Application access control method, device and storage medium based on system call restriction

Abstract

The present application provides an application access control method based on system call restrictions, which relates to the field of network security technology and provides an application behavior learning module and an application permission control module; the application behavior learning module performs the following steps: A1, creating an application behavior list; A2, dynamic training monitoring, training and monitoring for each item in the application behavior list; A3, generating a mapping table, establishing a mapping relationship between each item in the application behavior list and the system call; the application permission control module performs the following steps: B1, user authorization application, initiating an application access request to the authorization center; B2, authorization approval, after receiving the application access request, the authorization center authorizes the application according to the requirements; B3, issuing permissions. The present application further refines the granularity of permission management, reduces the exposure of applications, protects enterprises, reduces the risk of malicious behavior, protects system security and data privacy, and improves overall security.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an application access control method, device, and storage medium based on system call restriction. Background Art

[0002] Application access control technology is a method for defining and enforcing access policies to restrict user access to application system resources and functions, thereby protecting system security and data privacy. It plays a crucial role in identity authorization for enterprise network and system security. Existing application control technologies such as RBAC and ABAC have addressed access control issues to some extent, but they still have some shortcomings when faced with complex application environments and advanced threats.

[0003] RBAC has limited control granularity, primarily authorizing users based on the relationship between roles and permissions. This static authorization model struggles to address dynamically changing access requirements, especially in complex application environments. Role definitions can be too general to meet fine-grained access control requirements.

[0004] Although ABAC introduces more attributes, it presents challenges in policy management and complexity management. Attribute definition and management can become complex, requiring the maintenance of a large number of attribute rules and policies, increasing system complexity and management costs.

[0005] Furthermore, existing application access control technologies often struggle to prevent unknown security issues, particularly threats arising from vulnerabilities in the operating system kernel. Traditional technologies primarily rely on known security policies and rules for defense, failing to effectively address new attacks and unknown security vulnerabilities. The operating system kernel serves as the foundation for application functionality. Once a kernel vulnerability exists, it is highly likely that such vulnerability could be exploited to break control isolation, potentially leading to unauthorized access by applications. Summary of the Invention

[0006] The present application provides an application access control method, device and storage medium based on system call restriction to at least solve the above technical problems existing in the prior art.

[0007] According to a first aspect of the present application, there is provided an application access control method based on system call restriction, providing an application behavior learning module and an application permission control module;

[0008] The Applied Behavioral Learning module performs the following steps:

[0009] A1, create an application behavior list;

[0010] A2, dynamic training and monitoring, training and monitoring each item in the application behavior list;

[0011] A3, generating a mapping table to establish a mapping relationship between each item in the application behavior list and the system call;

[0012] The application permission control module performs the following steps:

[0013] B1, user authorization application, initiates application access request to the authorization center;

[0014] B2, authorization and approval: after receiving the application access request, the authorization center authorizes the application according to the requirements;

[0015] B3, authority is issued.

[0016] In certain embodiments of the first aspect of the present application, the application behavior list includes: creation, deletion, and modification of a database; creation, deletion, modification, query, and insertion of a data table; and connection and synchronization of a database.

[0017] In certain embodiments of the first aspect of the present application, the method of dynamic training monitoring is as follows:

[0018] First, open the monitoring program, then start the program and perform manual training. After the training is completed, stop monitoring and analyze the results.

[0019] In certain embodiments of the first aspect of the present application, in B2, the authorization is divided into dual authorization, including the user's access rights to the application and the application's access rights to system calls.

[0020] In certain embodiments of the first aspect of the present application, the dual authorization method is as follows: the authorization center first grants the user's MySQL application available permissions, and then authorizes the MySQL application to only call and System calls in .

[0021] In certain embodiments of the first aspect of the present application, the authorization of the system call is performed using seccomp, combined with BPF to implement filtering of specified system calls.

