File access control method and system based on file extension attribute of operating system

Abstract

The invention discloses a file access control method and system based on file extension attributes of an operating system, belongs to the technical field of file access, and aims to solve the technical problem of how to realize an integral thought of file access control and quickly provide fine-grained access control for files. Comprising the following steps: setting a security mark attribute for a specified file through a user mode file attribute management module to obtain an extension attribute, and configuring the extension attribute of the specified file; a kernel mode file access control module is constructed, a file access control realization function is realized based on a filepersion interface, and a security control strategy is added in the file access control realization function; performing access control on read-write operation of the specified file based on a security control strategy in the file access control function, and writing read-write operation information of the specified file and current time into an audit log; reading the extended attribute of the specified file from the source file, and copying the extended attribute into the target file.

Description

Technical Field

[0001] The present invention relates to the technical field of file access, in particular to a file access control method and system based on operating system file extension attributes. Background Art

[0002] The emergence of the trusted operating system is to meet the needs of specific trusted applications, especially when dealing with critical applications and data, its importance becomes more prominent. With the advancement of digital transformation, the security and privacy protection of various data have become particularly important. In the trusted environment, running applications often generate a large amount of sensitive data, which has a high security level. Any unauthorized access may lead to serious consequences, so strict control measures must be taken.

[0003] In order to meet this challenge, operating system vendors have continuously innovated in the security field and developed a variety of functions to improve the security level of the operating system. Among them, file management is a key area, because the leakage of file content is often one of the root causes of information security incidents. The operating system introduces a series of security access control technologies to restrict the reading and writing of files from multiple aspects to ensure the security of confidential files.

[0004] Various operating system vendors restrict file access from different technical perspectives and have not formed a unified file access control method. How to implement an overall idea of ​​file access control and quickly provide fine-grained access control to files is a technical problem that needs to be solved. Summary of the invention

[0005] The technical task of the present invention is to address the above shortcomings and provide a file access control method and system based on operating system file extension attributes to solve the technical problem of how to implement an overall idea of ​​file access control and quickly provide fine-grained access control to files.

[0006] In a first aspect, the present invention provides a file access control method based on operating system file extension attributes, which is used to implement mandatory access control of files from multiple dimensions by a trusted operating system, and includes the following steps: Construct a user-mode file attribute management module and a kernel-mode extended attribute management module, set security mark attributes for a specified file through the user-mode file attribute management module to obtain extended attributes, the user-mode file attribute management module calls the kernel-mode extended attribute management module through a system call interface, and configures the extended attributes of the specified file through the kernel-mode extended attribute management module; Construct a kernel-mode file access control module, configure the module initialization method and module exit method of the kernel-mode file access control module, implement the file access control implementation function based on the file_permission interface in the module initialization method, add a security control strategy to the file access control implementation function, and the security control strategy is used to perform access control on the read and write operations of the file based on the extended attributes set by the user; When the user state performs read and write operations on the specified file, the kernel state file read and write operations are accessed through the system call interface. When the kernel state performs file read and write operations, the file access control module configured in the kernel state is called. The file access control module calls the file access control function based on the file_permission interface, performs access control on the read and write operations of the specified file based on the security control policy in the file access control function, and writes the read and write operation information of the specified file and the current time into the audit log; When a file copy operation is performed on a specified file in user mode, the file copy operation in kernel mode is accessed through a system call interface. When the specified file is read from a source file in kernel mode and the specified file is copied to a target file, the extended attributes of the specified file are read from the source file and copied to the target file.

[0007] Preferably, the user-mode file attribute management module is a command line tool for supporting the user to set extended attributes for a specified file and configure the extended attributes based on commands; The commands in the user-mode file attribute management module include protect, unprotect, show, and help. protect is a protection mode that supports users to set extended attributes. unprotect is a non-protection mode that supports users to configure extended attributes. show is used to display the security attribute value of the specified file. help is used for command help information. Configuring the extended attributes of the specified file includes adding, modifying, deleting and viewing the extended attributes of the specified file.

