Security control method and device for cloud application environment, equipment and storage medium

Abstract

The embodiment of the invention provides a security control method and device for a cloud application environment, equipment and a storage medium. In the embodiment of the invention, the security control component is provided and is deployed on the host machine where the cloud application is located, and the security control can be flexibly performed on the cloud application environment on the host machine through the security control component, so that the operation security of the cloud application is ensured. Specifically, the safety control assembly comprises a safety control execution module in a user mode and a safety control monitoring module in a kernel mode, the safety control execution module in the user mode is matched with the safety control monitoring module, process running can be forbidden under the condition that the process needs to be forbidden, and running safety of the cloud application is ensured.

Description

Technical Field

[0001] The present application relates to the field of cloud computing technology, and in particular to a security control method, device, equipment and storage medium for a cloud application environment. Background Art

[0002] The execution environment of cloud applications depends on the operating system (OS) environment of the host machine. Usually, after logging into a cloud application, users can execute multiple computer management programs, such as the registry manager. If the user accidentally modifies one or some registries, the cloud application or even the entire host machine may not run normally. In the cloud application environment, it is necessary to perform security control on the operating environment of the cloud application so that the cloud application can run normally. Summary of the invention

[0003] Multiple aspects of the present application provide a security control method, apparatus, device and storage medium for a cloud application environment to ensure the operational security of cloud applications.

[0004] An embodiment of the present application provides a security control method for a cloud application environment, comprising: a security control component applied to a host machine where a cloud application is located, the security control component comprising: a security control execution module in user state and a security control monitoring module in kernel state, the security control monitoring module being different from a system kernel module in kernel state, the method comprising: the security control monitoring module monitoring whether a process is created on the host machine through the system kernel module, and providing the identifier of the process to the security control execution module when it is detected that a process is created; the security control execution module obtaining detailed information of the process according to the identifier of the process, and controlling the operation of the process according to the detailed information of the process and the security control policy used for the cloud application environment.

[0005] The embodiment of the present application also provides a security control method for a cloud application environment, including: a security control component applied to a host machine where the cloud application is located, the security control component including: a security control execution module in user state and a security control monitoring module in kernel state, the security control monitoring module being different from a system kernel module in kernel state, the method including: the security control monitoring module monitoring whether a process is created on the host machine through the system kernel module, and obtaining detailed information of the process according to the identifier of the process when it is detected that a process is created; and identifying whether the process is allowed to run according to the detailed information of the process and the security control policy for the cloud application environment, and providing the identifier of the process to the security control execution module when it is identified that the process is prohibited from running; the security control execution module prohibits the process from running when receiving the identifier of the process provided by the security control monitoring module.

[0006] An embodiment of the present application also provides a security control device for a cloud application environment, which is deployed on a host machine where a cloud application is located. The device includes: a security control execution module in user state and a security control monitoring module in kernel state, wherein the security control monitoring module is different from a system kernel module in kernel state; a security control monitoring module, which is used to monitor whether a process is created on the host machine through the system kernel module, and when a process is detected to be created, provides the process identifier to the security control execution module; a security control execution module, which is used to obtain detailed information of the process according to the process identifier, and to control the operation of the process according to the detailed information of the process and the security control policy used for the cloud application environment.

[0007] An embodiment of the present application also provides a security control device for a cloud application environment, which is deployed on a host machine where a cloud application is located. The device includes: a security control execution module in user state and a security control monitoring module in kernel state, wherein the security control monitoring module is different from a system kernel module in kernel state; a security control monitoring module for monitoring whether a process is created on the host machine through the system kernel module, and obtaining detailed information of the process based on an identifier of the process when a process is detected to be created; and identifying whether a process is allowed to run based on the detailed information of the process and a security control policy for the cloud application environment, and providing the identifier of the process to the security control execution module when it is identified that the process is prohibited from running; a security control execution module for prohibiting the process from running upon receiving the identifier of the process provided by the security control monitoring module.

[0008] An embodiment of the present application also provides an electronic device that can be implemented as a host machine where a cloud application is located. The electronic device includes: a memory and a processor; the memory stores a computer program corresponding to the security control component, and the processor is coupled to the memory for executing the computer program to implement the steps in the above-described method.

[0009] An embodiment of the present application also provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor is enabled to implement the steps in the above-described method.

[0010] An embodiment of the present application also provides a computer program product, which includes a computer program and / or instructions. When the computer program and / or instructions are executed by a processor, the processor is enabled to implement the steps in the above method.

[0011] In an embodiment of the present application, a security control component is provided and deployed on the host machine where the cloud application is located. Through the security control component, the cloud application environment on the host machine can be flexibly controlled to ensure the safe operation of the cloud application. Specifically, the security control component includes: a security control execution module in user state and a security control monitoring module in kernel state. The security control monitoring module in kernel state is responsible for monitoring whether a process is created, and the security control execution module in user state is responsible for controlling the operation of the created process according to the security control policy; or, the security control monitoring module in kernel state is responsible for monitoring whether a process is created, and identifying whether the created process needs to be prohibited from running according to the security control policy. The security control execution module in user state cooperates with the security control monitoring module to prohibit the process from running when the process needs to be prohibited, thereby ensuring the safe operation of the cloud application. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0013] Figure 1a A schematic diagram of the structure of a security control component of a cloud application environment provided in an embodiment of the present application;

[0014] Figure 1b A schematic diagram of the internal architecture of a host machine provided in an embodiment of the present application;

[0015] Figure 1c A schematic diagram of a process for issuing a security control policy provided in an embodiment of the present application;

[0016] Figure 1d A schematic diagram of an application process of the security control strategy provided in an embodiment of the present application;

[0017] Figure 1e A schematic diagram of another process of issuing a security control policy provided in an embodiment of the present application;

[0018] Figure 1f Another schematic diagram of the application process of the security control strategy provided by another exemplary embodiment of the present application;

[0019] Figure 2a A schematic diagram of a process flow of a security control method for a cloud application environment provided in an embodiment of the present application;

[0020] Figure 2b A flowchart of another cloud application environment security control method provided in an embodiment of the present application;

[0021] Figure 3aA schematic diagram of the structure of a security control device for a cloud application environment provided in an embodiment of the present application;

[0022] Figure 3b A schematic diagram of the structure of another security control device for a cloud application environment provided in an embodiment of the present application;

[0023] Figure 4 It is a schematic diagram of the structure of an electronic device provided in an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0024] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in combination with the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0025] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0026] In view of the technical security problems existing in the operating environment of existing cloud applications, in some embodiments of the present application, a security control component is provided and deployed on the host machine where the cloud application is located. Through the security control component, the cloud application environment on the host machine can be flexibly controlled to ensure the safe operation of the cloud application. Specifically, the security control component includes: a user-state security control execution module and a kernel-state security control monitoring module. The kernel-state security control monitoring module is responsible for monitoring whether a process is created, and the user-state security control execution module is responsible for controlling the operation of the created process according to the security control policy; or, the kernel-state security control monitoring module is responsible for monitoring whether a process is created, and identifying whether the created process needs to be prohibited from running according to the security control policy. The user-state security control execution module cooperates with the security control monitoring module to prohibit the process from running when the process needs to be prohibited, thereby ensuring the safe operation of the cloud application.

[0027] The technical solutions provided by various embodiments of the present application are described in detail below in conjunction with the accompanying drawings.

[0028] Figure 1aA structural diagram of a security control component 10 for a cloud application environment provided in an embodiment of the present application. The security control component 10 includes a user state level module and a kernel state level module. The user state and the kernel state are two operating levels of the operating system. The difference between the two operating levels is that the user state and the kernel state have different memory spaces and object ranges that can be accessed. Among them, the user state is used to run user programs, and the memory space that can be accessed is relatively small; the kernel state is used to run system programs, and the memory space that can be accessed is relatively large.

[0029] Specifically, Figure 1a As shown, the security control component 10 includes: a user-state security control execution module 11 and a kernel-state security control monitoring module 12. The user-state security control execution module 11 and the kernel-state security control monitoring module 12 can communicate with each other through system calls, and the two can cooperate with each other to perform security control on the cloud application environment on the host machine.

