A method and apparatus for processing operation permissions

Abstract

This invention relates to the field of data processing technology in financial technology (Fintech), and particularly to a method and apparatus for processing operation permissions, used to realize trusted user privilege escalation operations and ensure the security of privilege escalation operations. The method includes: receiving a privilege escalation request, the request including at least identification information of a target operation object and a corresponding target operation instruction; determining the execution method corresponding to the target operation instruction; determining a score for the target operation instruction based at least on the execution method and a preset scoring rule; if the score of the target operation instruction is greater than or equal to an interception threshold, stopping the execution of the target operation instruction; if the score of the target operation instruction is less than the interception threshold, executing the target operation instruction for the target operation object.

Description

Technical Field

[0001] This invention relates to the field of data processing technology in financial technology (Fintech), and in particular to a method and apparatus for processing operation permissions. Background Technology

[0002] With the development of computer technology, more and more technologies are being applied in the financial field. The traditional financial industry is gradually transforming into financial technology. However, due to the security and real-time requirements of the financial industry, higher demands are being placed on technology.

[0003] Information security requirements are quite stringent in most financial institutions. Regarding terminal usage, users are generally only allowed to log in and run software with normal operating system user privileges. This effectively prevents the execution of malicious software that requires system resources, reduces the security risks of desktop terminal compromise, and also better prevents unauthorized users from accessing or damaging system resources.

[0004] However, in practice, especially during software operation, installation, uninstallation, and system environment configuration, most operations still require system administrator privileges. For example, developers compiling programs and testers testing software may encounter access permission issues for system resources, requiring IT support personnel on the desktop terminal to grant users temporary or permanent privileges to administrators. Once a user's privileges are elevated to administrator, they are highly susceptible to unknowingly executing malicious programs. These malicious programs gain the same privileges as the administrator account, enabling access to all operating system resources, potentially leading to desktop terminal compromise, data theft, or corruption. Alternatively, users may unknowingly install and run remote control programs, which could be used for network intrusion or business espionage. In such cases, the actions of users with elevated privileges cannot be controlled, leading to untrusted operations and security vulnerabilities. Summary of the Invention

[0005] This application provides a method and apparatus for processing operation permissions, so as to realize the trusted operation of user privilege escalation and ensure the security of privilege escalation operation.

[0006] An embodiment of the present invention provides a method for processing operation permissions, the method comprising:

[0007] Receive a privilege escalation request, wherein the privilege escalation request includes at least the identification information of the target object and the corresponding target operation instruction;

[0008] Determine the execution method corresponding to the target operation instruction;

[0009] The score of the target operation instruction is determined at least according to the execution method and the preset scoring rules;

[0010] If the score of the target operation instruction is greater than or equal to the interception threshold, then the execution of the target operation instruction is stopped.

[0011] If the score of the target operation instruction is less than the interception threshold, then the target operation instruction is executed on the target operation object.

[0012] In one optional embodiment, the target operation instruction includes N target sub-operation instructions, where N is a positive integer;

[0013] Determining the execution method corresponding to the target operation instruction includes:

[0014] Determine the category of the target operation instruction, the target sub-operation instructions contained in the target operation instruction, and the storage path corresponding to each target sub-operation instruction;

[0015] Determining the score of the target operation instruction based at least on the execution method and the preset scoring rules includes:

[0016] The score for each target sub-operation instruction is determined based on the category of the target operation instruction, the target sub-operation instructions contained in the target operation instruction, the storage path corresponding to each target sub-operation instruction, and the preset scoring rules.

[0017] The score of the target operation instruction is determined based on the score of the target sub-operation instruction.

[0018] In one optional embodiment, determining the score corresponding to each target sub-operation instruction based on the category of the target operation instruction, the target sub-operation instructions contained in the target operation instruction, the storage path corresponding to each target sub-operation instruction, and a preset scoring rule includes:

[0019] Create a target process that executes the target operation instruction, the target process containing multiple sub-processes, one of which is used to execute a target sub-operation instruction;

[0020] The plurality of subprocesses are monitored, and when any target subprocess among the plurality of subprocesses is detected to start execution, the target process is paused.

[0021] The score of the target subprocess is determined based on the operation instruction category, sub-operation instruction category, and storage path corresponding to the target subprocess.

[0022] The step of determining the score of the target operation instruction based on the score of the target sub-operation instruction includes:

[0023] The scores of the target subprocesses are accumulated sequentially to obtain the score of the target operation instruction.

[0024] In an optional embodiment, the step of executing the target operation instruction for the target operation object if the score of the target operation instruction is less than the interception threshold includes:

[0025] If the score of the target operation instruction is determined to be less than the interception threshold, then the target sub-operation instruction is executed through the target sub-process.

