A web system row-column fine-grained access control method based on runtime hooking

Abstract

The application relates to a WEB system row and column fine-grained access control method based on a runtime hook and belongs to the field of access control. The application can make different users with the same role execute the same SQL statement, have different access permissions with the change of configuration tag attributes, dynamically complete the landing of the minimum permission principle of data from two dimensions of data rows and data columns, obtain a data set conforming to a predetermined security strategy, and avoid data leakage caused by data overreach. The row-level access control feature can accurately control the access of a database table to the row level of the data table, so that the database has the ability of row-level access control. The column-level access control feature can accurately control the access of a database table to the column level of the data table, realizes the access of sensitive data at the column level based on a tag-based security strategy, uses the database to have the ability of column-level access control, and the result set column information read by different users executing the same SQL query operation is different.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of access control, and particularly relates to a WEB system row and column fine-grained access control method based on runtime hook, and particularly relates to a runtime environment injection technology, and based on a host and guest label formed by configuration, database access control is accurate to a data row level and a column level. BACKGROUND

[0002] Database access control is used for preventing illegal users from entering a system and illegal use of system resources by legal users, and it ensures that all direct accesses of a subject to an object are authorized. In common language, an access control mechanism is used for determining what a user and a program representing the interests of the user can do. Three elements of secure access control include a subject (an entity capable of accessing an object, such as a process or a user), an object (an accessed object, such as a file, a database, a table, a tuple, an attribute, etc.), and an access right (a specific access operation that can be performed by the subject on the object, such as reading, writing, and executing). Currently, an access control based on an RBAC model is mainly used in an application system. The RBAC introduces a "role" concept between a user and a right, each user is associated with one or more roles, and each role is associated with one or more rights.

[0003] The RBAC is generally used for coarse-grained right control, each role is assigned a series of rights and restrictions, and each system user and related attributes do not need to be tracked, and only a corresponding role needs to be updated, the role is assigned to a user, or the assignment is deleted. The RBAC has fixed access rights, and there is no provision for temporary rights, and no consideration is given to location, time, or device attributes.

[0004] With the increase in complexity of a business system, it is necessary to dynamically adjust different data sets that can be accessed and operated by different users under the same role mechanism through a simple and convenient way. A security label component is a database object, and is used for indicating a condition for determining whether a user should access a data block. For example, the condition can be whether the user is in a specific department or whether they are completing a specific project. A security policy describes a condition for determining which users can access which data. A security policy contains one or more security label components. For any one table, only one security policy can be used to protect it, but different tables can be protected by different security policies.

[0005] Once a security tag is created, it can be associated with individual table columns and rows to protect the data stored in those locations. Data protected by a security tag is called protected data. Access to protected data is granted to a user by assigning a security tag to that user. When a user attempts to access protected data, their security tag is compared to the security tag used to protect that data. The tag used for protection blocks a portion of the security tags. Summary of the Invention

[0006] (a) Technical problems to be solved

[0007] The technical problem to be solved by this invention is how to provide a fine-grained access control method for web systems based on runtime hooks, so as to solve the problem of how to use third-party technical means to enable different users with the same role to execute the same SQL statement without changing the application code, and to have different access permissions depending on the configuration tag attributes.

[0008] (II) Technical Solution

[0009] To address the aforementioned technical issues, this invention proposes a fine-grained row and column access control system for web systems based on runtime hooks. The system comprises two parts: a server and a client. The server includes a metadata maintenance module, an RPC data communication module, and a policy configuration module. The client includes an RPCClient, a JavaAgent, and a policy judgment engine.

[0010] Metadata maintenance module: The WEB side provides three ways to obtain metadata related to the business system's database, tables, and columns, as well as user information of the business system. User metadata exists as the subject, while database, table, and column metadata exists as the object. The subject is the user in the business system, and the object is the name of the database table and column related in the business system.

[0011] RPC data communication module: The server supports row and column access control for several business systems. Based on the heartbeat thread and policy thread, it distinguishes different business systems and completes the sending and receiving of data information at the same time.

[0012] Strategy configuration module: Centered on tags, tags are identified by bound values, and tags are configured for subjects and objects. The subject and object tag identification values ​​are used for subsequent access permission decisions.

[0013] RPCClient, as a data communication client, is used to receive policy information and simultaneously send back the response results of the web system in executing the policy.

[0014] JavaAgent is injected into the JVM to intercept and parse the context user and the SQL information executed by the user in Java-based web systems, and synchronously associate the parsed SQL content with the user implementation.