[0030] In this embodiment, a series of multi-kernel functions with predetermined functions are provided in the kernel state, and are presented to the user state through a set of interfaces called system calls. The system call passes the request from the user state to the kernel state, and the kernel state calls the corresponding kernel function to complete the processing and returns the processing result to the user state. In the security control process, the security control execution module 11 and the security control monitoring module 12 can pass data such as requests or results related to security control through system calls.

[0031] It should be noted that if Figure 1a As shown, in addition to the security control monitoring module 12, the kernel state also includes a system kernel module 13, and the security control monitoring module 12 is different from the system kernel module 13. The system kernel module 13 is the core module in the kernel state and the most basic part of the operating system. It is responsible for managing the system's processes, memory, device drivers, file systems, and network systems, etc., and determines the performance and stability of the system. In addition, it will provide user-state programs with secure access control of the host's hardware resources. In this embodiment, the system kernel module 13 will also cooperate with the security control monitoring module 12 to achieve security control of the cloud application environment. The functional description of the user-state security control execution module 11 and the kernel-state security control monitoring module 12 and how to cooperate with each other to perform security control on the cloud application environment can be found in the following embodiments, which will not be described in detail here. It is explained here that some kernel functions in the above-mentioned system call can be executed by the system kernel module 13, for example, the system kernel module 13 can execute the kernel function for creating a process to create the corresponding process according to the application startup request or process creation request from the user state. Of course, some kernel functions can also be executed by the security control monitoring module 12.

[0032] Further, if Figure 1a As shown, the security control component 10 may also include a user-state message distribution module 14, which is used to obtain security control policies and send the security control policies to the security control monitoring module 12 and / or the security control execution module 11, so as to provide a data basis for the user-state security control execution module 11 and the kernel-state security control monitoring module 12 to cooperate with each other to perform security control on the cloud application environment on the host machine. The security control policy is the policy information required for performing security control on the cloud application environment on the host machine. The user-state message distribution module 14 and the kernel-state security control monitoring module 12 can communicate with each other through system calls. The user-state message distribution module 13 is also connected to the user-state security control execution module 12. There is no limitation on the way the message distribution module 14 obtains the security control policy.

[0033] It should be noted that the functional introduction of the above modules can be found in the relevant contents of the following embodiments, which will not be elaborated here.

[0034] like Figure 1b As shown, the security control component 10 provided in the embodiment of the present application can be deployed on the host machine where the cloud application is located, and is used to perform security control on the cloud application environment provided by the host machine to ensure the safe operation of the cloud application. The host machine can be any physical device that can provide hardware resources, such as a mobile phone, a notebook, a traditional server, or a cloud server, a cloud host, or other cloud devices with hardware resources. In this embodiment, the hardware resources provided by the host machine include, for example, but are not limited to: a processor (CPU), a memory (such as memory), a network card, a persistent memory, an input / output device, and other devices with specific processing functions, such as an input / output memory management unit (IOMMU), wherein the IOMMU can be used for the conversion of the virtual machine physical address and the host physical address.

[0035] exist Figure 1b In the system, various software programs run on the hardware resources provided by the host machine. These software programs include the operating system (i.e., various kernel-state program modules), as well as the virtualization management program, security control components, and various cloud applications implemented based on the virtualization management program. The various software programs on the operating system are user-state program modules.

[0036] It should be noted that the cloud application in this embodiment has a broader meaning, and generally refers to application programs that implement various functions or provide various services based on cloud computing technology, including but not limited to: cloud conferencing, cloud desktop, cloud gaming, cloud education, cloud medical care, etc.

[0037] Further, if Figure 1b As shown, in the application scenario of the security control component provided in this embodiment, a policy library 15 and a security control node 16 independently deployed outside the host machine are also included. The policy library 15 and the security control node 16 are communicatively connected, and the security control node 16 is communicatively connected to the host machine, specifically, to the message distribution module 14 on the host machine. Among them, the policy library 15 is used to store various security control policies. The security control node 16 is used to obtain the security control policy and send the security control policy to the message distribution module 14. Among them, the security control node 16 can obtain the security control policy from the policy library, or directly receive the security control policy submitted by the user, and there is no limitation on this. For the message distribution module 14, it can receive the security control policy sent by the security control node 16, and send the security control policy to the security control monitoring module 12 and / or the security control execution module 11.

[0038] In this embodiment, the implementation form of the security control node 16 is not limited. The security control node 16 can be a software module, which can be deployed on a virtual machine, a cloud server, a cloud host or a physical machine, or a dedicated hardware module or device. Optionally, there can be one or more security control nodes 16, which can be centrally deployed on a physical machine or a virtual machine, or distributedly deployed on multiple physical machines or multiple virtual machines, and are not limited thereto.

[0039] From the perspective of security control, the policy library 15 and the security management node 16 are the providers of security control policies and belong to the control plane in the security control process. The security control execution module 11, the message distribution module 14, the system kernel module 13 and the security control monitoring module 12 cooperate with each other to perform security control on the cloud application environment provided by the host machine according to the security control policy and belong to the data plane in the security control process.

[0040] In this embodiment, the implementation method of the security control component for the cloud application environment provided by the host machine is not limited. Figure 1a , Figure 1b The security control components and their application scenarios shown provide two specific implementation methods for performing security control on the cloud application environment provided by the host machine through the security control components.

[0041] Exemplary embodiment A:

[0042] In this embodiment, the user-state security control execution module is responsible for maintaining the security control policy for the cloud application environment. Based on this, the user-state security control monitoring module monitors whether a process is created on the host machine through the system kernel module, and when a process is detected to be created, the identifier of the process is provided to the user-state security control execution module through a system call; the security control execution module obtains the detailed information of the process according to the identifier of the process provided by the security control monitoring module, and performs operation control on the process according to the detailed information of the process and the maintained security control policy for the cloud application environment, that is, determines whether the process can be run to ensure the operation security of the cloud application. Among them, the identifier of the process can be the process ID assigned to it by the system kernel module when creating the process. The detailed information of the process includes, but is not limited to: the name of the process, the machine information of the machine to which the process belongs, the session information of the session to which the process belongs, or the user information of the user to whom the process belongs. Further, the machine information of the machine to which the process belongs is, but is not limited to: the machine name or the machine number. The machine here refers to the host machine.

[0043] Furthermore, before the security control execution module controls the operation of the process, the security control node can obtain the security control policy, encapsulate the security control policy into a policy message, and send the policy message to the message distribution module on the host machine through network transmission; the message distribution module parses the security control policy for the cloud application environment from the policy message, and provides the security control policy for the cloud application environment to the security control execution module.

[0044] In this embodiment, the security control node can obtain the security control policy from the policy library periodically or according to the request of the cloud application user to update the security control policy, or can provide a security policy configuration interface for the cloud application user, which can be a web page, a command window, etc. The cloud application user can configure the required security control policy through the security policy configuration interface at any time and anywhere, and can also update the existing security control policy in the policy library at any time and anywhere. For the security control node, the way to obtain the security control policy can also be: responding to the cloud application user's operation of configuring the security control policy through the security policy configuration interface, obtaining the security control policy configured by the cloud application user; or responding to the cloud application user's operation of changing the security control policy through the security policy configuration interface, obtaining the security control policy changed by the cloud application user. Optionally, whether it is the security control policy newly configured by the cloud application user or the updated security control policy, the security control node can also store or update these security control policies to the policy library.

[0045] Furthermore, in this embodiment, the security control policy will be updated; accordingly, the message distribution module receives the policy message dynamically issued by the security management node when the security control policy is updated, parses the updated security control policy from the policy message, and provides the updated security control policy to the security control execution module.

