An access control method, system, device, medium and program product

Abstract

The application provides an access control method, system, device, medium and program product, the method comprising: intercepting an access operation of a process on a resource; retrieving a target subject corresponding to the process and identification information corresponding to the target subject in a subject list, the subject list comprising subjects allowed to access the resource and identification information of the subjects, the identification information comprising a measurement policy and a measurement reference value; measuring the process according to the measurement policy corresponding to the target subject to obtain a to-be-tested measurement reference value; and returning an access result based on a measurement security policy, the to-be-tested measurement reference value and the measurement reference value corresponding to the target subject, the measurement security policy identifying the subject based on the identification information. Malicious software cannot bypass the measurement security policy of the application by moving or renaming the process path, the application can effectively defend against malicious software attacks, improve security, and even if the process path is moved or renamed, the measurement security policy does not need to be updated, and the stability is higher.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of access control, and in particular, to an access control method, system, device, medium and program product. BACKGROUND

[0002] In early computer systems, resources (such as files, devices, etc.) were usually shared by a single user or a small group of users, and these systems often ran in a relatively closed and trusted environment. With the development of technology and the widespread popularity of computer applications, systems have become more open and user groups have become more diverse, which has led to a significant increase in security risks for data and resources. As the manager of computer resources, the operating system needs to effectively control access to these resources to prevent unauthorized use, data leakage, data damage and other security threats. Therefore, an access control mechanism is introduced in the operating system, which implements a security policy based on the principle of least privilege to prevent unauthorized users from accessing and modifying system resources, thereby protecting the integrity and confidentiality of the system.

[0003] With the development of access control technology, the access control mechanism has developed from a simple model to a more complex model to adapt to changing security needs and technical environments. There are mainly two access control mechanisms in modern operating systems: discretionary access control (DAC) and mandatory access control (MAC).

[0004] Discretionary access control allows the owner or designated controller of a resource to manage and control access to their resources. In the DAC model, users can assign access rights to other users according to their own judgment. Discretionary access control has always been the basic access control mechanism in operating systems due to its user-friendly security logic and simple configuration method, but its security is highly dependent on the decisions of individual users, who may inadvertently grant unsafe or unnecessary permissions, thereby introducing security risks.

[0005] Mandatory access control is an access control mechanism strictly controlled by the operating system administrator or security policy administrator to determine the access rights of users and programs to system resources (such as files, directories, network ports, etc.). In the MAC model, access rights are based on a set of mandatory rules defined by the system administrator in advance, rather than determined by the owner of the resource. This model is designed to improve data security and prevent data leakage.

[0006] The mandatory access control commonly used in modern operating systems includes SELinux and Apparmor. SELinux determines whether to allow a specific access by comparing the security context of a subject and an object. The structure and policy configuration of SELinux are very complex and are not suitable for use in some general scenarios. Apparmor mainly defines its security policy through a path-based configuration file, allowing system administrators to control which files and directories a program can access and which operations (read, write, and execute) they can perform. However, the security policy of Apparmor is based on file paths, which is difficult to defend against malware attacks. Malware can easily bypass the security policy by moving or renaming, and the security is poor. SUMMARY

[0007] Embodiments of the present application provide an access control method, system, device, medium and program product to solve the problem of insufficient security of the existing path-based configuration access control method.

[0008] To solve the above technical problems, the present application is implemented as follows:

[0009] In a first aspect, the embodiments of the present application provide an access control method, comprising:

[0010] Intercepting an access operation of a process on a resource;

[0011] Retrieving a target subject corresponding to the process and identification information corresponding to the target subject in a subject list, wherein the subject list includes subjects allowed to access the resource and identification information of the subjects, and the identification information includes a measurement policy and a measurement reference value;

[0012] Measuring the process according to the measurement policy corresponding to the target subject to obtain a to-be-tested measurement reference value;

[0013] Returning an access result based on a measurement security policy, the to-be-tested measurement reference value, and the measurement reference value corresponding to the target subject, wherein the measurement security policy identifies the subject based on the identification information.