[0015] The policy judgment engine identifies read, write, and deny permissions by obtaining the SQL parsing results and combining them with tag information.

[0016] Furthermore, the subject and object are respectively equipped with sensitivity tags and trust tags, and the policy permission determination criteria supported by the policy configuration module are as follows:

[0017] Reading: Subject sensitivity >= Object sensitivity;

[0018] Write: Subject sensitivity >= object sensitivity && subject credibility >= object credibility;

[0019] Access denied: Subject sensitivity < Object sensitivity.

[0020] Furthermore, the JavaAgent dynamically modifies the Java bytecode when the server starts up, hooking functions that perform sensitive operations.

[0021] Furthermore, the functions for the sensitive operations include database operations, file read and write operations.

[0022] Furthermore, the specific implementation process of the JavaAgent is as follows:

[0023] When the JavaAgent starts executing the command, it performs instrumentation. When a class is loaded by the ClassLoader, the bytecode of that class is first handed over to the custom Transformer for processing.

[0024] The custom Transformer will determine whether the class is one that needs to be hooked. If so, it will hand the class over to the javassist bytecode processing framework for processing.

[0025] The Javassist framework parses each method of a class's bytecode step by step according to an event-driven model. When a hooked method is triggered, bytecode that enters the detection function is inserted at the beginning or end of the method. The hooked bytecode is then returned to the transformer and loaded into the virtual machine.

[0026] This invention provides a fine-grained access control method for rows and columns in a web system based on runtime hooks. The method includes the following steps:

[0027] S1 and APP1 run on the Java Virtual Machine (JVM). When a user accesses APP1, the operations involved include querying, updating, and deleting.

[0028] S2 and JavaAgent use Agent technology to hook JVM file operations and network operations. The business system intercepts query, update and delete related operation interfaces.

[0029] S3. Intercept SQL from the business system to enter the processing logic of this system, and at the same time obtain the user in the current context, parse the SQL to get the table, field information and query conditions, read the policy information, and rewrite the SQL according to the access permissions.

[0030] S4. After rewriting, the SQL is returned to the corresponding class in the JVM;

[0031] S5. Continue the original business system process and interact with the database through the data-driven interface using SQL;

[0032] S6. Continue the original process of the business system and pass the database return result to the business system processing class;

[0033] S7. Continue the original business system process and return the data information to the user interface.

[0034] Furthermore, the subject and object are respectively equipped with sensitivity tags and trust tags, and the policy permission determination criteria supported by the policy configuration module are as follows:

[0035] Reading: Subject sensitivity >= Object sensitivity;

[0036] Write: Subject sensitivity >= object sensitivity && subject credibility >= object credibility;

[0037] Access denied: Subject sensitivity < Object sensitivity.

[0038] Furthermore, the JavaAgent dynamically modifies the Java bytecode when the server starts up, hooking functions that perform sensitive operations.

[0039] Furthermore, the functions for the sensitive operations include database operations, file read and write operations.

[0040] Furthermore, the specific implementation process of the JavaAgent is as follows:

[0041] When the JavaAgent starts executing the command, it performs instrumentation. When a class is loaded by the ClassLoader, the bytecode of that class is first handed over to the custom Transformer for processing.

[0042] The custom Transformer will determine whether the class is one that needs to be hooked. If so, it will hand the class over to the javassist bytecode processing framework for processing.

[0043] The Javassist framework parses each method of a class's bytecode step by step according to an event-driven model. When a hooked method is triggered, bytecode that enters the detection function is inserted at the beginning or end of the method. The hooked bytecode is then returned to the transformer and loaded into the virtual machine.

[0044] (III) Beneficial Effects

[0045] This invention proposes a fine-grained row and column access control method for web systems based on runtime hooks. The purpose of this invention is to address how to utilize third-party technologies to enable different users with the same role to execute the same SQL statements without altering the application code. Users' access permissions vary depending on the configured tag attributes. This dynamically implements the principle of least privilege from both the row and column dimensions, thereby obtaining datasets that conform to predetermined security policies and preventing data leakage due to unauthorized access.

[0046] Row-level access control refines database table access control down to the row level, enabling row-level access control. Different users executing the same SQL query will retrieve different result sets.

[0047] Column-level access control features refine database table access control down to the column level. Tag-based security policies enable access to column-sensitive data, allowing databases to achieve column-level access control capabilities. This means that different users executing the same SQL query will retrieve different column information from the result set. Attached Figure Description

[0048] Figure 1 A diagram showing the composition of row and column access control;

[0049] Figure 2 Flowchart of HOOK Class principle

[0050] Figure 3 This is a schematic diagram of row and column access control.