[0008] Preferably, the user sets the security tag attributes of the file size File-Size-Limit, the number of accesses Access-Count and the access time Time-Field for the specified file, and obtains the security attributes as extended attributes, wherein the extended attributes include access-count-max, access-count-min, file-size-limit, time-field-end and time-field-start, access-count-max means the upper limit of the interval for limiting the number of file accesses, access-count-min means the lower limit of the interval for limiting the number of file accesses, file-size-limit means the upper limit of the file read and write size, time-field-end means the end time of the file read and write, and time-field-start means the start time of the file read and write; Correspondingly, the security control strategies include the following: Time-based read and write access control: When the security tag attribute Time-Field is not NULL, it indicates the time range in which read and write operations are allowed. When the time when the read and write access behavior occurs is within the Time-Field, the read and write operation is allowed and the file content is output. Otherwise, access denial information is returned. Read and write operation access control based on access count: When the security tag Access-Count is not NULL, it indicates the number of times that read and write operations are allowed. When the access count of read and write operations is less than or equal to min times or greater than or equal to max times, read and write operations are allowed and file contents are output. Otherwise, access denial information is returned. Read and write operation access control based on file size: When the security tag File-Size-Limit is not NULL, it indicates the maximum file size allowed for read and write operations. When the file is less than or equal to the predetermined bytes, read and write operations are allowed and the file content is output. Otherwise, access denial information is returned.

[0009] Preferably, when the read and write operation information of the specified file and the current time are written into the audit log, the format is: xx year xx month xx day, xx hour xx minute xx second, xx attempts to read xx file, success / failure, violation / compliance, time / number of accesses / file size access control policy.

[0010] Preferably, the system call interface includes fsetxattr, fgetxattr, fremovexattr and copy_file_range, fsetxattr means setting the extended attributes of a file, fgetxattr means getting the extended attributes of a file, fremovexattr means removing the extended attributes of a file, and copy_file_range means copying a part of a file to another file.

[0011] In a second aspect, the present invention provides a file access control system based on operating system file extended attributes, which is used to implement file access control by using a file access control method based on operating system file extended attributes as described in any one of the first aspects, wherein the system includes a user-mode file attribute management device, a kernel-mode file access control device, a file read and write operation management device, and a file copy operation management device; The user state file attribute management device is used to perform the following: construct a user state file attribute management module and a kernel state extended attribute management module, set a security mark attribute on a specified file through the user state file attribute management module to obtain an extended attribute, the user state file attribute management module calls the kernel state extended attribute management module through a system call interface, and configures the extended attribute of the specified file through the kernel state extended attribute management module; The kernel state file access control device is used to perform the following: construct a kernel state file access control module, configure a module initialization method and a module exit method of the kernel state file access control module, in the module initialization method, implement a file access control implementation function based on the file_permission interface, add a security control strategy to the file access control implementation function, and the security control strategy is used to perform access control on the read and write operations of the file based on the extended attributes set by the user; The file read and write operation management device is used to perform the following: when performing read and write operations on a specified file in the user state, access the file read and write operations in the kernel state through the system call interface, and when performing file read and write operations in the kernel state, call the file access control module configured in the kernel state, the file access control module calls the file access control function based on the file_permission interface, performs access control on the read and write operations of the specified file based on the security control policy in the file access control function, and writes the read and write operation information of the specified file and the current time into the audit log; The file copy operation management device is used to perform the following: when a file copy operation is performed on a designated file in user mode, the file copy operation in kernel mode is accessed through a system call interface; when a designated file is read from a source file in kernel mode and the designated file is copied to a target file, the extended attributes of the designated file are read from the source file and the extended attributes are copied to the target file.

[0012] Preferably, the user-mode file attribute management module is a command line tool for supporting the user to set extended attributes for a specified file and configure the extended attributes based on commands; The commands in the user-mode file attribute management module include protect, unprotect, show, and help. protect is a protection mode that supports users to set extended attributes. unprotect is a non-protection mode that supports users to configure extended attributes. show is used to display the security attribute value of the specified file. help is used for command help information. Configuring the extended attributes of the specified file includes adding, modifying, deleting and viewing the extended attributes of the specified file.

