Program starting method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention discloses a program starting method and device, electronic equipment and a storage medium. In the method, a program starting path sent by a to-be-started program is received, and the program starting path is generated and sent when the to-be-started program receives a starting request based on user permission; obtaining a session ID and a user token corresponding to the current user generating the starting request; extracting an administrator token from a preset process, and extracting a first type of parameters used for representing identity information of a current user from the user token; obtaining complete token parameters according to the first type of parameters and preset second type of parameters used for representing authority information the same as the administrator authority, and creating a target token based on the administrator token and the complete token parameters; configuring the session ID as the session ID of the target token; and starting the program according to the target token for configuring the session ID and the program starting path. According to the embodiment of the invention, the guest user can directly, safely and orderly access the administrator permission program on the premise of obtaining the administrator permission authorization.

Description

Technical Field

[0001] Embodiments of the present invention relate to the technical field of operating systems, and in particular to a program startup method, device, electronic device, and storage medium. Background Art

[0002] Various applications are the software foundation for electronic devices to realize the functions required by users. In electronic devices, applications run based on the operating system. In order to protect the information security of users of electronic devices, the operating system usually configures different usage permissions through different user accounts. For example, administrator permissions are configured for the administrator user of the holder, and the highest permissions can be used to operate the electronic device; user permissions are configured for guest users other than the holder, and user permissions can be used to operate the electronic device with permissions lower than administrator permissions. Intuitively, administrator permissions can open programs that can be opened under user permissions, and can also open programs that cannot be opened under user permissions. The data generated by different users in the process of using electronic devices are isolated from each other.

[0003] In the actual use of electronic devices, there may be limited user programs that can only be opened by the guest user with administrator privileges. In the prior art, after the token is copied and the session ID is placed, a service program is created to replace the limited user program to complete the operation. This processing method may disrupt the order of the entire operating system and bring security risks. Summary of the invention

[0004] The present invention provides a program startup method, device, electronic device and storage medium to solve the technical problem in the prior art that after a restricted user program copies a token and places a session ID, a service program is created to replace the restricted user program to complete the operation, which may disrupt the order of the entire operating system and bring security risks.

[0005] In a first aspect, an embodiment of the present invention provides a program startup method, comprising:

[0006] Receiving a program startup path sent by the program to be started, where the program startup path is generated and sent by the program to be started when receiving a startup request based on user authority;

[0007] Get the session ID and user token corresponding to the current user who generated the start request;

[0008] Extracting an administrator token from a preset process, and extracting a first type of parameter from a user token, where the first type of parameter is used to represent the identity information of the current user;

[0009] Obtaining complete token parameters according to the first type of parameters and the preset second type of parameters, and creating a target token based on the administrator token and the complete token parameters, wherein the second type of parameters are used to represent permission information that is the same as the administrator's permissions;

[0010] Configure the session ID to be the session ID of the target token;

[0011] Starts the program based on the target token configured with the session ID and the program startup path.

[0012] In a second aspect, an embodiment of the present invention further provides a program starting device, including:

[0013] A path receiving unit, used to receive a program startup path sent by the program to be started, where the program startup path is generated and sent by the program to be started when receiving a startup request based on user authority;

[0014] An information acquisition unit, used to acquire a session ID and a user token corresponding to the current user who generates the start request;

[0015] A parameter extraction unit, used to extract an administrator token from a preset process and extract a first type of parameter from a user token;

[0016] A token creation unit, configured to obtain complete token parameters according to the first type of parameters and preset second type of parameters, and to create a target token based on the administrator token and the complete token parameters;

[0017] A token configuration unit, configured to configure the session ID to be the session ID of the target token;

[0018] The path starting unit is used to start the program according to the target token configured with the session ID and the program starting path.

[0019] In a third aspect, an embodiment of the present invention further provides an electronic device, including:

[0020] one or more processors;

[0021] a memory for storing one or more computer programs;

[0022] When one or more computer programs are executed by one or more processors, the electronic device implements the program startup method of the first aspect.

[0023] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the program startup method of the first aspect is implemented.