[0026] Continue executing the steps of monitoring the multiple sub-processes until all target sub-operations have been completed.

[0027] In an optional embodiment, after receiving the privilege escalation request and before determining the execution method corresponding to the target operation instruction, the method further includes:

[0028] Based on the identification information of the target operation object, determine whether the target operation object is in the blacklist or whitelist;

[0029] If the target operation object is in the blacklist, the privilege escalation request is rejected;

[0030] If the target operation object is in the whitelist, then the target operation instruction is executed for the target operation object;

[0031] If the target operation object is neither in the blacklist nor in the whitelist, then the step of determining the execution method corresponding to the target operation instruction is executed.

[0032] In an optional embodiment, it further includes:

[0033] At least the identification information of the target operation object, the target process information corresponding to the target operation instruction with a score greater than or equal to the interception threshold, the target process information corresponding to the target operation instruction with a score less than the interception threshold, and the execution time are recorded and sent to the server.

[0034] In one optional embodiment, before determining the score of the target operation instruction based at least on the execution method and a preset scoring rule, the method further includes:

[0035] Send a request to the server;

[0036] Receive the retrieval response from the server, the retrieval response containing the scoring rules.

[0037] This invention also provides an operation permission processing device, comprising:

[0038] A transceiver unit is used to receive privilege escalation requests, wherein the privilege escalation request includes at least the identification information of the target operation object and the corresponding target operation instruction;

[0039] The parsing unit is used to determine the execution method corresponding to the target operation instruction;

[0040] A scoring unit is used to determine the score of the target operation instruction based at least on the execution method and preset scoring rules.

[0041] The execution unit is configured to stop executing the target operation instruction if the score of the target operation instruction is greater than or equal to the interception threshold; and to execute the target operation instruction for the target operation object if the score of the target operation instruction is less than the interception threshold.

[0042] In one optional embodiment, the target operation instruction includes N target sub-operation instructions, where N is a positive integer;

[0043] The parsing unit is specifically used to determine the category of the target operation instruction, the target sub-operation instructions contained in the target operation instruction, and the storage path corresponding to each target sub-operation instruction;

[0044] The scoring unit is specifically used to determine the score corresponding to each target sub-operation instruction based on the category of the target operation instruction, the target sub-operation instructions contained in the target operation instruction, the storage path corresponding to each target sub-operation instruction, and the preset scoring rules; and to determine the score of the target operation instruction based on the score of the target sub-operation instructions.

[0045] In one optional embodiment, the execution unit is specifically used to create a target process that executes the target operation instruction. The target process includes multiple sub-processes, one of which is used to execute a target sub-operation instruction.

[0046] The scoring unit is specifically used to monitor the plurality of sub-processes. When it detects that any target sub-process among the plurality of sub-processes has started execution, it pauses the target process. Based on the operation instruction category, sub-operation instruction category and storage path corresponding to the target sub-process, it determines the score of the target sub-process. The scores of the target sub-processes are accumulated sequentially to obtain the score of the target operation instruction.

[0047] In one optional embodiment, the execution unit is specifically used for:

[0048] If the score of the target operation instruction is determined to be less than the interception threshold, then the target sub-operation instruction is executed through the target sub-process.

[0049] Continue executing the steps of monitoring the multiple sub-processes until all target sub-operations have been completed.

[0050] In an optional embodiment, a preliminary detection unit is further included, for:

[0051] Based on the identification information of the target operation object, determine whether the target operation object is in the blacklist or whitelist;

[0052] If the target operation object is in the blacklist, the privilege escalation request is rejected;

[0053] If the target operation object is in the whitelist, then the target operation instruction is executed for the target operation object;

[0054] If the target operation object is neither in the blacklist nor in the whitelist, then the step of determining the execution method corresponding to the target operation instruction is executed.

[0055] In an optional embodiment, a log unit is further included, for:

[0056] At least the identification information of the target operation object, the target process information corresponding to the target operation instruction with a score greater than or equal to the interception threshold, the target process information corresponding to the target operation instruction with a score less than the interception threshold, and the execution time are recorded and sent to the server.

[0057] In one optional embodiment, the transceiver unit is further configured to:

[0058] Send a request to the server;

[0059] Receive the retrieval response from the server, the retrieval response containing the scoring rules.

[0060] This invention also provides an electronic device, comprising:

[0061] At least one processor; and,

[0062] A memory communicatively connected to the at least one processor; wherein,

[0063] The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method as described above.

[0064] This invention also provides a non-transitory computer-readable storage medium storing computer instructions for causing the computer to perform the method described above.