[0014] Optionally, the method further comprises:

[0015] Converting an original security policy of the subject accessing the resource into the measurement security policy, wherein the original security policy identifies the subject based on a program path, and the measurement security policy further includes a program name corresponding to the subject;

[0016] Binding the measurement security policy to the resource. Optionally, the converting the original security policy of the subject accessing the resource into the measurement security policy comprises:

[0017] divide the code segment of the executable file of the specified path in the original security policy into memory blocks of fixed size, and index each memory block;

[0018] obtain a random number sequence based on the index number;

[0019] measure the memory page with the random number sequence as the label to generate the measurement reference value;

[0020] replace the identification information of the subject in the original security policy with the program name corresponding to the subject, the random number sequence, and the measurement reference value as the identification information of the subject to obtain the measurement security policy.

[0021] Optionally, the obtaining of the random number sequence based on the index number comprises:

[0022] determining the number of memory blocks that need to be measured as t;

[0023] generating t random numbers within the range of the index number to obtain the random number sequence.

[0024] Optionally, the searching for the target subject corresponding to the process in the subject list comprises:

[0025] obtaining the extended attribute of the resource according to the resource index, wherein the subject list is included in the extended attribute;

[0026] searching for the target subject corresponding to the process in the subject list according to the program name of the process.

[0027] Optionally, the obtaining of the extended attribute of the resource further comprises:

[0028] intercepting the function call for obtaining the extended attribute of the resource;

[0029] deleting the subject list in the extended attribute in the return content of the function call.

[0030] Optionally, the measurement policy further comprises a memory block index, and the memory block of the memory block index is the memory block that needs to be measured.

[0031] The measurement of the process according to the measurement policy corresponding to the target subject to obtain the to-be-checked measurement reference value comprises:

[0032] measuring the code segment of the process according to the memory block index corresponding to the target subject to obtain the to-be-checked measurement reference value.

[0033] Optionally, the access result is returned based on the metric security policy, the to-be-inspected metric reference value, and the metric reference value corresponding to the target subject, and the access result comprises:

[0034] The to-be-inspected metric reference value is compared with the metric reference value corresponding to the target subject.

[0035] If the to-be-inspected metric reference value matches the metric reference value corresponding to the target subject, the access permission of the process is checked.

[0036] If the current access of the process is a subset of the access permission, the access is allowed.

[0037] If the current access of the process is not a subset of the access permission, the access of the process to the file is terminated, and error information is returned.

[0038] In a second aspect, an embodiment of the present application provides an access control system, comprising:

[0039] An interception module is configured to intercept an access operation of a process to a resource.

[0040] A retrieval module is configured to retrieve a target subject corresponding to the process and identification information corresponding to the target subject in a subject list, wherein the subject list comprises subjects allowed to access the resource and identification information of the subjects, and the identification information comprises a metric policy and a metric reference value.

[0041] A metric module is configured to perform metric on the process according to the metric policy corresponding to the target subject, to obtain a to-be-inspected metric reference value.

[0042] A result module is configured to return an access result based on a metric security policy, the to-be-inspected metric reference value, and the metric reference value corresponding to the target subject, and the metric security policy identifies the subject based on the identification information.

[0043] Optionally, the access control system further comprises:

[0044] A conversion module is configured to convert an original security policy of the subject accessing the resource into the metric security policy, wherein the original security policy identifies the subject based on a program path, and the metric security policy further comprises a program name corresponding to the subject.

[0045] The metric security policy is bound to the resource.

[0046] Optionally, the conversion module comprises:

[0047] a replacing module, configured to divide a code segment of an executable file of a specified path in the original security policy into memory blocks of a fixed size, and index each of the memory blocks;

[0048] based on the index number, obtain a random number sequence;

[0049] measure a memory page with a label of the random number sequence to generate the measurement reference value;

[0050] replace identification information of the subject in the original security policy with the program name corresponding to the subject, the random number sequence and the measurement reference value as identification information of the subject to obtain the measurement security policy.

[0051] Optionally, the replacing module comprises:

[0052] a random number module, configured to determine that the number of memory blocks to be measured is t;

[0053] generate t random numbers in the index number range to obtain the random number sequence.

[0054] Optionally, the searching module comprises:

[0055] an extending module, configured to obtain an extended attribute of the resource according to a resource index, wherein the extended attribute comprises the subject list;

[0056] search for a target subject corresponding to the process in the subject list according to the program name of the process.

[0057] Optionally, the searching module further comprises:

[0058] a deleting module, configured to intercept a function call for obtaining the extended attribute of the resource;

[0059] delete the subject list in the extended attribute in return content of the function call.