[0013] Preferably, the user sets the security tag attributes of the file size File-Size-Limit, the number of accesses Access-Count and the access time Time-Field for the specified file, and obtains the security attributes as extended attributes, wherein the extended attributes include access-count-max, access-count-min, file-size-limit, time-field-end and time-field-start, access-count-max means the upper limit of the interval for limiting the number of file accesses, access-count-min means the lower limit of the interval for limiting the number of file accesses, file-size-limit means the upper limit of the file read and write size, time-field-end means the end time of the file read and write, and time-field-start means the start time of the file read and write; Correspondingly, the security control strategies include the following: Time-based read and write access control: When the security tag attribute Time-Field is not NULL, it indicates the time range in which read and write operations are allowed. When the time when the read and write access behavior occurs is within the Time-Field, the read and write operation is allowed and the file content is output. Otherwise, access denial information is returned. Read and write operation access control based on access count: When the security tag Access-Count is not NULL, it indicates the number of times that read and write operations are allowed. When the access count of read and write operations is less than or equal to min times or greater than or equal to max times, read and write operations are allowed and file contents are output. Otherwise, access denial information is returned. Read and write operation access control based on file size: When the security tag File-Size-Limit is not NULL, it indicates the maximum file size allowed for read and write operations. When the file is less than or equal to the predetermined bytes, read and write operations are allowed and the file content is output. Otherwise, access denial information is returned.

[0014] Preferably, when the read and write operation information of the specified file and the current time are written into the audit log, the format is: xx year xx month xx day, xx hour xx minute xx second, xx attempts to read xx file, success / failure, violation / compliance, time / number of accesses / file size access control policy.

[0015] Preferably, the system call interface includes fsetxattr, fgetxattr, fremovexattr and copy_file_range, fsetxattr means setting the extended attributes of a file, fgetxattr means getting the extended attributes of a file, fremovexattr means removing the extended attributes of a file, and copy_file_range means copying a part of a file to another file.

[0016] The file access control method and system based on operating system file extended attributes of the present invention have the following advantages: realizing a kernel-state file access control module and a user-state file attribute management module, supporting user-state setting of extended attributes of file access restrictions such as file size, access count, access time, etc., supporting kernel-state file reading and writing access control, supporting kernel-state file reading and writing audit logs, supporting kernel-state file extended attribute copying, realizing mandatory access control of files from multiple dimensions such as access time, file size, access count, etc. by the trusted operating system, improving the overall security of the trusted operating system, and ensuring the data security of trusted applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] The present invention is further described below in conjunction with the accompanying drawings.

[0019] Figure 1 This is a block diagram of the working principle of a file access control method based on operating system file extension attributes in Example 1. DETAILED DESCRIPTION

[0020] The present invention is further described below in conjunction with the accompanying drawings and specific embodiments so that those skilled in the art can better understand the present invention and implement it. However, the embodiments are not intended to limit the present invention. In the absence of conflict, the embodiments of the present invention and the technical features in the embodiments may be combined with each other.

[0021] The embodiment of the present invention provides a file access control method and system based on operating system file extension attributes, which are used to solve the technical problem of how to implement an overall idea of ​​file access control and quickly provide fine-grained access control for files.

[0022] Embodiment 1: A file access control method based on operating system file extended attributes, including user state file attribute management, kernel state file access control, file read and write operation management, and file copy operation management.

[0023] Step S100 user-state file attribute management: construct a user-state file attribute management module and a kernel-state extended attribute management module, set security mark attributes for the specified file through the user-state file attribute management module to obtain extended attributes, the user-state file attribute management module calls the kernel-state extended attribute management module through the system call interface, and configures the extended attributes of the specified file through the kernel-state extended attribute management module.

[0024] In this embodiment, the user-mode file attribute management module is used as a command line tool to support users to set extended attributes for designated files and configure the extended attributes based on commands.