[0024] In the above-mentioned program startup method, device, electronic device and storage medium, a program startup path sent by the program to be started is received, and the program startup path is generated and sent by the program to be started when receiving a startup request based on user rights; the session ID and user token corresponding to the current user who generates the startup request are obtained; the administrator token is extracted from the preset process, and the first type of parameters are extracted from the user token, and the first type of parameters are used to characterize the identity information of the current user; the complete token parameters are obtained according to the first type of parameters and the preset second type of parameters, and the target token is created based on the administrator token and the complete token parameters, and the second type of parameters are used to characterize the authority information that is the same as the administrator authority; the session ID is configured as the session ID of the target token; and the program is started according to the target token configured with the session ID and the program startup path. When the program to be started cannot be started directly, a new token with administrator authority is generated according to the administrator token based on the basic parameters of the user authority corresponding to the guest user and the preset parameters related to the access rights, and the program is started with this token, so that the guest user can access the administrator authority program safely and orderly on the premise of obtaining the administrator authority authorization. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 A method flow chart of a program startup method provided by an embodiment of the present invention.

[0026] Figure 2 A schematic diagram of the structure of a program starting device provided in an embodiment of the present invention.

[0027] Figure 3 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0028] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only the parts related to the present invention, rather than all structures, are shown in the accompanying drawings.

[0029] It should be noted that the present application specification does not enumerate all optional implementation modes. After reading the present application specification, those skilled in the art should be able to understand that as long as the technical features do not contradict each other, any combination of the technical features can constitute an optional implementation mode.

[0030] When the operating system is under administrator privileges, the boot program will be installed in the operating system as a service and set to run automatically. The electronic device will automatically start the boot program after it is turned on. After the boot program starts, it will start to monitor the user login status. The boot program monitors whether it is a guest user logging in. When it monitors that a guest user has successfully logged in to the operating system, it obtains its own token A (Token A) and copies it to generate token B (Token B); since token B used to create the service program is copied from token A of the boot program, the service program created with this token has the same service privileges as the boot program. The boot program obtains the session ID (SessionID) of the current guest user by calling the function provided by the operating system, and places the session ID into token B. The boot program uses token B as the process token to create a new service program. The token B of the service program originates from the boot program, so it has administrator operation privileges; and its session ID originates from the current guest user, so the service program runs in the current guest user session. When a limited user program needs to perform an administrator privilege operation, it sends the operation content to the service program through inter-process communication, and the service program completes the operation on behalf of the limited user program.

[0031] In general, the actual operation process uses the token B of the new service program, which is obtained by copying the process token of service program A and modifying the session ID. Although the token B obtained by this method does have administrator privileges, the identity of the service program actually used has service privileges and can only run in the newly logged-in user session. The service privilege is the highest privilege identity in the operating system and can control all computer resources. Random use will disrupt the order of the operating system and bring security risks, such as:

[0032] (1) Any operation will leave the identity of the service user in the operating system's access audit system, disrupting the operating system's access audit system.

[0033] (2) All user-related file and configuration modifications are performed as a service, resulting in the inability to read the guest user's configuration. At the same time, modifications to the guest user's configuration cannot take effect on the guest user, but instead take effect on the administrator user.

[0034] (3) Any file created uses the identity of the service program, resulting in the file being accessible only to service users, making it inaccessible to guest users.

[0035] (4) Abuse of permissions: If an error occurs during the operation performed with excessive permissions, critical files or configurations may be damaged and there is no chance of recovery.

[0036] (5) Security risks: Once a security vulnerability is exploited during an operation, the highest permissions of the operating system will be leaked, and malicious programs can completely control all resources of the computer.

[0037] In response to the above technical problems, this solution proposes a program startup method. When the program to be started cannot be started directly, based on the basic parameters of the user permissions corresponding to the guest user and the preset parameters related to the access permissions, a new token with administrator permissions is generated according to the administrator token, and the program is started with it. In this way, the guest user can access the administrator permission program safely and orderly on the premise of obtaining administrator permission authorization.

[0038] The following is a detailed description of the various embodiments of the present invention.

[0039] Figure 1 This is a method flow chart of a program startup method provided by an embodiment of the present invention, and the program startup method is implemented by an electronic device. Figure 1 The program startup method includes steps S110 to S140:

[0040] Step S110: receiving a program startup path sent by the program to be started. The program startup path is generated and sent by the program to be started when receiving a startup request based on user authority.

