Privacy protection controllable method and system for limiting information leakage of terminal, and medium

Abstract

The invention provides a privacy protection controllable method and system for limiting terminal information leakage and a medium, and the method comprises the steps: obtaining a process descriptor of a process when it is monitored that the process successfully opens a file of a preset security domain for the first time; the process descriptor is modified such that any write operation of the process is discarded. According to the method, by changing the process descriptor of the sensitive process, the sensitive process is prevented from leaking the information of the security domain to the visual terminal, the situation that an external application obtains the information of the security domain by monitoring data output by the visual terminal is avoided, and the risk of data leakage in the security domain is reduced.

Description

Technical Field

[0001] The present invention belongs to the field of computer network technology, and in particular relates to a controllable privacy protection method, system and medium for limiting terminal information leakage. Background Art

[0002] Application No. 202311241074.X "A method for controllable use of data" provides a new paradigm for privacy computing, that is, the storage logical partitions in the storage / computing nodes of the data user are divided into security domains controlled by the data provider, ensuring that private data can only be processed in the security domain and cannot flow out of the security domain. This ensures that although the private data of the data provider is visible to the data user, it prevents the data user from copying the private data out of the security domain in various ways for secondary sales. This solution can run properly in a single machine, ensuring that no process can violate restrictions and illegally copy data, but it is not applicable to distributed clusters such as federated learning.

[0003] However, in actual applications, the process is only restricted from writing data to the non-secure domain or another secure domain after reading data in the secure domain, and it is not prohibited from writing data to all devices. For example, the process can write data to the visual terminal (display or other character devices, etc.), and writing to the device is not prohibited. Therefore, the process can write data to the visual terminal at any time, and many applications on the market can monitor and record the output information of the visual terminal, so the data in the secure domain still has a certain risk of leakage. Summary of the invention

[0004] In view of the defects in the prior art, the present invention provides a controllable privacy protection method, system and medium for limiting terminal information leakage, thereby reducing the risk of data leakage in the security domain.

[0005] In a first aspect, a controllable privacy protection method for limiting information leakage by a terminal includes:

[0006] When it is detected that a process successfully opens a file in a preset security domain for the first time, a process descriptor of the process is obtained;

[0007] The process descriptor is modified so that any write operations of the process are discarded.

[0008] Furthermore, modifying the process descriptor specifically includes:

[0009] Obtaining a file open table in the process descriptor;

[0010] Disable or replace the entry for standard output in the file open table.

[0011] Further, replacing the table entry of the standard output in the file opening table specifically includes:

[0012] Replace the entry for standard output in the file open table with the file structure for the / dev / null device.

[0013] In a second aspect, a controllable privacy protection system for limiting information leakage by a terminal includes:

[0014] A monitoring unit: configured to obtain a process descriptor of a process when it is detected that a process successfully opens a file in a preset security domain for the first time;

[0015] Modification unit: used for modifying the process descriptor so that any write operation of the process is discarded.

[0016] Furthermore, the modification unit is specifically used for:

[0017] Obtaining a file open table in the process descriptor;

[0018] Disable or replace the entry for standard output in the file open table.

[0019] Furthermore, the modification unit is specifically used for:

[0020] Replace the entry for standard output in the file open table with the file structure for the / dev / null device.

[0021] In a third aspect, a privacy protection controllable system for limiting terminal information leakage includes a processor, an input device, an output device and a memory, wherein the processor, input device, output device and memory are interconnected, wherein the memory is used to store a computer program, and the computer program includes program instructions, and the processor is configured to call the program instructions to execute the method of the first aspect.

[0022] According to a fourth aspect, a computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a processor, the processor executes the method according to the first aspect.

[0023] It can be seen from the above technical solution that the privacy protection controllable method, system and medium for limiting terminal information leakage provided by the present invention prevent sensitive processes from leaking security domain information to the visualization terminal by changing the process descriptor of sensitive processes, thereby avoiding external applications from obtaining security domain information by monitoring the output data of the visualization terminal, and reducing the risk of data leakage in the security domain. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following is a brief introduction to the drawings required for the specific embodiments or the description of the prior art. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn according to the actual scale.

[0025] Figure 1 A flowchart of a controllable privacy protection method provided in an embodiment.

[0026] Figure 2 A module block diagram of a controllable privacy protection system provided in an embodiment. DETAILED DESCRIPTION

[0027] The embodiments of the technical solution of the present invention will be described in detail below in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and are therefore only used as examples, and the protection scope of the present invention cannot be limited thereto. It should be noted that, unless otherwise specified, the technical terms or scientific terms used in this application should be the common meanings understood by those skilled in the art to which the present invention belongs.