[0060] Optionally, the measurement strategy further comprises a memory block index, and the memory block of the memory block index is the memory block to be measured.

[0061] the measurement module comprises:

[0062] a measurement sub-module, configured to measure the code segment of the process according to the memory block index corresponding to the target subject to obtain the to-be-checked measurement reference value.

[0063] Optionally, the result module comprises:

[0064] a result sub-module, configured to compare the to-be-checked measurement reference value and the measurement reference value corresponding to the target subject.

[0065] If the metric reference value to be detected and the metric reference value corresponding to the target subject match, checking the access permission of the process;

[0066] If the current access of the process is a subset of the access permission, allowing the access;

[0067] If the current access of the process is not a subset of the access permission, terminating the access of the process to the file and returning error information.

[0068] In a third aspect, an electronic device is provided, which includes a processor, a memory, and a program stored in the memory and executable on the processor, and when the program is executed by the processor, the steps of the access control method according to the first aspect are implemented.

[0069] In a fourth aspect, a computer readable storage medium is provided, which stores a computer program, and when the computer program is executed by a processor, the steps of the access control method according to the first aspect are implemented.

[0070] In a fifth aspect, a computer program product is provided, which includes computer instructions, and when the computer instructions are executed by a processor, the steps of the access control method according to the first aspect are implemented.

[0071] In the present application, the access operation of a process to a resource is intercepted, a target subject corresponding to the process is searched in a subject list, and identification information corresponding to the target subject is searched, wherein the subject list includes subjects allowed to access the resource and identification information of the subjects, and the identification information includes a metric policy and a metric reference value; the process is measured according to the metric policy corresponding to the target subject, and a to-be-detected metric reference value is obtained; and an access result is returned based on a metric security policy, the to-be-detected metric reference value, and the metric reference value corresponding to the target subject, and the metric security policy identifies the subject based on the identification information. Different from the security policy based on a program path in the prior art, in the present application, after the access operation of the process to the resource is intercepted, the process is measured according to the metric policy corresponding to the target subject corresponding to the process, and the access result is determined based on the to-be-detected metric reference value obtained by the measurement, the metric security policy, and the metric reference value corresponding to the target subject. Malicious software cannot bypass the metric security policy by moving or renaming the process path, and can effectively defend against malicious software attacks, effectively improve security, and even if the process path is moved or renamed, the metric security policy does not need to be updated, and the stability is higher. BRIEF DESCRIPTION OF DRAWINGS

[0072] Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments with reference made to the accompanying drawings. The drawings are for purposes of illustration only and are not intended to be limiting in

[0073] Figure 1 is a flow chart of an access control method provided by an embodiment of the present application;

[0074] Figure 2 is a schematic diagram of an access control architecture provided by an embodiment of the present application;

[0075] Figure 3 is a structural schematic diagram of an access control system provided by an embodiment of the present application;

[0076] Figure 4 is a structural schematic diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0077] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0078] The commonly used mandatory access control mechanisms in the prior art mainly include the following two schemes: scheme 1) subject trust verification method based on metrics, including loading metrics and real-time metrics in runtime; and scheme 2) access control scheme based on Apparmor mechanism, which defines its security policy through a path-based configuration file, and each security policy entry specifies a file path and corresponding access permission.

[0079] However, scheme 1) needs to rely on the traditional mandatory access control mechanism, and its working principle is to measure the memory of a process after checking by the traditional mandatory access control mechanism, so as to solve the memory tampering problem of the process during loading and after loading. Therefore, this scheme only verifies the subject, and does not involve the security policy design of the subject accessing the object, and is not a complete mandatory access control scheme. Moreover, this scheme measures the code segment and immutable data area of a program in full amount, which firstly has a large amount of data to be measured, and secondly, due to the characteristics of physical memory delay allocation, this method further leads to performance reduction and increases the usage amount of physical memory, and therefore is unacceptable in the performance-sensitive resource access control stage.

[0080] The Apparmor mechanism of Scheme 2 mainly defines its security policy through path-based configuration files, each policy entry specifies a file path and corresponding access permission, as shown in the following code:

[0081] / bin / ls{

[0082] / etc / *r,

[0083] / var / log / ls.log w,

[0084] }

[0085] In this embodiment, a configuration file is defined for the / bin / ls command, allowing it to read all files in the / etc / directory and write to / var / log / ls.log.

