Application access control method and device based on system call limitation and storage medium

Abstract

The invention provides an application access control method based on system call limitation, relates to the technical field of network security, and provides an application behavior learning module and an application authority control module. The application behavior learning module executes the following steps: A1, creating an application behavior list; a2, dynamic training monitoring: training and monitoring each item of content in the application behavior list; a3, generating a mapping table, and establishing a mapping relation between each item of content in the application behavior list and system calling; the application authority control module executes the following steps: B1, user authorization application: initiating an application access request to an authorization center; b2, authorization approval: after receiving the application access request, the authorization center authorizes the application as required; and B3, issuing the authority. According to the method, the granularity of authority management is refined, the exposure surface of the application is reduced, enterprises are guaranteed, the malicious behavior risk is reduced, the system security and data privacy are protected, and the overall security is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an application access control method, device and storage medium based on system call restriction. Background Art

[0002] Application access control technology is a method to limit users' access to system resources and functions of applications by defining and implementing access policies to protect system security and data privacy. It is of great significance in the identity authorization of enterprise network and system security. Existing application control technologies such as RBAC and ABAC have solved the problems related to access control to a certain extent, but they still have some shortcomings when facing complex application environments and advanced threats.

[0003] RBAC has limited control granularity and mainly authorizes based on the relationship between roles and permissions. This static authorization model is difficult to cope with dynamically changing access requirements, especially in complex application environments. The definition of roles may be too general and cannot meet the requirements of fine-grained access control.

[0004] Although ABAC introduces more attributes, it has challenges in policy management and complexity management. The definition and management of attributes may become complicated, requiring the maintenance of a large number of attribute rules and policies, which increases the complexity and management cost of the system.

[0005] In addition, existing application access control technologies often have difficulty preventing unknown security issues, especially threats from vulnerabilities in the operating system kernel. Traditional technologies mainly defend against known security policies and rules, and cannot effectively deal with new attacks and unknown security vulnerabilities. The operating system kernel is the basis for providing application functions. Once a vulnerability occurs in the kernel, it is very likely to break the control isolation by exploiting the kernel vulnerability, causing problems such as unauthorized access by the application. Summary of the invention

[0006] The present application provides an application access control method, device and storage medium based on system call restriction to at least solve the above technical problems existing in the prior art.

[0007] According to a first aspect of the present application, there is provided an application access control method based on system call restriction, providing an application behavior learning module and an application permission control module; The applied behavioral learning module performs the following steps: A1, create an application behavior list; A2, dynamic training monitoring, training and monitoring for each item in the application behavior list; A3, generating a mapping table, establishing a mapping relationship between each item in the application behavior list and the system call; The application permission control module performs the following steps: B1, user authorization application, initiates application access request to the authorization center; B2, authorization and approval. After receiving the application access request, the authorization center authorizes the application according to the requirements; B3, authority is issued.

[0008] In certain embodiments of the first aspect of the present application, the application behavior list includes: creation, deletion, modification of a database; creation, deletion, modification, query, insertion of a data table; connection and synchronization of a database.

[0009] In certain embodiments of the first aspect of the present application, the method of dynamic training monitoring is as follows: First, open the monitoring program, then start the program, perform manual training, stop monitoring after the training is completed, and analyze the results.

[0010] In certain embodiments of the first aspect of the present application, in B2, the authorization is divided into dual authorization, including the user's access rights to the application and the application's access rights to the system call.

[0011] In certain embodiments of the first aspect of the present application, the dual authorization method is as follows: the authorization center first grants the user's MySQL application available permissions, and then authorizes the MySQL application to only call and The system calls in .

[0012] In certain embodiments of the first aspect of the present application, the authorization of the system call is performed using seccomp, combined with BPF to implement filtering of designated system calls.

[0013] According to a second aspect of the present application, an electronic device is provided, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method described in the present application.

[0014] According to a third aspect of the present application, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute the method described in the present application.

[0015] Compared with the prior art, this application has the following beneficial effects: 1. This application controls access to applications by restricting system calls, and establishes a double-layer control mechanism. Access communications from user layer to user layer and from user layer to kernel layer are restricted within a controllable range.

[0016] 2. This application obtains system calls by learning application behavior, simulating the user's actual operation scenario, and can capture system calls more accurately, establish a mapping between application behavior and system calls, and control user behavior.

[0017] 3. This application further refines the granularity of permission management, reduces the exposure of applications, protects enterprises, reduces the risk of malicious behavior, protects system security and data privacy, and improves overall security.