[0065] In this embodiment of the invention, the terminal receives a privilege escalation request from a user. This request is used to elevate the user's operational privileges and includes at least the identification information of the target operation object and the corresponding target operation instruction. The terminal determines the execution method corresponding to the target operation instruction and, at least based on the execution method and a preset scoring rule, determines the score of the target operation instruction. The target operation instruction is compared with an interception threshold. If the score of the target operation instruction is greater than or equal to the interception threshold, the execution of the target operation instruction is stopped; if the score of the target operation instruction is less than the interception threshold, the target operation instruction is executed against the target operation object. This embodiment of the invention monitors the execution method of the target operation instruction, scores the target operation instruction based on the execution method, and stops the execution of the target operation instruction when the score is greater than or equal to the interception threshold. This controls the execution process of the target operation instruction, prevents untrusted operations during the execution of the target operation instruction, avoids security risks associated with privilege escalation, and improves the security of privilege escalation operations. Attached Figure Description

[0066] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0067] Figure 1 This is a schematic diagram of a possible system architecture provided in an embodiment of the present invention;

[0068] Figure 2 A flowchart illustrating a method for processing operation permissions provided in an embodiment of the present invention;

[0069] Figure 3 This is a schematic diagram illustrating the monitoring process of a target process provided in an embodiment of the present invention;

[0070] Figure 4 This is a schematic diagram of the main functional modules in a specific embodiment of the present invention;

[0071] Figure 5 A flowchart illustrating the method for processing operation permissions provided in a specific embodiment of the present invention;

[0072] Figure 6 A schematic diagram of the structure of an operation permission processing device provided in an embodiment of the present invention;

[0073] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0074] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0075] For ease of understanding, the terms that may be involved in the embodiments of the present invention are defined and explained below.

[0076] Desktop management software: Software used for unified management of desktop terminal computer environment and configuration within an enterprise, such as the mainstream Microsoft System Cener abroad; and the mainstream domestic software such as Lianruan Security Assistant and IP-Guard.

[0077] Privilege escalation: The process of granting ordinary users temporary access to manage operating system resources through certain means.

[0078] Trustworthy: In the embodiments of this invention, this mainly refers to software use, command operations, etc., that conform to safety expectations.

[0079] A process is a running activity of a program with independent functionality concerning a certain set of data. It can request and own system resources; it is a dynamic concept and an active entity.

[0080] A thread is the smallest unit of computation that an operating system can schedule. It is contained within a process and is the actual unit of operation within that process. A thread refers to a single, sequential flow of control within a process. Multiple threads can run concurrently within a process, each executing different tasks in parallel.

[0081] API (Application Programming Interface) refers to predefined interfaces (such as functions or HTTP interfaces) or conventions for connecting different components of a software system.

[0082] See Figure 1 The diagram shown is an application architecture diagram of the operation permission processing method in an embodiment of the present invention. The system architecture includes a terminal device 100 and a server 200.

[0083] Terminal device 100 can be a mobile or a fixed electronic device. Examples include mobile phones, tablets, laptops, desktop computers, various wearable devices, smart TVs, in-vehicle devices, or other electronic devices capable of performing the aforementioned functions. Terminal device 100 has an operating system and various software installed, enabling it to receive and process privilege escalation requests sent by users.

[0084] Terminal device 100 and server 200 can be connected via the Internet to enable communication between them. Optionally, the Internet described above uses standard communication technologies and / or protocols. The Internet is typically the Internet, but can also be any network, including but not limited to Local Area Network (LAN), Metropolitan Area Network (MAN), Wide Area Network (WAN), mobile, wired or wireless networks, private networks or virtual private networks, and any combination thereof. In some embodiments, technologies and / or formats including Hyper Text Markup Language (HTML), Extensible Markup Language (XML), etc., are used to represent data exchanged over the network. Furthermore, conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Network (VPN), and Internet Protocol Security (IPsec) can be used to encrypt all or some links. In other embodiments, customized and / or dedicated data communication technologies can be used to replace or supplement the aforementioned data communication technologies.

[0085] Server 200 can provide various network services to terminal device 100, and server 200 can use cloud computing technology for information processing. Server 200 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. Terminals can be smartphones, tablets, laptops, desktop computers, smart speakers, smartwatches, etc., but are not limited to these. Terminals and servers can be directly or indirectly connected via wired or wireless communication, which is not limited herein.

[0086] Specifically, the terminal device 100 may include a processor 110 (Center Processing Unit, CPU), a memory 120, an input device 130, and an output device 140, etc. The input device 130 may include a keyboard, mouse, touch screen, etc., and the output device 140 may include a display device, such as a liquid crystal display (LCD) or a cathode ray tube (CRT).