[0086] However, the above security policy is based on file paths, and if the file is moved or renamed, the related policy may need to be updated accordingly; and the security policy based on file paths is difficult to defend against malware attacks, and malware can easily bypass the security policy by moving or renaming.

[0087] The essence of the shortcomings of the above two schemes is that the file path cannot accurately reflect the security attributes of the file, and the same malware can be moved and renamed in multiple paths, and legitimate software may also be moved and renamed at will, which cannot be handled by the security policy based on file paths.

[0088] Therefore, please refer to Figure 1 The embodiment of the present application provides an access control method, comprising:

[0089] Step 11: intercepting an access operation of a process on a resource;

[0090] Step 12: searching for a target subject corresponding to the process and identification information corresponding to the target subject in a subject list, wherein the subject list comprises subjects allowed to access the resource and identification information of the subjects, and the identification information comprises a measurement policy and a measurement reference value;

[0091] Step 13: measuring the process according to the measurement policy corresponding to the target subject to obtain a to-be-tested measurement reference value;

[0092] Step 14: returning an access result based on a measurement security policy, the to-be-tested measurement reference value and the measurement reference value corresponding to the target subject, wherein the measurement security policy identifies the subject based on the identification information.

[0093] Optionally, the returned access result can include whether the subject of the access is consistent with and has corresponding access rights. When a process accesses a file, the access operation of the process to the resource is intercepted, the related calling functions such as open, read, write, and close are intercepted, the process is measured according to a measurement policy, and it is determined whether the process has read, write, or execution access rights of the file according to the to-be-inspected measurement reference value, the measurement reference value corresponding to the target subject, and the measurement security policy.

[0094] In the present application, the access operation of a process to a resource is intercepted, a target subject corresponding to the process is searched in a subject list, and identification information corresponding to the target subject is searched, wherein the subject list includes subjects allowed to access the resource and identification information of the subjects, and the identification information includes a measurement policy and a measurement reference value; the process is measured according to the measurement policy corresponding to the target subject to obtain a to-be-inspected measurement reference value; and an access result is returned based on a measurement security policy, the to-be-inspected measurement reference value, and the measurement reference value corresponding to the target subject, wherein the measurement security policy identifies the subject based on the identification information. Unlike the security policy based on a program path in the prior art, in the embodiments of the present application, after the access operation of a process to a resource is intercepted, the process is measured according to the measurement policy corresponding to the target subject corresponding to the process, and the access result is determined based on the to-be-inspected measurement reference value obtained by measurement, the measurement security policy, and the measurement reference value corresponding to the target subject. Malicious software cannot bypass the measurement security policy by moving or renaming the process path, and can effectively defend against malicious software attacks, effectively improve security, and even if the process path is moved or renamed, the measurement security policy does not need to be updated, and the stability is higher.

[0095] A security policy is composed of a subject, an object, and a behavior. In the embodiments of the present application, the program name, the measurement policy, and the measurement reference value are used as the subject, please refer to Figure 2 Optionally, in some embodiments, in order to implement each embodiment in the access control method of the present application, the present application further provides an overall architecture of access control, wherein each functional module includes a security policy conversion module, a security policy loading module, and a security policy checking module. Optionally, based on the Linux Security Modules (LSM) mechanism in the kernel, the file access operation of a process is intercepted.

[0096] Optionally, in some embodiments, the overall access control process can also be divided into a security policy conversion phase (for converting the original security policy into the metric security policy in the present application), a security policy loading phase (for reorganizing the metric security policy in the present application), and a security policy checking phase (for access control based on the metric security policy in the present application). The access control process in the above embodiments can be performed by a security policy checking module.

[0097] In the security policy configuration phase, the original security policy is converted into the metric security policy in the present application. Specifically:

[0098] Optionally, in some embodiments, the method further comprises:

[0099] converting the original security policy of the subject accessing the resource into the metric security policy; wherein the original security policy identifies the subject based on a program path, and the metric security policy further contains a program name corresponding to the subject;

[0100] binding the metric security policy with the resource. Optionally, the embodiments of the present application can be performed by a security policy conversion module, which functions to convert the path-based security policy P1 (original security policy) into the metric security policy P2 (metric security policy) based on the metric policy and the metric value benchmark.