[0046] In the embodiments of the present application, the manner in which the message distribution module provides the security control policy for the cloud application environment to the security control execution module is not limited. In an optional embodiment, the message distribution module can write the security control policy into a memory space on the host machine that can be accessed by the security control execution module to achieve the purpose of providing the security control policy to the security control execution module. Further optionally, the memory space can be a shared memory space that can be shared by the message distribution module and the security control execution module, and the message distribution module has read and write permissions to the shared memory space, and the security control execution module has read permissions to the shared memory space.

[0047] Combine the following Figure 1c and Figure 1d The process of issuing the security control policy and the process of applying the security control policy in exemplary implementation A are described in detail.

[0048] like Figure 1c As shown, the process of issuing security control policies includes: the security control node can obtain the security control policy from the policy library, encapsulate the security control policy into a policy message, and provide the policy message to the message distribution module; the message distribution module parses the security control policy from the policy message, and provides the security control policy to the security control execution module. The security control execution module adds the security control policy locally and performs operation control on the corresponding process based on the security control policy.

[0049] Further, if Figure 1c As shown, in addition to issuing and adding security control policies, the security control execution module can also remove and query security control policies with the cooperation of the message distribution module. For example, the message distribution module can periodically query the security control policies added by the security control execution module, and issue removal instructions to the expired security control policies. The security control execution module removes the expired security control policies according to the removal instructions to free up memory space.

[0050] like Figure 1dAs shown, the application process of the security control policy includes: the user initiates a request to start the application, and the system call interface responds to the request to start the application and sends a request to create a process to the system kernel module; the system kernel module creates a process according to the request to create a process, and provides the process identifier to the security control monitoring module through a callback function callback; when the security control monitoring module detects that a process has been created, the process identifier is provided to the security control execution module; the security control execution module applies the policy according to the process identifier and the pre-maintained security control policy, that is, it determines whether the process is allowed to run according to the security control policy, and then controls the operation of the process. If the process is allowed, it is released; if the process is not allowed to run, it is prohibited to run; and the process operation control results are provided to the user through the security control monitoring module, the system kernel module and the system call interface in sequence. Figure 1d In the process, the security control execution module returns the policy application result to the security control monitoring module, either prohibiting the process from running or allowing the process to run. The security control monitoring module returns the policy application result to the system kernel module, and the system kernel module returns the process creation result to the user through the system call interface. That is, when the policy application result is to prohibit the process from running, the process creation result is the result of process creation failure. When the policy application result is to allow the process to run, the process creation result is the result of process creation success.

[0051] In an embodiment of the present application, the system kernel module is provided with a callback registration function, allowing other kernel modules to register callback functions with it, and different functions can be implemented for different callback functions. In an embodiment of the present application, the security control monitoring module calls the callback registration function provided by the system kernel module at startup, and registers the callback function with the system kernel module. The function of the callback function is to request the system kernel module to obtain the identifier of the process created by it; in this way, the security control monitoring module can obtain the identifier of the process created by the system kernel module through the callback function, and then provide it to the security control execution module. For the system kernel module, when the security control monitoring module registers a callback function for obtaining the identifier of the process, when creating a process, the identifier of the created process will be returned to the callback function registered with the security control monitoring module, so that the security control monitoring module can obtain the identifier of the created process.

[0052] In this embodiment, the type of callback registration function is not limited. Depending on the operating system, the implementation of the callback registration function may be different. For example, the callback registration function may be PsSetCreatProcessNotifyRoutineEx, which is a function under the Windows operating system and is a kernel API for implementing process monitoring by setting a callback function. Among them, multiple callback functions are stored in a callback function list, and a parameter of the callback registration function points to a pointer, through which the callback function to be executed is specified from the callback function list.

[0053] In an optional embodiment, when the security control execution module obtains detailed information of the process according to the process identifier, it is specifically used to: query the process information structure through the process identifier, and obtain detailed information of the process from the process information structure. After each process is created, it has its own process information structure, and the process information structure stores detailed information of the process.

[0054] In this embodiment, the control level of the security control policy is not limited. For example, it can be machine-level, user-level, or session-level. Among them, the machine-level security control policy refers to a security control policy that can constrain any process on the entire host machine, the user-level security control policy refers to a security control policy that constrains processes created by a specific user; the session-level security control policy refers to a security control policy that constrains processes belonging to a specific session. In this embodiment, it is allowed to configure security control policies of various control levels, which makes the security control granularity more flexible and helps to meet the security control needs of different users and different cloud applications.

[0055] It is explained here that in actual application, a security control policy of one control level can be configured, or security control policies of multiple control levels can be controlled at the same time. In the case of controlling security control policies of multiple control levels at the same time, in order to avoid conflicts caused by security control policies of different control levels taking effect at the same time, a security control policy of one control level is allowed to take effect in the same period. Based on this, when there are multiple security control policies, the security control execution module first needs to determine the currently effective target security control policy from multiple security control policies when performing operation control on the process based on the detailed information of the process and the security control policy used for the cloud application environment; and then perform operation control on the process based on the detailed information of the process and the target security control policy.

[0056] In an optional embodiment, different priorities can be set for security control policies of different control levels. For example, the higher the control level, the higher the priority. In the case where there are security control policies of multiple control levels at the same time, the security control policy with the highest priority can be defaulted or set to take effect. Based on this, when the security control execution module determines the currently effective target security control policy from multiple security control policies, it is specifically used to: determine the security control policy with the highest priority as the target security control policy based on the priorities of multiple security control policies. For example, there are security control policies 1, 2, 3, and 4, where the priority ranking of the above security control policies is: security control policy 1>security control policy 2>security control policy 3>security control policy 4, then the security control policy 1 with the highest priority can be used as the target security control policy.

[0057] In another optional embodiment, the cloud application allows users to dynamically specify the security control policies that need to be effective through the security control node. The security control node can dynamically issue effective instructions according to application requirements, and the security control policies that need to be effective are included in the effective instructions. Based on this, when the security control execution module determines the currently effective target security control policy from multiple security control policies, it is specifically used to: determine the security control policy indicated by the effective instruction as the target security control policy according to the latest effective instruction issued by the security control node, wherein the security control node can dynamically issue effective instructions according to application requirements. For example, there are security control policies 1, 2, 3, and 4. If security control policy 1 is included in the latest effective instruction issued by the security control node, security control policy 1 is determined to be the target security control policy; if security control policy 2 is included in the latest effective instruction issued by the security control node, security control policy 2 is determined to be the target security control policy. In this embodiment, there is no need to pay attention to the priority of the security control policy.

[0058] In this embodiment, when the target security control policy is determined, the process can be run controlled according to the detailed information of the process and the target security control policy. Among them, the security control policy can be implemented in different ways, for example, a whitelist method can be used to limit the process information allowed to run, a blacklist method can be used to limit the process information prohibited from running, and a blacklist and whitelist method can be used at the same time to limit the process information prohibited from running and the process information allowed to run. Depending on the different implementation methods adopted by the security control policy, the way to control the process running will be different. Specifically, according to the detailed information of the process, it can be queried whether the process is in the blacklist or whitelist of the target security control policy. If it is in the blacklist or not in the whitelist, the process is prohibited from running. On the contrary, if it is not in the blacklist or is in the whitelist, the process is allowed to run.

[0059] Since processes and security control policies are divided into levels, when querying whether a process is in the blacklist or whitelist of the target security control policy, it is possible to first determine whether the process belongs to a process under the control level corresponding to the security control policy. Based on this, before querying whether the process is in the blacklist or whitelist of the target security control policy based on the detailed information of the process, the security control execution module is also used to: determine whether the process belongs to a process within the target control level based on the detailed information of the process, and the target control level is the control level corresponding to the target security control policy; if so, execute the operation of querying whether the process is in the blacklist or whitelist of the target security control policy based on the detailed information of the process.

[0060] For example, if the target security control policy is a machine-level security control policy, since the security control policy at this level applies to all processes on the host machine, it can be directly determined that the process belongs to the target control level; if the target security control policy is a session-level security control policy, then based on the session identifier in the process details, it is determined whether the session to which the process belongs belongs to a session to which the target security control policy applies; if so, it is determined that the process belongs to the target control level; if not, it is determined that the process does not belong to the target control level;

[0061] If the target security control policy is a user-level security control policy, that is, the target control level is user level, then based on the user information corresponding to the session identifier in the process details, determine whether the user who started the process is a user to which the target security control policy applies; if so, determine that the process is within the target control level; if not, determine that the process is not within the target control level.

