Access control method, system, device, medium and program product

Abstract

The invention provides an access control method, system and device, a medium and a program product. The method comprises the following steps: intercepting an access operation of a process on a resource; a target subject corresponding to the process and identification information corresponding to the target subject are retrieved in a subject list, the subject list comprises subjects allowing access to resources and the identification information of the subjects, and the identification information comprises a measurement strategy and a measurement reference value; measuring the process according to a measurement strategy corresponding to the target subject to obtain a to-be-detected measurement reference value; and based on the measurement security policy, the to-be-detected measurement reference value and a measurement reference value corresponding to the target subject, an access result is returned, and the measurement security policy identifies the subject based on the identification information. The malicious software cannot bypass the measurement security policy by moving or renaming the process path, the attack of the malicious software can be effectively defended, the security is improved, the measurement security policy does not need to be updated even if the process path is moved or renamed, and the stability is higher.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of access control technology, and in particular, to an access control method, system, device, medium and program product. Background Art

[0002] In early computer systems, resources (such as files, devices, etc.) were usually shared by a single user or a small group of users, and these systems tended to run in a relatively closed and trusted environment. With the development of technology and the widespread popularity of computer applications, systems have become more open and user groups have become more diverse, which has led to a significant increase in the security risks of data and resources. As the manager of computer resources, the operating system needs to effectively control access to these resources to prevent unauthorized use, data leakage, data corruption and other security threats. Therefore, access control mechanisms are introduced into the operating system to implement security policies based on the principle of least privilege to prevent unauthorized users from accessing and modifying system resources, thereby protecting the integrity and confidentiality of the system.

[0003] With the development of access control technology, access control mechanisms have evolved from the initial simple model to a more complex model to adapt to the ever-changing security requirements and technical environment. There are two main access control mechanisms in modern operating systems: Discretionary Access Control (DAC1) and Mandatory Access Control (MAC).

[0004] Discretionary access control allows resource owners or designated controllers to manage and control access to their resources. In the DAC model, users can assign access rights to other users based on their own judgment. Discretionary access control has been used as a basic access control mechanism in operating systems due to its user-friendly security logic and simple configuration. However, its security is highly dependent on the decisions of individual users, and users may inadvertently grant unsafe or unnecessary permissions, thereby introducing security risks.

[0005] Mandatory access control is an access control mechanism strictly controlled by the operating system administrator or security policy administrator to determine the access rights of users and programs to system resources (such as files, directories, network ports, etc.). In the MAC model, access rights are based on a set of mandatory rules pre-defined by the system administrator, rather than being determined by the resource owner. This model is designed to improve data security and prevent data leakage.

[0006] Common mandatory access controls in modern operating systems include SELinux and Apparmor. SELinux determines whether to allow specific access by comparing the security context of the subject and the object. The structure and policy configuration of SELinux are very complex and not suitable for use in some general scenarios. Apparmor mainly defines its security policy through path-based configuration files, allowing system administrators to control which files and directories programs can access and which operations they can perform (read, write, execute). However, Apparmor's security policy is based on file paths, making it difficult to defend against malware attacks. Malware can easily bypass security policies by moving or renaming, resulting in poor security. Summary of the invention

[0007] The embodiments of the present application provide an access control method, system, device, medium and program product to solve the problem of insufficient security of existing access control methods based on path configuration.

[0008] In order to solve the above technical problems, this application is implemented as follows:

[0009] In a first aspect, an embodiment of the present application provides an access control method, including:

[0010] Intercept the process's access to resources;

[0011] Retrieving a target subject corresponding to the process and identification information corresponding to the target subject in a subject list, wherein the subject list includes subjects allowed to access the resource and identification information of the subjects, and the identification information includes a measurement strategy and a measurement reference value;

[0012] Measuring the process according to the measurement strategy corresponding to the target subject to obtain a measurement benchmark value to be checked;

[0013] Based on the metric security policy, the metric reference value to be checked, and the metric reference value corresponding to the target subject, an access result is returned, wherein the metric security policy identifies the subject based on the identification information.