[0101] binding the metric security policy with the resource by a security policy loading module.

[0102] In the embodiments of the present application, the original security policy identifying the subject based on the program path is converted into the metric security policy taking {program name, metric policy, metric value benchmark} as the subject identification, which is more secure than the security policy based on the program path; and the identification information is more reasonable, only including the program name for retrieval, the metric policy for metric, and the metric value benchmark for comparison, with less information quantity, less information quantity of each subject entry, and faster processing speed.

[0103] Further, the present application starts from the nature of the file when formulating the security policy. Whether a file is malicious is obviously determined by its executable code area. Therefore, optionally, the conversion of the original security policy of the subject accessing the resource into the metric security policy comprises:

[0104] dividing the code segment memory of the executable file of the specified path in the original security policy into fixed-size memory blocks, and indexing and numbering each of the memory blocks;

[0105] obtaining a random number sequence based on the index number;

[0106] measure the memory page with the label of the random number sequence to generate the measurement reference value;

[0107] replace the subject identification information in the original security policy with the program name corresponding to the subject, the random number sequence and the measurement reference value as the subject identification information of the subject to obtain the measurement security policy.

[0108] Optionally, the random number sequence is obtained based on the index number, and the method comprises the following steps of:

[0109] determining the number of memory blocks that need to be measured as t;

[0110] generating t random numbers in the index number range to obtain a random number sequence.

[0111] Optionally, the above embodiment is explained by the following specific embodiment in the security policy conversion stage:

[0112] 1) reading the executable file of the specified path in the original security policy, obtaining the start address and end address of the code by parsing, and determining the code segment memory size M;

[0113] 2) dividing the memory into blocks of a fixed size, for example, 128 bytes, and numbering each block (1, 2, 3, 4... n);

[0114] 3) determining the number of blocks to be measured as t according to the security requirement and performance requirement, and ensuring that the performance of the t number of blocks measured in the access control process still meets the requirement;

[0115] 4) generating t random numbers (n0, n1... nt) in the range of 1 to n;

[0116] 5) measuring the memory page with the label of (n0, n1... nt) to generate the measurement reference value Ref;

[0117] 6) replacing the subject identification information in the security policy P1 with {program name, (n0, n1... nt), Ref} as the new subject identification information to form a new security policy (P2) (measurement security policy).

[0118] Optionally, in the embodiment of the application, the executable file code segment memory is measured by introducing random numbers, the memory data that needs to be accessed in the access control check process is reduced, the performance of the access control is greatly improved, the balance between performance and security can be achieved, malicious software can be effectively avoided to bypass the measurement security policy, the security is effectively enhanced, and the overall performance is improved.

[0119] Optionally, in some embodiments, the security policy is reorganized in the security policy loading stage, taking the resource file name as the unique identifier, and the subjects having access to the resource file are organized in a hash table, taking the program name as the key value of the hash table, so that the relevant subject entry can be quickly retrieved when the file access is intercepted.

[0120] Optionally, in some embodiments, the subject list is set in the extended attribute (security.measure) of the file, and in the security policy checking stage, the extended attribute is obtained according to the file index, the subject entry in the extended attribute is obtained according to the program name, and the program is measured according to the subject entry and the subsequent benchmark value checking and permission checking.

[0121] Optionally, in some embodiments, the retrieving the target subject corresponding to the process in the subject list comprises:

[0122] According to the resource index, the extended attribute of the resource is obtained, wherein the subject list is included in the extended attribute;

[0123] According to the program name of the process, the target subject corresponding to the process is retrieved in the subject list.

[0124] Optionally, the extended attribute of the resource file is obtained according to the index of the resource file, and the extended attribute saves the subject list that can access the resource file, and each subject contains the program name, the block index to be measured, and the benchmark value.

[0125] Optionally, the security policy can be bound to the resource in the form of an extended attribute through a security policy loading module.

[0126] Optionally, the obtaining the extended attribute of the resource further comprises:

[0127] Intercepting the function call for obtaining the extended attribute of the resource;

[0128] Deleting the subject list in the extended attribute in the return content of the function call.