[0062] Exemplary embodiment B:

[0063] In this embodiment, the security control monitoring module in the kernel state is responsible for maintaining the security control policy for the cloud application environment. Based on this, the security control monitoring module monitors whether a process is created on the host machine through the system kernel module, and when a process is detected to be created, the detailed information of the process is obtained according to the process identifier; and according to the detailed information of the process and the security control policy for the cloud application environment, it is identified whether the process is allowed to run, and when it is identified that the process is prohibited from running, the process identifier is provided to the security control execution module; the security control execution module prohibits the process from running when receiving the process identifier provided by the security control monitoring module. Among them, the process identifier can be the process ID assigned to it by the system kernel module when creating the process. The detailed information of the process includes, but is not limited to: the name of the process, the machine information of the machine to which the process belongs, the session information of the session to which the process belongs, or the user information of the user to whom the process belongs. Further, the machine information of the machine to which the process belongs is, but is not limited to: the machine name or the machine number. The machine here refers to the host machine.

[0064] Furthermore, before the security control monitoring module identifies whether the process is allowed to run, the security control node can obtain the security control policy, encapsulate the security control policy into a policy message, and send the policy message to the message distribution module on the host machine through network transmission; the message distribution module parses the security control policy for the cloud application environment from the policy message, and provides the security control policy for the cloud application environment to the security control execution module, which then provides it to the security control monitoring module.

[0065] In this embodiment, the security control node can obtain the security control policy from the policy library periodically or according to the request of the cloud application user to update the security control policy, or can provide a security policy configuration interface for the cloud application user, which can be a web page, a command window, etc. The cloud application user can configure the required security control policy through the security policy configuration interface at any time and anywhere, and can also update the existing security control policy in the policy library at any time and anywhere. For the security control node, the way to obtain the security control policy can also be: responding to the cloud application user's operation of configuring the security control policy through the security policy configuration interface, obtaining the security control policy configured by the cloud application user; or responding to the cloud application user's operation of changing the security control policy through the security policy configuration interface, obtaining the security control policy changed by the cloud application user. Optionally, whether it is the security control policy newly configured by the cloud application user or the updated security control policy, the security control node can also store or update these security control policies to the policy library.

[0066] Furthermore, in this embodiment, the security control policy will be updated; accordingly, the message distribution module receives the policy message dynamically issued by the security management node when the security control policy is updated, parses the updated security control policy from the policy message, and provides the updated security control policy to the security control execution module, which then provides it to the security control monitoring module.

[0067] In the embodiments of the present application, the manner in which the message distribution module provides the security control policy for the cloud application environment to the security control execution module is not limited. In an optional embodiment, the message distribution module can write the security control policy into a memory space on the host machine that can be accessed by the security control execution module, so as to achieve the purpose of providing the security control policy to the security control execution module. Further optionally, the memory space can be a shared memory space that can be shared by the message distribution module and the security control execution module, and the message distribution module has read and write permissions to the shared memory space, and the security control execution module has read permissions to the shared memory space. Among them, the security control execution module can provide the security control policy to the security control monitoring module in the form of a system call.

[0068] Combine the following Figure 1e and Figure 1f The process of issuing the security control policy and the process of applying the security control policy in exemplary implementation B are described in detail.

[0069] like Figure 1e As shown, the process of issuing security control policies includes: the security control node can obtain the security control policy from the policy library, encapsulate the security control policy into a policy message, and provide the policy message to the message distribution module; the message distribution module parses the security control policy from the policy message, and provides the security control policy to the security control execution module; the security control execution module provides the security control policy to the security control monitoring module, the security control monitoring module adds the security control policy locally, and runs the corresponding process based on the security control policy.

[0070] Further, if Figure 1e As shown, in addition to issuing and adding security control policies, the security control monitoring module can also remove and query security control policies with the cooperation of the security control execution module. For example, the security control execution module can periodically query the security control policies added by the security control monitoring module, and issue removal instructions to the expired security control policies. The security control monitoring module removes the expired security control policies according to the removal instructions to free up memory space.

[0071] like Figure 1f As shown, the application process of the security control policy includes: the user initiates a request to start the application, and the called interface responds to the request to start the application and sends a request to create a process to the system kernel module; the system kernel module creates a process according to the request to create a process, and provides the process identifier to the security control monitoring module through a callback function callback; when the security control monitoring module detects that a process has been created, the policy is applied based on the process identifier and the maintained security control policy, that is, it identifies whether the process is allowed to run according to the security control policy, and provides the process identifier to the security control execution module through a system call when it is identified that the process is prohibited from running; the security control execution module prohibits the process from running, and provides the result of prohibiting the process from running to the user through the security control monitoring module, the system kernel module and the system call interface in sequence. Figure 1f In the process, the security control execution module returns the result of prohibiting the process from running to the security control monitoring module, and the security control monitoring module returns the policy application result to the system kernel module, that is, prohibiting the process from running. The system kernel module returns the process creation result to the user through the system call interface, that is, the result of the process creation failure.

[0072] In this embodiment, the system kernel module is provided with a callback registration function, allowing other kernel modules to register with it to return to the function, and different functions can be implemented for different callback functions. In the embodiment of the present application, the security control monitoring module calls the callback registration function provided by the system kernel module at startup, registers the callback function with the system kernel module, and the function of the callback function is to request the system kernel module to obtain the identifier of the process created by it; in this way, the security control monitoring module can obtain the identifier of the process created by the system kernel module through the callback function, and then identify whether the process identified by the identifier is allowed to run according to the maintained security control policy, and provide the identifier of the process to the security control execution module when it is identified that the process needs to be prohibited from running. For the system kernel module, when the security control monitoring module registers a callback function for obtaining the identifier of the process, when creating a process, the identifier of the created process will be returned to the callback function registered by the security control monitoring module, so that the security control monitoring module obtains the identifier of the created process. For the relevant description of the callback registration function and the callback function, please refer to the aforementioned embodiment, which will not be repeated here.

[0073] In an optional embodiment, when the security control monitoring module obtains detailed information of the process according to the process identifier, it is specifically used to: query the process information structure through the process identifier, and obtain the detailed information of the process from the process information structure. After each process is created, it has its own process information structure, and the process information structure stores the detailed information of the process.

[0074] In this embodiment, the control level of the security control policy is not limited. For example, it can be machine-level, user-level, or session-level. For relevant descriptions of the security control policy, please refer to the aforementioned embodiment and will not be repeated here. In an optional embodiment, the security control monitoring module identifies whether the process is allowed to run based on the detailed information of the process and the security control policy used for the cloud application environment. Specifically, in the case of multiple security control policies, the security control monitoring module determines the currently effective target security control policy from multiple security control policies; based on the detailed information of the process, query whether the process is in the blacklist or whitelist of the target security control policy. If it is in the blacklist or not in the whitelist, the process is prohibited from running. Among them, the blacklist is a list of processes that are prohibited from running by the target security control policy, and the whitelist is a list of processes that are allowed to run by the target security control policy.

[0075] In an optional embodiment, different priorities can be set for security control policies of different control levels. For example, the higher the control level, the higher the priority. In the case where there are multiple security control policies of different control levels, the security control policy with the highest priority can be defaulted or set to take effect. Based on this, when the security control monitoring module determines the currently effective target security control policy from multiple security control policies, it is specifically used to: determine the security control policy with the highest priority as the target security control policy according to the priorities of multiple security control policies.

[0076] In another optional embodiment, the cloud application allows users to dynamically specify the security control policies that need to be effective through the security control node. The security control node can dynamically issue effective instructions according to application requirements, and the effective instructions include the security control policies that need to be effective. Based on this, when the security control monitoring module determines the currently effective target security control policy from multiple security control policies, it is specifically used to: determine the security control policy indicated by the effective instruction as the target security control policy according to the latest effective instruction issued by the security control node, wherein the security control node can dynamically issue effective instructions according to application requirements.