[0025] As shown in Table 1, the commands in the user-mode file attribute management module include protect, unprotect, show, and help. protect is a protection mode used to support users to set extended attributes. Unprotect is a non-protection mode used to support users to configure extended attributes. Show is used to display the security attribute value of the specified file. Help is used for command help information. Among them, configuring the extended attributes of the specified file includes adding, modifying, deleting, and viewing the extended attributes of the specified file.

[0026] Table 1. Commands and their meanings

[0027] As a specific implementation of the extended attribute, its content is shown in Table 2. The user sets the security tag attributes of the file size File-Size-Limit, the access count Access-Count, and the access time Time-Field for the specified file, and obtains the security attributes as extended attributes, where the extended attributes include access-count-max, access-count-min, file-size-limit, time-field-end, and time-field-start. Access-count-max means the upper limit of the interval for limiting the number of file accesses, access-count-min means the lower limit of the interval for limiting the number of file accesses, file-size-limit means the upper limit of the file read and write size, time-field-end means the end time of the file read and write, and time-field-start means the start time of the file read and write.

[0028] Table 2. Safety mark attributes and meanings

[0029] As shown in Table 3, the user-mode file attribute management module in this embodiment implements functions such as setting, viewing, and deleting file extended attributes by calling the following system call interface.

[0030] Table 3. System call interface and meaning

[0031] An example of setting extended attributes is as follows: [root@master01 bin]# . / File attribute management module -f test.log / / Specify file protect / / Use protection command --time-field-start "2006-01-02T15:04:05Z" / / Set the start time for file reading --time-field-end "2016-01-02T15:04:05Z" / / Set the end time of file reading --access-count-min 10 / / Set the lower limit of the file access count interval --access-count-max 20 / / Set the upper limit of the range of file access counts --file-size-limit 100 / / Set the limit on file read and write size.

[0032] Check the extended attributes as follows: [root@master01 bin]# . / File attribute management module -f test.log show AccessTimeStart: 2006-01-02T23:04:05+08:00 AccessTimeEnd: 2016-01-02T23:04:05+08:00 AccessCountMax : 20 AccessCountMin : 10 FileSizeLimit : 100.

[0033] An example of deleting extended attributes is as follows: [root@master01 bin]# . / File attribute management module -f test.log unprotect.

[0034] Step S200 kernel state file access control: construct a kernel state file access control module, configure the module initialization method and module exit method of the kernel state file access control module, in the module initialization method, implement the file access control implementation function based on the file_permission interface, and add a security control policy to the file access control implementation function. The security control policy is used to perform access control on the read and write operations of the file based on the extended attributes set by the user.

[0035] In this embodiment, a kernel-mode file access control security module is implemented based on the operating system LSM framework to implement access control processing of security tags such as access time (Time-Field), access count (Access-Count), access size (File-Size-Limit), and record file operation audit logs.

[0036] In specific operations, a file access control security module is defined based on the LSM framework, and a module initialization method is implemented. In the module initialization method, a file access control implementation function is implemented based on the file_permission interface. In the file access control implementation function, security control strategies for access time (Time-Field), access count (Access-Count), and access size (File-Size-Limit) are added.

[0037] As a specific implementation of the security control strategy, it includes the following: (1) Time-based read and write access control: When the security tag attribute Time-Field is not NULL, it indicates the time range in which read and write operations are allowed. When the time when the read and write access behavior occurs is within the Time-Field, the read and write operation is allowed and the file content is output. Otherwise, access denial information is returned. (2) Read and write operation access control based on access count: When the security tag Access-Count is not NULL, it indicates the number of times the read and write operations are allowed to be performed. When the read and write operation access count is less than or equal to min times or greater than or equal to max times, the read and write operations are allowed to be performed and the file content is output. Otherwise, access denial information is returned. (3) Read and write operation access control based on file size: When the security tag File-Size-Limit is not NULL, it indicates the maximum file size allowed for read and write operations. When the file is less than or equal to the predetermined bytes, read and write operations are allowed and the file content is output. Otherwise, access denial information is returned.