[0014] Optionally, the method further includes:

[0015] Converting the original security policy for the subject to access resources into the metric security policy; wherein the original security policy identifies the subject based on the program path, and the metric security policy also includes the program name corresponding to the subject;

[0016] Binding the measurement security policy to the resource. Optionally, converting the original security policy for the subject to access the resource into the measurement security policy includes:

[0017] Divide the code segment memory of the executable file of the specified path in the original security policy into memory blocks of fixed size, and assign index numbers to each of the memory blocks;

[0018] Based on the index number, a random number sequence is obtained;

[0019] Measuring the memory page labeled with the random number sequence to generate the measurement reference value;

[0020] The program name corresponding to the subject, the random number sequence and the measurement reference value are used as the identification information of the subject to replace the identification information of the subject in the original security policy to obtain the measurement security policy.

[0021] Optionally, obtaining a random number sequence based on the index number includes:

[0022] Determine the number of memory blocks that need to be measured as t;

[0023] Generate t random numbers within the index number range to obtain a random number sequence.

[0024] Optionally, retrieving a target subject corresponding to the process in a subject list includes:

[0025] According to the resource index, acquiring the extended attribute of the resource, wherein the extended attribute includes the subject list;

[0026] According to the program name of the process, a target subject corresponding to the process is retrieved from the subject list.

[0027] Optionally, the step of obtaining the extended attribute of the resource further includes:

[0028] intercepting a function call for obtaining extended attributes of the resource;

[0029] The subject list in the extended attribute in the return content of the call to the function is deleted.

[0030] Optionally, the measurement strategy further includes a memory block index, and the memory block of the memory block index is the memory block to be measured;

[0031] The step of measuring the process according to the measurement strategy corresponding to the target subject to obtain the measurement reference value to be checked includes:

[0032] The code segment of the process is measured according to the memory block index corresponding to the target subject to obtain the measurement reference value to be checked.

[0033] Optionally, returning the access result based on the metric security policy, the metric reference value to be checked, and the metric reference value corresponding to the target subject includes:

[0034] Comparing the metric reference value to be checked with the metric reference value corresponding to the target subject;

[0035] If the metric reference value to be checked matches the metric reference value corresponding to the target subject, checking the access rights of the process;

[0036] If the current access of the process is a subset of the access rights, then access is allowed;

[0037] If the current access of the process is not a subset of the access rights, the access of the process to the file is terminated and an error message is returned.

[0038] In a second aspect, an embodiment of the present application provides an access control system, including:

[0039] The interception module is used to intercept the process's access to resources;

[0040] A retrieval module, configured to retrieve a target subject corresponding to the process and identification information corresponding to the target subject in a subject list, wherein the subject list includes subjects allowed to access the resource and identification information of the subjects, and the identification information includes a measurement strategy and a measurement reference value;

[0041] A measurement module, used to measure the process according to the measurement strategy corresponding to the target subject to obtain a measurement benchmark value to be tested;

[0042] A result module is used to return an access result based on a metric security policy, the metric reference value to be checked, and the metric reference value corresponding to the target subject, wherein the metric security policy identifies the subject based on the identification information.

[0043] Optionally, the access control system further includes:

[0044] A conversion module, used to convert the original security policy for the subject to access resources into the metric security policy; wherein the original security policy identifies the subject based on the program path, and the metric security policy also includes the program name corresponding to the subject;

[0045] The metric security policy is bound to the resource.

[0046] Optionally, the conversion module includes:

[0047] A replacement module, used to divide the code segment memory of the executable file of the specified path in the original security policy into memory blocks of fixed size, and to index each of the memory blocks;

[0048] Based on the index number, a random number sequence is obtained;

[0049] Measuring the memory page labeled with the random number sequence to generate the measurement reference value;

[0050] The program name corresponding to the subject, the random number sequence and the measurement reference value are used as the identification information of the subject to replace the identification information of the subject in the original security policy to obtain the measurement security policy.