[0077] In an optional embodiment, before the security control monitoring module queries whether the process is in the blacklist or whitelist of the target security control policy based on the detailed information of the process, it is also used to: determine whether the process belongs to the process within the target control level based on the detailed information of the process, the target control level is the control level corresponding to the target security control policy; if so, execute the operation of querying whether the process is in the blacklist or whitelist of the target security control policy based on the detailed information of the process.

[0078] Further optionally, when the security control monitoring module is used to determine whether a process belongs to a process within the target control level based on the detailed information of the process, it is specifically used to: if the target control level is user-level, that is, the corresponding effective security control policy is a user-level policy, then based on the user information corresponding to the session identifier in the detailed information of the process, determine whether the user who started the process belongs to a user to which the target security control policy applies; if so, determine that it belongs to the target control level; if not, determine that it does not belong to the target control level. If the target control level is session-level, then based on the session identifier in the detailed information of the process, determine whether the session to which the process belongs belongs to a session to which the target security control policy applies; if so, determine that it belongs to the target control level; if not, determine that it does not belong to the target control level. If the target control level is machine-level, then both session-level processes and user-level processes belong to machine-level processes, thereby directly determining that it belongs to the target control level.

[0079] In the above embodiment of the present application, a security control component is provided and deployed on the host machine where the cloud application is located. Through the security control component, the cloud application environment on the host machine can be flexibly controlled to ensure the safe operation of the cloud application. Specifically, the security control component includes: a security control execution module in user state and a security control monitoring module in kernel state. The security control monitoring module in kernel state is responsible for monitoring whether a process is created, and the security control execution module in user state is responsible for performing operation control on the created process according to the security control policy; or, the security control monitoring module in kernel state is responsible for monitoring whether a process is created, and identifying whether the created process needs to be prohibited from running according to the security control policy. The security control execution module in user state cooperates with the security control monitoring module to prohibit the process from running when the process needs to be prohibited, thereby ensuring the safe operation of the cloud application.

[0080] Furthermore, the security control component provided in the embodiment of the present application is independent of the domain control technology in the operating system. The security control component cooperates with the security control node and the policy library to realize a self-closed loop of security control, which is no longer subject to the various restrictions of the domain control technology, and can achieve timely configuration, updating and issuance of security control policies; it also supports security control policies of multiple control levels, which facilitates further isolation between users in the security control dimension, and can flexibly configure the control granularity to improve the flexibility of security control.

[0081] Figure 2a A schematic diagram of a process flow of a cloud application environment security control method provided in an embodiment of the present application. Figure 2a As shown, the method is applied to the security control component on the host machine where the cloud application is located, and the security control component includes: a security control execution module in user state and a security control monitoring module in kernel state, and the security control monitoring module is different from the system kernel module in kernel state. The method includes:

[0082] 201a. The security control monitoring module monitors whether a process is created on the host machine through the system kernel module, and when a process is detected to be created, provides the process identifier to the security control execution module;

[0083] 202a. The security control execution module obtains detailed information of the process according to the identifier of the process, and controls the operation of the process according to the detailed information of the process and the security control policy for the cloud application environment.

[0084] In an optional embodiment, the security control monitoring module monitors whether a process is created on the host machine through the system kernel module, and provides the process identifier to the security control execution module when it is detected that a process is created, including: the security control monitoring module calls the callback registration function provided by the system kernel module at startup, and registers the callback function with the system kernel module; obtains the identifier of the process created by the system kernel module through the callback function, and provides it to the security control execution module; wherein, the system kernel module passes the process identifier to the callback function when creating the process.

[0085] In an optional embodiment, the security control execution module controls the operation of the process based on the detailed information of the process and the security control policy used for the cloud application environment, including: when there are multiple security control policies, the security control execution module determines the currently effective target security control policy from the multiple security control policies; based on the detailed information of the process, query whether the process is in the blacklist or whitelist of the target security control policy, and if it is in the blacklist or not in the whitelist, prohibiting the process from running.

[0086] Optionally, the security control execution module determines the currently effective target security control policy from multiple security control policies, including: determining the security control policy with the highest priority as the target security control policy based on the priorities of multiple security control policies; or determining the security control policy indicated by the effective instruction as the target security control policy based on the latest effective instruction issued by the security management and control node, wherein the security management and control node dynamically issues the effective instruction according to application requirements.

[0087] Optionally, before querying whether the process is in the blacklist or whitelist of the target security control policy based on the detailed information of the process, it also includes: judging whether the process is within the target control level based on the detailed information of the process, the target control level is the control level corresponding to the target security control policy; if so, executing the operation of querying whether the process is in the blacklist or whitelist of the target security control policy based on the detailed information of the process.

[0088] Optionally, judging whether the process belongs to a process within a target control level based on the detailed information of the process, including: if the target control level is user level, judging whether the user who starts the process belongs to a user to which the target security control policy applies based on the user information corresponding to the session identifier in the detailed information of the process; if so, determining that it is a process within the target control level; if not, determining that it is not a process within the target control level; if the target control level is session level, judging whether the session to which the process belongs belongs to a session to which the target security control policy applies based on the session identifier in the detailed information of the process; if so, determining that it is a process within the target control level; if not, determining that it is not a process within the target control level; if the target control level is machine level, directly determining that it is a process within the target control level.

[0089] Further optionally, the security control component also includes: a user-state message distribution module; the above method also includes: the message distribution module receives the policy message dynamically issued by the security management node when the security control policy is updated, parses the updated security control policy from the policy message, and provides the updated security control policy to the security control execution module.

[0090] The detailed implementation and beneficial effects of each step in the embodiment of the method have been described in detail in the aforementioned embodiments and will not be elaborated here.

[0091] Figure 2b A flowchart of another security control method for a cloud application environment provided in an embodiment of the present application. The method is applied to a security control component on a host machine where a cloud application is located, and the security control component includes: a security control execution module in user state and a security control monitoring module in kernel state, and the security control monitoring module is different from the system kernel module in kernel state. The method includes:

[0092] 201b. The security control monitoring module monitors whether a process is created on the host machine through the system kernel module, and if a process is detected to be created, obtains detailed information of the process according to the process identifier; identifies whether the process is allowed to run according to the detailed information of the process and the security control policy for the cloud application environment, and if it is identified that the process is prohibited from running, provides the process identifier to the security control execution module;

[0093] 202b. The security control execution module prohibits the process from proceeding when receiving the process identifier provided by the security control monitoring module.

[0094] In an optional embodiment, the security control monitoring module monitors whether a process is created on the host machine through the system kernel module, and when it is detected that a process is created, obtains the details of the process according to the process identifier, including: the security control monitoring module calls the callback registration function provided by the system kernel module at startup, and registers the callback function with the system kernel module; obtains the identifier of the process created by the system kernel module through the callback function; obtains the detailed information of the process according to the identifier of the process; wherein, the system kernel module passes the process identifier to the callback function when creating the process.

[0095] In an optional embodiment, the security control monitoring module controls the operation of the process based on the detailed information of the process and the security control policy used for the cloud application environment, including: when there are multiple security control policies, the security control monitoring module determines the currently effective target security control policy from the multiple security control policies; based on the detailed information of the process, query whether the process is in the blacklist or whitelist of the target security control policy, and if it is in the blacklist or not in the whitelist, prohibiting the process from running.

[0096] Optionally, the security control monitoring module determines the currently effective target security control policy from multiple security control policies, including: determining the security control policy with the highest priority as the target security control policy based on the priorities of multiple security control policies; or determining the security control policy indicated by the effective instruction as the target security control policy based on the latest effective instruction issued by the security management and control node, wherein the security management and control node dynamically issues the effective instruction according to application requirements.