[0051] Figure 4 This is a row and column access control logic diagram;

[0052] Figure 5 A diagram showing the relationship between labels and subjects / objects;

[0053] Figure 6 This is a logic diagram for permission decision-making.

[0054] Figure 7 Access control policy communication flowchart;

[0055] Figure 8 This is a screenshot showing the effect of fine-grained access control. Detailed Implementation

[0056] To make the objectives, contents, and advantages of the present invention clearer, the specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples.

[0057] We employ an advanced application runtime injection technology to inject an agent into the application, integrating it seamlessly. This allows for real-time monitoring of SQL statements in the business logic process and, based on predetermined strategies, completes SQL rewriting that conforms to row and column access control. The application requires no modifications during coding and only simple configuration is needed.

[0058] The purpose of this invention is to propose a fine-grained access control method for web systems based on runtime hooks. This invention mainly addresses how to utilize third-party technologies to enable different users with the same role to execute the same SQL statements without changing the application code, and to grant different access permissions based on configuration tag attributes. It dynamically implements the principle of least privilege from both the data row and data column dimensions, thereby obtaining a dataset that conforms to the established security policy and preventing data leakage caused by unauthorized access.

[0059] Row-level access control refines database table access control down to the row level, enabling row-level access control. Different users executing the same SQL query will retrieve different result sets.

[0060] Column-level access control features refine database table access control down to the column level. Tag-based security policies enable access to column-sensitive data, allowing databases to achieve column-level access control capabilities. This means that different users executing the same SQL query will retrieve different column information from the result set.

[0061] like Figure 1 As shown ( Figure 1 As part of the overall framework, subsequent Figures 2 to 8 (All of these are effective within this framework). The fine-grained access control system for web systems relies on the established access policies of the subject and object to take effect. This system consists of two parts: a server and a client. The server includes:

[0062] Metadata Maintenance Module: The web side provides three methods for obtaining metadata related to the business system's database, tables, and columns, as well as user information. User metadata exists as the subject, while database, table, and column metadata exists as the object. The subject is the user in the business system, and the object is the name of the database table and column in the business system.

[0063] RPC data communication module: The server can support row and column access control for several business systems. Based on the heartbeat thread and policy thread, it can distinguish different business systems and complete the sending and receiving of data information.

[0064] Policy configuration module: Centered on tags, the system provides two default standards, and users can also define other custom tags. Tags are identified through bound numerical values, and are configured for both the subject and object. These subject / object tag values ​​are used for subsequent access permission decisions. Currently supported policy permission determination standards are as follows:

[0065] 1. Reading: Subject sensitivity >= Object sensitivity

[0066] 2. Write: Subject sensitivity >= Object sensitivity && Subject credibility >= Object credibility

[0067] 3. Deny access: Subject sensitivity < Object sensitivity

[0068] The client also includes the following three parts. The client is mainly responsible for receiving configuration policies, responding in real time to users' fine-grained operation permissions for application databases, tables, rows, and columns, covering read permissions, write permissions, and deny access permissions, and returning a dataset that meets expectations based on the permission information.

[0069] RPCClient serves as a data communication client, receiving policy information and simultaneously sending back the response results of the web system executing the policy.

[0070] JavaAgent is injected into the JVM. For Java-based web systems, it intercepts and parses the context user and the SQL information executed by the user, and synchronously associates the SQL parsing content (tables and columns) with the user implementation. The same applies to PythonAgent and PHPAgent.

[0071] The policy judgment engine identifies read, write, and deny permissions by obtaining the SQL parsing results and combining them with tag information.

[0072] like Figure 2 As shown, the Java Agent mechanism can dynamically modify Java bytecode when the server starts up, hooking functions that perform sensitive operations, such as database operations, file read and write operations.

[0073] 1. When the JavaAgent starts executing the command, it performs instrumentation. When a class is loaded by the ClassLoader, the bytecode of that class is first handed over to the custom Transformer for processing.

[0074] 2. A custom Transformer will determine whether the class is one that needs to be hooked. If so, it will hand the class over to the Javassist bytecode processing framework for processing.

[0075] 3. The Javassist framework will parse each method of the class bytecode step by step according to the event-driven model. When the method we need to hook is triggered, the bytecode of the detection function will be inserted at the beginning or end of the method, and the hooked bytecode will be returned to the transformer to be loaded into the virtual machine.