[0051] Optionally, the replacement module includes:

[0052] The random number module is used to determine the number of memory blocks that need to be measured as t;

[0053] Generate t random numbers within the index number range to obtain a random number sequence.

[0054] Optionally, the retrieval module includes:

[0055] An extension module, used for acquiring the extended attribute of the resource according to the resource index, wherein the extended attribute includes the subject list;

[0056] According to the program name of the process, a target subject corresponding to the process is retrieved from the subject list.

[0057] Optionally, the retrieval module further includes:

[0058] A deletion module, used for intercepting a function call for obtaining the extended attributes of the resource;

[0059] The subject list in the extended attribute in the return content of the call to the function is deleted.

[0060] Optionally, the measurement strategy further includes a memory block index, and the memory block of the memory block index is the memory block to be measured;

[0061] The measurement module comprises:

[0062] The measurement submodule is used to measure the code segment of the process according to the memory block index corresponding to the target subject to obtain the measurement reference value to be tested.

[0063] Optionally, the result module includes:

[0064] A result submodule, used to compare the metric reference value to be checked with the metric reference value corresponding to the target subject;

[0065] If the metric reference value to be checked matches the metric reference value corresponding to the target subject, checking the access rights of the process;

[0066] If the current access of the process is a subset of the access rights, then access is allowed;

[0067] If the current access of the process is not a subset of the access rights, the access of the process to the file is terminated and an error message is returned.

[0068] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the access control method described in the first aspect above.

[0069] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the access control method described in the first aspect above are implemented.

[0070] In a fifth aspect, a computer program product is provided, comprising computer instructions, which, when executed by a processor, implement the steps of the access control method as described in the first aspect above.

[0071] In the present application, the process access operation to the resource is intercepted; the target subject corresponding to the process and the identification information corresponding to the target subject are retrieved in the subject list, wherein the subject list includes the subject allowed to access the resource and the identification information of the subject, and the identification information includes the measurement strategy and the measurement reference value; the process is measured according to the measurement strategy corresponding to the target subject to obtain the measurement reference value to be checked; based on the measurement security policy, the measurement reference value to be checked and the measurement reference value corresponding to the target subject, the access result is returned, and the measurement security policy identifies the subject based on the identification information. Different from the security policy based on the program path in the prior art, after the process access operation to the resource is intercepted, the embodiment of the present application will measure the process according to the measurement strategy corresponding to the target subject corresponding to the process, and determine the access result based on the measurement reference value to be checked, the measurement security policy, and the measurement reference value corresponding to the target subject obtained by the measurement, and the malware cannot bypass the measurement security policy by moving or renaming the process path, which can effectively defend against malware attacks and effectively improve security, and even if the process path is moved or renamed, there is no need to update the measurement security policy, and the stability is higher. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0073] Figure 1 is a flow chart of an access control method provided by an embodiment of the present application;

[0074] Figure 2 is a schematic diagram of an access control architecture provided by an embodiment of the present application;

[0075] Figure 3 It is a schematic diagram of the structure of an access control system provided by an embodiment of the present application;

[0076] Figure 4 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0077] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0078] There are two main mandatory access control mechanisms commonly used in the prior art: Solution 1) a measurement-based subject trust verification method, where the measurement includes loading measurement and real-time measurement at runtime; Solution 2) an access control solution based on the Apparmor mechanism, which defines its security policy through a path-based configuration file, and each security policy entry specifies a file path and corresponding access rights.

[0079] However, solution 1) needs to rely on the traditional mandatory access control mechanism. Its working principle is to measure the memory of the process after checking it with the traditional mandatory access control mechanism to solve the problem of memory tampering during and after the process is loaded. Therefore, this only verifies the subject and does not involve the design of the security policy for the subject's access to the object. It is not a complete mandatory access control solution. In addition, this solution will measure the entire code segment and immutable data area of ​​the program. First, the amount of data measured is relatively large. Secondly, due to the characteristics of delayed allocation of physical memory, this method further leads to performance degradation and increases the usage of physical memory. Therefore, it is also unacceptable in the performance-sensitive resource access control stage.