[0028] It should be understood that when used in this specification and the appended claims, the terms "include" and "comprises" indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0029] It should also be understood that the terms used in this specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the specification of the present invention and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0030] As used in this specification and the appended claims, the term "if" may be interpreted as "when" or "upon" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrases "if it is determined" or "if [described condition or event] is detected" may be interpreted as meaning "upon determination" or "in response to determining" or "upon detection of [described condition or event]" or "in response to detecting [described condition or event]," depending on the context.

[0031] Example:

[0032] A privacy-preserving controllable method to limit information leakage from terminals, see Figure 1 ,include:

[0033] When it is detected that a process successfully opens a file in a preset security domain for the first time, a process descriptor of the process is obtained;

[0034] The process descriptor is modified so that any write operations of the process are discarded.

[0035] In this embodiment, Linux's VFS (virtual file system) will hide different driver functions in various devices in the kernel part, and only present a unified file interface to the outside, so that no matter whether writing data to external devices such as network cards, displays or disks, you only need to call the write function to write data to any external device. When a process reads and writes a file, it does not know which external device or external file its file open table entry or file descriptor corresponds to. And there is no hook function corresponding to read or write in the LSM framework, so when a process successfully opens an external file or external device, the general operation of the process on the external file or external device cannot be captured.

[0036] In this embodiment, after the process successfully opens the file, it is difficult to effectively restrict the behavior of the process under the existing framework. Whether the file of the preset security domain is successfully opened can be judged by the domain_id where the file is located. If the domain_id where the file is located is greater than 0, and the operation of opening the file is successful, the file of the preset security domain is considered to be successfully opened. In general, the process directly calls the read or write function in the ops function pointer list corresponding to the file structure, so this method modifies the process descriptor of the process. The content stored in the security domain is mainly privacy data, and the privacy data cannot be copied or leaked outside the security domain in a conventional manner. At the same time, considering that the process that has not read the security domain cannot be affected when reading and writing devices, this method modifies the process descriptor after the process successfully opens the file of the preset security domain for the first time, so that any subsequent write operations of the process will be discarded.

[0037] The method prevents sensitive processes from leaking security domain information to visualization terminals by changing the process descriptors of sensitive processes, avoids external applications from obtaining security domain information by monitoring the output data of visualization terminals, and reduces the risk of data leakage in the security domain.

[0038] Further, in some embodiments, modifying the process descriptor specifically includes:

[0039] Obtaining a file open table in the process descriptor;

[0040] Disable or replace the entry for standard output in the file open table.

[0041] In this embodiment, the user generally logs in to the Linux system as an ordinary user. The bash or login shell of the Linux system is created by the login process. When bash is created, it inherits three entries in the file open table of the parent process, which are the entries with subscripts 0, 1, and 2, respectively, wherein the entry with subscript 0 is the standard input, the entry with subscript 1 is the standard output, and the entry with subscript 2 is the standard error. Therefore, whether the process runs the commands that come with the Linux system (such as cat, cp, etc.), or compiles and runs a custom program by itself, it will inherit these three file descriptors in bash. Therefore, if the process does not need to perform some redirection behaviors, then the process can directly write data to the standard output through write at any time, or call the print function in the upper package. The device file corresponding to the standard output is stdout under / dev, which is a symbolic link, generally linked to a device file under the / dev folder (such as / proc / self / fd / 1 of the display). The / proc folder is the kernel mapping the process in the VFS in the form of a file, most of which are read-only, and the user can understand the information of the process by reading the information of the file.

[0042] In this embodiment, the table entry of the file open table in the process only records the pointer to the system file open table, and the specific information and metadata of the file will not be recorded. When the process calls commands such as dup, different table entries or file descriptors in the file open table can point to the same table entry in the system open table. When the process fork inherits the file descriptor, the file descriptors of the two processes can point to the same table entry in the system open table. In addition, the system also has an i-node table, and the unique identifier of the file is its i-node. Therefore, the reading and writing of a file will be on its i-node node, and the i-node will store the file-related type, metadata, and the operation function of the file. When the process calls open for the same file multiple times, two table entries in the system file open table can point to the same i-node table entry.

[0043] In this embodiment, because the process behavior cannot be changed, the corresponding file descriptor cannot be directly closed. If the inherited file descriptor is closed, the process needs to re-enter the system's file permission management if it wants to open an external device again. Therefore, when modifying the process descriptor, the method can disable or replace the corresponding table entry in the file open table.

[0044] Further, in some embodiments, replacing the table entry of the standard output in the file open table specifically includes:

[0045] Replace the entry for standard output in the file open table with the file structure for the / dev / null device.

[0046] In this embodiment, when a process successfully opens a file in a security domain for the first time, the method obtains the file structure corresponding to its task_struct (i.e., process descriptor), directly modifies the entry with subscript 1 in its file open table, and replaces it with the file structure for the / dev / null device. In Linux, any write operation to the / dev / null device will be directly discarded.