[0041] The program startup method in the embodiment of the present invention can be implemented by a service agent program that has certain similarities with the boot program. That is, when the operating system is under the administrator's authority, the service agent program is installed in the operating system as a service and set to run automatically, and the service agent program is automatically started after the electronic device is turned on. Of course, it can also be implemented by other boot process methods. In the embodiment of the present invention, the service agent program is used as an example for explanation.

[0042] The program to be started in the embodiment of the present invention is a program configured with a program startup path generation and sending function, such as a program that is synchronized with or developed corresponding to a service agent program and needs to be started under administrator privileges. In general, if a program can be started normally under user privileges, or can only fail to start under user privileges, this solution cannot be implemented.

[0043] When a program receives a launch request under user privileges, and the program requires administrator privileges to launch, the program is a restricted user program relative to the guest user with user privileges and cannot be launched directly. In this case, the program path to be launched is sent to the service agent through inter-process communication.

[0044] Step S120: Obtain the session ID and user token corresponding to the current user who generates the start request.

[0045] The service agent obtains the session ID and user token of the currently logged-in guest user by calling the function provided by the operating system. Here, the token of the currently logged-in guest user is recorded as token A.

[0046] Step S130: extracting the administrator token from the preset process, and extracting the first type of parameters from the user token.

[0047] The service agent searches for a preset process in the current process list. A preset process is a system program that must exist and is authenticated and logged in as an administrator of the operating system, that is, a program with administrator privileges. Such programs are usually part of the core functions of the operating system, such as the lsass process. The handle of the preset process is obtained, and then the token of the process is extracted from the process handle. The token extracted at this time is the administrator token.

[0048] Token A carries various information about the corresponding guest user in a fixed format. Parameters related to the basic user information are extracted from the token in a fixed format, which are the first type of parameters. The first type of parameters are mainly used to characterize the user's identity information, that is, to record the guest user corresponding to token A, such as the user ID and the user group relationship. The first type of parameters mainly include authentication ID, token expiration time, user SID, custom SID in the user group, token primary group SID, token access control list, and token source information. A user group is a composite structure composed of a series of user SIDs.

[0049] The authentication ID is extracted from the statistical information of token A using the operating system token statistical information extraction function. When the complete token parameters are subsequently generated, the authentication ID in the statistical information of token A is used as the parameter value.

[0050] Use the operating system token statistics extraction function to extract statistics from token A. When subsequently generating complete token parameters, use the expiration time in the statistics of token A as the parameter value, so that the expiration time of the newly created token is consistent with that of token A.

[0051] The user SID is extracted from token A using the operating system token user extraction function. The SID of token A is used as the parameter value when the complete token parameters are subsequently generated, so that the user identity of the token is consistent with the logged-in guest user.

[0052] The primary group SID of the token represents the default primary group SID of the permission group of the operating system objects (including files) created by the process of this token. The primary group SID of the primary group is extracted from token A using the operating system token primary group extraction function. When the complete token parameters are subsequently generated, the primary group SID of token A is used as the parameter value, so that the primary group SID of the token is consistent with the logged-in guest user.

[0053] The token access control list represents the default access control list of the operating system objects (including files) created by the process of this token. The access control list is extracted from token A using the operating system token access control list extraction function. The access control list of token A is used as the parameter value when the complete token parameters are subsequently generated, so that the access control list of the token is consistent with the logged-in guest user.

[0054] The token source information is some remarks written by the creator of the token. The source information is extracted from token A using the Windows system token source information extraction function. The source information of token A is used as the parameter value when the complete token parameters are subsequently generated, so that the source information of the token is consistent with the logged-in user.

[0055] Step S140: Obtain complete token parameters according to the first type of parameters and preset second type of parameters, and create a target token based on the administrator token and the complete token parameters.

[0056] Corresponding to the first type of parameters are the second type of parameters, which are mainly used to characterize the user's permission information, that is, information that records what the user can do. The preset second type of parameters are statically set permission information, which are mainly used to characterize permission information that is the same as the administrator's permissions. In the embodiment of the present application, the preset second type of parameters records what permissions the guest user corresponding to token A needs to achieve the same access as the administrator. The preset second type of parameters can be used directly when recreating the token. In the embodiment of the present invention, the second type of parameters specifically record the parameters that are the same as the administrator's permissions. In terms of information type, the second type of parameters include token permissions, token types, predefined SIDs, and privileged parameters.