[0080] The Apparmor mechanism of solution 2) mainly defines its security policy through a path-based configuration file. Each policy entry specifies a file path and corresponding access rights, as shown in the following code:

[0081] / bin / ls{

[0082] / etc / *r,

[0083] / var / log / ls.log w,

[0084] }

[0085] In this example, a configuration file is defined for the / bin / ls command, allowing it to read all files in the / etc / directory and write to / var / log / ls.log.

[0086] However, the above security policies are based on file paths. If the file is moved or renamed, the relevant policies may need to be updated accordingly. Moreover, the security policies are based on file paths, which makes it difficult to defend against malware attacks. Malware can easily bypass the security policies by moving or renaming.

[0087] The essence of the shortcomings of the above two solutions is that the file path cannot accurately reflect the security attributes of the file. The same malware can be moved and renamed in multiple paths, and legitimate software may also be moved and renamed at will. These are all things that security policies based on file paths cannot handle.

[0088] Therefore, please refer to Figure 1 , an embodiment of the present application provides an access control method, including:

[0089] Step 11: Intercept the process's access to resources;

[0090] Step 12: Retrieve the target subject corresponding to the process and the identification information corresponding to the target subject in the subject list, wherein the subject list includes subjects allowed to access the resource and the identification information of the subjects, and the identification information includes a measurement strategy and a measurement benchmark value;

[0091] Step 13: Measure the process according to the measurement strategy corresponding to the target subject to obtain a measurement benchmark value to be tested;

[0092] Step 14: Return an access result based on a metric security policy, the metric reference value to be checked, and the metric reference value corresponding to the target subject, wherein the metric security policy identifies the subject based on the identification information.

[0093] Optionally, the returned access result may include whether the access subject meets the requirements and has the corresponding access rights. When a process accesses a file, the process's access operation to the resource is intercepted, and the related call functions, such as open, read, write, and close, are intercepted. The process is measured according to the measurement strategy, and it is determined whether the process has the access rights such as read, write, or execute the file according to the measurement reference value to be checked, the measurement reference value corresponding to the target subject, and the measurement security policy.

[0094] In the present application, the process access operation to the resource is intercepted; the target subject corresponding to the process and the identification information corresponding to the target subject are retrieved in the subject list, wherein the subject list includes the subject allowed to access the resource and the identification information of the subject, and the identification information includes the measurement strategy and the measurement reference value; the process is measured according to the measurement strategy corresponding to the target subject to obtain the measurement reference value to be checked; based on the measurement security policy, the measurement reference value to be checked and the measurement reference value corresponding to the target subject, the access result is returned, and the measurement security policy identifies the subject based on the identification information. Different from the security policy based on the program path in the prior art, after the process access operation to the resource is intercepted, the embodiment of the present application will measure the process according to the measurement strategy corresponding to the target subject corresponding to the process, and determine the access result based on the measurement reference value to be checked, the measurement security policy, and the measurement reference value corresponding to the target subject obtained by the measurement, and the malware cannot bypass the measurement security policy by moving or renaming the process path, which can effectively defend against malware attacks and effectively improve security, and even if the process path is moved or renamed, there is no need to update the measurement security policy, and the stability is higher.

[0095] The security policy consists of a subject, an object, and a behavior. The traditional security policy uses the program path to identify the subject. In the embodiment of this application, the program name, the measurement policy, and the measurement benchmark value are used as the subject. Please refer to Figure 2 Optionally, in some embodiments, to implement the various embodiments of the access control method of the present application, the present application also provides an overall architecture of access control, wherein each functional module includes a security policy conversion module, a security policy loading module and a security policy checking module, and optionally, based on the Linux Security Modules (LSM) mechanism in the kernel, the file access operations of the process are intercepted.

[0096] Optionally, in some embodiments, the overall access control process can also be divided into a security policy conversion phase (for converting the original security policy into the metric security policy in this application), a security policy loading phase (for reorganizing the metric security policy in this application), and a security policy checking phase (for performing access control based on the metric security policy in this application). The access control process in the above embodiment can be performed by a security policy checking module.

