Operating system level dynamic operation and maintenance authorization method and system

Abstract

The application provides an operating system level dynamic operation and maintenance authorization method and system, the method comprises the following steps: receiving a user initiated access request; according to the access request, querying a preset mapping relationship configuration table to obtain a user field of a security context; determining the login mode of the user, and according to the login mode, obtaining a role field of the security context and a type field of the security context; according to the user field of the security context, the role field of the security context and the type field of the security context, obtaining a corresponding security context, and according to the security context, granting the user corresponding permissions. The application determines the operation permission of the user by obtaining the user field, the role field and the type field of the security context, so as to determine whether the corresponding access operation can be performed according to the access request, realizes the dynamic configuration of the execution permission of the user to the operation and maintenance software, and simultaneously controls the operation permission of other software started by the user to the operation and maintenance software.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to an operating system-level dynamic operation and maintenance authorization method and system. Background Technology

[0002] SELinux is a mandatory access control mechanism that is loaded into the kernel as an LSM kernel module. Its security policy is implemented through Type Enhancement (TE) under Role-Based Access Control (RBAC). SELinux is a fine-grained access control mechanism that uses LSM hooks to control access to kernel resources. Access decisions are loaded into the kernel by the security server through a privileged userspace interface. Unauthorized subjects are prohibited from performing operations on objects by default, and only access with authorized rules is allowed.

[0003] However, SELinux is a fine-grained, mandatory access control system that prohibits all operations by default. Operations are only allowed if the rules are authorized, which leads to problems such as cumbersome rule customization and huge manpower consumption.

[0004] RBAC is a role-based access control that acts as an abstraction layer between users and type enforcement (TE). It provides very fine-grained access control. The core idea is that system operation permissions are not directly granted to specific users, but rather a set of roles is established between the set of users and the set of permissions. Each role corresponds to a set of permissions. Once a user is assigned an appropriate role, that user possesses all the operation permissions for that role; permissions are assigned based on roles.

[0005] If a user is bound to a role, they will have all the permissions of that role, but cannot authorize individual permissions within the role. Role permissions cannot be dynamically adjusted, and there is a possibility of an uncontrollable super administrator gaining all permissions by switching roles. Furthermore, RBAC is predefined in policies; updates require modifying the policy file and restarting the login system for the policy to take effect. RBAC only supports role-based permission authorization; if specific permissions are required, policies must be manually written, demanding familiarity with policies and significant manpower costs. Summary of the Invention

[0006] This invention provides an operating system-level dynamic operation and maintenance authorization method and system to solve the shortcomings of existing technologies that require manual writing of policies based on specified permissions, making it impossible to dynamically adjust role permissions. It enables dynamic configuration of user execution permissions for operation and maintenance software, while controlling the operation permissions of other software launched by the user on the operation and maintenance software. It can control the operation and maintenance operations of remote login by operation and maintenance administrators, while ensuring that other software is not affected by the control, preventing unauthorized operations, and ensuring the secure operation of the operating system.

[0007] This invention provides an operating system-level dynamic operation and maintenance authorization method, comprising: receiving an access request initiated by a user; querying a preset mapping relationship configuration table according to the access request to obtain the user field of the security context; determining the user's login method, and obtaining the role field and type field of the security context according to the login method; obtaining the corresponding security context according to the user field, role field, and type field of the security context, and determining the user's permissions according to the security context.

[0008] According to an operating system-level dynamic operation and maintenance authorization method provided by the present invention, the step of obtaining the role field and the type field of the security context based on the login method includes: matching according to the login method using a preset configuration file to obtain the running domain, role field, and type field of the corresponding security context; wherein, the preset configuration file includes the mapping relationship between the login method running domain, role field, and type field, as well as the matching order of the running domain, role field, and type field.

[0009] According to an operating system-level dynamic operation and maintenance authorization method provided by the present invention, before obtaining the role field and type field of the security context, the method includes: receiving a task execution request issued by an operation and maintenance authorization server; periodically polling the operation and maintenance authorization server, and if a task corresponding to the task execution request is detected, downloading the corresponding task; parsing the downloaded task to generate a task structure; adding the task structure to a task queue, and according to the task queue, calling the policy authorization core engine library to execute the corresponding task to dynamically generate a security policy; loading the security policy into the system kernel, and generating a feedback result according to the policy loading status; and returning the feedback result to the operation and maintenance authorization server.