[0087] The memory 120 may include a read-only memory (ROM) and a random access memory (RAM), and provides the processor 110 with program instructions and data stored in the memory 120. In this embodiment of the invention, the memory 120 may be used to store a program for processing operation permissions in this embodiment of the invention.

[0088] The processor 110 calls the program instructions stored in the memory 120, and the processor 110 is used to execute the steps of any operation permission processing method in the embodiments of the present invention according to the obtained program instructions.

[0089] Based on the above architecture, embodiments of the present invention provide a method for processing operation permissions, such as... Figure 2 As shown, when the operation permission processing method provided in this embodiment of the invention is applied to a terminal device, the method includes the following steps:

[0090] Step 201: The terminal receives a privilege escalation request, which includes at least the identification information of the target object and the corresponding target operation instruction.

[0091] In practice, a privilege escalation client can be installed on the terminal, and the user can send privilege escalation requests through the client; alternatively, the terminal can directly display a page for privilege escalation operations to the user, who can then perform the operations and send privilege escalation requests on the page.

[0092] A privilege escalation request may include information such as the identifier of the target operation object, the target operation command, the user identifier, the process name, the process ID, the process hash, the parent process, and the operation time. The target operation object can be software running on the terminal, the operating system, etc.

[0093] Step 202: The terminal determines the execution method corresponding to the target operation instruction.

[0094] In practice, after receiving a privilege escalation request, the terminal parses it, converting it into command-line format for easy storage and transmission. Simultaneously, the parsed information, including current time, current user, process name, process ID, process hash, and parent process, is recorded in a log.

[0095] Specific log examples are as follows:

[0096] <eventdata>

[0097] <Data Name='UtcTime'>2021-03-01 14:57:38.900

[0098] <Data Name='ProcessId'>18272

[0099] <Data Name='Image'>C:\Windows\SysWOW64\msiexec.exe

[0100] <Data Name='CommandLine'>"C:\WINDOWS\System32\msiexec.exe" / i"C:\Program Files(x86)\scmclient\EMETSetup.msi" / qn"

[0101] <Data Name='User'>domain\user1

[0102] <DataName='Hashes'>MD5=9D09DC1EDA745A5F87553048E57620CF

[0103] <Data Name='ParentProcessId'>3560

[0104] <Data Name='ParentImage'>C:\windows\uniaccessagent.exe

[0105] <DataName='ParentCommandLine'>"

[0106] C:\windows\uniaccessagent.exe"

[0107] < / eventdata>

[0108] Furthermore, the terminal determines the corresponding execution method for the target operation instruction obtained from parsing the privilege escalation request. The execution method includes the process, subprocess, and storage path that executes the target operation instruction.

[0109] Step 203: The terminal determines the score of the target operation instruction based at least on the execution method and the preset scoring rules.

[0110] In practice, the preset scoring rules include scores corresponding to different execution methods. These rules can be stored on the terminal or on the server. The terminal retrieves the scoring rules from the server in real time, which facilitates the unified management of the scoring rules.

[0111] After determining the execution method and scoring rules of the target operation command, the terminal determines the score of the target operation command based on the correspondence between the execution method and the score in the scoring rules. Then, the score of the target operation command is compared with the interception threshold, and different privilege escalation operations are executed based on different comparison results.

[0112] Step 204: If the score of the target operation instruction is greater than or equal to the interception threshold, the terminal stops executing the target operation instruction.

[0113] Step 205: If the score of the target operation instruction is less than the interception threshold, the terminal executes the target operation instruction for the target operation object.

[0114] In practice, after the terminal stops executing the target operation command, it can also display a warning to the user that privilege escalation is refused through the interception interface, and show the reason for the refusal.

[0115] On the other hand, after the terminal executes the target operation instruction, it can also display the user's consent response and the operation result of the target object through the privilege escalation interface.

[0116] In this embodiment of the invention, the terminal receives a privilege escalation request from a user. This request is used to elevate the user's operational privileges and includes at least the identification information of the target operation object and the corresponding target operation instruction. The terminal determines the execution method corresponding to the target operation instruction and, at least based on the execution method and a preset scoring rule, determines the score of the target operation instruction. The target operation instruction is compared with an interception threshold. If the score of the target operation instruction is greater than or equal to the interception threshold, the execution of the target operation instruction is stopped; if the score of the target operation instruction is less than the interception threshold, the target operation instruction is executed against the target operation object. This embodiment of the invention monitors the execution method of the target operation instruction, scores the target operation instruction based on the execution method, and stops the execution of the target operation instruction when the score is greater than or equal to the interception threshold. This controls the execution process of the target operation instruction, prevents untrusted operations during the execution of the target operation instruction, avoids security risks associated with privilege escalation, and improves the security of privilege escalation operations.

