain is safe, it is determined whether the current domain transfer termination condition is met. If not, the target transfer path is determined according to a predefined domain transfer strategy, and the current domain corresponding to the target process is transferred to the next domain according to the target transfer path. The next domain is used as the new current domain, and the process jumps to the step of performing security verification on the current domain corresponding to the target process based on the preset security function. If the current domain transfer termination condition is met, the current domain corresponding to the target process is used as the final domain. Grant the target process the target permissions required to execute the target operation request based on the final domain, so that the target process can use the target permissions to execute the target operation.

2. The process permission configuration method based on multi-domain transfer according to claim 1, characterized in that, Also includes: The original super users are divided into different categories of management users, and the permissions corresponding to the original super users are divided to obtain multiple independent sets of permissions; wherein, each set of permissions corresponds to the permission range of a category of management users. Each management user is associated with a set of source types; the set of source types contains at least one source type, each source type has specific operation permissions within the permission scope of the power set corresponding to its management user, and there is no intersection between different sets of source types.

3. The process permission configuration method based on multi-domain transfer according to claim 2, characterized in that, For any two different first power sets and second power sets, the intersection of the first power set and the second power set is empty, and the union of all power sets is all the permissions corresponding to the original super user; the operation permissions corresponding to any source type set do not exceed the permission range of the power set corresponding to the managing user.

4. The process permission configuration method based on multi-domain transfer according to claim 2, characterized in that, Also includes: Divide the source type set corresponding to any type of management user into at least one source type subset, and establish a domain transfer path between the source type subset and the source type subset associated with the target authority set, so that the process of any management user can use the domain transfer path to perform a domain transfer in order to obtain permissions within the authority set corresponding to another type of management user; the target authority set is the authority set corresponding to other types of management users excluding the authority set corresponding to any type of management user.

5. The process permission configuration method based on multi-domain transfer according to claim 1, characterized in that, Also includes: Each management user is associated with a unique user role, and a corresponding set of source types is associated with each user role. A default source type is assigned to each user role. The default source type can be converted to any source type in the set of source types associated with the user role. Accordingly, creating a target process associated with the target operation request and placing the target process in a pre-defined initial domain includes: Determine the target user role corresponding to the target management client of the target operation request, and create a corresponding target process based on the target user role; Determine the target default source type corresponding to the target user role, set the initial domain corresponding to the target process to the target default source type, and place the target process in the initial domain.

6. The process permission configuration method based on multi-domain transfer according to claim 1, characterized in that, Also includes: If the current domain corresponding to the target process is subjected to security verification based on the preset security function, and the verification result indicates that it is insecure and the preset domain transfer termination condition is not met, then the domain transfer is terminated and the target operation request sent by the target management client is rejected. If the security verification of the current domain corresponding to the target process is performed based on the preset security function, and the verification result indicates that it is insecure and the preset domain transfer termination condition is met, then the final domain authentication is determined to fail and the target operation request sent by the target management client is rejected.

7. The process permission configuration method based on multiple domain transfer according to any one of claims 1 to 6, characterized in that, After the target process executes the target operation using the target permissions, it also includes: Revoke the additional privileges acquired by the target process through domain transfer, so that the target process can return to the pre-set initial domain; Based on the domain transfer information of the target process and the permission change information during the domain transfer process, corresponding operation records are generated and saved.

8. A process permission configuration device based on multi-domain transfer, characterized in that, include: The process creation module is used to obtain the target operation request sent by the target management user terminal, create a target process associated with the target operation request, place the target process in a pre-set initial domain, and use the initial domain as the current domain of the target process; Management users include system administrators, audit administrators, and security administrators; the domain is the security context of the process. The domain transfer module is used to perform security verification on the current domain corresponding to the target process based on a preset security function. If the verification result indicates that it is safe, it determines whether the current domain transfer termination condition is met. If not, it determines the target transfer path according to the predefined domain transfer strategy, transfers the current domain corresponding to the target process to the next domain according to the target transfer path, uses the next domain as the new current domain, and jumps to the step of performing security verification on the current domain corresponding to the target process based on the preset security function. If the current domain transfer termination condition is met, it uses the current domain corresponding to the target process as the final domain. An operation execution module is used to grant the target process the target permissions required to execute the target operation request based on the final domain, so that the target process can use the target permissions to execute the target operation.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the process permission configuration method based on multiple domain transfer as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Used to store computer programs, which, when executed by a processor, implement the process permission configuration method based on multiple domain transfer as described in any one of claims 1 to 7.

Images