[0010] According to an operating system-level dynamic operation and maintenance authorization method provided by the present invention, the dynamic generation of security policies includes: dynamically changing the relationship between the user and the role field, and calling the role authorization function interface corresponding to the user and role field in the policy authorization core engine library to generate a security policy; or, dynamically changing the binding relationship between the role field and the executable file corresponding to the preset software, and calling the role and software authorization function interface corresponding to the role field in the policy authorization core engine library to generate the security policy; or, dynamically changing the binding relationship between the type field and role field of the security context corresponding to the main software started by the user and the security context of the specified executable file, and calling the authorization interface of the main software and the executable file in the policy authorization core engine library to generate the security policy.

[0011] According to an operating system-level dynamic operation and maintenance authorization method provided by the present invention, the step of determining the user's permissions based on the security context includes: determining in the system kernel whether the role field of the security context is a role field transferred from a system service; if not, determining, according to the security policy, whether the role field is bound to the security context of an executable file corresponding to a preset software; wherein, the security policy pre-establishes a binding relationship between the security context of the software's executable file and the corresponding role; if bound, granting the corresponding role operation permissions for the corresponding software based on the role field.

[0012] According to an operating system-level dynamic operation and maintenance authorization method provided by the present invention, the step of determining the user's permissions based on the security context further includes: starting the main software, transferring the current running domain to the running domain of the main software, and obtaining the security context corresponding to the main software; determining in the system kernel whether the security context type field of the running domain of the main software conforms to a preset running domain type to be controlled; if it conforms, determining the matching relationship between the role field in the security context of the main software and the role in the preset special type, so as to select the executable file corresponding to the role in the preset special type as a specific executable file according to the matching relationship, and determining whether the running domain of the main software can execute the specific executable file, and granting the corresponding main software operation permissions of the software corresponding to the specific executable file based on the ability to execute the specific executable file.

[0013] According to an operating system-level dynamic operation and maintenance authorization method provided by the present invention, the step of determining whether the execution domain of the main software can execute the specific executable file includes: determining whether a mapping relationship has been established between the role field in the security context of the main software and the label in the security context of the specific executable file; if a mapping relationship has been established, then the specific executable file can be executed.

[0014] The present invention also provides an operating system-level dynamic operation and maintenance authorization system, comprising: a request receiving module for receiving access requests initiated by users; a first security context acquisition module for querying a preset mapping relationship configuration table according to the access request to obtain the user field of the security context; a second security context acquisition module for determining the user's login method and obtaining the role field and type field of the security context according to the login method; and an authorization module for obtaining the corresponding security context according to the user field, role field, and type field of the security context, and granting corresponding permissions to the user according to the security context.

[0015] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of any of the above-described operating system-level dynamic operation and maintenance authorization methods.

[0016] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the operating system-level dynamic operation and maintenance authorization method described above.

[0017] The present invention also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of any of the above-described operating system-level dynamic operation and maintenance authorization methods.

[0018] The operating system-level dynamic operation and maintenance authorization method and system provided by this invention determines a user's operation permissions by obtaining the user field, role field, and type field of the security context, thereby determining whether the corresponding access operation can be performed according to the access request. It supports dynamic authorization management for users and roles, dynamic fine-grained authorization management for users by domain and permissions, and dynamic fine-grained authorization management for software by domain and permissions. It enables dynamic configuration of the user's execution permissions for operation and maintenance software, while controlling the operation permissions of other software started by the same user on the operation and maintenance software. In addition, domain-based permission control is performed within the specific software (i.e., the aforementioned main software) runtime domain. For example, after SSH login, the runtime domain of the software is controlled within the domain, without affecting the operation permissions of other software under the same user on the operation and maintenance software. This achieves user-domain-based permission control and software-domain-based permission control, which can be uniformly controlled according to roles or isolated between software, achieving loose coupling and non-interference among multiple software runtime domains. While ensuring the control of operation and maintenance operations performed by remote logins of operation and maintenance administrators, it ensures that other software is not affected by the control, prevents unauthorized operations, and ensures the secure operation of the operating system. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0020] Figure 1 This is a flowchart illustrating the operating system-level dynamic operation and maintenance authorization method provided by the present invention;