[0129] Optionally, in some embodiments, in the security policy checking stage, the security policy checking module also needs to intercept the function call for obtaining the extended attribute, and delete the content of the security.measure extended attribute in the return content, so as to hide the measurement policy information and prevent malicious attacks from arranging binary codes according to the measurement policy to bypass the access control mechanism.

[0130] Optionally, the measurement policy further comprises a memory block index, and the memory block of the memory block index is a memory block to be measured.

[0131] The process is measured according to the metric policy corresponding to the target subject, and a to-be-inspected metric reference value is obtained.

[0132] The code segment of the process is measured according to the memory block index corresponding to the target subject, and the to-be-inspected metric reference value is obtained.

[0133] Optionally, the corresponding target subject is retrieved according to the program name of the current process, and the code segment of the process is measured according to the block index to be measured. Optionally, the to-be-inspected metric reference value obtained after measurement is compared with the metric reference value of the target subject.

[0134] Optionally, the access result is returned based on the metric security policy, the to-be-inspected metric reference value, and the metric reference value corresponding to the target subject, and the access result includes:

[0135] The to-be-inspected metric reference value is compared with the metric reference value corresponding to the target subject.

[0136] If the to-be-inspected metric reference value matches the metric reference value corresponding to the target subject, the access permission of the process is checked.

[0137] If the current access of the process is a subset of the access permission, the access is allowed.

[0138] If the current access of the process is not a subset of the access permission, the access of the process to the file is terminated, and error information is returned.

[0139] Optionally, if the to-be-inspected metric reference value does not match the metric reference value corresponding to the target subject, the access to the file is terminated. The metric security policy further includes a behavior, that is, the subject is allowed to perform an access operation (access permission) on the object (resource), such as reading, writing, and executing. Therefore, if the to-be-inspected metric reference value matches the metric reference value corresponding to the target subject, the access permission is further checked. If the current access is a subset of the access permission, the access is allowed. Otherwise, the access to the file is terminated, and error information is returned.

[0140] Overall, in some embodiments, in the security policy conversion stage, the original security policy P1 identifying the subject by the program path is modified to the security policy P2 identifying the subject by {program name, block index (n0, n1... nt), metric reference value Ref}. In the original security policy, the code segment memory of the executable file specified by the path is divided into blocks of a fixed size, each block is indexed and numbered, and the corresponding metric reference value Ref is set based on the principle of random number.

[0141] In some embodiments, in the security policy checking phase, when the process accesses the file is intercepted, the extended attribute of the file is obtained according to the file index, the extended attribute stores a list of subjects that can access the file, each subject contains {program name, block index and metric reference value Ref}, the corresponding subject is retrieved according to the program name of the current process, and the code segment of the process is measured according to the block index, and the reference value obtained after the measurement is compared with the metric reference value Ref of the subject to determine whether the process has the corresponding access right.

[0142] Based on the above embodiments, the malicious software can be prevented from bypassing the measurement security policy by moving or renaming the process path, the security can be effectively improved, and even if the process path is moved or renamed, the measurement security policy does not need to be updated, and the stability is higher.

[0143] For reference Figure 3 The embodiments of the present application also provide an access control system 20, comprising:

[0144] An interception module 21 is configured to intercept an access operation of a process on a resource;

[0145] A retrieval module 22 is configured to retrieve a target subject corresponding to the process and identification information corresponding to the target subject in a subject list, wherein the subject list includes subjects allowed to access the resource and identification information of the subjects, and the identification information includes a measurement policy and a metric reference value;

[0146] A measurement module 23 is configured to measure the process according to the measurement policy corresponding to the target subject to obtain a to-be-inspected metric reference value;

[0147] A result module 24 is configured to return an access result based on a measurement security policy, the to-be-inspected metric reference value and the metric reference value corresponding to the target subject, and the measurement security policy identifies the subject based on the identification information.

[0148] Optionally, the access control system 20 further comprises:

[0149] A conversion module is configured to convert an original security policy of the subject accessing the resource into the measurement security policy; wherein the original security policy identifies the subject based on a program path, and the measurement security policy further includes a program name corresponding to the subject;

[0150] The measurement security policy is bound to the resource.