[0097] During the security policy configuration phase, the original security policy is converted into the metric security policy in this application. Specifically:

[0098] Optionally, in some embodiments, the method further comprises:

[0099] Converting the original security policy for the subject to access resources into the metric security policy; wherein the original security policy identifies the subject based on the program path, and the metric security policy also includes the program name corresponding to the subject;

[0100] Bind the metric security policy to the resource. Optionally, the embodiment of the present application may be executed by a security policy conversion module, which converts the path-based security policy P1 (original security policy) into a security policy P2 (metric security policy) based on a metric policy and a metric reference value.

[0101] The measurement security policy is bound to the resource through a security policy loading module.

[0102] In an embodiment of the present application, the original security policy based on the path identification subject is converted into a metric security policy with {program name, metric policy, metric reference value} as the subject identification, which is more secure than the security policy based on the program path; and the identification information is more reasonable, only including the program name for retrieval, the metric policy for measurement, and the metric reference value for comparison. The amount of information is small, the amount of information in each subject entry is small, and the processing speed is faster.

[0103] Furthermore, the present application starts from the nature of the file when formulating the security policy. Whether a file is malicious is obviously determined by its executable code area. Therefore, optionally, the original security policy of the subject accessing the resource is converted into the metric security policy, including:

[0104] Divide the code segment memory of the executable file of the specified path in the original security policy into memory blocks of fixed size, and assign index numbers to each of the memory blocks;

[0105] Based on the index number, a random number sequence is obtained;

[0106] Measuring the memory page labeled with the random number sequence to generate the measurement reference value;

[0107] The program name corresponding to the subject, the random number sequence and the measurement reference value are used as the identification information of the subject to replace the identification information of the subject in the original security policy to obtain the measurement security policy.

[0108] Optionally, obtaining a random number sequence based on the index number includes:

[0109] Determine the number of memory blocks that need to be measured as t;

[0110] Generate t random numbers within the index number range to obtain a random number sequence.

[0111] Optionally, the security policy conversion stage is described in the above embodiment through the following specific embodiments:

[0112] 1) Read the executable file of the specified path in the original security policy, obtain the starting address and ending address of its code by parsing, and determine the memory size M of its code segment;

[0113] 2) Divide the memory into fixed-size blocks, such as 128 bytes, and number each block (1, 2, 3, 4...n);

[0114] 3) According to security requirements and performance requirements, the number of blocks to be measured is determined to be t, ensuring that the performance of measuring t blocks in the access control process can still meet the requirements;

[0115] 4) Generate t random numbers (n0,n1...nt) in the range of 1 to n;

[0116] 5) Measure the memory pages numbered (n0, n1...nt) to generate a measurement reference value Ref;

[0117] 6) Replace the subject identification information in the security policy P1 with {program name, (n0, n1...nt), Ref} as the new subject identification information to form a new security policy (P2) (metric security policy).

[0118] Optionally, in the embodiment of the present application, random numbers are introduced to measure the memory of the executable file code segment, thereby reducing the memory data that needs to be accessed during the access control check process, greatly improving the performance of access control, achieving a balance between performance and security, and effectively preventing malware from bypassing measurement security policies, effectively enhancing security and improving overall performance.

[0119] Optionally, in some embodiments, during the security policy loading phase, the security policy is reorganized, using the resource file name as a unique identifier, and the subjects with access rights to the resource file are organized in the form of a hash table, where the program name is used as the key value of the hash table, so that when file access is intercepted, the relevant subject entries can be quickly retrieved.

[0120] Optionally, in some embodiments, the subject list is set to the extended attributes of the file (security.measure). During the security policy checking phase, when file access is intercepted, the extended attributes are obtained based on the file index, the subject entry in the extended attributes is obtained based on the program name, and the program is measured based on the subject entry, as well as subsequent baseline value checks and permission checks.