[0057] In the embodiment of the present invention, the highest authority corresponding to the administrator's authority is used. The token authority in the second category parameter uses TOKEN_ALL_ACCESS, that is, the highest authority of the token, and the corresponding complete token parameter has the highest authority. The token type in the second category parameter is the main type, because only the main type of token can be used to start the process. The complete token parameter refers to the set of all parameters carried in an available token. As mentioned above, in the embodiment of the present application, the parameter structure in the complete token parameter is divided into parameters for describing identity information and parameters for describing permission information. For different tokens, the parameter values ​​of the corresponding parameters may be different, but the overall parameter structure can be divided into first-category parameters and second-category parameters based on the above division method. Correspondingly, when creating a token, the first-category parameters and the second-category parameters with clear parameter values ​​are also required as the parameter basis.

[0058] The process of obtaining the user group in the parameters of the complete token can be regarded as the process of traversing, judging and replacing the user group in token A after obtaining it; of course, it can also be regarded as the process of directly locating and replacing it. The following is an exemplary description of the process of traversing, judging, replacing and confirming the user group.

[0059] Taking the Window operating system as an example, the Windows operating system token user group extraction function is used to extract the user group from token A, which is recorded as user group A. First, determine the number of SIDs in user group A, recorded as C, and allocate a memory space of 4 bytes plus C+2 user SIDs to store the new user group. Then add WinBuiltinAdministratorsSid (a SID predefined by the Windows system, indicating the system's built-in administrator user group) to the new user group. Traverse the SIDs in user group A and copy them one by one to the new user group added to the complete token parameters. During the specific copying process, if the SID to be copied is found to be WinMediumLabelSid (a SID predefined by the Windows system, indicating medium integrity), change it to WinHighLabelSid (a SID predefined by the Windows system, indicating high integrity). In the specific copying process, if the SID to be copied is found to be WinLocalAccountSid (a SID predefined by the Windows system, indicating a local account), a WinLocalAccountAndAdministratorSid (a SID predefined by the Windows system, indicating a local account and a local administrator account) is inserted after it, and after the traversal is completed, the new user group is finally used as the parameter value. Through the above processing, it is realized that based on the user group of the guest user's corresponding token, it is adjusted according to the necessary users of the administrator user, and the necessary information of the token with administrator privileges available to the guest user is obtained.

[0060] The privilege group consists of a series of privilege states. Privileges are permissions for some special operations in Windows. The privilege attributes in the privilege group after the administrator user logs in are fixed. An exemplary privilege attribute is shown in the following table.

[0061]

[0062]

[0063] The complete token parameters include the same parameter structure as the user token and the administrator token, which are specifically generated by the first and second parameters. That is, the complete token parameters include token permissions (from the second parameters), token type (from the second parameters), authentication ID (from the first parameters), token expiration time (from the first parameters), user SID (from the first parameters), privilege parameters (from the second parameters), user group (including the custom SID in the first parameters and the predefined SID in the second parameters), token owner SID (the same as the user SID), token primary group SID (from the first parameters), token access control list (from the first parameters) and token source information (from the first parameters).

[0064] The specific process of creating the target token needs to be run under administrator privileges, so it is necessary to call the token disguise function of the operating system and use the administrator token for privilege disguise. Privilege disguise can also be called token simulation, which can be achieved through the corresponding token disguise function. On the basis of privilege disguise, the calling address of the token creation function is found from the core system function library of the operating system; the token creation function is called according to the calling address, and the complete token parameters are passed to the token creation function to create the target token. By calling the token creation function of the operating system itself and creating the target token according to the complete token parameters, the creation efficiency can be effectively improved and the amount of code processing can be reduced.

[0065] Step S150: configure the session ID as the session ID of the target token.

[0066] Configuring the session ID as the session ID of the target token can directly call the corresponding function implementation by using the two as function running parameters, such as calling the session configuration function of the operating system, passing the session ID and the target token as function running parameters to the session configuration function to configure the session ID as the session ID of the target token.

[0067] Step S160: Start the program according to the target token configured with the session ID and the program startup path.