[0117] Preferably, the target operation instruction in this embodiment of the invention includes N target sub-operation instructions, where N is a positive integer. Then, determining the execution mode corresponding to the target operation instruction includes:

[0118] Determine the category of the target operation instruction, the target sub-operation instructions contained in the target operation instruction, and the storage path corresponding to each target sub-operation instruction;

[0119] Determining the score of the target operation instruction based at least on the execution method and the preset scoring rules includes:

[0120] The score for each target sub-operation instruction is determined based on the category of the target operation instruction, the target sub-operation instructions contained in the target operation instruction, the storage path corresponding to each target sub-operation instruction, and the preset scoring rules.

[0121] The score of the target operation instruction is determined based on the score of the target sub-operation instruction.

[0122] In specific implementation, the execution method corresponding to the target operation instruction includes the category of the target operation instruction, the target sub-operation instructions contained in the target operation instruction, and the storage path corresponding to each target sub-operation instruction. In this embodiment of the invention, the score corresponding to each target sub-operation instruction is determined based on the category of the target operation instruction, the target sub-operation instructions contained in the target operation instruction, and the storage path corresponding to each target sub-operation instruction. For example, first, the category corresponding to the target operation instruction is determined, and then for each target sub-operation instruction in the target operation instruction, the category of the target sub-operation instruction and the storage path corresponding to the target sub-operation instruction are determined, thereby determining the score of the target sub-operation instruction.

[0123] Specifically, Table 1 shows the scores corresponding to each execution method. The scores for each target sub-operation instruction can be calculated according to Table 1.

[0124] Table 1

[0125]

[0126] After calculating the score of each target sub-operation instruction, the final score of the target operation instruction can be determined based on the scores of all target sub-operation instructions contained in the target operation instruction.

[0127] In one optional embodiment, the scores of each target sub-operation instruction in the target operation instruction can be accumulated sequentially until the accumulated score is greater than or equal to the interception threshold, thus determining that the target operation instruction exceeds the security permissions and needs to be intercepted.

[0128] The above-mentioned method determines the score corresponding to each target sub-operation instruction based on the category of the target operation instruction, the target sub-operation instructions contained in the target operation instruction, the storage path corresponding to each target sub-operation instruction, and the preset scoring rules, including:

[0129] Create a target process that executes the target operation instruction, the target process containing multiple sub-processes, one of which is used to execute a target sub-operation instruction;

[0130] The plurality of subprocesses are monitored, and when any target subprocess among the plurality of subprocesses is detected to start execution, the target process is paused.

[0131] The score of the target subprocess is determined based on the operation instruction category, sub-operation instruction category, and storage path corresponding to the target subprocess.

[0132] The step of determining the score of the target operation instruction based on the score of the target sub-operation instruction includes:

[0133] The scores of the target subprocesses are accumulated sequentially to obtain the score of the target operation instruction.

[0134] In practice, the operation instructions can be for installing, repairing, or uninstalling software, or for modifying operating system environment variables or system settings. In this embodiment of the invention, a target process is created to execute the target operation instructions. The execution of this target process requires administrator privileges; that is, the operator needs high-level privileges to execute it. Generally, the target process contains multiple sub-processes, each of which executes a target sub-operation instruction.

[0135] This invention monitors each child process within the target process. When any target child process is detected to be starting execution, the target process is paused. Specifically, the API NtSuspendProcess can be called to pause the target process. After the target process is paused, the target child processes are analyzed and scored; the specific scoring method can be found in Table 1.

[0136] After determining the scores of the target subprocesses in sequence, the scores of the target subprocesses are accumulated.

[0137] Further, the step of executing the target operation instruction for the target operation object if the score of the target operation instruction is less than the interception threshold includes:

[0138] If the score of the target operation instruction is determined to be less than the interception threshold, then the target sub-operation instruction is executed through the target sub-process.

[0139] Continue executing the steps of monitoring the multiple sub-processes until all target sub-operations have been completed.

[0140] In the specific implementation process, the target subprocesses are accumulated sequentially. For each subprocess's score, the accumulated result is used as the target operation instruction's score and compared with the interception threshold. For example, if the first subprocess's score is 1 and the interception threshold is 6, the target process is paused when the first subprocess starts executing. The score of the target operation instruction at this point is determined to be the first subprocess's score. If this score is less than the interception threshold, the first subprocess's operation instruction is executed. This process continues, monitoring multiple subprocesses. When a second subprocess starts executing, the target process is paused. If the second subprocess's score is determined to be 2, the target operation instruction's score is 3, which is also less than the interception threshold. The second subprocess's operation instruction is then executed. If the target process includes only the first and second subprocesses, all target sub-operations are executed.