[0151] Optionally, the conversion module comprises:

[0152] a replacing module, configured to divide a code segment of an executable file of a specified path in the original security policy into memory blocks of a fixed size, and index each of the memory blocks;

[0153] based on the index number, obtain a random number sequence;

[0154] measure a memory page with a label of the random number sequence to generate the measurement reference value;

[0155] replace identification information of the subject in the original security policy with the program name corresponding to the subject, the random number sequence and the measurement reference value as identification information of the subject to obtain the measurement security policy.

[0156] Optionally, the replacing module comprises:

[0157] a random number module, configured to determine that the number of memory blocks to be measured is t;

[0158] generate t random numbers in the index number range to obtain the random number sequence.

[0159] Optionally, the searching module 22 comprises:

[0160] an extending module, configured to obtain an extended attribute of the resource according to a resource index, wherein the subject list is included in the extended attribute;

[0161] search for a target subject corresponding to the process in the subject list according to the program name of the process.

[0162] Optionally, the searching module 22 further comprises:

[0163] a deleting module, configured to intercept a function call for obtaining the extended attribute of the resource;

[0164] delete the subject list in the extended attribute in return content of the function call.

[0165] Optionally, the measurement strategy further comprises a memory block index, and the memory block of the memory block index is the memory block to be measured.

[0166] the measurement module 23 comprises:

[0167] a measurement sub-module, configured to measure the code segment of the process according to the memory block index corresponding to the target subject to obtain the to-be-tested measurement reference value.

[0168] Optionally, the result module 24 comprises:

[0169] a result sub-module, configured to compare the to-be-tested measurement reference value with the measurement reference value corresponding to the target subject.

[0170] If the measurement benchmark value to be inspected matches the measurement benchmark value corresponding to the target subject, the access rights of the process are checked.

[0171] If the process's current access is a subset of the access permissions, then access is permitted;

[0172] If the process's current access is not a subset of the access permissions, terminate the process's access to the file and return an error message.

[0173] The access control system 20 provided in this embodiment can achieve... Figure 1 The various processes implemented in the method embodiments achieve the same technical effect, and will not be described again here to avoid repetition.

[0174] This application provides an electronic device 30, see [link to relevant documentation] Figure 4 As shown, Figure 4 This is a schematic block diagram of an electronic device 30 according to an embodiment of this application, including a processor 31, a memory 32, and a program or instructions stored in the memory 32 and executable on the processor 31. When the program or instructions are executed by the processor, they implement the steps in any access control method of this application.

[0175] This application provides a readable storage medium on which a program or instruction is stored. When the program or instruction is executed by a processor, it implements the various processes of the access control method embodiments described above and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0176] Computer-readable media include both permanent and non-permanent, removable and non-removable media, which can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0177] The embodiment of the application further provides a computer program product comprising computer instructions, which, when executed by a processor, implement the above-mentioned Figure 1 The embodiment of the access control method of any one of the above-mentioned processes, and the same technical effects can be achieved, to avoid repetition, which will not be described here.

[0178] It should be noted that in this paper, the term "including", "containing" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed, or includes elements inherent to such process, method, article or device. Without more limitations, the element defined by the sentence "including a" does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0179] It should be noted that in the technical solution of the present disclosure, the collection, collection, update, analysis, processing, use, transmission, storage and other aspects of user personal information are in line with relevant laws and regulations, are used for legal purposes, and do not violate public order and good customs. Necessary measures are taken to prevent illegal access to user personal information data, and to maintain user personal information security and network security.

[0180] The above-mentioned serial numbers of the embodiments of the application are only for description, not representing the advantages and disadvantages of the embodiments.

[0181] From the above description of the embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment method can be realized by means of software and necessary general hardware platform, of course, it can also be realized by hardware, but in many cases the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes a plurality of instructions for making a service classification device (which can be a mobile phone, computer, server, air conditioner or network device) execute the method described in each embodiment of the present application.

[0182] The above-mentioned only is the preferred embodiment of the present application, it should be pointed out, for those skilled in the art, without departing from the principle of the present application, can make a number of improvements and refinements, these improvements and refinements should be regarded as the protection scope of the present application.