[0022] According to a second aspect of the present application, an electronic device is provided, including:

[0023] at least one processor; and

[0024] a memory communicatively connected to the at least one processor; wherein,

[0025] The memory stores instructions that can be executed by the at least one processor. The instructions are executed by the at least one processor to enable the at least one processor to perform the method described in this application.

[0026] According to a third aspect of the present application, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute the method described in the present application.

[0027] Compared with the prior art, this application has the following beneficial effects:

[0028] 1. This application controls access to applications by restricting system calls, establishing a two-layer control mechanism. Access communications from user layer to user layer and from user layer to kernel layer are restricted within a controllable range.

[0029] 2. This application obtains system calls through application behavior learning, simulating the user's actual operation scenario, which can capture system calls more accurately, establish a mapping between application behavior and system calls, and control user behavior.

[0030] 3. This application further refines the granularity of permission management, reduces the exposure of applications, protects enterprises, reduces the risk of malicious behavior, protects system security and data privacy, and improves overall security.

[0031] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present application, nor is it intended to limit the scope of the present application. Other features of the present application will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] The above and other objects, features and advantages of the exemplary embodiments of the present application will become readily understood by reading the detailed description below with reference to the accompanying drawings. In the accompanying drawings, several embodiments of the present application are shown in an illustrative and non-limiting manner, in which:

[0033] In the drawings, the same or corresponding reference numerals denote the same or corresponding parts.

[0034] Figure 1 The overall framework diagram of the first embodiment of the present application is shown.

[0035] Figure 2 A schematic diagram of dynamic training of application behavior according to the first embodiment of the present application is shown.

[0036] Figure 3 The following is a flowchart of application permission control according to the first embodiment of the present application.

[0037] Figure 4 A schematic diagram of the structure of an electronic device according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0038] In order to make the purpose, features, and advantages of this application more obvious and easy to understand, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without making creative efforts shall fall within the scope of protection of this application.

[0039] Example 1:

[0040] Please refer to Figure 1 ,This embodiment 1 provides an application access control method based on system call restriction, providing an application behavior learning module and an application permission control module;

[0041] 1. Applied Behavioral Learning Module

[0042] Application access control based on call restrictions requires understanding the system calls that an application needs to invoke when performing specific tasks. For example, Linux kernel version 5.15.75 supports 347 system calls. By default, programs are granted access to all of these system calls, but in practice, programs typically do not use all of these system calls. For example, when viewing or accessing MySQL tables, users often need to invoke system calls such as __name__ and __name__ to operate on database files. However, they do not need to invoke system calls to set process scheduling parameters or to perform network communication. In reality, executing all of MySQL's functions requires no more than 90 system calls (this number varies depending on the operating system version).

[0043] The best practice in security is the Principle of Least Privilege (PLP), which stipulates that any module (application, process, etc.) should only be granted the necessary privileges to perform its functions. Ideally, applications should have the minimum resource access rights necessary to meet their functional requirements. System calls, as one of the most important resources in the Linux kernel, should also be subject to access restrictions. This module monitors the specific execution process of the application and dynamically captures the system calls used by the application at runtime, which serves as the basis for subsequent authorization of system calls by the application. The application behavior learning module mainly performs the following steps:

[0044] A1, create an application behavior list;

[0045] First, you need to clearly define the application's behaviors and create a list of them. For example, using the MySQL database, common database operations (i.e., application behaviors) include creating, deleting, and modifying databases; creating, deleting, modifying, querying, and inserting tables; and connecting to and synchronizing databases. This list of functions can be customized based on the organization and user roles.

[0046] A2, dynamic training and monitoring, performs training and monitoring on each item in the application behavior list.

[0047] Then, for each item in the application behavior list, train and monitor it. For example, connecting to MySQL, viewing data tables, modifying data tables, etc. Figure 2 As shown, first start the monitoring program. For the Linux operating system, you can use tools such as strace, sysdig, and ebpf. Then start the program. Then the operator performs manual training operations. After the training operation is completed, stop monitoring and analyze the results.