[0047] A privacy-preserving controllable system that limits information leakage from terminals, see Figure 2 ,include:

[0048] A monitoring unit: configured to obtain a process descriptor of a process when it is detected that a process successfully opens a file in a preset security domain for the first time;

[0049] Modification unit: used for modifying the process descriptor so that any write operation of the process is discarded.

[0050] Furthermore, in some embodiments, the modification unit is specifically configured to:

[0051] Obtaining a file open table in the process descriptor;

[0052] Disable or replace the entry for standard output in the file open table.

[0053] Furthermore, in some embodiments, the modification unit is specifically configured to:

[0054] Replace the entry for standard output in the file open table with the file structure for the / dev / null device.

[0055] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0056] In the several embodiments provided in the present application, it should be understood that the disclosed system can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, or it can be an electrical, mechanical or other form of connection.

[0057] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiments of the present invention.

[0058] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0059] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0060] The system provided in the embodiment of the present invention is briefly described. For matters not mentioned in the embodiment part, reference may be made to the corresponding contents in the aforementioned embodiment.

[0061] A controllable privacy protection system for limiting terminal information leakage includes a processor, an input device, an output device and a memory, wherein the processor, the input device, the output device and the memory are interconnected, wherein the memory is used to store a computer program, the computer program includes program instructions, and the processor is configured to call the program instructions to execute the above method.

[0062] It should be understood that in the embodiments of the present invention, the processor referred to may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0063] Input devices may include a touchpad, a fingerprint sensor (for collecting the user's fingerprint information and fingerprint direction information), a microphone, etc., and output devices may include a display (LCD, etc.), a speaker, etc.

[0064] The memory may include a read-only memory and a random access memory, and provide instructions and data to the processor. A portion of the memory may also include a non-volatile random access memory. For example, the memory may also store information about the device type.

[0065] The system provided in the embodiment of the present invention is briefly described. For matters not mentioned in the embodiment part, reference may be made to the corresponding contents in the aforementioned embodiment.

[0066] A computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a processor, the processor executes the above method.

[0067] The computer-readable storage medium may be an internal storage unit of the terminal described in any of the foregoing embodiments, such as a hard disk or memory of the terminal. The computer-readable storage medium may also be an external storage device of the terminal, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the terminal. Further, the computer-readable storage medium may also include both an internal storage unit of the terminal and an external storage device. The computer-readable storage medium is used to store the computer program and other programs and data required by the terminal. The computer-readable storage medium may also be used to temporarily store data that has been output or is to be output.

[0068] The medium provided in the embodiments of the present invention is briefly described. For matters not mentioned in the embodiments, reference may be made to the corresponding contents in the aforementioned embodiments.

[0069] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein by equivalents. These modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be included in the scope of the claims and specification of the present invention.

Claims

1. A controllable privacy protection method for limiting terminal information leakage, characterized in that: include: When it is detected that a process successfully opens a file in a preset security domain for the first time, a process descriptor of the process is obtained; The process descriptor is modified so that any write operations of the process are discarded.

2. According to claim 1, the privacy protection controllable method for limiting terminal information leakage is characterized in that: Modifying the process descriptor specifically includes: Obtaining a file open table in the process descriptor; Disable or replace the entry for standard output in the file open table.

3. According to claim 2, the privacy protection controllable method for limiting terminal information leakage is characterized in that: The table items that replace the standard output in the file open table specifically include: Replace the entry for standard output in the file open table with the file structure for the / dev / null device.

4. A privacy protection controllable system for limiting terminal information leakage, characterized in that: include: A monitoring unit: configured to obtain a process descriptor of a process when it is detected that a process successfully opens a file in a preset security domain for the first time; Modification unit: used for modifying the process descriptor so that any write operation of the process is discarded.

5. According to claim 4, the privacy protection controllable system for limiting terminal information leakage is characterized in that: The modification unit is specifically used for: Obtaining a file open table in the process descriptor; Disable or replace the entry for standard output in the file open table.

6. The privacy protection controllable system for limiting terminal information leakage according to claim 5 is characterized in that: The modification unit is specifically used for: Replace the entry for standard output in the file open table with the file structure for the / dev / null device.

7. A privacy protection controllable system for limiting terminal information leakage, characterized in that: The method comprises a processor, an input device, an output device and a memory, wherein the processor, the input device, the output device and the memory are interconnected, wherein the memory is used to store a computer program, the computer program comprises program instructions, and the processor is configured to call the program instructions to execute the method according to any one of claims 1 to 3.

8. A computer-readable storage medium, characterized in that: The computer storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a processor, the processor is caused to perform the method according to any one of claims 1 to 3.

Images