[0097] Optionally, before querying whether the process is in the blacklist or whitelist of the target security control policy based on the detailed information of the process, it also includes: judging whether the process is within the target control level based on the detailed information of the process, the target control level is the control level corresponding to the target security control policy; if so, executing the operation of querying whether the process is in the blacklist or whitelist of the target security control policy based on the detailed information of the process.

[0098] Optionally, judging whether the process belongs to a process within a target control level based on the detailed information of the process, including: if the target control level is user level, judging whether the user who starts the process belongs to a user to which the target security control policy applies based on the user information corresponding to the session identifier in the detailed information of the process; if so, determining that it is a process within the target control level; if not, determining that it is not a process within the target control level; if the target control level is session level, judging whether the session to which the process belongs belongs to a session to which the target security control policy applies based on the session identifier in the detailed information of the process; if so, determining that it is a process within the target control level; if not, determining that it is not a process within the target control level; if the target control level is machine level, directly determining that it is a process within the target control level.

[0099] Further optionally, the security control component also includes: a user-state message distribution module; the above method also includes: the message distribution module receives the policy message dynamically issued by the security management node when the security control policy is updated, parses the updated security control policy from the policy message, and provides the updated security control policy to the security control monitoring module.

[0100] The detailed implementation and beneficial effects of each step in the embodiment of the method have been described in detail in the aforementioned embodiments and will not be elaborated here.

[0101] Figure 3a A schematic diagram of the structure of a security control device for a cloud application environment provided in an embodiment of the present application. In an embodiment of the present application, the device can also be used as a security control component in the above embodiment and deployed on the host machine where the cloud application is located. Figure 3a As shown, the device includes: a security control monitoring module 31a in kernel state and a security control execution module 32a in user state, wherein the security control monitoring module 31a is different from the system kernel module in kernel state;

[0102] The security control monitoring module 31a is used to monitor whether a process is created on the host machine through the system kernel module, and provide the process identifier to the security control execution module 32a when a process is detected to be created;

[0103] The security control execution module 32a is used to obtain detailed information of the process according to the identifier of the process, and to control the operation of the process according to the detailed information of the process and the security control policy for the cloud application environment.

[0104] In an optional embodiment, the security control monitoring module 31a monitors whether a process is created on the host machine through the system kernel module, and when it is detected that a process is created, the security control monitoring module 31a provides the process identifier to the security control execution module 32a, specifically for: the security control monitoring module 31a calls the callback registration function provided by the system kernel module at startup, and registers the callback function with the system kernel module; obtains the identifier of the process created by the system kernel module through the callback function, and provides it to the security control execution module 32a; wherein, the system kernel module passes the process identifier to the callback function when creating the process.

[0105] In an optional embodiment, when the security control execution module 32a controls the operation of the process based on the detailed information of the process and the security control policy used for the cloud application environment, it is specifically used to: when there are multiple security control policies, determine the currently effective target security control policy from the multiple security control policies; based on the detailed information of the process, query whether the process is in the blacklist or whitelist of the target security control policy, and if it is in the blacklist or not in the whitelist, prohibit the process from running.

[0106] Optionally, when the security control execution module 32a determines the currently effective target security control policy from multiple security control policies, it is specifically used to: determine the security control policy with the highest priority as the target security control policy according to the priorities of the multiple security control policies; or determine the security control policy indicated by the effective instruction as the target security control policy according to the latest effective instruction issued by the security management and control node, wherein the security management and control node dynamically issues the effective instruction according to application requirements.

[0107] Optionally, before querying whether the process is in the blacklist or whitelist of the target security control policy based on the detailed information of the process, the security control execution module 32a is also used to: determine whether the process belongs to a process within the target control level based on the detailed information of the process, the target control level is the control level corresponding to the target security control policy; if so, execute the operation of querying whether the process is in the blacklist or whitelist of the target security control policy based on the detailed information of the process.

[0108] Optionally, when the security control execution module 32a determines whether a process belongs to a process within the target control level based on the detailed information of the process, it is specifically used to: if the target control level is user level, then based on the user information corresponding to the session identifier in the detailed information of the process, determine whether the user who starts the process belongs to a user to which the target security control policy applies; if so, determine that the process belongs to the target control level; if not, determine that the process does not belong to the target control level; if the target control level is session level, then based on the session identifier in the detailed information of the process, determine whether the session to which the process belongs belongs to a session to which the target security control policy applies; if so, determine that the process belongs to the target control level; if not, determine that the process does not belong to the target control level; if the target control level is machine level, directly determine that the process belongs to the target control level.

[0109] Further optionally, the device of this embodiment also includes: a user-state message distribution module 33a; the message distribution module 33a is used to receive policy messages dynamically issued by the security management and control node when the security control policy is updated, parse the updated security control policy from the policy message, and provide the updated security control policy to the security control execution module 32a.

[0110] The detailed implementation and beneficial effects of each module in the method of this embodiment have been described in detail in the aforementioned embodiments and will not be elaborated here.

[0111] Figure 3b This is a schematic diagram of the structure of another security control device for a cloud application environment provided in an embodiment of the present application. In the embodiment of the present application, the device can also be used as a security control component in the above embodiment and deployed on the host machine where the cloud application is located. Figure 3bAs shown, the device includes: a security control monitoring module 31b in kernel state and a security control execution module 32b in user state, wherein the security control monitoring module 31b is different from the system kernel module in kernel state;

[0112] The security control monitoring module 31b is used to monitor whether a process is created on the host machine through the system kernel module, and if a process is detected to be created, obtain detailed information of the process according to the process identifier; and identify whether the process is allowed to run according to the detailed information of the process and the security control policy for the cloud application environment, and provide the process identifier to the security control execution module 31b if it is identified that the process is prohibited from running;

[0113] The security control execution module 32b is used to prohibit the process identified by the identifier from running when receiving the identifier of the process provided by the security control monitoring module 31b.

[0114] In an optional embodiment, the security control monitoring module 31b monitors whether a process is created on the host machine through the system kernel module, and when it is detected that a process is created, obtains the details of the process according to the process identifier. It is specifically used to: call the callback registration function provided by the system kernel module at startup, and register the callback function with the system kernel module; obtain the identifier of the process created by the system kernel module through the callback function; obtain detailed information of the process according to the process identifier; wherein, the system kernel module passes the process identifier to the callback function when creating the process.

[0115] In an optional embodiment, the security control monitoring module 31b identifies whether the process is allowed to run based on the detailed information of the process and the security control policy used for the cloud application environment. Specifically, it is used to: when there are multiple security control policies, determine the currently effective target security control policy from the multiple security control policies; based on the detailed information of the process, query whether the process is in the blacklist or whitelist of the target security control policy. If it is in the blacklist or not in the whitelist, it is determined that the process needs to be prohibited from running; otherwise, it is determined that the process is allowed to run.

[0116] Optionally, when the security control monitoring module 31b determines the currently effective target security control policy from multiple security control policies, it is specifically used to: determine the security control policy with the highest priority as the target security control policy according to the priorities of multiple security control policies; or determine the security control policy indicated by the effective instruction as the target security control policy according to the latest effective instruction issued by the security management and control node, wherein the security management and control node dynamically issues the effective instruction according to application requirements.

[0117] Optionally, before querying whether the process is in the blacklist or whitelist of the target security control policy based on the detailed information of the process, the security control monitoring module 31b is also used to: determine whether the process belongs to the process within the target control level based on the detailed information of the process, the target control level is the control level corresponding to the target security control policy; if so, execute the operation of querying whether the process is in the blacklist or whitelist of the target security control policy based on the detailed information of the process.

[0118] Optionally, when the security control monitoring module 31b determines whether a process belongs to a process within the target control level based on the detailed information of the process, it is specifically used to: if the target control level is user level, then based on the user information corresponding to the session identifier in the detailed information of the process, determine whether the user who starts the process belongs to a user to which the target security control policy applies; if so, determine that it is a process within the target control level; if not, determine that it is not a process within the target control level; if the target control level is session level, then based on the session identifier in the detailed information of the process, determine whether the session to which the process belongs belongs to a session to which the target security control policy applies; if so, determine that it is a process within the target control level; if not, determine that it is not a process within the target control level; if the target control level is machine level, directly determine that it is a process within the target control level.