[0141] The interception threshold in this embodiment of the invention can be as shown in Table 2. In this case, the interception threshold is 6, that is, when the score is less than 6, it is low risk and can continue to be executed; if the score is greater than or equal to 6, it is high risk and needs to be intercepted.

[0142] Table 2

[0143] 0-5 Low risk continue 6-14 High risk Intercept

[0144] On the other hand, if the target process also contains a third child process, after the third child process starts executing, the target process is paused. If the score of the third child process is determined to be 3, then the score of the target operation instruction is 6, which equals the interception threshold. Therefore, the execution of both the third child process and the target process is stopped, and the target operation instruction is intercepted. This prevents unauthorized bypassing or privilege escalation, and confirms the credibility of privilege escalation behavior. The above monitoring process can be performed as follows: Figure 3 As shown.

[0145] Furthermore, after receiving the privilege escalation request and before determining the execution method corresponding to the target operation instruction, the method further includes:

[0146] Based on the identification information of the target operation object, determine whether the target operation object is in the blacklist or whitelist;

[0147] If the target operation object is in the blacklist, the privilege escalation request is rejected;

[0148] If the target operation object is in the whitelist, then the target operation instruction is executed for the target operation object;

[0149] If the target operation object is neither in the blacklist nor in the whitelist, then the step of determining the execution method corresponding to the target operation instruction is executed.

[0150] In the specific implementation process, a preliminary security check is also required on the target operation instructions. This mainly involves comparing the security signature database synchronized from the server with the running privilege escalation operations, judging the process name, process hash value, and command line keywords to determine whether it belongs to the blacklist / whitelist or is an unknown program.

[0151] If it is on the blacklist, it will be blocked directly and the message "Privilege escalation failed due to security issues" will be returned.

[0152] If it is on the whitelist, it will run directly without real-time monitoring;

[0153] If the target process is neither on the whitelist nor the blacklist, then the target process will be monitored in real time after it is created.

[0154] Preferably, in this embodiment of the invention, the scoring rules are stored in a server, and the terminal can send a request to the server to obtain the scoring rules as needed. Therefore, before determining the score of the target operation instruction based at least on the execution method and the preset scoring rules, the method further includes:

[0155] Send a request to the server;

[0156] Receive the retrieval response from the server, the retrieval response containing the scoring rules.

[0157] In practice, the server can configure the following three rules:

[0158] Process blacklist: The blacklist can be enriched by accessing threat intelligence, or administrators can manually add process names and process hashes.

[0159] Process whitelist: Allows administrators to manually add process names, process hashes, etc.

[0160] Critical path rules: Administrators can manually add file / directory paths, registry paths, etc., for example, file system path: *\windows\system32\*, registry path: HKEY_LOCAL_MACHINE\SAM\*.

[0161] Furthermore, embodiments of the present invention also include:

[0162] At least the identification information of the target operation object, the target process information corresponding to the target operation instruction with a score greater than or equal to the interception threshold, the target process information corresponding to the target operation instruction with a score less than the interception threshold, and the execution time are recorded and sent to the server.

[0163] In the specific implementation process, during the monitoring, interception, and execution of target operation instructions, information such as user identification, operation time, allowed processes, and intercepted processes can be recorded and uploaded to the server in the form of breakpoints for post-event auditing, which facilitates the administrator to optimize the rules.

[0164] In addition, the server in this embodiment of the invention also records the operation from the server and the log information from the terminal, which is used to trace back the user privilege escalation situation and provide a reference for the system administrator to manually add allow / block rules to the feature library module for wrongful or missed blocking.

[0165] The following specific examples illustrate the implementation process of the operation permission processing method provided in this embodiment of the invention. The specific embodiment is based on a C / S (client / server) architecture, where the client runs on a terminal with local super administrator privileges using desktop management software. It is launched interactively via a call and is primarily responsible for the entire trusted privilege escalation operation. The server is mainly responsible for feature library distribution and client log collection. Its main functional modules are as follows: Figure 4 As shown. The specific implementation process is as follows: Figure 5 As shown, the process includes the following:

[0166] Users use privilege escalation software to target the object for which they want to escalate privileges.

[0167] The privilege escalation software obtains command line information and other relevant information of privilege escalation behavior and performs a blacklist / whitelist check. If it is on the blacklist, it directly intercepts the request and notifies the user of the reason; if it is on the whitelist, it directly executes privilege escalation until the privilege escalation ends; if it is outside the blacklist / whitelist, it calls the security monitoring module to continuously monitor the behavior characteristics, and immediately intercepts the request if any abnormality is detected, otherwise it continues to run until the privilege escalation ends.