[0068] By directly calling the corresponding function with the target token of the configured session ID and the program startup path as function running parameters, the program can be started according to the permissions and path. For example, the program startup function of the operating system is called, and the target token of the configured session ID and the program startup path are passed to the program startup function as function running parameters to start the program corresponding to the program startup path based on administrator permissions.

[0069] In the above method, a program startup path sent by the program to be started is received, and the program startup path is generated and sent by the program to be started when receiving a startup request based on user rights; the session ID and user token corresponding to the current user who generates the startup request are obtained; the administrator token is extracted from the preset process, and the first type of parameters are extracted from the user token; the complete token parameters are obtained according to the first type of parameters and the preset second type of parameters, and a target token is created based on the administrator token and the complete token parameters; the session ID is configured as the session ID of the target token; and the program is started according to the target token configured with the session ID and the program startup path. When the program to be started cannot be started directly, a new token with administrator rights is generated according to the administrator token based on the basic parameters of the user rights corresponding to the guest user and the preset parameters related to the access rights, and the program is started with this token, so that the guest user can access the administrator-rights program safely and orderly on the premise of obtaining the administrator rights authorization.

[0070] Figure 2 A schematic diagram of the structure of a program startup device provided by an embodiment of the present invention. Figure 2 The program starting device includes a path receiving unit 210, an information acquiring unit 220, a parameter extracting unit 23, a token creating unit 240, a token configuring unit 250 and a path starting unit 260.

[0071] Among them, the path receiving unit 210 is used to receive the program startup path sent by the program to be started, and the program startup path is generated and sent by the program to be started when it receives a startup request based on user permissions; the information acquisition unit 220 is used to obtain the session ID and user token corresponding to the current user who generates the startup request; the parameter extraction unit 230 is used to extract the administrator token from the preset process and extract the first type of parameters from the user token, and the first type of parameters are used to characterize the identity information of the current user; the token creation unit 240 is used to obtain the complete token parameters according to the first type of parameters and the preset second type of parameters, and create a target token based on the administrator token and the complete token parameters, and the second type of parameters are used to characterize the permission information that is the same as the administrator's permissions; the token configuration unit 250 is used to configure the session ID as the session ID of the target token; the path startup unit 260 is used to start the program according to the target token with the configured session ID and the program startup path.

[0072] Based on the above embodiments, the first category of parameters includes authentication ID, token expiration time, user SID, custom SID in the user group, token primary group SID, token access control list and token source information; the second category of parameters includes token permissions, token type, predefined SID and privileged parameters.

[0073] Based on the above embodiment, the token creation unit 240 includes:

[0074] The token disguise module is used to call the token disguise function of the operating system and use the administrator token to disguise permissions;

[0075] An address search module is used to search for a calling address of a token creation function from a core system function library of an operating system;

[0076] The parameter passing module is used to call the token creation function according to the calling address and pass the complete token parameters to the token creation function to create the target token.

[0077] Based on the above embodiment, the token configuration unit 250 includes:

[0078] The configuration module is called to call the session configuration function of the operating system, and the session ID and the target token are passed to the session configuration function as function running parameters to configure the session ID as the session ID of the target token.

[0079] Based on the above embodiment, the path starting unit 260 includes:

[0080] The startup module is called to call the program startup function of the operating system, and the target token for configuring the session ID and the program startup path are passed to the program startup function as function running parameters to start the program corresponding to the program startup path based on the administrator's authority.

[0081] Based on the above embodiment, the preset process is the lsass process.

[0082] The program startup device provided in the embodiment of the present invention is included in an electronic device and can be used to execute any program startup method provided in the above embodiments, and has corresponding functions and beneficial effects.

[0083] It is worth noting that in the embodiment of the above-mentioned program startup device, the various units and modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.

[0084] Figure 3 FIG. 1 is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. Figure 3 As shown, the electronic device includes a processor 310 and a memory 320, and may also include an input device 330, an output device 340 and a communication device 350; the number of the processor 310 in the electronic device may be one or more, Figure 3 A processor 310 is taken as an example; the processor 310, the memory 320, the input device 330, the output device 340 and the communication device 350 in the electronic device can be connected via a bus or other means. Figure 3The example of connecting through bus is taken in the following.