[0018] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present application, nor is it intended to limit the scope of the present application. Other features of the present application will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] By reading the detailed description below with reference to the accompanying drawings, the above and other purposes, features and advantages of the exemplary embodiments of the present application will become readily understood. In the accompanying drawings, several embodiments of the present application are shown in an exemplary and non-limiting manner, wherein: In the drawings, the same or corresponding reference numerals represent the same or corresponding parts.

[0020] Figure 1 The overall framework diagram of the first embodiment of the present application is shown.

[0021] Figure 2 A schematic diagram of dynamic training of application behavior according to the first embodiment of the present application is shown.

[0022] Figure 3 The application permission control flow chart of the first embodiment of the present application is shown.

[0023] Figure 4 A schematic diagram of the structure of an electronic device according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0024] In order to make the purpose, features, and advantages of the present application more obvious and easy to understand, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0025] Embodiment 1: Please refer to Figure 1 ,This embodiment 1 provides an application access control method based on system call restriction, providing an application behavior learning module and an application permission control module; 1. Applied Behavioral Learning Module Application access control based on call restrictions needs to know which system calls the application needs to call when performing certain specific tasks. Taking the Linux operating system as an example, the number of system calls supported by the Linux kernel version 5.15.75 is 347. By default, the program has the right to call all system calls, but the program will obviously not use all system calls when it is actually executed. Taking the database mysql as an example, when users view or run mysql data tables, they often need to call system calls such as , to operate database files, but they do not need to call to set the scheduling parameters of the process, nor do they need to use system calls related to network communication, such as . In fact, it only takes no more than 90 system calls to execute all the functions of mysql (different operating system call versions are different).

[0026] The best practice principle in security is the Principle of Least Privilege (PLP), which stipulates that any module (application, process, etc.) should only be granted the necessary privileges to perform its functions. Ideally, an application should have the minimum resource access rights that can meet its own functional conditions. System calls, as one of the most important resources of the Linux kernel, should also be subject to access restrictions. This module monitors the specific execution process of the application and dynamically captures the system calls used by the application at runtime as the basis for subsequent authorization of system calls to the application. The application behavior learning module mainly performs the following steps: A1, create an application behavior list; First, you need to clarify what behaviors the application has and list the application behaviors. Taking the MySQL database as an example, common operations of a database (i.e., application behaviors) include database creation, deletion, and modification; table creation, deletion, modification, query, and insertion; database connection and synchronization, etc. The function list can be customized based on the division of enterprises and user roles.

[0027] A2, dynamic training monitoring, training and monitoring are performed for each item in the application behavior list.

[0028] Then, for each item in the application behavior list, we train and monitor it, such as connecting to MySQL, viewing data tables, modifying data tables, etc. Figure 2As shown, first start the monitoring program. For the Linux operating system, you can choose tools such as strace, sysdig, and ebpf. Then start the program. Then the operator performs manual training operations. After the training operation is completed, stop monitoring and analyze the results.

[0029] A3, generate a mapping table, and establish a mapping relationship between each item in the application behavior list and the system call. An example is as follows:

[0030]

[0031]

[0032]

[0033] The following is a supplement to the specific examples of dynamic training monitoring of the content, which aims to ensure the safe and efficient operation of the MySQL database by monitoring these behaviors and to detect potential problems in a timely manner.

[0034] 1. mysql.create dynamic training monitoring instance Monitoring target: Monitor the creation of new tables in the MySQL database.

[0035] Monitoring methods: Log analysis: By analyzing MySQL log files (such as error logs and slow query logs), SQL statements related to the creation of new tables can be identified.

[0036] Trigger monitoring: Create a trigger in MySQL. When a new table is created, the trigger will record relevant information (such as table name, creation time, creator, etc.) in the log table.

[0037] Performance monitoring: Use performance monitoring tools (such as Prometheus and Grafana) to monitor database performance, especially performance indicators related to the creation of new tables (such as I / O load, CPU usage, etc.).

[0038] Dynamic Training: Model training: Based on historical data, train machine learning models to predict patterns and trends in new table creation behavior.

[0039] Anomaly detection: Use the model to detect abnormal new table creation behavior, such as frequent creation of a large number of tables, creation of tables during non-working hours, etc.

[0040] Feedback optimization: Continuously optimize monitoring strategies and model parameters based on monitoring results and model predictions.

[0041] 2. mysql.list dynamic training monitoring example Monitoring target: Monitor the query (list) behavior of tables in the MySQL database.

[0042] Monitoring methods: SQL parsing: Parse SQL query statements and identify query behaviors that list tables.

[0043] Access frequency monitoring: monitors the query frequency of the table and identifies high-frequency or low-frequency query behaviors.