[0168] After the privilege escalation is complete, the terminal will upload logs to the server.

[0169] This invention also provides an operation permission processing device, the device as follows: Figure 6 As shown, it includes:

[0170] The transceiver unit 601 is used to receive a privilege escalation request, wherein the privilege escalation request includes at least the identification information of the target operation object and the corresponding target operation instruction;

[0171] The parsing unit 602 is used to determine the execution mode corresponding to the target operation instruction;

[0172] Scoring unit 603 is used to determine the score of the target operation instruction based at least on the execution method and the preset scoring rules;

[0173] The execution unit 604 is configured to stop executing the target operation instruction if the score of the target operation instruction is greater than or equal to the interception threshold; and to execute the target operation instruction for the target operation object if the score of the target operation instruction is less than the interception threshold.

[0174] In one optional embodiment, the target operation instruction includes N target sub-operation instructions, where N is a positive integer;

[0175] The parsing unit 602 is specifically used to determine the category of the target operation instruction, the target sub-operation instructions contained in the target operation instruction, and the storage path corresponding to each target sub-operation instruction;

[0176] The scoring unit 603 is specifically used to determine the score corresponding to each target sub-operation instruction based on the category of the target operation instruction, the target sub-operation instructions contained in the target operation instruction, the storage path corresponding to each target sub-operation instruction, and the preset scoring rules; and to determine the score of the target operation instruction based on the score of the target sub-operation instructions.

[0177] In one optional embodiment, the execution unit 604 is specifically used to create a target process that executes the target operation instruction. The target process includes multiple sub-processes, one of which is used to execute a target sub-operation instruction.

[0178] The scoring unit 603 is specifically used to monitor the plurality of sub-processes. When it detects that any target sub-process among the plurality of sub-processes has started execution, it pauses the target process. Based on the operation instruction category, sub-operation instruction category and storage path corresponding to the target sub-process, it determines the score of the target sub-process. The scores of the target sub-processes are accumulated sequentially to obtain the score of the target operation instruction.

[0179] In one optional embodiment, the execution unit 604 is specifically used for:

[0180] If the score of the target operation instruction is determined to be less than the interception threshold, then the target sub-operation instruction is executed through the target sub-process.

[0181] Continue executing the steps of monitoring the multiple sub-processes until all target sub-operations have been completed.

[0182] In an optional embodiment, a preliminary detection unit 605 is further included, for:

[0183] Based on the identification information of the target operation object, determine whether the target operation object is in the blacklist or whitelist;

[0184] If the target operation object is in the blacklist, the privilege escalation request is rejected;

[0185] If the target operation object is in the whitelist, then the target operation instruction is executed for the target operation object;

[0186] If the target operation object is neither in the blacklist nor in the whitelist, then the step of determining the execution method corresponding to the target operation instruction is executed.

[0187] In an optional embodiment, a log unit 606 is further included, for:

[0188] At least the identification information of the target operation object, the target process information corresponding to the target operation instruction with a score greater than or equal to the interception threshold, the target process information corresponding to the target operation instruction with a score less than the interception threshold, and the execution time are recorded and sent to the server.

[0189] In an optional embodiment, the transceiver unit 601 is further configured to:

[0190] Send a request to the server;

[0191] Receive the retrieval response from the server, the retrieval response containing the scoring rules.

[0192] Based on the same principle, the present invention also provides an electronic device, such as... Figure 7 As shown, it includes:

[0193] It includes a processor 701, a memory 702, a transceiver 703, and a bus interface 704, wherein the processor 701, the memory 702, and the transceiver 703 are connected through the bus interface 704.

[0194] The processor 701 is used to read the program in the memory 702 and execute the following methods:

[0195] Receive a privilege escalation request, wherein the privilege escalation request includes at least the identification information of the target object and the corresponding target operation instruction;

[0196] Determine the execution method corresponding to the target operation instruction;

[0197] The score of the target operation instruction is determined at least according to the execution method and the preset scoring rules;

[0198] If the score of the target operation instruction is greater than or equal to the interception threshold, then the execution of the target operation instruction is stopped.

[0199] If the score of the target operation instruction is less than the interception threshold, then the target operation instruction is executed on the target operation object.