[0085] The memory 320 is a computer-readable storage medium that can be used to store software programs, computer executable programs and modules, such as program instructions / modules corresponding to the program startup method in the embodiment of the present invention. The processor 310 executes various functional applications and data processing of the electronic device by running the software programs, instructions and modules stored in the memory 320, that is, implements the above-mentioned program startup method.

[0086] The memory 320 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the electronic device, etc. In addition, the memory 320 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some instances, the memory 320 may further include a memory remotely arranged relative to the processor 310, and these remote memories may be connected to the electronic device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0087] The input device 330 can be used to receive input digital or character information and generate key signal input related to user settings and function control of the electronic device. The output device 340 can include a display device such as a display screen for displaying power, working mode, and a window after the program is started.

[0088] An embodiment of the present invention also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, it is used to perform relevant operations in the program startup method provided in any embodiment of the present application, and has corresponding functions and beneficial effects.

[0089] Those skilled in the art should understand that the embodiments of the present application may be provided as methods, systems, or computer program products.

[0090] Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the functions in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the functions specified in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0091] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory. The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0092] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0093] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0094] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A program startup method, characterized in that: include: Receiving a program startup path sent by a program to be started, wherein the program startup path is generated and sent by the program to be started when receiving a startup request based on user authority; Obtain the session ID and user token corresponding to the current user who generated the start request; Extracting an administrator token from a preset process, and extracting a first type of parameter from the user token, wherein the first type of parameter is used to characterize identity information of the current user; Obtaining complete token parameters according to the first type of parameters and preset second type of parameters, and creating a target token based on the administrator token and the complete token parameters, wherein the second type of parameters are used to represent permission information that is the same as the administrator's permissions; Configuring the session ID as the session ID of the target token; The program is started according to the target token configured with the session ID and the program start path.

2. The program startup method according to claim 1, characterized in that: The first category of parameters includes authentication ID, token expiration time, user SID, custom SID in user group, token primary group SID, token access control list and token source information; the second category of parameters includes token permissions, token type, predefined SID and privileged parameters.

3. The program startup method according to claim 1 or 2, characterized in that: The obtaining of complete token parameters according to the first type of parameters and the preset second type of parameters, and creating a target token based on the administrator token and the complete token parameters, includes: Calling the token camouflage function of the operating system and using the administrator token to perform permission camouflage; Find the calling address of the token creation function from the core system function library of the operating system; The token creation function is called according to the calling address, and the complete token parameters are passed to the token creation function to create a target token.

4. The program startup method according to claim 1 or 2, characterized in that: The configuring the session ID as the session ID of the target token comprises: The session configuration function of the operating system is called, and the session ID and the target token are passed to the session configuration function as function running parameters, so as to configure the session ID as the session ID of the target token.

5. The program startup method according to claim 1 or 2, characterized in that: The starting a program according to the target token configured with the session ID and the program starting path comprises: The program startup function of the operating system is called, and the target token configured with the session ID and the program startup path are passed to the program startup function as function running parameters, so as to start the program corresponding to the program startup path based on the administrator authority.

6. The program startup method according to claim 1 or 2, characterized in that: The preset process is the lsass process.

7. A program starting device, characterized in that: include: A path receiving unit, configured to receive a program startup path sent by a program to be started, wherein the program startup path is generated and sent by the program to be started when receiving a startup request based on user authority; An information acquisition unit, used to acquire a session ID and a user token corresponding to the current user who generates the start request; A parameter extraction unit, configured to extract an administrator token from a preset process and extract a first type of parameter from the user token; A token creation unit, configured to obtain complete token parameters according to the first type of parameters and preset second type of parameters, and to create a target token based on the administrator token and the complete token parameters; A token configuration unit, configured to configure the session ID as the session ID of the target token; A path starting unit is used to start a program according to a target token configured with the session ID and the program starting path.

8. The program startup device according to claim 7, characterized in that: The first category of parameters includes authentication ID, token expiration time, user SID, custom SID in user group, token primary group SID, token access control list and token source information; the second category of parameters includes token permissions, token type, predefined SID and privileged parameters.

9. An electronic device, characterized in that: include: one or more processors; a memory for storing one or more computer programs; When the one or more computer programs are executed by the one or more processors, the electronic device implements the program startup method as described in any one of claims 1-6.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the program startup method according to any one of claims 1 to 6 is implemented.

Images