[0021] Figure 2 This is a schematic diagram of the dynamic authorization management of users and roles provided by the present invention;

[0022] Figure 3 This is a schematic diagram of the dynamic fine-grained authorization management of user domain-based and hierarchical authorization provided by the present invention;

[0023] Figure 4 This is a schematic diagram of the dynamic fine-grained authorization management of software domain-based and hierarchical authorization provided by the present invention;

[0024] Figure 5 This is one of the structural diagrams of the operating system-level dynamic operation and maintenance authorization system provided by the present invention;

[0025] Figure 6 This is the second schematic diagram of the operating system-level dynamic operation and maintenance authorization system provided by the present invention;

[0026] Figure 7 This is a flowchart illustrating the operating system-level dynamic operation and maintenance authorization system provided by the present invention;

[0027] Figure 8 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0029] Figure 1 A flowchart illustrating an operating system-level dynamic operation and maintenance authorization method is shown. This method includes:

[0030] S11, receives access requests initiated by users;

[0031] S12, based on the access request, query the preset mapping relationship configuration table to obtain the user field of the security context;

[0032] S13, determine the user's login method, and based on the login method, obtain the role field and type field of the security context;

[0033] S14. Obtain the corresponding security context based on the user field, role field, and type field of the security context, and determine the user's permissions based on the security context.

[0034] It should be noted that the execution subject of this manual is the operation and maintenance terminal. Furthermore, S1N in this manual does not represent the order of the operating system-level dynamic operation and maintenance authorization methods; the following will explain in detail... Figures 2-4This invention describes the operating system-level dynamic operation and maintenance authorization method.

[0035] Step S11: Receive the access request initiated by the user.

[0036] It should be noted that user-initiated access requests can only be made after successful login; therefore, prior login is required. In this embodiment, login methods include remote login and local login, with remote login including SSH login, etc. For example, refer to... Figure 2 When a user logs into the operations and maintenance terminal using a Linux account, a mapping relationship between the Linux account and the SELinux user stored in the operations and maintenance terminal needs to be established in advance. It should be noted that the mapping relationship between Linux accounts and SELinux users is many-to-one; that is, one Linux account can only be bound to one SELinux user, and one SELinux user can correspond to multiple Linux accounts. The SELinux user and SELinux role fields have a one-to-one relationship in this invention.

[0037] Step S12: Based on the access request, query the preset mapping relationship configuration table to obtain the user field of the security context.

[0038] It should be noted that the preset mapping configuration table includes a user field with pre-established mapping relationships with users. Additionally, the security context is a variable-length string representing a security label, and the security identifier is an integer mapped from the security operations and maintenance authorization server to the security context. The security context includes the following fields: user, role, and type.

[0039] In one optional embodiment, before obtaining the role field and type field of the security context, a security policy generated based on tasks issued by the operations and maintenance authorization server is included. Specifically, the security policy generated based on tasks issued by the operations and maintenance authorization server includes: receiving task execution requests issued by the operations and maintenance authorization server; periodically polling the operations and maintenance authorization server, and if a task with a corresponding task execution request is detected, downloading the corresponding task; parsing the downloaded task to generate a task structure; adding the task structure to a task queue, and according to the task queue, calling the policy authorization core engine library to execute the corresponding task to dynamically generate a security policy; loading the security policy into the system kernel, and generating feedback results based on the policy loading status; and returning the feedback results to the operations and maintenance authorization server. The operations and maintenance terminal executes the policy by receiving tasks issued by the operations and maintenance authorization server and calling the dynamic authorization interface provided by the core engine library, and supports time settings to complete dynamic fine-grained operations and maintenance authorization.