[0048] A3 generates a mapping table to establish a mapping relationship between each item in the application behavior list and the system call. An example is as follows:

[0049]

[0050]

[0051]

[0052]

[0053] The following are specific examples of dynamic training monitoring to supplement the content. The purpose is to ensure the safe and efficient operation of the MySQL database by monitoring these behaviors and to detect potential problems in a timely manner.

[0054] 1. mysql.create dynamic training monitoring instance

[0055] Monitoring target: Monitor the creation of new tables in the MySQL database.

[0056] Monitoring methods:

[0057] Log analysis: By analyzing MySQL log files (such as error logs and slow query logs), we can identify SQL statements related to creating new tables.

[0058] Trigger monitoring: Create a trigger in MySQL. When a new table is created, the trigger will record relevant information (such as table name, creation time, creator, etc.) in the log table.

[0059] Performance monitoring: Use performance monitoring tools (such as Prometheus and Grafana) to monitor database performance, especially performance metrics related to new table creation (such as I / O load and CPU usage).

[0060] Dynamic training:

[0061] Model training: Based on historical data, a machine learning model is trained to predict patterns and trends in new table creation behavior.

[0062] Anomaly detection: Use the model to detect abnormal new table creation behavior, such as frequent creation of a large number of tables, creation of tables during non-working hours, etc.

[0063] Feedback optimization: Continuously optimize monitoring strategies and model parameters based on monitoring results and model predictions.

[0064] 2. mysql.list dynamic training monitoring example

[0065] Monitoring target: Monitor the query (list) behavior of tables in the MySQL database.

[0066] Monitoring methods:

[0067] SQL parsing: Parse SQL query statements and identify query behaviors that list tables.

[0068] Access frequency monitoring: Monitors the query frequency of a table and identifies high-frequency or low-frequency query behaviors.

[0069] User behavior analysis: Analyze the query behavior of different users and identify abnormal or malicious behavior.

[0070] Dynamic training:

[0071] Behavioral pattern learning: Learn users' normal query behavior patterns, including query frequency, query time, etc.

[0072] Abnormal behavior detection: Use models to detect abnormal query behavior, such as frequent queries on sensitive tables and large numbers of queries during non-working hours.

[0073] Policy adjustment: Adjust monitoring policies and permission settings based on monitoring results and user feedback.

[0074] 3. mysql.delete dynamic training monitoring example

[0075] Monitoring objective: Monitor the deletion of data in the MySQL database.

[0076] Monitoring methods:

[0077] SQL Audit: Audits SQL delete statements and records relevant information about the delete operation (such as table name, delete conditions, delete time, etc.).

[0078] Data backup and recovery: Back up the database regularly to ensure that data can be quickly restored after being deleted.

[0079] Performance monitoring: Monitor the impact of delete operations on database performance, especially large-scale delete operations.

[0080] Dynamic training:

[0081] Model training: Based on historical deletion data, a machine learning model is trained to predict patterns and trends in deletion behavior.

[0082] Risk warning: Use models to predict potential deletion risks, such as large amounts of data being accidentally deleted or deleted without authorization.

[0083] Emergency response: Develop an emergency response plan, including data recovery and permission adjustments, to address potential deletion risks.

[0084] 4. mysql.connect dynamic training monitoring example

[0085] Monitoring target: Monitor the connection behavior of the MySQL database.

[0086] Monitoring methods:

[0087] Connection log analysis: Analyze MySQL connection logs to identify abnormal connection behavior (such as frequent connection failures, unauthorized connections, etc.).

[0088] Network monitoring: Use network monitoring tools (such as Wireshark) to monitor database network traffic and identify illegal connection requests.

[0089] User behavior analysis: Analyze the connection behavior of different users and identify abnormal or malicious behavior.

[0090] Dynamic training:

[0091] Behavioral pattern learning: Learn users' normal connection behavior patterns, including connection frequency, connection time, etc.

[0092] Abnormal behavior detection: Use models to detect abnormal connection behaviors, such as frequent brute force password cracking attempts and large numbers of connections during non-working hours.