[0121] Optionally, in some embodiments, retrieving the target subject corresponding to the process in the subject list includes:

[0122] According to the resource index, acquiring the extended attribute of the resource, wherein the extended attribute includes the subject list;

[0123] According to the program name of the process, a target subject corresponding to the process is retrieved from the subject list.

[0124] Optionally, the extended attributes of the resource file are obtained according to the index of the resource file. The extended attributes store a list of entities that can access the resource file. Each entity contains the program name, the block index to be measured, the benchmark value, and other contents.

[0125] Optionally, the security policy can be bound to the resource in the form of extended attributes through the security policy loading module.

[0126] Optionally, the step of obtaining the extended attribute of the resource further includes:

[0127] intercepting a function call for obtaining extended attributes of the resource;

[0128] The subject list in the extended attribute in the return content of the call to the function is deleted.

[0129] Optionally, in some embodiments, during the security policy checking phase, the security policy checking module also needs to intercept the function call for obtaining extended attributes, delete the content of the security.measure extended attribute in the returned content, and achieve hiding of the measurement policy information to prevent malicious attacks from arranging binary codes according to the measurement policy and bypassing the access control mechanism.

[0130] Optionally, the measurement strategy further includes a memory block index, and the memory block of the memory block index is the memory block to be measured;

[0131] The step of measuring the process according to the measurement strategy corresponding to the target subject to obtain the measurement reference value to be checked includes:

[0132] The code segment of the process is measured according to the memory block index corresponding to the target subject to obtain the measurement reference value to be checked.

[0133] Optionally, the corresponding target subject is retrieved according to the program name of the current process, and the code segment of the process is measured according to the block index to be measured. Optionally, the benchmark value to be measured obtained after the measurement is compared with the measurement benchmark value of the target subject.

[0134] Optionally, returning the access result based on the metric security policy, the metric reference value to be checked, and the metric reference value corresponding to the target subject includes:

[0135] Comparing the metric reference value to be checked with the metric reference value corresponding to the target subject;

[0136] If the metric reference value to be checked matches the metric reference value corresponding to the target subject, checking the access rights of the process;

[0137] If the current access of the process is a subset of the access rights, then access is allowed;

[0138] If the current access of the process is not a subset of the access rights, the access of the process to the file is terminated and an error message is returned.

[0139] Optionally, if there is no match, access to the file is terminated; the measurement security policy also includes "behavior", that is, the subject is allowed to perform access operations (access rights) on the object (resource), such as read, write, execute, etc., so if there is a match, the access rights are further checked; if the current access is a subset of the access rights, access is allowed; otherwise, access to the file is terminated and an error message is returned.

[0140] Generally speaking, in some embodiments, during the security policy conversion phase, the original security policy P1 that identifies the subject with the program path is modified to the security policy P2 that identifies the subject with {program name, block index (n0, n1...nt), metric reference value Ref}; wherein the code segment memory of the executable file of the specified path in the original security policy is divided into blocks of a fixed size, and each block is indexed and numbered, and the corresponding metric reference value Ref is set based on the random number principle.

[0141] In some embodiments, during the security policy checking stage, when a process's access to a file is intercepted, the extended attributes of the file are obtained based on the file index. The extended attributes store a list of subjects that can access the file, each subject contains {program name, block index, and measurement reference value Ref}. The corresponding subject is retrieved based on the program name of the current process, and the code segment of the process is measured based on the block index. The reference value obtained after the measurement is compared with the measurement reference value Ref of the subject to determine whether the process has the corresponding access rights.

[0142] Based on the above embodiments, it is possible to prevent malware from bypassing the metric security policy by moving or renaming the process path, effectively defend against malware attacks, effectively improve security, and even if the process path is moved or renamed, there is no need to update the metric security policy, which has higher stability.