[0040] It should be added that parsing the downloaded task to generate a task structure includes: parsing the downloaded task to obtain tasks that are easy for subsequent interfaces to identify, and generating a task structure based on the parsed task. In this embodiment, the downloaded task can be a hierarchical file, mainly including the machine's unique identifier, relevant parameters involved in calling the interface, and interface parameters involved in the interface. It should be noted that the full path is also obtained when parsing the downloaded task.

[0041] In one optional embodiment, the policy authorization core engine library provides an authorization interface for automatically updating security policies and configuration files. After updating, the policies are automatically compiled and loaded into the kernel, and take effect immediately. Specifically, when the task is user and role authorization management, the policy authorization core engine library is invoked to execute the corresponding task to dynamically generate security policies, including: dynamically changing the relationship between user and role fields, and invoking the role authorization function interface corresponding to the user and role fields in the policy authorization core engine library to generate security policies.

[0042] Additionally, by dynamically changing the relationship between user and role fields and calling the user and role authorization function interface, operation permission control is achieved. A real-time policy authorization function has been developed, which changes the security context in real time. After calling the user and role authorization engine library, it is not necessary to log in again to read the configuration file; new mapping relationships are established in real time, and dynamic updates of the security context are supported. Furthermore, different users have different operation permissions after logging into the operations and maintenance terminal, and dynamic customization of permissions is supported.

[0043] In an optional embodiment, when the task is role and software authorization management, the policy authorization core engine library is invoked to execute the corresponding task to dynamically generate a security policy, including: dynamically changing the binding relationship between the role field and the executable file corresponding to the preset software, and invoking the role and software authorization function interface corresponding to the role field in the policy authorization core engine library to generate a security policy.

[0044] In an optional embodiment, when the task is to manage the authorization of the user-initiated main software runtime domain and the specified executable file, the policy authorization core engine library is invoked to execute the corresponding task to dynamically generate a security policy, including: dynamically changing the binding relationship between the type field and role field of the security context corresponding to the main software and the security context of the specified executable file, and invoking the authorization interface of the main software and the executable file in the policy authorization core engine library to generate a security policy.

[0045] Step S13: Determine the user's login method, and based on the login method, obtain the role field and type field of the security context.

[0046] In this embodiment, the role field and type field of the security context are obtained according to the login method, including: matching according to the login method and a preset configuration file to obtain the running domain, role field and type field of the corresponding security context; wherein, the preset configuration file includes the mapping relationship between the login method running domain, role field and type field, as well as the matching order of the running domain, role field and type field.

[0047] It should be noted that the security context is a valid security context, meaning that the runtime domain, role field, and type field of the security context have been pre-mapped in a preset configuration file. This facilitates matching based on the preset configuration file to obtain a valid security context. If the security context is invalid, the next security context in the preset configuration file is matched until the first valid security context is found, and its corresponding role and type fields are used as the user's role and type fields after login. It should be noted that after a user logs into the operations and maintenance terminal, the security context corresponding to that user account is obtained to facilitate authorization management based on that security context.

[0048] Step S14: Obtain the corresponding security context based on the user field, role field, and type field of the security context, and determine the user's permissions based on the security context.

[0049] In one alternative embodiment, reference Figure 3 The system determines user permissions based on the security context, including: determining in the system kernel whether the role field of the security context is a role field transferred from a system service; if not, determining whether the role field is bound to the security context of the executable file corresponding to the pre-defined software, based on the security policy; wherein, the security policy pre-establishes the binding relationship between the security context of the software's executable file and the corresponding role; if bound, granting the corresponding role the corresponding software's operation permissions based on the role field, thereby facilitating the execution of the corresponding software program based on the operation permissions.

[0050] It should be added that user access permissions to software are determined based on whether a binding relationship is established between the role field and the security context of the preset software executable file. By dynamically changing the binding relationship between the role field and the security context of the preset software executable file, dynamic fine-grained authorization management with domain-based permissions can be achieved. It supports type-based fine-grained authorization management as well as path-based fine-grained authorization management, accurately assigning role access permissions to individual software or a class of software.