[0119] Further optionally, the device of this embodiment also includes: a user-state message distribution module 33b; a message distribution module 33b is used to receive a policy message dynamically issued by the security management node when the security control policy is updated, parse the updated security control policy from the policy message, and provide the updated security control policy to the security control monitoring module 31b.

[0120] The detailed implementation and beneficial effects of each module in this embodiment have been described in detail in the aforementioned embodiments and will not be elaborated here.

[0121] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 4As shown, the electronic device can be implemented as a host machine where the cloud application is located, and the host machine can be a cloud host, a terminal or a server, etc. The electronic device includes: a memory 40a and a processor 40b; the memory 40a stores a computer program corresponding to the security control component, and the computer program corresponding to the security control component at least includes: a program code corresponding to the security control monitoring module in the kernel state and a program code corresponding to the security control execution module in the user state, and the security control monitoring module in the kernel state and the security control execution module in the user state can communicate with each other through a system call. The processor 40a is coupled to the memory 40b, and is used to run the program code corresponding to the security control monitoring module to monitor whether a process is created on the host machine through the system kernel module, and when a process is detected to be created, the identifier of the process is provided to the security control execution module; and the program code corresponding to the security control execution module is run to obtain the detailed information of the process according to the identifier of the process, and the process is controlled according to the detailed information of the process and the security control policy used for the cloud application environment.

[0122] In an optional embodiment, the processor 40a runs the program code corresponding to the security control monitoring module to monitor whether a process is created on the host machine through the system kernel module, and when it is detected that a process is created, the processor 40a provides the process identifier to the security control execution module, specifically for: running the program code corresponding to the security control monitoring module to call the callback registration function provided by the system kernel module at startup, and register the callback function with the system kernel module; obtaining the identifier of the process created by the system kernel module through the callback function, and providing it to the security control execution module; wherein the system kernel module passes the process identifier to the callback function when creating the process.

[0123] In an optional embodiment, the processor 40a runs the program code corresponding to the security control execution module to control the operation of the process according to the detailed information of the process and the security control policy used for the cloud application environment, specifically for: running the program code corresponding to the security control execution module to determine the currently effective target security control policy from multiple security control policies when there are multiple security control policies; querying whether the process is in the blacklist or whitelist of the target security control policy according to the detailed information of the process, and if it is in the blacklist or not in the whitelist, prohibiting the process from running.

[0124] Optionally, the processor 40a determines the currently effective target security control policy from multiple security control policies, specifically for: determining the security control policy with the highest priority as the target security control policy according to the priorities of the multiple security control policies; or determining the security control policy indicated by the effective instruction as the target security control policy according to the latest effective instruction issued by the security management and control node, wherein the security management and control node dynamically issues the effective instruction according to application requirements.

[0125] Optionally, before querying whether the process is in the blacklist or whitelist of the target security control policy based on the detailed information of the process, the processor 40a is also used to: determine whether the process belongs to a process within a target control level based on the detailed information of the process, the target control level is the control level corresponding to the target security control policy; if so, execute the operation of querying whether the process is in the blacklist or whitelist of the target security control policy based on the detailed information of the process.

[0126] Optionally, when the processor 40a determines whether a process belongs to a process within the target control level based on the detailed information of the process, it is specifically used to: if the target control level is user level, determine whether the user who starts the process belongs to a user to which the target security control policy applies based on the user information corresponding to the session identifier in the detailed information of the process; if so, determine that it is a process within the target control level; if not, determine that it is not a process within the target control level; if the target control level is session level, determine whether the session to which the process belongs belongs to a session to which the target security control policy applies based on the session identifier in the detailed information of the process; if so, determine that it is a process within the target control level; if not, determine that it is not a process within the target control level; if the target control level is machine level, directly determine that it is a process within the target control level.

[0127] Further optionally, the processor 40a is also used to: run the program code corresponding to the user-state message distribution module to receive the policy message dynamically sent by the security management node when the security control policy is updated, parse the updated security control policy from the policy message, and provide the updated security control policy to the security control execution module.

[0128] Furthermore, if Figure 4 As shown, the electronic device also includes: a communication component 40c, a power supply component 40d, and other components. Figure 4 Only some components are shown schematically, which does not mean that the electronic device only includes Figure 4 Components shown.

[0129] The detailed implementation and beneficial effects of each module in this embodiment have been described in detail in the aforementioned embodiments and will not be elaborated here.

[0130] remove Figure 4 In addition to the electronic device shown in the figure, the embodiment of the present application also provides another electronic device. Figure 4 The electronic devices shown have the same or similar implementation structures, so they are not shown in the figure again. Figure 4The difference between the electronic devices of the illustrated embodiments is mainly that the functions implemented by the processor executing various program codes stored in the memory are different. Specifically, the processor in the electronic device of this embodiment executes various program codes stored in the memory to implement the following functions:

[0131] Run the program code corresponding to the security control monitoring module to monitor whether a process is created on the host machine through the system kernel module, and when it is detected that a process is created, obtain the detailed information of the process according to the process identifier; and identify whether the process is allowed to run according to the detailed information of the process and the security control policy used for the cloud application environment, and when it is identified that the process is prohibited from running, provide the process identifier to the security control execution module; and run the program code corresponding to the security control execution module to prohibit the process identified by the identifier from running when receiving the process identifier provided by the security control monitoring module.

[0132] In an optional embodiment, the processor runs the program code corresponding to the security control monitoring module to monitor whether a process is created on the host machine through the system kernel module, and when it is detected that a process is created, obtains the details of the process according to the process identifier. It is specifically used to: run the program code corresponding to the security control monitoring module to call the callback registration function provided by the system kernel module at startup, and register the callback function with the system kernel module; obtain the identifier of the process created by the system kernel module through the callback function; obtain detailed information of the process according to the identifier of the process; wherein, the system kernel module passes the identifier of the process to the callback function when creating the process.

[0133] In an optional embodiment, when the processor identifies whether a process is allowed to run based on the detailed information of the process and the security control policy used for the cloud application environment, it is specifically used to: when there are multiple security control policies, determine the currently effective target security control policy from the multiple security control policies; based on the detailed information of the process, query whether the process is in the blacklist or whitelist of the target security control policy; if it is in the blacklist or not in the whitelist, determine that the process is prohibited from running; otherwise, determine that the process is allowed to run.

[0134] Optionally, when the processor determines the currently effective target security control policy from multiple security control policies, it is specifically used to: determine the security control policy with the highest priority as the target security control policy based on the priorities of the multiple security control policies; or determine the security control policy indicated by the effective instruction as the target security control policy based on the latest effective instruction issued by the security management and control node, wherein the security management and control node dynamically issues the effective instruction according to application requirements.

[0135] Optionally, before querying whether the process is in the blacklist or whitelist of the target security control policy based on the detailed information of the process, the processor is also used to: determine whether the process belongs to a process within a target control level based on the detailed information of the process, the target control level is the control level corresponding to the target security control policy; if so, execute an operation of querying whether the process is in the blacklist or whitelist of the target security control policy based on the detailed information of the process.

[0136] Optionally, when the processor determines whether a process belongs to a process within a target control level based on the detailed information of the process, it is specifically used to: if the target control level is user level, determine whether the user who starts the process belongs to a user to which the target security control policy applies based on the user information corresponding to the session identifier in the detailed information of the process; if so, determine that it is a process within the target control level; if not, determine that it is not a process within the target control level; if the target control level is session level, determine whether the session to which the process belongs belongs to a session to which the target security control policy applies based on the session identifier in the detailed information of the process; if so, determine that it is a process within the target control level; if not, determine that it is not a process within the target control level; if the target control level is machine level, directly determine that it is a process within the target control level.

[0137] Further optionally, the processor is also used to: run the program code corresponding to the user-state message distribution module to receive the policy message dynamically sent by the security management node when the security control policy is updated, parse the updated security control policy from the policy message, and provide the updated security control policy to the security control monitoring module.