[0038] Step S300 file read and write operation management: when performing read and write operations on the specified file in the user state, the file read and write operations in the kernel state are accessed through the system call interface. When the kernel state executes file read and write operations, the file access control module configured in the kernel state is called. The file access control module calls the file access control function based on the file_permission interface, performs access control on the read and write operations of the specified file based on the security control policy in the file access control function, and writes the read and write operation information of the specified file and the current time into the audit log.

[0039] Among them, when the read and write operation information of the specified file and the current time are written into the audit log, the format is: xx year xx month xx day, xx hour xx minute xx second, xx attempts to read xx file, success / failure, violation / compliance, time / number of accesses / file size access control policy.

[0040] The code sample for this step is as follows: / / Define file access control security module DEFINE_LSM(File Access Control Security Module) = { .name = "File access control security module name", .init = File access control security module initialization function, }; / / File access control security module initialization function static int __init file access control security module initialization function (void) { security_add_hooks(LSM module hook implementation function, ARRAY_SIZE(LSM module hook implementation function), "File access control security module"); return 0; } / / LSM module hook implementation function static structsecurity_hook_listLSM module hook implementation function[] __lsm_ro_after_init = { LSM_HOOK_INIT (file_permission, file access control implementation function) }; / / File access control implementation function static int file access control implementation function (struct file *file, int mask) { / / Get the file security extended attributes vfs_getxattr(file->f_path.dentry, "security attributes", buf, 1000); if (buf[0] != 0) { / / Implement security constraints such as file access count, file access time, file size limit, etc. } / / Record file access operation audit log kernel_write(log file, log information, strnlen(log information), log file cursor); }.

[0041] Step S400 file copy operation management: when performing a file copy operation on a specified file in user mode, the file copy operation in kernel mode is accessed through the system call interface. When the specified file is read from the source file in kernel mode and the specified file is copied to the target file, the extended attributes of the specified file are read from the source file and copied to the target file.

[0042] In this embodiment, this step modifies the system call function of the kernel-mode file copy, obtains security attributes such as file size, file access count, and file access time from the source file, and sets them to the extended attributes of the target file to ensure that the extended attributes are copied together when the file is copied.

[0043] The file copy system call interface is copy_file_range, which means copying part of a file to another file.

[0044] The following is a sample of the operation code: / / Modify the file copy system call of the operating system kernel SYSCALL_DEFINE6(copy_file_range, int, fd_in, loff_t __user *, off_in, int, fd_out, loff_t __user *, off_out, size_t, len, unsigned int, flags) { … / / Get the security attributes of the source file char buf

[512] = {0}; vfs_getxattr(f_in.file->f_path.dentry, security extended attributes, buf, 512); / / Set to the security extended attributes of the target file intbuflen = strlen(buf); if (buflen) { vfs_setxattr(f_out.file->f_path.dentry, security extended attributes, buf, buflen,XATTR_CREATE); … }.

[0045] The method of this embodiment implements a kernel-state file access control module and a user-state file attribute management module, supports user-state setting of extended attributes for file access restrictions such as file size, access count, and access time, supports kernel-state file reading and writing access control, supports kernel-state file reading and writing audit logs, supports kernel-state file extended attribute copying, and implements mandatory access control of files from multiple dimensions such as access time, file size, and access count by the trusted operating system, thereby improving the overall security of the trusted operating system and ensuring the data security of trusted applications.

[0046] Embodiment 2: The present invention provides a file access control system based on operating system file extension attributes, including a user state file attribute management device, a kernel state file access control device, a file read and write operation management device, and a file copy operation management device.

[0047] The user-state file attribute management device is used to perform the following: construct a user-state file attribute management module and a kernel-state extended attribute management module, set a security mark attribute for a specified file through the user-state file attribute management module to obtain an extended attribute, the user-state file attribute management module calls the kernel-state extended attribute management module through a system call interface, and configures the extended attribute of the specified file through the kernel-state extended attribute management module.

[0048] In this embodiment, the user-mode file attribute management module is used as a command line tool to support users to set extended attributes for designated files and configure the extended attributes based on commands.