[0051] Furthermore, if the aforementioned role field is not bound to the security context of the executable file of the preset software, the corresponding user role will not have operation permissions on the executable file of the preset software. This achieves user permission management and isolation, as well as dynamic, fine-grained authorization management with user domain-based permissions. The preset software can be predetermined based on user operation needs; no further limitations are made here.

[0052] In one alternative embodiment, reference Figure 4 Determining user permissions based on security context also includes: starting the main software, transferring the current execution domain to the execution domain of the main software, and obtaining the corresponding security context of the main software; determining in the system kernel whether the security context type field of the execution domain of the main software matches the preset execution domain type to be controlled; if it matches, determining the matching relationship between the role field in the security context of the main software and the roles in the preset special type, so as to select the executable file corresponding to the role in the preset special type as the specific executable file according to the matching relationship, and determining whether the execution domain of the main software can execute the specific executable file, and granting the corresponding software operation permission of the specific executable file to the corresponding main software based on the ability to execute the specific executable file, thereby facilitating the execution of the corresponding software program according to the operation permission.

[0053] It should be noted that different users launching the same core software will have different user and role fields in their security contexts, resulting in different operational permissions for different users launching the same software. This supports dynamic customization of permissions. The role and type fields of the security context are used together as the basis for judgment, ensuring that different users can execute different software after launching the core software, achieving dynamic, fine-grained authorization management with domain-specific permissions. Additionally, preset special types include multiple roles and executable files corresponding to each role.

[0054] For example, the preset special types include roles such as security and auditing, and each role corresponds to an executable file. Accordingly, it is determined whether the role field of the main software security context belongs to security or auditing, so as to determine the correspondence between the role field of the security context and the preset special types based on the determination result, and then select the executable file corresponding to the role in the preset special types as the specific executable file based on the correspondence.

[0055] Furthermore, determining whether the execution domain of the main software can execute a specific executable file includes: determining whether a mapping relationship has been established between the role field in the security context of the main software and the label in the security context of the specific executable file; if a mapping relationship has been established, then the specific executable file can be executed. It should be added that the above-mentioned fine-grained software authorization management supports fine-grained authorization management based on labels and paths, precisely granting the execution domain of the main software operation permission to individual software or a class of software. Combining user management and software execution domain management, it ensures that different users, after starting the corresponding main software and transferring to the execution domain, can execute different software to perform different operational operations, thus achieving domain-based and permission-based software management.

[0056] It should be noted that, to facilitate the implementation of the above approach, modifications to the security kernel module at the kernel layer are also required. A mandatory access control process needs to be designed, where access requests are judged by the kernel control logic, and if the conditions for allowing access are not met, access is denied. The application layer mainly consists of a data import module and a policy authorization core engine library. The data import module is used to import policy files, such as the kernel's judgment criteria. The policy authorization core engine library provides interfaces for dynamically generating policies and making them effective immediately.

[0057] In summary, this embodiment of the invention determines a user's operation permissions by obtaining the user, role, and type fields of the security context, thereby determining whether corresponding access operations can be performed based on the access request. It supports dynamic authorization management for users and roles, dynamic fine-grained authorization management for users across domains and permissions, and dynamic fine-grained authorization management for software across domains and permissions. This enables dynamic configuration of a user's execution permissions for the maintenance software, while simultaneously controlling the operation permissions of other software launched by that user on the maintenance software. Furthermore, domain-based permission control is implemented within the specific software's (i.e., the aforementioned main software) runtime domain. For example, after SSH login, domain-based control is performed within the software's runtime domain, without affecting the operation permissions of other software under that user on the maintenance software. This achieves user-domain-based permission control and software-domain-based permission control, allowing for unified control based on roles or isolation between software, ensuring loose coupling and non-interference among multiple software runtime domains. While ensuring control over the maintenance operations of remote login administrators, it protects other software from uncontrolled operations, prevents unauthorized operations, and ensures the secure operation of the operating system.

[0058] The operating system-level dynamic operation and maintenance authorization system provided by the present invention is described below. The operating system-level dynamic operation and maintenance authorization system described below and the operating system-level dynamic operation and maintenance authorization method described above can be referred to in correspondence.