[0076] like Figure 3 , Figure 4 As shown, the principle of fine-grained row and column access control in this system is explained in the form of data flow. Based on the access policy, fine-grained control of row and column permissions is implemented by rewriting SQL. Figure 4 Yes Figure 3 Details of steps S2, S3, and S4:

[0077] S1 and APP1 (business systems, application objects with fine-grained access permissions) run on the JVM (Java Virtual Machine). When users access APP1, it usually involves operations such as querying, updating, and deleting.

[0078] S2 and JavaAgent utilize agent technology to hook (intercept hooks, callbacks) JVM file operations and network operations. The business system primarily intercepts query, update, and delete-related operation interfaces.

[0079] S3. Intercept the SQL from the business system to enter the processing logic of this system, and at the same time obtain the user in the current context, parse the SQL to get the table, field information and query conditions, read the policy information (determine the user's actual operation permissions on the data table rows and columns based on the comparison relationship of user and object related tags: read, write, deny access), and rewrite the SQL according to the access permissions;

[0080] S4. After rewriting, the SQL is returned to the corresponding class in the JVM.

[0081] S5. Continue the existing business system processes, and allow SQL and other algorithms to interact with the database through a data-driven interface.

[0082] S6. Continue the existing business system process and pass the database return result to the business system processing class.

[0083] S7. Continue the existing business system process and return the data information to the user interface.

[0084] like Figure 5 , 6The diagram illustrates the working mode of the strategy decision engine and the two default types of tags: sensitivity and trustworthiness. Sensitivity tags are bound to the subject, and trustworthiness tags are bound to the object, respectively. During permission decisions, the subject's sensitivity is compared with the object's sensitivity (read permission check); the subject's trustworthiness is compared with the object's trustworthiness (write permission check). If neither matches, access is denied.

[0085] 1. Reading: Subject sensitivity >= Object sensitivity

[0086] 2. Write: Subject sensitivity >= Object sensitivity && Subject credibility >= Object credibility

[0087] 3. Deny access: Subject sensitivity < Object sensitivity

[0088] like Figure 7 As shown, the key points illustrate the data interaction process: after the access control policy is configured, the data information reaches the JavaAgent process of the server where the application system resides. The overall interaction process is centered around a heartbeat, which not only achieves access control of the server where the business system resides (it can detect immediately if the business system is disconnected from this system), but also promptly distributes the incremental update policy to the JavaAgent process of the corresponding business system server.

[0089] like Figure 8 As shown, users A and B have the same role and perform the same operations. However, because users A and B have different labels, the returned result sets are not the same. That is, without modifying the business system, the existing RBAC (role-based access control) configuration of the original system remains unchanged. By using labels, the minimum closed loop of user access and operation data permissions is achieved, which practices the principle of least privilege.

[0090] Example 1:

[0091] 1. User business systems require fine-grained access control. A JavaAgent program needs to be deployed and run on their machines. Once started, this program automatically identifies and detects JVM execution functions, such as file operations, database operations, and network operations.

[0092] 2. The server completes the paired configuration of access policies (user is the subject metadata binding tag, and database table column is the object metadata binding tag) and sends the policy content through RPC;

[0093] 2. The JavaAgent uses hook technology to obtain context-related information: username, SQL statement (Data Definition Language, Data Manipulation Language).

[0094] 3. The JavaAgent intercepts the SQL statements executed by the business system, parses the SQL to obtain the subject (user) and object (operation object, database, table, row, column), and determines the user's permissions for the operation object based on the comparison of subject and object tags in the access policy. Then, it rewrites the SQL and passes it to the JVM through the database driver interface.

[0095] 5. The data-driven interface sends the rewritten SQL statement to the database.

[0096] 6. Return the query result set to the application system.

[0097] 7. Users can view data content that conforms to the permission system through a web page.

[0098] Note: JVM is the environment that Java web systems depend on for running, also known as the Java JDK virtual machine.

[0099] Example 2

[0100] A fine-grained access control method for WEB systems based on runtime hooking, comprising: (1) without modifying the application system source code and keeping the usage unchanged, controlling row and column permissions based on configuration policies by starting an independent JAR on the application system running server; (2) configuring custom tags for user and database table row and column as attributes, and distributing them to the WEB system server in the form of access control policies; (3) using JAR to hook the WEB system running environment JVM, forming a decision mechanism based on security policies, and determining the user's row-level and list-level access permissions.