[0044] User behavior analysis: Analyze the query behavior of different users and identify abnormal or malicious behavior.

[0045] Dynamic Training: Behavioral pattern learning: Learn users’ normal query behavior patterns, including query frequency, query time, etc.

[0046] Abnormal behavior detection: Use models to detect abnormal query behaviors, such as frequent queries to sensitive tables and large numbers of queries during non-working hours.

[0047] Policy adjustment: Adjust monitoring policies and permission settings based on monitoring results and user feedback.

[0048] 3. mysql.delete dynamic training monitoring example Monitoring objective: Monitor the deletion of data in the MySQL database.

[0049] Monitoring methods: SQL Audit: Audit SQL delete statements and record relevant information of the delete operation (such as table name, delete condition, delete time, etc.).

[0050] Data backup and recovery: Back up the database regularly to ensure that data can be quickly restored after being deleted.

[0051] Performance monitoring: Monitor the impact of delete operations on database performance, especially large batch delete operations.

[0052] Dynamic Training: Model training: Based on historical deletion data, train machine learning models to predict patterns and trends in deletion behavior.

[0053] Risk warning: Use models to predict potential deletion risks, such as large amounts of data being accidentally deleted or unauthorizedly deleted.

[0054] Emergency response: Develop an emergency response plan, including data recovery, permission adjustment, etc., to deal with potential deletion risks.

[0055] 4. mysql.connect dynamic training monitoring example Monitoring target: Monitor the connection behavior of the MySQL database.

[0056] Monitoring methods: Connection log analysis: Analyze MySQL connection logs to identify abnormal connection behaviors (such as frequent connection failures, unauthorized connections, etc.).

[0057] Network monitoring: Use network monitoring tools (such as Wireshark) to monitor the database network traffic and identify illegal connection requests.

[0058] User behavior analysis: Analyze the connection behavior of different users and identify abnormal or malicious behavior.

[0059] Dynamic Training: Behavioral pattern learning: Learn users’ normal connection behavior patterns, including connection frequency, connection time, etc.

[0060] Abnormal behavior detection: Use models to detect abnormal connection behaviors, such as frequent attempts to brute force password cracking, large numbers of connections during non-working hours, etc.

[0061] Security policy adjustment: Adjust security policies (such as password complexity requirements, connection restrictions, etc.) based on monitoring results and user feedback.

[0062] 2. Application permission control module According to the mapping table between application behaviors and system calls obtained above, fine-grained access control can be implemented on applications at the operating system level based on traditional application access control. Figure 3 As shown, the application permission control module mainly performs the following steps: B1, user authorization application, initiates an application access request to the authorization center: for example, a user wants access rights to MySQL to view a data table.

[0063] B2, authorization approval. After receiving the application access request, the authorization center authorizes the application according to the requirements.

[0064] The authorization center receives the request and authorizes the application according to the user's needs. The authorization is divided into two types: the user's access rights to the application and the application's access rights to the system call. The authorization center first grants the guest user's mysql application available permissions, and then authorizes the mysql application to only call and The system calls in .

[0065] The following are further examples of dual authorization: Example background: Assume that there is an enterprise-level database management system that includes an authorization center, multiple users (including guest users), a MySQL application, and a series of system calls. The authorization center is responsible for managing and assigning permissions to ensure the security and normal operation of the system.

[0066] 1. User access rights to the application Example 1: Guest user accesses MySQL application The guest user is a temporary user who needs to access the MySQL application to perform some basic database query operations. The authorization center first verifies the guest user's identity and confirms that it is a member of the user group. According to the permission configuration of the user group, the authorization center grants the guest user access to the MySQL application, but is limited to performing basic query operations (such as SELECT). After the guest user passes the identity authentication, he can log in to the system and access the MySQL application, but can only perform the query operations that are granted.

[0067] Example 2: Advanced user access to MySQL application An advanced user is a user with higher permissions who needs access to MySQL applications to perform more complex database operations. The authorization center verifies the identity of the advanced user and confirms that he or she is a member of the user group. Based on the permission configuration of the user group, the authorization center grants the advanced user access to the MySQL application, including the ability to perform query, insert, update, and delete operations (such as SELECT, INSERT, UPDATE, DELETE). After the advanced user passes the identity authentication, he or she can log in to the system and access the MySQL application to perform all the database operations granted to him or her.

[0068] 2. Application access rights to system calls Example 1: MySQL application calls basic system calls MySQL applications need to perform some basic system calls, such as file reading and writing, network connection, etc., to complete database operations. The authorization center evaluates the security and necessity of MySQL applications. Based on the evaluation results, the authorization center grants MySQL applications the authority to call basic system calls. When performing database operations, MySQL applications can call the granted system calls to complete necessary system-level operations.