[0059] Figure 5 This diagram illustrates the structure of an operating system-level dynamic operation and maintenance authorization system, which includes:

[0060] The request receiving module 51 receives access requests initiated by users;

[0061] The first security context acquisition module 52 queries the preset mapping relationship configuration table to obtain the user field of the security context based on the access request;

[0062] The second security context acquisition module 53 determines the user's login method and, based on the login method, acquires the role field and the type field of the security context.

[0063] The authorization module 54 obtains the corresponding security context based on the user field, role field, and type field of the security context, and grants the corresponding permissions to the user based on the security context.

[0064] In one alternative embodiment, reference Figure 6 and Figure 7 The system also includes a task acquisition module, a task parsing module, a queue management module, a task execution module, a policy authorization core engine library, a kernel security module, and a process management module. Specifically, before acquiring the role field and type field of the security context, the task acquisition module receives task execution requests from the operations and maintenance authorization server, periodically polls the server, and if a corresponding task execution request is detected, downloads the task and forwards it to the task parsing module. The task parsing module parses the downloaded task, generates a task structure, and forwards the task structure to the queue management module. The queue management module adds the task structure to the task queue and sends the task queue to the task execution module. The task execution module... The system is divided into several modules: The first module, based on the task queue, invokes the policy authorization core engine library to execute corresponding tasks, dynamically generating security policies. The policy authorization core engine library, based on the request from the task execution module, automatically generates security policies, loads them into the kernel security module, generates feedback results based on policy loading status, and returns the feedback results to the task execution module. The task execution module then returns the feedback results to the operations and maintenance authorization server. The kernel security module loads the security policies generated by the policy authorization core engine library, modifies the policy matrix and configuration files to make them effective immediately, prohibits any violations, and outputs violation logs. The process management module is used to query the health status of each module, handle timeout tasks in the queue module, read configuration files, etc., ensuring the normal operation of each module on the terminal.

[0065] Furthermore, the task parsing module includes a parsing unit that parses the downloaded task to obtain a task that is easily identifiable by subsequent interfaces, and generates a task structure based on the parsed task. It should be noted that the downloaded task can be a hierarchical file, mainly including the machine's unique identifier, relevant parameters involved in calling the interface, and the interface parameters involved in the interface. It should also be noted that the full path is obtained when parsing the downloaded task.

[0066] Furthermore, the task execution module includes: a first task execution module that dynamically changes the relationship between the user and role fields and calls the role authorization function interface corresponding to the user and role fields in the policy authorization core engine library to generate a security policy; or a second task execution module that dynamically changes the binding relationship between the role field and the executable file corresponding to the preset software and calls the role and software authorization function interface corresponding to the role field in the policy authorization core engine library to generate a security policy; or a third task execution module that dynamically changes the binding relationship between the type field and role field of the security context corresponding to the main software and the security context of the specified executable file, and calls the authorization interface of the main software and the executable file in the policy authorization core engine library to generate a security policy.

[0067] Accordingly, the operation and maintenance authorization server includes a task instruction issuing module and an execution result receiving module. The task instruction issuing module sends task execution requests to the operation and maintenance terminal; the execution result receiving module receives the feedback results returned by the task execution module.

[0068] The second security context acquisition module 53 includes: a matching unit, which performs matching according to the login method and a preset configuration file to obtain the running domain, role field and type field of the corresponding security context; wherein, the preset configuration file includes the mapping relationship between the login method running domain, role field and type field, as well as the matching order of the running domain, role field and type field.

[0069] The authorization module 54 includes: a first judgment unit, which determines in the system kernel whether the role field of the security context is the role field transferred from the system service; if not, a second judgment unit, based on the security policy, determines whether the role field is bound to the security context of the executable file corresponding to the preset software; wherein, the security policy pre-establishes the binding relationship between the security context of the software's executable file and the corresponding role; if bound, the corresponding role is granted operation permissions for the corresponding software based on the role field, thereby facilitating the execution of the corresponding software program based on the operation permissions.

