Design method of multi-domain isolation operating system file access trusted environment

Abstract

The application discloses a design method of a multi-domain isolated operating system file access trusted environment, which comprises the following steps: step S1: partitioning user process execution to open a file operation; step S2: generating an open call to switch to a partition kernel processing and obtaining process information; step S3: the partition kernel executing a trusted environment judgment function to verify whether the process is a process in the trusted environment; step S4: if the process is not a process in the trusted environment, the process does not have the authority, an error of no authority is returned, and the open call terminates the execution of the open file operation; if the process is a process in the trusted environment, the process has the authority, the open call executes the open file operation, and a file descriptor is returned to the partition.

Description

Technical Field

[0001] This invention relates to an access method, specifically a design method for a trusted environment for file access in a multi-domain isolated operating system. Background Technology

[0002] In a multi-domain isolated operating system based on the Linux kernel, the partition serves as the actual entry point for users to access the computer, and its internal security is entirely determined by the user's system usage habits. If a user downloads software installation packages from unknown sources, leaving backdoor programs within the partition, user files may be scanned by malicious background programs, leading to the leakage of sensitive information stored therein. Current methods for protecting files, including encryption and setting access permissions, cannot achieve both transparency to applications and prevention of access by malicious programs that may have root privileges. Therefore, a method is needed to effectively protect sensitive files within partitions through the kernel, preventing access by other users or malicious programs. Summary of the Invention

[0003] To address the aforementioned issues, the present invention aims to provide a design method for a trusted environment for file access in a multi-domain isolated operating system. A trusted environment is implemented within a partition, and users can access this trusted environment after successful authentication. Any access to files within the trusted environment is secure, and access requests are granted. Outside the trusted environment, even processes with root privileges cannot access files; the system will intercept such attempts and return an error to the upper-level process.

[0004] This invention discloses a design method for a trusted environment for file access in a multi-domain isolated operating system, comprising the following steps: Step S1: The partition user's process performs an open file operation; Step S2: Generate an open call to switch to the partition kernel for processing and obtain process information; Step S3: The partition kernel executes the trusted environment judgment function to verify whether the process is a process in a trusted environment; Step S4: If the process is not in a trusted environment, the process does not have the necessary permissions, and a permission failure error is returned. The open call terminates the execution of the file opening operation. If the process is in a trusted environment, then the process has the necessary permissions to perform the open call to open the file and return the file descriptor to the partition.

[0005] A further improvement of the present invention is that, in step S0, the authentication is based on the data interaction capability between the partition and the host of the multi-domain isolated operating system. The partition user runs the user authentication program in the shell, and after entering the username and password, the partition kernel will transmit the username and password to the host kernel through the data path. The host kernel compares the username and password and returns the authentication result.

[0006] A further improvement of the present invention is that, after successful authentication, the partition kernel creates a trusted environment based on the shell and saves the structure information of the trusted environment.

[0007] A further improvement of the present invention is that the structure information of the trusted environment includes the process ID, username, and authentication time of the shell that runs the user authentication program and has been successfully authenticated.

[0008] A further improvement of the present invention is that the verification process of the trusted environment judgment function in step S3 is as follows: Step S31: Obtain the process creation time and compare it with the authentication time; If the creation time is later than the identity authentication time, proceed to step S32; If the creation time is earlier than the authentication time, then the process is not a process in a trusted environment; Step S32: Obtain the process ID of the parent process of the process and determine whether it matches the process ID recorded in the structure information of the trusted environment; If the process ID matches the process ID recorded in the structure information of the trusted environment, then it is a process in the trusted environment, and the verification is successful. If the process number does not match the process number recorded in the structure information of the trusted environment, then proceed to step S33; Step S33: Determine if the process ID of the parent process of the process is 1; If the process ID of the parent process of a process is 1, then the process is not executed by a shell in a trusted environment, and the process is not a process in a trusted environment. If the process ID of the parent process of the process is not 1, then execute step S34; Step S34: The parent process of the process repeats step S31.

[0009] A further improvement of the present invention is that it also includes step S5; Step S5: After the file opening operation, a file access operation is performed. After the file access operation is completed, the partition user can exit the trusted environment through the user authentication program, and the partition kernel deletes the saved trusted environment structure information.

[0010] A further improvement of the present invention is that the structure information of the trusted environment also includes a timer, which can be set for a period of time so that the user exits the trusted environment after the user has not performed any operation on the file within the set time.

[0011] The beneficial effects of this invention are: The partitioned trusted environment design scheme proposed in this invention provides relevant functional support in the partition kernel, which can effectively control the behavior of processes (programs) in the partition to access sensitive files. Even if a malicious program has root privileges, it will not be able to access the files. Attached Figure Description

[0012] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0013] Figure 1 This is a schematic diagram of the method for accessing a trusted environment for operating system files in a multi-domain isolated environment according to the present invention; Detailed Implementation

[0014] The technical solutions in the embodiments of the present invention will be clearly and completely described below. Many specific details are set forth in the following description to provide a thorough understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Those skilled in the art can make similar extensions without departing from the spirit of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0015] The purpose of this invention is to provide a design method for a trusted environment for file access in a multi-domain isolated operating system. A trusted environment is implemented in the partition. After successful authentication, users can access the trusted environment. Any access to files in the trusted environment is secure, and access requests are approved. Outside the trusted environment, even processes with root privileges cannot access files. The system will intercept such behavior and return an error to the upper-level process.