[0143] Please refer to Figure 3 The embodiment of the present application further provides an access control system 20, including:

[0144] The interception module 21 is used to intercept the access operation of the process to the resource;

[0145] A retrieval module 22, configured to retrieve a target subject corresponding to the process and identification information corresponding to the target subject in a subject list, wherein the subject list includes subjects allowed to access the resource and identification information of the subjects, and the identification information includes a measurement strategy and a measurement reference value;

[0146] A measurement module 23, used to measure the process according to the measurement strategy corresponding to the target subject to obtain a measurement benchmark value to be checked;

[0147] The result module 24 is used to return an access result based on a metric security policy, the metric reference value to be checked, and the metric reference value corresponding to the target subject, wherein the metric security policy identifies the subject based on the identification information.

[0148] Optionally, the access control system 20 further includes:

[0149] A conversion module, used to convert the original security policy for the subject to access resources into the metric security policy; wherein the original security policy identifies the subject based on the program path, and the metric security policy also includes the program name corresponding to the subject;

[0150] The metric security policy is bound to the resource.

[0151] Optionally, the conversion module includes:

[0152] A replacement module, used to divide the code segment memory of the executable file of the specified path in the original security policy into memory blocks of fixed size, and to index each of the memory blocks;

[0153] Based on the index number, a random number sequence is obtained;

[0154] Measuring the memory page labeled with the random number sequence to generate the measurement reference value;

[0155] The program name corresponding to the subject, the random number sequence and the measurement reference value are used as the identification information of the subject to replace the identification information of the subject in the original security policy to obtain the measurement security policy.

[0156] Optionally, the replacement module includes:

[0157] The random number module is used to determine the number of memory blocks that need to be measured as t;

[0158] Generate t random numbers within the index number range to obtain a random number sequence.

[0159] Optionally, the retrieval module 22 includes:

[0160] An extension module, used for acquiring the extended attribute of the resource according to the resource index, wherein the extended attribute includes the subject list;

[0161] According to the program name of the process, a target subject corresponding to the process is retrieved from the subject list.

[0162] Optionally, the retrieval module 22 further includes:

[0163] A deletion module, used for intercepting a function call for obtaining the extended attributes of the resource;

[0164] The subject list in the extended attribute in the return content of the call to the function is deleted.

[0165] Optionally, the measurement strategy further includes a memory block index, and the memory block of the memory block index is the memory block to be measured;

[0166] The measurement module 23 includes:

[0167] The measurement submodule is used to measure the code segment of the process according to the memory block index corresponding to the target subject to obtain the measurement reference value to be tested.

[0168] Optionally, the result module 24 includes:

[0169] A result submodule, used to compare the metric reference value to be checked with the metric reference value corresponding to the target subject;

[0170] If the metric reference value to be checked matches the metric reference value corresponding to the target subject, checking the access rights of the process;

[0171] If the current access of the process is a subset of the access rights, then access is allowed;

[0172] If the current access of the process is not a subset of the access rights, the access of the process to the file is terminated and an error message is returned.

[0173] The access control system 20 provided in the embodiment of the present application can achieve Figure 1 The various processes implemented by the method embodiment and achieving the same technical effect are not described here to avoid repetition.

[0174] The present application embodiment provides an electronic device 30, see Figure 4 As shown, Figure 4 This is a principle block diagram of an electronic device 30 according to an embodiment of the present application, including a processor 31, a memory 32, and a program or instruction stored in the memory 32 and executable on the processor 31. When the program or instruction is executed by the processor, the steps in any access control method of the present application are implemented.

[0175] An embodiment of the present application provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, each process of an embodiment of an access control method such as any one of the above-mentioned items is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0176] Computer readable media include permanent and non-permanent, removable and non-removable media, and can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0177] The present application also provides a computer program product, including computer instructions, which, when executed by a processor, implement the above Figure 1 The various processes of any of the access control method embodiments shown can achieve the same technical effect and will not be described again here to avoid repetition.

[0178] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0179] It should be noted that the collection, collection, updating, analysis, processing, use, transmission, storage and other aspects of user personal information involved in the technical solution of this disclosure are in compliance with the provisions of relevant laws and regulations, are used for legitimate purposes, and do not violate public order and good morals. Necessary measures are taken for user personal information to prevent illegal access to user personal information data and maintain the security of user personal information and network security.