[0070] In an optional embodiment, the authorization module 54 further includes: a security context acquisition unit, which starts the main software, transfers the current running domain to the running domain of the main software, and obtains the security context of the corresponding main software; a third judgment unit, which judges in the system kernel whether the security context type field of the running domain of the main software conforms to the preset running domain type to be controlled; if it does, then a fourth judgment unit determines the matching relationship between the role field in the security context of the main software and the roles in the preset special type, so as to select the executable file corresponding to the role in the preset special type as the specific executable file according to the matching relationship, and judges whether the running domain of the main software can execute the specific executable file, and grants the corresponding main software operation permission corresponding to the specific executable file based on the ability to execute the specific executable file, thereby facilitating the execution of the corresponding software program according to the operation permission. It should be added that the preset special type includes multiple roles and an executable file corresponding to each role.

[0071] Furthermore, the fourth judgment unit includes: a judgment subunit, which judges whether a mapping relationship has been established between the role field in the security context of the main software and the label in the security context of the specific executable file; if a mapping relationship has been established, the specific executable file can be executed.

[0072] In summary, this embodiment of the invention determines a user's operation permissions by obtaining the user, role, and type fields of the security context, thereby determining whether corresponding access operations can be performed based on the access request. It supports dynamic authorization management for users and roles, dynamic fine-grained authorization management for users across domains and permissions, and dynamic fine-grained authorization management for software across domains and permissions. This enables dynamic configuration of a user's execution permissions for the maintenance software, while simultaneously controlling the operation permissions of other software launched by that user on the maintenance software. Furthermore, domain-based permission control is implemented within the specific software's (i.e., the aforementioned main software) runtime domain. For example, after SSH login, domain-based control is performed within the software's runtime domain, without affecting the operation permissions of other software under that user on the maintenance software. This achieves user-domain-based permission control and software-domain-based permission control, allowing for unified control based on roles or isolation between software, ensuring loose coupling and non-interference among multiple software runtime domains. While ensuring control over the maintenance operations of remote login administrators, it protects other software from uncontrolled operations, prevents unauthorized operations, and ensures the secure operation of the operating system.

[0073] Figure 8 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 8As shown, the electronic device may include: a processor 81, a communications interface 82, a memory 83, and a communication bus 84. The processor 81, communications interface 82, and memory 83 communicate with each other via the communication bus 84. The processor 81 can invoke logical instructions in the memory 83 to execute an operating system-level dynamic operation and maintenance authorization method. This method includes: receiving an access request initiated by a user; querying a preset mapping relationship configuration table based on the access request to obtain the user field of the security context; determining the user's login method and obtaining the role field and type field of the security context based on the login method; obtaining the corresponding security context based on the user field, role field, and type field of the security context; and granting the user corresponding permissions based on the security context.

[0074] Furthermore, the logical instructions in the aforementioned memory 83 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0075] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the operating system-level dynamic operation and maintenance authorization method provided by the above methods. The method includes: receiving an access request initiated by a user; querying a preset mapping relationship configuration table according to the access request to obtain the user field of the security context; determining the user's login method and obtaining the role field and type field of the security context according to the login method; obtaining the corresponding security context according to the user field, role field, and type field of the security context, and granting the user corresponding permissions according to the security context.

[0076] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the operating system-level dynamic operation and maintenance authorization method provided by the above methods. The method includes: receiving an access request initiated by a user; querying a preset mapping relationship configuration table according to the access request to obtain the user field of the security context; determining the user's login method and obtaining the role field and type field of the security context according to the login method; obtaining the corresponding security context according to the user field, role field, and type field of the security context, and granting the user corresponding permissions according to the security context.

[0077] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0078] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0079] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An operating system-level dynamic operation and maintenance authorization method, characterized in that, include: Receive access requests initiated by users; Based on the access request, query the preset mapping relationship configuration table to obtain the user field of the security context; Determine the user's login method, and based on the login method, obtain the role field and the type field of the security context; Based on the user field, role field, and type field of the security context, the corresponding security context is obtained, and the user's permissions are determined based on the security context. Before obtaining the role field and type field of the security context, the process includes: Receive task execution requests issued by the operations and maintenance authorization server; The system periodically polls the operation and maintenance authorization server. If a task corresponding to the task execution request is detected, the corresponding task is downloaded. The downloaded task is parsed to generate a task structure; The task structure is added to the task queue, and the corresponding task is executed by calling the policy authorization core engine library according to the task queue in order to dynamically generate a security policy. The security policy is loaded into the system kernel, and feedback results are generated based on the policy loading status. The feedback result is returned to the operation and maintenance authorization server.