[0200] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable processing device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable processing device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0201] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0202] These computer program instructions can also be loaded onto a computer or other programmable processing device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable device for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0203] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0204] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A method for processing operation permissions, characterized in that, include: Receive a privilege escalation request, wherein the privilege escalation request includes at least the identification information of the target object and the corresponding target operation instruction; Determine the execution method corresponding to the target operation instruction; The score of the target operation instruction is determined at least according to the execution method and the preset scoring rules; If the score of the target operation instruction is greater than or equal to the interception threshold, then the execution of the target operation instruction is stopped. If the score of the target operation instruction is less than the interception threshold, then the target operation instruction is executed on the target operation object; The target operation instruction includes N target sub-operation instructions, where N is a positive integer; Determining the execution method corresponding to the target operation instruction includes: Determine the category of the target operation instruction, the target sub-operation instructions contained in the target operation instruction, and the storage path corresponding to each target sub-operation instruction; Determining the score of the target operation instruction based at least on the execution method and the preset scoring rules includes: The score for each target sub-operation instruction is determined based on the category of the target operation instruction, the target sub-operation instructions contained in the target operation instruction, the storage path corresponding to each target sub-operation instruction, and the preset scoring rules. The score of the target operation instruction is determined based on the score of the target sub-operation instruction.

2. The method as described in claim 1, characterized in that, The step of determining the score for each target sub-operation instruction based on the category of the target operation instruction, the target sub-operation instructions contained in the target operation instruction, the storage path corresponding to each target sub-operation instruction, and the preset scoring rules includes: Create a target process that executes the target operation instruction, the target process containing multiple sub-processes, one of which is used to execute a target sub-operation instruction; The plurality of subprocesses are monitored, and when any target subprocess among the plurality of subprocesses is detected to start execution, the target process is paused. The score of the target subprocess is determined based on the operation instruction category, sub-operation instruction category, and storage path corresponding to the target subprocess. The step of determining the score of the target operation instruction based on the score of the target sub-operation instruction includes: The scores of the target subprocesses are accumulated sequentially to obtain the score of the target operation instruction.

3. The method as described in claim 2, characterized in that, If the score of the target operation instruction is less than the interception threshold, then executing the target operation instruction for the target operation object includes: If the score of the target operation instruction is determined to be less than the interception threshold, then the target sub-operation instruction is executed through the target sub-process. Continue executing the steps of monitoring the multiple sub-processes until all target sub-operations have been completed.

4. The method according to any one of claims 1 to 3, characterized in that, After receiving the privilege escalation request and before determining the execution method corresponding to the target operation instruction, the method further includes: Based on the identification information of the target operation object, determine whether the target operation object is in the blacklist or whitelist; If the target operation object is in the blacklist, the privilege escalation request is rejected; If the target operation object is in the whitelist, then the target operation instruction is executed for the target operation object; If the target operation object is neither in the blacklist nor in the whitelist, then the step of determining the execution method corresponding to the target operation instruction is executed.

5. The method as described in claim 1, characterized in that, Also includes: At least the identification information of the target operation object, the target process information corresponding to the target operation instruction with a score greater than or equal to the interception threshold, the target process information corresponding to the target operation instruction with a score less than the interception threshold, and the execution time are recorded and sent to the server.

6. The method as described in claim 1, characterized in that, Before determining the score of the target operation instruction based at least on the execution method and the preset scoring rules, the method further includes: Send a request to the server; Receive the retrieval response from the server, the retrieval response containing the scoring rules.

7. A device for processing operation permissions, characterized in that, include: A transceiver unit is used to receive privilege escalation requests, wherein the privilege escalation request includes at least the identification information of the target operation object and the corresponding target operation instruction; The parsing unit is used to determine the execution method corresponding to the target operation instruction; A scoring unit is used to determine the score of the target operation instruction based at least on the execution method and preset scoring rules. An execution unit is configured to stop executing the target operation instruction if the score of the target operation instruction is greater than or equal to the interception threshold. If the score of the target operation instruction is less than the interception threshold, then the target operation instruction is executed on the target operation object; wherein, the target operation instruction includes N target sub-operation instructions, where N is a positive integer; The parsing unit is specifically used to determine the category of the target operation instruction, the target sub-operation instructions contained in the target operation instruction, and the storage path corresponding to each target sub-operation instruction; The scoring unit is specifically used to determine the score corresponding to each target sub-operation instruction based on the category of the target operation instruction, the target sub-operation instructions contained in the target operation instruction, the storage path corresponding to each target sub-operation instruction, and the preset scoring rules; and to determine the score of the target operation instruction based on the score of the target sub-operation instructions.

8. An electronic device, characterized in that, include: At least one processor; as well as, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1-6.

9. A non-transitory computer-readable storage medium, characterized in that, The non-transitory computer-readable storage medium stores computer instructions for causing the computer to perform the method of any one of claims 1 to 6.

10. A computer program product, characterized in that, The computer program product stores instructions that, when read and executed by a computer, cause the computer to perform the method as described in any one of claims 1-6.

Images