[0101] Furthermore, the security agent service implements the response configuration policy (database column) to encrypt the database column, uses the checksum to retrieve the encrypted data, and finally decrypts the encrypted data and returns the decryption result to the application system.

[0102] Furthermore, the tag attribute method is used to describe a specific set of security conditions for database objects. Tag attributes are applied to data to protect it. They are granted to users to allow them to access the protected data. When a user attempts to access protected data, their tag attributes are compared with the tag attributes used to protect that data. The tag attributes used for protection will block a portion of the tag attributes. If a user's tag attributes are blocked, that user will not be able to access the data.

[0103] Furthermore, the system obtains the principal user information for the current business operation SQL execution through context, parses the SQL content to obtain the object data table and column information, then searches for the label attributes configured by the principal user and the label attributes configured by the object data in the existing strategy, compares the results of the subject and object label attribute data value-based analysis, and returns the normal execution permissions: read, write, or deny.

[0104] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A fine-grained row and column access control system for a web system based on runtime hooks, characterized in that, The system consists of two parts: a server and a client. The server includes a metadata maintenance module, an RPC data communication module, and a policy configuration module. The client includes an RPCClient, a JavaAgent, and a policy judgment engine. Metadata maintenance module: The WEB side provides three methods for obtaining metadata related to the business system's database, tables, and columns, as well as user information of the business system. The three methods are RestAPI, ETL, and UI Import. User metadata exists as the subject, and database, table, and column metadata exists as the object. The subject is the user in the business system, and the object is the name of the database, table, and column in the business system. RPC data communication module: The server supports row and column access control for several business systems. Based on the heartbeat thread and policy thread, it distinguishes different business systems and completes the sending and receiving of data information at the same time. The strategy configuration module is centered around tags. Tags are calculated and identified using bound numerical values. These tags are also configured for subjects and objects, and the numerical values ​​representing these subject and object tags are used for subsequent access permission decisions. The subject and object are respectively assigned sensitivity tags and trust tags. The policy permission determination criteria supported by the policy configuration module are as follows: Reading: Subject sensitivity >= Object sensitivity; Write: Subject sensitivity >= Object sensitivity && Subject credibility >= Object credibility; Access denied: Subject sensitivity < Object sensitivity; RPCClient, as a data communication client, is used to receive policy information and simultaneously send back the response results of the web system in executing the policy. JavaAgent is injected into the JVM to intercept and parse the context user and the SQL information executed by the user in Java-based web systems, and synchronously associate the parsed SQL content with the user implementation. The policy judgment engine obtains the SQL parsing results and combines them with tag information to identify read, write, and deny permissions. in, The specific implementation process of the JavaAgent is as follows: When the JavaAgent starts executing the command, it performs instrumentation. When a class is loaded by the ClassLoader, the bytecode of that class is first handed over to the Transformer for processing. The Transformer will determine whether the class is one that needs to be hooked. If so, it will hand the class over to the Javassist bytecode processing framework for processing. The Javassist framework parses each method of a class's bytecode step by step according to an event-driven model. When a hooked method is triggered, bytecode that enters the detection function is inserted at the beginning or end of the method. The hooked bytecode is then returned to the Transformer and loaded into the virtual machine.

2. The fine-grained row and column access control system for WEB systems based on runtime hooks as described in claim 1, characterized in that, The JavaAgent dynamically modifies Java bytecode and hooks functions that perform sensitive operations when the server starts.

3. The fine-grained row and column access control system for WEB systems based on runtime hooks as described in claim 2, characterized in that, The functions for the sensitive operations include database operations, file read and write operations.

4. A fine-grained access control method for rows and columns of a web system based on runtime hooks, as described in any one of claims 1-3, characterized in that... The method includes the following steps: S1 and APP1 run on the Java Virtual Machine (JVM). When a user accesses APP1, the operations involved include querying, updating, and deleting. S2 and JavaAgent use Agent technology to hook JVM file operations and network operations. The business system intercepts query, update and delete related operation interfaces. S3. Intercept SQL from the business system to enter the processing logic of this system, and at the same time obtain the user in the current context, parse the SQL to get the table, field information and query conditions, read the policy information, and rewrite the SQL according to the access permissions. S4. After rewriting, the SQL is returned to the corresponding class in the JVM; S5. Continue the original business system process and interact with the database through the data-driven interface using SQL; S6. Continue the original process of the business system and pass the database return result to the business system processing class; S7. Continue the original business system process and return the data information to the user interface.

Images