2. The operating system-level dynamic operation and maintenance authorization method according to claim 1, characterized in that, The step of obtaining the role field and type field of the security context based on the login method includes: Based on the login method, a preset configuration file is used for matching to obtain the corresponding security context's running domain, role field, and type field; wherein, the preset configuration file includes the mapping relationship between the login method's running domain, role field, and type field, as well as the matching order of the login method's running domain, role field, and type field.

3. The operating system-level dynamic operation and maintenance authorization method according to claim 1, characterized in that, The dynamically generated security policy includes: The relationship between the user and the role field is dynamically changed, and the role authorization function interface corresponding to the user and role fields in the policy authorization core engine library is called to generate a security policy; or, The binding relationship between the role field and the executable file corresponding to the preset software is dynamically changed, and the role and software authorization function interface corresponding to the role field in the policy authorization core engine library is called to generate the security policy; or, The binding relationship between the type field and role field of the security context corresponding to the user-initiated main software and the security context of the specified executable file is dynamically changed, and the authorization interface of the main software and the executable file in the policy authorization core engine library is called to generate the security policy.

4. The operating system-level dynamic operation and maintenance authorization method according to claim 1, characterized in that, Determining the user's permissions based on the security context includes: The system kernel determines whether the role field of the security context is a role field transferred from the system service. If not, then according to the security policy, it is determined whether the role field is bound to the security context of the executable file corresponding to the preset software; wherein, the security policy pre-establishes the binding relationship between the security context of the software's executable file and the corresponding role; If bound, the corresponding role will be granted the corresponding software operation permissions based on the role field.

5. The operating system-level dynamic operation and maintenance authorization method according to claim 1, characterized in that, The step of determining the user's permissions based on the security context further includes: Start the main software, transfer the current running domain to the running domain of the main software, and obtain the security context corresponding to the main software; In the system kernel, it is determined whether the security context type field of the main software's runtime domain conforms to the preset runtime domain type to be controlled; If the match is found, the matching relationship between the role field in the security context of the main software and the role in the preset special type is determined. Based on the matching relationship, the executable file corresponding to the role in the preset special type is selected as the specific executable file. It is then determined whether the execution domain of the main software can execute the specific executable file. Based on the ability to execute the specific executable file, the corresponding main software is granted the operation permission of the software corresponding to the specific executable file.

6. The operating system-level dynamic operation and maintenance authorization method according to claim 5, characterized in that, The determination of whether the execution domain of the main software can execute the specific executable file includes: Determine whether a mapping relationship has been established between the role field in the security context of the main software and the label in the security context of the specific executable file; If a mapping relationship has been established, the specific executable file can be executed.

7. An operating system-level dynamic operation and maintenance authorization system, characterized in that, include: The request receiving module receives access requests initiated by users; The first security context acquisition module queries a preset mapping relationship configuration table to obtain the user field of the security context based on the access request. The second security context acquisition module determines the user's login method and, based on the login method, acquires the role field and the type field of the security context. The authorization module obtains the corresponding security context based on the user field, role field, and type field of the security context, and grants the corresponding permissions to the user based on the security context. The system also includes: The task acquisition module receives a task execution request from the operation and maintenance authorization server before acquiring the role field and type field of the security context. It periodically polls the operation and maintenance authorization server. If a task corresponding to the task execution request is detected, the corresponding task is downloaded. The task parsing module parses the downloaded tasks, generates a task structure, and adds the task structure to the task queue. The task execution module, based on the task queue, calls the policy authorization core engine library to execute corresponding tasks, dynamically generates security policies, loads the security policies into the system kernel, generates feedback results based on the policy loading status, and returns the feedback results to the operation and maintenance authorization server.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the operating system-level dynamic operation and maintenance authorization method as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the operating system-level dynamic operation and maintenance authorization method as described in any one of claims 1 to 6.

Images