[0138] The exemplary embodiment of the present application also provides a computer program product, which includes a computer program and / or instructions. When the computer program and / or instructions are executed by a processor, the processor is enabled to perform the steps in the above method embodiment. The detailed implementation and beneficial effects of each module in this embodiment have been described in detail in the above embodiments, and will not be elaborated here.

[0139] The exemplary embodiment of the present application also provides a computer-readable storage medium storing a computer program / instruction, which, when executed by a processor, enables the processor to implement the steps in the above method. The detailed implementation and beneficial effects of each module in this embodiment have been described in detail in the aforementioned embodiments, and will not be elaborated here.

[0140] The above-mentioned memory can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read only memory (EEPROM), erasable programmable read only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0141] The above-mentioned communication component is configured to facilitate wired or wireless communication between the device where the communication component is located and other devices. The device where the communication component is located can access a wireless network based on a communication standard, such as WiFi, 2G, 3G, 4G / LTE, 5G and other mobile communication networks, or a combination thereof. In an exemplary embodiment, the communication component receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be based on Radio Frequency Identification (RFID) technology, Infrared Data Association (IrDA) technology, Ultra Wide Band (UWB) technology, Bluetooth (BT) technology and other technologies.

[0142] The above-mentioned display includes a screen, and the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundary of a touch or slide action, but also detect the duration and pressure associated with the touch or slide operation.

[0143] The power supply assembly provides power to various components of the device where the power supply assembly is located. The power supply assembly may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device where the power supply assembly is located.

[0144] The above-mentioned audio component can be configured to output and / or input audio signals. For example, the audio component includes a microphone (Microphone, MIC), and when the device where the audio component is located is in an operating mode, such as a call mode, a recording mode, and a speech recognition mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in a memory or sent via a communication component. In some embodiments, the audio component also includes a speaker for outputting an audio signal.

[0145] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-readable storage media (including but not limited to disk storage, compact disc read-only memory (Compact Disc Read-Only Memory, CD-ROM), optical storage, etc.) containing computer-usable program code.

[0146] The present application is described with reference to the flowchart and / or block diagram of the method, device (system) and computer program product according to the embodiment of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, and the combination of the process and / or box in the flowchart and / or block diagram can be realized by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for realizing the function specified in one process or multiple processes in the flowchart and / or one box or multiple boxes in the block diagram.

[0147] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0148] These computer program instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0149] In a typical configuration, a computing device includes one or more processors (Central Processing Unit, CPU), input / output interface, network interface and memory.

[0150] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0151] Computer readable media include permanent and non-permanent, removable and non-removable media that can be used to store information by any method or technology. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase-change random access memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0152] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0153] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A security control method for a cloud application environment, characterized in that: A security control component applied to a host computer where a cloud application is located, the security control component comprising: a security control execution module in user state and a security control monitoring module in kernel state, the security control monitoring module being different from a system kernel module in kernel state, the method comprising: The security control monitoring module monitors whether a process is created on the host machine through the system kernel module, and provides the identifier of the process to the security control execution module when a process is detected to be created; The security control execution module obtains detailed information of the process according to the identifier of the process, and controls the operation of the process according to the detailed information of the process and the security control policy for the cloud application environment.

2. The method according to claim 1, characterized in that: The security control monitoring module monitors whether a process is created on the host machine through the system kernel module, and provides the identifier of the process to the security control execution module when a process is detected to be created, including: The security control monitoring module calls the callback registration function provided by the system kernel module when starting up, and registers the callback function with the system kernel module; The identifier of the process created by the system kernel module is obtained through the callback function and provided to the security control execution module; wherein the system kernel module passes the identifier of the process to the callback function when creating the process.

3. The method according to claim 1, characterized in that: The security control execution module controls the operation of the process according to the detailed information of the process and the security control policy for the cloud application environment, including: In the case where there are multiple security control strategies, the security control execution module determines a currently effective target security control strategy from the multiple security control strategies; According to the detailed information of the process, it is queried whether the process is in the blacklist or whitelist of the target security control policy. If the process is in the blacklist or not in the whitelist, the process is prohibited from running.

4. The method according to claim 3, characterized in that The security control execution module determines a currently effective target security control policy from the multiple security control policies, including: According to the priorities of the multiple security control policies, determining the security control policy with the highest priority as the target security control policy; or According to the latest effective instruction issued by the security control node, the security control policy indicated by the effective instruction is determined to be the target security control policy, wherein the security control node dynamically issues the effective instruction according to application requirements.

5. The method according to claim 3, characterized in that: Before querying whether the process is in the blacklist or whitelist of the target security control policy according to the detailed information of the process, the method further includes: According to the detailed information of the process, determining whether the process belongs to a process within a target control level, where the target control level is a control level corresponding to the target security control policy; If so, an operation is performed to query whether the process is in the blacklist or whitelist of the target security control policy based on the detailed information of the process.

6. The method according to claim 5, characterized in that Judging whether the process belongs to a process within a target control level according to the detailed information of the process includes: If the target control level is user level, then judging whether the user who started the process belongs to the user to which the target security control policy applies according to the user information in the detailed information of the process; if so, determining that the process belongs to the target control level; if not, determining that the process does not belong to the target control level; If the target control level is the session level, determine whether the session to which the process belongs is a session to which the target security control policy applies based on the session identifier in the process details information; if so, determine that it is a process within the target control level; if not, determine that it is not a process within the target control level.

7. The method according to any one of claims 1 to 6, characterized in that: The security control component further includes: a user-mode message distribution module; the method further includes: The message distribution module receives a policy message dynamically sent by the security management and control node when the security control policy is updated, parses the updated security control policy from the policy message, and provides the updated security control policy to the security control execution module.

8. A security control method for a cloud application environment, characterized in that: A security control component applied to a host computer where a cloud application is located, the security control component comprising: a security control execution module in user state and a security control monitoring module in kernel state, the security control monitoring module being different from a system kernel module in kernel state, the method comprising: The security control monitoring module monitors whether a process is created on the host machine through the system kernel module, and when a process is detected to be created, obtains detailed information of the process according to an identifier of the process; and According to the detailed information of the process and the security control policy for the cloud application environment, identifying whether the process is allowed to run, and if it is identified that the process is prohibited from running, providing the identifier of the process to the security control execution module; The security control execution module prohibits the process from being performed when receiving the identifier of the process provided by the security control monitoring module.

9. A security control device for a cloud application environment, characterized in that: Deployed on a host machine where a cloud application is located, the device comprises: a security control execution module in user state and a security control monitoring module in kernel state, wherein the security control monitoring module is different from the system kernel module in the kernel state; The security control monitoring module is used to monitor whether a process is created on the host machine through the system kernel module, and provide the identifier of the process to the security control execution module when a process is detected to be created; The security control execution module is used to obtain detailed information of the process according to the identifier of the process, and to control the operation of the process according to the detailed information of the process and the security control policy for the cloud application environment.

10. A security control device for a cloud application environment, characterized in that: Deployed on a host machine where a cloud application is located, the device comprises: a security control execution module in user state and a security control monitoring module in kernel state, wherein the security control monitoring module is different from the system kernel module in the kernel state; The security control monitoring module is used to monitor whether a process is created on the host machine through the system kernel module, and if a process is detected to be created, obtain detailed information of the process according to the identifier of the process; and identify whether the process is allowed to run according to the detailed information of the process and the security control policy for the cloud application environment, and provide the identifier of the process to the security control execution module if it is identified that the process is prohibited from running; The security control execution module is used to prohibit the process from being carried out when receiving the identifier of the process provided by the security control monitoring module.

11. An electronic device, characterized in that: The electronic device can be implemented as a host machine where a cloud application is located, and includes: a memory and a processor; the memory stores a computer program corresponding to a security control component, and the processor is coupled to the memory for executing the computer program to implement the steps in the method described in any one of claims 1 to 7 and claim 8.

12. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the processor is enabled to implement the steps of the method according to any one of claims 1 to 7 and claim 8.

Images