[0016] In Linux systems, there is a general I / O model for files. The process of accessing a file can be abstracted and summarized by four system calls: the `open` call, which opens the file and returns a file descriptor to refer to in subsequent function calls; the `read` call, which reads a specified number of bytes of data from the open file pointed to by the file descriptor into memory; the `write` call, which writes a specified number of bytes of data to the open file pointed to by the file descriptor; and the `close` call, which releases the file descriptor and closes the open file. The file descriptor acts as an index of open files maintained by the kernel for processes, identifying files and providing processes with file object information to associate with disk files.

[0017] The design method of this invention is to add a restriction to the open system call: only open calls initiated in a trusted environment after identity authentication can be successfully executed and return a file descriptor for the program to use.

[0018] This invention discloses a design method for a trusted environment for file access in a multi-domain isolated operating system, comprising the following steps: Figure 1 As shown, Step S0: The partition user runs a user authentication program in the shell to authenticate the partition user's identity in order to verify whether the partition user can access the trusted environment; If the identity authentication is successful, the user in the partition is connected to the trusted environment and step S1 is executed; If authentication fails, users in the partition will be unable to access the trusted environment, and execution will terminate.

[0019] Identity authentication is based on the data interaction capability between the partition and the host of a multi-domain isolated operating system. The partition user runs the user authentication program in the shell, and after entering the username and password, the partition kernel will pass the username and password to the host kernel through the data path. The host kernel compares the username and password and returns the identity authentication result.

[0020] After successful authentication, the partition kernel creates a trusted environment based on that shell and saves the trusted environment's structure information. The trusted environment's structure information includes the process ID, username, and authentication time of the shell that ran the user authentication program and passed authentication; these serve as the criteria for determining a trusted environment. Once this trusted environment meets the security and trust requirements after authentication, all processes subsequently created and run within it will become descendant processes of the shell and will also reside within the trusted environment.

[0021] The design method of this invention is based on the tree structure under Linux to determine the trusted environment. The user authentication program runs as a direct child process of the current shell. Since other processes in the system cannot attach themselves to the shell by modifying its parent process, all child processes running in the shell environment are initiated by the user. Therefore, information such as the current shell's PID and the time of successful authentication can be recorded as a basis for determining the trusted environment. If user authentication is successful, the current shell environment is considered to be controlled by a legitimate user and not initiated by other users or malicious programs, and all subsequent file access operations should be allowed.

[0022] Step S1: The partition user's process performs an open file operation; Step S2: Generate an open call and switch to the partition kernel for processing, and obtain process information of the process; Step S3: The partition kernel executes the trusted environment judgment function to verify whether the process is a process in a trusted environment; The user's process accessing the securely isolated file will trigger events such as Figure 1 The open call permission verification process shown in the diagram involves the partition kernel determining whether each process that makes an open call to open a secure isolated file is in a trusted environment. The detailed process of the trusted environment determination function is as follows: Step S31: Obtain the process creation time and compare it with the authentication time; If the creation time is later than the identity authentication time, proceed to step S32; If the creation time is earlier than the authentication time, then the process is not a process in a trusted environment; Step S32: Obtain the process ID of the parent process of the process and determine whether it matches the process ID recorded in the trusted environment structure information; If the process ID matches the process ID recorded in the structure information of the trusted environment, then it is a process in the trusted environment, and the verification is successful. If the process number does not match the process number recorded in the structure information of the trusted environment, then proceed to step S33; Step S33: Determine if the process ID of the parent process of the process is 1; If the process ID of the parent process of a process is 1, then the process is not executed by a shell in a trusted environment, and the process is not a process in a trusted environment. If the process ID of the parent process of the process is not 1, then execute step S34; Step S34: The parent process of the process repeats step S31.

[0023] Step S34 refers to verifying the parent process of the current process through the trusted environment determination function.

[0024] Step S4: If the process is not in a trusted environment, the process does not have the necessary permissions, and a permission failure error is returned. The open call terminates the execution of the file opening operation. If the process is in a trusted environment, then the process has the necessary permissions to perform the open call to open the file and return the file descriptor to the partition.

[0025] Step S5: After opening the file, perform the file access operation. After the file access operation is completed, the partition user can exit the trusted environment through the user authentication program, and the partition kernel will delete the saved trusted environment structure information.

[0026] The trusted environment's structure information also includes a timer, which can be set to allow the user to exit the trusted environment after a set period of inactivity on the file.

[0027] This method is designed based on the tree-structured process architecture in Linux to determine the trusted environment of a process. The trusted environment determination function recursively checks whether the parent process of a process matches the process ID (PID) of each process in the shell recorded in the trusted environment, and whether the process was created after successful authentication. This ensures that only processes newly created by the user in the current shell after authentication, and their forked descendants, have access to files. Processes whose parent processes are recursively checked up to process number 1 or those created before the user authentication time are determined to lack access permissions, and their attempts to access files will return a permission denied error.