[0093] Security policy adjustments: Adjust security policies (such as password complexity requirements, connection restrictions, etc.) based on monitoring results and user feedback.

[0094] 2. Application permission control module

[0095] Based on the mapping table between application behaviors and system calls obtained above, fine-grained access control can be implemented on the application at the operating system level based on traditional application access control. Figure 3 As shown, the application permission control module mainly performs the following steps:

[0096] B1, user authorization application, initiates an application access request to the authorization center: for example, a user wants access rights to MySQL to view a data table.

[0097] B2, authorization and approval: After receiving the application access request, the authorization center authorizes the application according to the requirements.

[0098] The authorization center receives the request and authorizes the application according to the user's needs. The authorization is divided into two types: the user's access rights to the application and the application's access rights to the system call. The authorization center first grants the guest user the available permissions for the mysql application, and then authorizes the mysql application to only call and System calls in .

[0099] The following are further examples of dual authorization:

[0100] Example background: Consider an enterprise-level database management system consisting of an authorization center, multiple users (including guest users), a MySQL application, and a series of system calls. The authorization center is responsible for managing and assigning permissions to ensure system security and normal operation.

[0101] 1. User access rights to the application

[0102] Example 1: guest user accessing MySQL application

[0103] The guest user is a temporary user who needs to access the MySQL application to perform basic database queries. The authorization center first verifies the guest user's identity and confirms their membership in the user group. Based on the user group's permission configuration, the authorization center grants the guest user access to the MySQL application, but only allows them to perform basic query operations (such as SELECT). After passing authentication, the guest user can log in to the system and access the MySQL application, but can only perform the query operations for which they are authorized.

[0104] Example 2: Advanced user access to MySQL application

[0105] Advanced users are users with higher privileges who require access to MySQL applications to perform more complex database operations. The Authorization Center verifies the advanced user's identity and confirms their membership in the user group. Based on the privilege configuration of the user group, the Authorization Center grants the advanced user access to MySQL applications, including the ability to perform query, insert, update, and delete operations (such as SELECT, INSERT, UPDATE, and DELETE). After passing authentication, the advanced user can log in to the system and access MySQL applications, performing all authorized database operations.

[0106] 2. Application access rights to system calls

[0107] Example 1: MySQL application calls basic system calls

[0108] MySQL applications require basic system calls, such as those for reading and writing files and connecting to the network, to complete database operations. The Authorization Center assesses the security and necessity of MySQL applications. Based on the assessment results, the Authorization Center grants MySQL applications the privilege to call basic system calls. When performing database operations, MySQL applications can call these granted system calls to complete necessary system-level operations.

[0109] Example 2: MySQL application calls restricted system calls

[0110] In some cases, MySQL applications may need to invoke restricted system calls, such as executing system commands or accessing sensitive files. The Authorization Center conducts rigorous review and assessment to ensure the necessity and safety of MySQL applications invoking restricted system calls. If the assessment passes, the Authorization Center grants the MySQL application permission to invoke the restricted system calls, but implements strict access control and auditing mechanisms. When invoking restricted system calls, MySQL applications must comply with the access control and auditing mechanisms to ensure operational security and compliance.

[0111] In the Linux operating system, system call authorization can be performed using seccomp. Seccomp (Secure Computing Mode) is a security mechanism provided by the Linux kernel for restricting system calls. It uses BPF to filter specific system calls. After authorization, unauthorized applications are prohibited from accessing any system calls, while authorized applications can only access authorized system calls.

[0112] B3, authority is issued.

[0113] After the authorization is completed, although the user is authorized by MySQL, he or she only has the permission to view the data table, and does not have other permissions such as modifying or creating data tables. This keeps the permission distribution to a minimum, in line with the principle of least privilege.

[0114] Example 2:

[0115] According to an embodiment of the present application, the present application also provides an electronic device and a readable storage medium.