[0069] Example 2: MySQL application calls restricted system calls In some cases, MySQL applications may need to call some restricted system calls, such as executing system commands, accessing sensitive files, etc. The Authorization Center conducts strict review and evaluation to ensure the necessity and security of MySQL applications calling restricted system calls. If the evaluation is passed, the Authorization Center will grant the MySQL application the permission to call restricted system calls, but will set up strict access control and audit mechanisms. When calling restricted system calls, MySQL applications need to comply with the requirements of the access control and audit mechanisms to ensure the security and compliance of operations.

[0070] In the Linux operating system, system call authorization can be performed using seccomp. Seccomp (Secure Computing Mode) is a security mechanism provided by the Linux kernel for system call restriction. It implements filtering of specified system calls by combining BPF. After authorization, unauthorized applications are prohibited from accessing any system calls, and authorized applications can only access authorized system calls.

[0071] B3, authority is issued.

[0072] After the authorization is completed, although the user is authorized by MySQL, he only has the permission to view the data table, and does not have other permissions such as modifying or creating data tables. This keeps the permission distribution to a minimum, in line with the principle of least privilege.

[0073] Embodiment 2: According to an embodiment of the present application, the present application also provides an electronic device and a readable storage medium.

[0074] Figure 4 A schematic block diagram of an example electronic device that can be used to implement an embodiment of the present application is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or required herein.

[0075] like Figure 4As shown, the device includes a computing unit, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) or a computer program loaded from a storage unit into a random access memory (RAM). In the RAM, various programs and data required for the operation of the device can also be stored. The computing unit, ROM, and RAM are connected to each other through a bus. An input / output (I / O) interface is also connected to the bus.

[0076] Multiple components in the device are connected to the I / O interface, including: input units, such as keyboards, mice, etc.; output units, such as various types of displays, speakers, etc.; storage units, such as disks, optical disks, etc.; and communication units, such as network cards, modems, wireless communication transceivers, etc. The communication unit allows the device to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunication networks.

[0077] The computing unit may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of computing units include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit performs the various methods and processes described above, such as the application access control method based on system call restrictions described in Example 1. For example, in some embodiments, the application access control method based on system call restrictions may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit. In some embodiments, part or all of the computer program may be loaded and / or installed on the device via a ROM and / or a communication unit. When the computer program is loaded into RAM and executed by the computing unit, one or more steps of the application access control method based on system call restrictions described above may be performed. Alternatively, in other embodiments, the computing unit may be configured to perform the application access control method based on system call restrictions in any other appropriate manner (e.g., by means of firmware).

[0078] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0079] The program code for implementing the method of the present application can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, implements the functions / operations specified in the flow chart and / or block diagram. The program code can be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0080] In the context of the present application, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0081] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0082] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0083] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0084] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this application can be executed in parallel, sequentially or in different orders, as long as the expected results of the technical solution of this application can be achieved, and this document is not limited here.

[0085] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0086] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. An application access control method based on system call restriction, characterized in that: Provide application behavior learning module and application permission control module; The applied behavioral learning module performs the following steps: A1, create an application behavior list; A2, dynamic training monitoring, training and monitoring for each item in the application behavior list; A3, generating a mapping table, establishing a mapping relationship between each item in the application behavior list and the system call; The application permission control module performs the following steps: B1, user authorization application, initiates application access request to the authorization center; B2, authorization and approval. After receiving the application access request, the authorization center authorizes the application according to the requirements; B3, authority is issued.

2. The application access control method based on system call restriction according to claim 1, characterized in that: The application behavior list includes: creation, deletion, modification of database; creation, deletion, modification, query, insertion of data table; connection and synchronization of database.

3. The application access control method based on system call restriction according to claim 1 or 2, characterized in that: The method of dynamic training monitoring is as follows: First, open the monitoring program, then start the program, perform manual training, stop monitoring after the training is completed, and analyze the results.

4. The application access control method based on system call restriction according to claim 1, characterized in that: In B2, the authorization is divided into dual authorization, including the user's access rights to the application and the application's access rights to the system call.

5. The application access control method based on system call restriction according to claim 4 is characterized in that: The dual authorization method is as follows: the authorization center first grants the user's MySQL application available permissions, and then authorizes the MySQL application to only call and The system calls in .

6. The application access control method based on system call restriction according to claim 5, characterized in that: The authorization of the system call is performed using seccomp, combined with BPF to implement filtering of the specified system call.

7. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 6.

8. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to cause the computer to execute the method according to any one of claims 1 to 6.

Images