[0028] For backdoor programs used to scan and access sensitive files in the system, they may have a scheduled task run by a system program. This can be prevented by checking whether the parent process of the process is the shell environment used for user authentication. Alternatively, there is a possibility that malicious commands have been added to the shell's runtime configuration file to execute a specific backdoor program after each shell run. This program, as a child process of the shell, should not be granted file access permissions. In this case, checking whether the process's creation time is later than the time the user authenticates upon accessing the trusted environment can identify it.

[0029] This design method can transparently and effectively control the processes that access files. After user authentication, new processes running in the current shell environment can access files, while other processes, even with root privileges, cannot access sensitive files, thus protecting the confidential information stored within them.

[0030] Technical terms: 1. Operating System: A type of basic software, such as Windows, iOS, and Android.

[0031] 2. Virtualization technology: Virtualization builds an abstraction layer on top of computer hardware through software, allowing the hardware's processor, memory, storage hard disk, etc., to be divided into multiple virtual computers, each running its own operating system.

[0032] 3. Multi-domain isolation: An operating system architecture that typically uses virtualization technology to simulate multiple domains. Computer resources are allocated to different domains according to custom rules, making programs running in each domain unaware of the actual information of the computer system, thereby improving the security of the computer system to some extent. In this architecture, a host system runs on the real physical hardware. By running various virtualization software on the host system, the physical hardware can be simulated and new guest systems can be run. These guest system environments are called partitions.

[0033] 4. Linux Process Tree Structure: In Linux, each process has a globally unique process ID (PID) for identification. Besides the initial process in the system, each process has a parent process (PPID), identifying the parent process that spawned it. The Linux process tree is a tree structure formed by connecting all processes in the system according to parent-child relationships. Each process may have multiple child processes or no child processes, but it has one and only one parent process. This property determines that each process and the process at the top of the tree structure form a unique path through the parent-child relationships. Any process searching upwards for its parent process and repeating this process will eventually find the process at the top.

[0034] Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

Claims

1. A design method for a trusted environment for file access in a multi-domain isolated operating system, characterized in that, Includes the following steps: Step S0: The partition user runs a user authentication program in the shell to authenticate the partition user's identity in order to verify whether the partition user can access the trusted environment; If the identity authentication is successful, the user in the partition is connected to the trusted environment and step S1 is executed; If authentication fails, users in the partition will be unable to access the trusted environment, and execution will terminate. Step S1: The partition user's process performs an open file operation; Step S2: Generate an open call to switch to the partition kernel for processing and obtain process information; Step S3: The partition kernel verifies whether a process is in a trusted environment by executing a trusted environment judgment function; Step S4: If the process is not in a trusted environment, the process does not have the necessary permissions, and a permission failure error is returned. The open call terminates the execution of the file opening operation. If the process is in a trusted environment, then the process has the necessary permissions to execute the open call to open the file and return the file descriptor to the partition. After successful authentication, the partition kernel creates a trusted environment based on the shell and saves the structure information of the trusted environment; The structure information of the trusted environment includes the process ID, username, and authentication time of the shell that runs the user authentication program and has been successfully authenticated. The verification process of the trusted environment judgment function in step S3 is as follows: Step S31: Obtain the process creation time and compare it with the authentication time; If the creation time is later than the identity authentication time, proceed to step S32; If the creation time is earlier than the authentication time, then the process is not a process in a trusted environment; Step S32: Obtain the process ID of the parent process of the process and determine whether it matches the process ID recorded in the structure information of the trusted environment; If the process ID matches the process ID recorded in the structure information of the trusted environment, then it is a process in the trusted environment, and the verification is successful. If the process number does not match the process number recorded in the structure information of the trusted environment, then proceed to step S33; Step S33: Determine if the process ID of the parent process of the process is 1; If the process ID of the parent process of a process is 1, then the process is not executed by a shell in a trusted environment, and the process is not a process in a trusted environment. If the process ID of the parent process of the process is not 1, then execute step S34; Step S34: The parent process of the process repeats step S31.

2. The design method for a trusted environment for file access in a multi-domain isolated operating system according to claim 1, characterized in that, In step S0, authentication is based on the data interaction capability between the partition and the host of the multi-domain isolated operating system. The partition user runs the user authentication program in the shell, and after entering the username and password, the partition kernel will transmit the username and password to the host kernel through the data path. The host kernel compares the username and password and returns the authentication result.

3. The design method for a trusted environment for file access in a multi-domain isolated operating system according to claim 1, characterized in that, It also includes step S5; Step S5: After opening the file, file access operations can be performed. After the file access operation is completed, the partition user can exit the trusted environment through the user authentication program, and the partition kernel will delete the saved trusted environment structure information.

4. The design method for a trusted environment for file access in a multi-domain isolated operating system according to claim 3, characterized in that, The trusted environment's structure information also includes a timer, which can be set to allow the user to exit the trusted environment after a set period of inactivity on the file.

Images