[0180] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0181] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a service classification device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0182] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. An access control method, characterized in that: include: Intercept the process's access to resources; Retrieving a target subject corresponding to the process and identification information corresponding to the target subject in a subject list, wherein the subject list includes subjects allowed to access the resource and identification information of the subjects, and the identification information includes a measurement strategy and a measurement reference value; Measuring the process according to the measurement strategy corresponding to the target subject to obtain a measurement benchmark value to be checked; Based on the metric security policy, the metric reference value to be checked, and the metric reference value corresponding to the target subject, an access result is returned, wherein the metric security policy identifies the subject based on the identification information.

2. The method according to claim 1, characterized in that The method further comprises: Converting the original security policy for the subject to access resources into the metric security policy; wherein the original security policy identifies the subject based on the program path, and the metric security policy also includes the program name corresponding to the subject; The metric security policy is bound to the resource.

3. The method according to claim 2, characterized in that The converting the original security policy for the subject to access resources into the measured security policy comprises: Divide the code segment memory of the executable file of the specified path in the original security policy into memory blocks of fixed size, and assign index numbers to each of the memory blocks; Based on the index number, a random number sequence is obtained; Measuring the memory page labeled with the random number sequence to generate the measurement reference value; The program name corresponding to the subject, the random number sequence and the measurement reference value are used as the identification information of the subject to replace the identification information of the subject in the original security policy to obtain the measurement security policy.

4. The method according to claim 3, characterized in that The obtaining of a random number sequence based on the index number comprises: Determine the number of memory blocks that need to be measured as t; Generate t random numbers within the index number range to obtain a random number sequence.

5. The method according to claim 1, characterized in that The retrieving the target subject corresponding to the process in the subject list includes: According to the resource index, acquiring the extended attribute of the resource, wherein the extended attribute includes the subject list; According to the program name of the process, a target subject corresponding to the process is retrieved from the subject list.

6. The method according to claim 5, characterized in that The step of obtaining the extended attribute of the resource further includes: intercepting a function call for obtaining extended attributes of the resource; The subject list in the extended attribute in the return content of the call to the function is deleted.

7. The method according to claim 1, characterized in that The measurement strategy also includes a memory block index, and the memory block of the memory block index is the memory block that needs to be measured; The step of measuring the process according to the measurement strategy corresponding to the target subject to obtain the measurement reference value to be checked includes: The code segment of the process is measured according to the memory block index corresponding to the target subject to obtain the measurement reference value to be checked.

8. The method according to claim 1, characterized in that The returning the access result based on the metric security policy, the metric reference value to be checked and the metric reference value corresponding to the target subject includes: Comparing the metric reference value to be checked with the metric reference value corresponding to the target subject; If the metric reference value to be checked matches the metric reference value corresponding to the target subject, checking the access rights of the process; If the current access of the process is a subset of the access rights, then access is allowed; If the current access of the process is not a subset of the access rights, the access of the process to the file is terminated and an error message is returned.

9. An access control system, characterized in that: include: The interception module is used to intercept the process's access to resources; A retrieval module, configured to retrieve a target subject corresponding to the process and identification information corresponding to the target subject in a subject list, wherein the subject list includes subjects allowed to access the resource and identification information of the subjects, and the identification information includes a measurement strategy and a measurement reference value; A measurement module, used to measure the process according to the measurement strategy corresponding to the target subject to obtain a measurement benchmark value to be checked; A result module is used to return an access result based on a metric security policy, the metric reference value to be checked, and the metric reference value corresponding to the target subject, wherein the metric security policy identifies the subject based on the identification information.

10. An electronic device, characterized in that: include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program implements the access control method according to any one of claims 1 to 8 when executed by the processor.

11. A computer-readable storage medium, characterized in that: A computer program is stored on a computer-readable storage medium, and when the computer program is executed by a processor, the access control method according to any one of claims 1 to 8 is implemented.

12. A computer program product, characterized in that The method comprises computer instructions, which implement the access control method according to any one of claims 1 to 8 when executed by a processor.

Images