[0116] Figure 4 A schematic block diagram of an example electronic device that can be used to implement an embodiment of the present application is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or required herein.

[0117] like Figure 4 As shown, the device includes a computing unit that can perform various appropriate actions and processes based on a computer program stored in a read-only memory (ROM) or loaded from a storage unit into a random access memory (RAM). The RAM can also store various programs and data required for device operation. The computing unit, ROM, and RAM are interconnected via a bus. An input / output (I / O) interface is also connected to the bus.

[0118] Many components in a device are connected to the I / O interface, including: input units, such as a keyboard and mouse; output units, such as various types of displays and speakers; storage units, such as magnetic disks and optical disks; and communication units, such as network cards, modems, and wireless communication transceivers. The communication unit allows the device to exchange information / data with other devices via computer networks such as the Internet and / or various telecommunication networks.

[0119] The computing unit can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of computing units include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit performs the various methods and processes described above, such as the application access control method based on system call restrictions described in Example 1. For example, in some embodiments, the application access control method based on system call restrictions can be implemented as a computer software program tangibly embodied in a machine-readable medium, such as a storage unit. In some embodiments, part or all of the computer program can be loaded and / or installed onto a device via ROM and / or a communication unit. When the computer program is loaded into RAM and executed by the computing unit, one or more steps of the application access control method based on system call restrictions described above can be performed. Alternatively, in other embodiments, the computing unit can be configured to perform the application access control method based on system call restrictions through any other suitable means (e.g., via firmware).

[0120] Various embodiments of the systems and techniques described above can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0121] The program code for implementing the methods of the present application can be written in any combination of one or more programming languages. Such program code can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the program code is executed by the processor or controller, the functions / operations specified in the flow charts and / or block diagrams are implemented. The program code can be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0122] In the context of this application, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or apparatus. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of machine-readable storage media may include an electrical connection based on one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fibers, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0123] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0124] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), and the Internet.

[0125] A computer system may include a client and a server. The client and server are generally remote from each other and typically interact through a communication network. The client-server relationship arises through computer programs running on the respective computers and having a client-server relationship with each other. The server may be a cloud server, a server in a distributed system, or a server integrated with a blockchain.

[0126] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this application can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solution of this application can be achieved. This is not limited herein.

[0127] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features being referred to. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one such feature. Throughout the description of this application, "plurality" means two or more, unless otherwise specifically defined.

[0128] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. An application access control method based on system call restriction, characterized in that: Provide application behavior learning module and application permission control module; The Applied Behavioral Learning module performs the following steps: A1, create an application behavior list; A2, dynamic training and monitoring, training and monitoring each item in the application behavior list; A3, generating a mapping table to establish a mapping relationship between each item in the application behavior list and the system call; The application permission control module performs the following steps: B1, user authorization application, initiates application access request to the authorization center; B2, authorization and approval: after receiving the application access request, the authorization center authorizes the application according to the requirements; B3, authority issuance; In B2, authorization is divided into dual authorization, including the user's access rights to the application and the application's access rights to system calls; The authorization center grants different types of users different application access rights; users perform different application behaviors according to the application access rights.

2. The application access control method based on system call restriction according to claim 1, characterized in that: The application behavior list includes: creation, deletion, modification of database; creation, deletion, modification, query, insertion of data table; connection and synchronization of database.

3. The application access control method based on system call restriction according to claim 1 or 2, characterized in that: The method of dynamic training monitoring is as follows: First, open the monitoring program, then start the program and perform manual training. After the training is completed, stop monitoring and analyze the results.

4. The application access control method based on system call restriction according to claim 1, characterized in that: The dual authorization method is as follows: the authorization center first grants the user the available permissions for the MySQL application, and then authorizes the MySQL application to only call and System calls in .

5. The application access control method based on system call restriction according to claim 4, characterized in that: The authorization of the system call is performed using seccomp, combined with BPF to implement filtering of the specified system call.

6. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 5.

7. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to cause the computer to execute the method according to any one of claims 1 to 5.

Images