Claims

1. An access control method characterized by, The method comprises: intercepting an access operation of a process to a resource; retrieving a target subject corresponding to the process in a subject list, and identification information corresponding to the target subject, wherein the subject list comprises subjects allowed to access the resource and identification information of the subjects, and the identification information comprises a measurement policy and a measurement reference value; measuring the process according to the measurement policy corresponding to the target subject to obtain a to-be-inspected measurement reference value; returning an access result based on a measurement security policy, the to-be-inspected measurement reference value, and the measurement reference value corresponding to the target subject, wherein the measurement security policy identifies the subject based on the identification information; The method further comprises: converting an original security policy of the subject accessing the resource into the measurement security policy, wherein the original security policy identifies the subject based on a program path, and the measurement security policy further comprises a program name corresponding to the subject; binding the measurement security policy to the resource; The conversion of the original security policy of the subject accessing the resource into the measurement security policy comprises: dividing a code segment of an executable file of a specified path in the original security policy into memory blocks of a fixed size, and indexing and numbering each memory block; obtaining a random number sequence based on the index number; measuring a memory page with a label of the random number sequence to generate the measurement reference value; replacing identification information of the subject in the original security policy with a program name corresponding to the subject, the random number sequence, and the measurement reference value as identification information of the subject to obtain the measurement security policy.

2. The method of claim 1, wherein, The obtaining of the random number sequence based on the index number comprises: determining that the number of memory blocks to be measured is t; generating t random numbers in the range of the index number to obtain a random number sequence.

3. The method of claim 1, wherein, The retrieval of the target subject corresponding to the process in the subject list comprises: obtaining an extended attribute of the resource according to a resource index, wherein the extended attribute comprises the subject list; retrieving the target subject corresponding to the process in the subject list according to a program name of the process.

4. The method of claim 3, wherein, The obtaining of the extended attribute of the resource further comprises: intercepting a function call for obtaining the extended attribute of the resource; deleting the subject list in the extended attribute in return content of the function call.

5. The method of claim 1, wherein, The measurement policy further comprises a memory block index, and the memory block of the memory block index is a memory block to be measured. The measurement of the process according to the measurement policy corresponding to the target subject to obtain the to-be-inspected measurement reference value comprises: measuring a code segment of the process according to the memory block index corresponding to the target subject to obtain the to-be-inspected measurement reference value.

6. The method of claim 1, wherein, The returning of the access result based on the measurement security policy, the to-be-inspected measurement reference value, and the measurement reference value corresponding to the target subject comprises: comparing the to-be-inspected measurement reference value with the measurement reference value corresponding to the target subject; checking an access right of the process if the to-be-inspected measurement reference value matches the measurement reference value corresponding to the target subject; if the current access of the process is a subset of the access permission, then the access is allowed; if the current access of the process is not a subset of the access permission, then the access of the process to the file is terminated and an error message is returned.

7. An access control system characterized by, The method comprises the following steps: intercepting the access operation of the process to the resource; retrieving a target subject corresponding to the process and identification information corresponding to the target subject in a subject list, wherein the subject list comprises subjects allowed to access the resource and identification information of the subjects, and the identification information comprises a measurement policy and a measurement reference value; measuring the process according to the measurement policy corresponding to the target subject to obtain a to-be-tested measurement reference value; returning an access result based on a measurement security policy, the to-be-tested measurement reference value and the measurement reference value corresponding to the target subject, wherein the measurement security policy identifies the subject based on the identification information; The method further comprises the following steps: converting an original security policy of the subject accessing the resource into the measurement security policy, wherein the original security policy identifies the subject based on a program path, and the measurement security policy further comprises a program name corresponding to the subject; and binding the measurement security policy to the resource. The conversion module comprises the following steps: dividing a code segment of an executable file of a specified path in the original security policy into memory blocks of a fixed size, and indexing and numbering each memory block; obtaining a random number sequence based on the index number; measuring a memory page with a label of the random number sequence to generate the measurement reference value; 8. An electronic device, comprising: replacing identification information of the subject in the original security policy with identification information of the subject, which comprises the program name corresponding to the subject, the random number sequence and the measurement reference value, to obtain the measurement security policy. The method comprises the following steps:

9. A computer-readable storage medium, characterized in that, a processor, a memory and a program stored on the memory and executable on the processor, wherein the program is executed by the processor to implement the access control method according to any one of claims 1 to 6.

10. A computer program product, characterised in that, A computer program is stored on a computer readable storage medium, and the computer program is executed by a processor to implement the access control method according to any one of claims 1 to 6. Computer instructions are included, and the computer instructions are executed by a processor to implement the access control method according to any one of claims 1 to 6.

Images