[0049] The commands in the user-mode file attribute management module include protect, unprotect, show, and help. protect is a protection mode used to support users to set extended attributes. unprotect is a non-protection mode used to support users to configure extended attributes. show is used to display the security attribute value of the specified file. Help is used for command help information. Among them, configuring the extended attributes of the specified file includes adding, modifying, deleting, and viewing the extended attributes of the specified file.

[0050] As a specific implementation of the extended attributes, the user sets the security tag attributes of the file size File-Size-Limit, the access count Access-Count, and the access time Time-Field for the specified file, and obtains the security attributes as the extended attributes, wherein the extended attributes include access-count-max, access-count-min, file-size-limit, time-field-end, and time-field-start. Access-count-max means the upper limit of the interval for limiting the number of file accesses, access-count-min means the lower limit of the interval for limiting the number of file accesses, file-size-limit means the upper limit of the file read and write size, time-field-end means the end time of the file read and write, and time-field-start means the start time of the file read and write.

[0051] In this embodiment, the user-mode file attribute management module implements functions such as setting, viewing, and deleting file extended attributes by calling the following system call interface.

[0052] The system call interfaces include fsetxattr, fgetxattr, and fremovexattr. fsetxattr is used to set the extended attributes of a file, fgetxattr is used to get the extended attributes of a file, and fremovexattr is used to remove the extended attributes of a file.

[0053] The kernel-mode file access control device is used to perform the following: construct a kernel-mode file access control module, configure the module initialization method and module exit method of the kernel-mode file access control module, in the module initialization method, implement the file access control implementation function based on the file_permission interface, add a security control strategy to the file access control implementation function, and the security control strategy is used to perform access control on the read and write operations of the file based on the extended attributes set by the user.

[0054] In this embodiment, the kernel-mode file access control device is used to implement a kernel-mode file access control security module based on the operating system LSM framework, implement access control processing of security tags such as access time (Time-Field), access count (Access-Count), access size (File-Size-Limit), and record file operation audit logs.

[0055] In specific operations, a file access control security module is defined based on the LSM framework, and a module initialization method is implemented. In the module initialization method, a file access control implementation function is implemented based on the file_permission interface. In the file access control implementation function, security control strategies for access time (Time-Field), access count (Access-Count), and access size (File-Size-Limit) are added.

[0056] As a specific implementation of the security control strategy, it includes the following: (1) Time-based read and write access control: When the security tag attribute Time-Field is not NULL, it indicates the time range in which read and write operations are allowed. When the time when the read and write access behavior occurs is within the Time-Field, the read and write operation is allowed and the file content is output. Otherwise, access denial information is returned. (2) Read and write operation access control based on access count: When the security tag Access-Count is not NULL, it indicates the number of times the read and write operations are allowed to be performed. When the read and write operation access count is less than or equal to min times or greater than or equal to max times, the read and write operations are allowed to be performed and the file content is output. Otherwise, access denial information is returned. (3) Read and write operation access control based on file size: When the security tag File-Size-Limit is not NULL, it indicates the maximum file size allowed for read and write operations. When the file is less than or equal to the predetermined bytes, read and write operations are allowed and the file content is output. Otherwise, access denial information is returned.

[0057] The file read and write operation management device is used to perform the following: when performing read and write operations on a specified file in user mode, access the file read and write operations in kernel mode through a system call interface, call a file access control function when performing file read and write operations in kernel mode, perform access control on the read and write operations of the specified file based on the security control policy in the file access control function, and write the read and write operation information of the specified file and the current time into an audit log.

[0058] In this embodiment, when the read and write operation information of the specified file and the current time are written into the audit log, the format is: xx year xx month xx day, xx hour xx minute xx second, xx attempts to read xx file, success / failure, violation / compliance, time / number of accesses / file size access control policy.

[0059] The file copy operation management device is used to perform the following: when a file copy operation is performed on a designated file in user mode, the file copy operation in kernel mode is accessed through a system call interface; when a designated file is read from a source file in kernel mode and the designated file is copied to a target file, the extended attributes of the designated file are read from the source file and the extended attributes are copied to the target file.

[0060] In this embodiment, the file copy operation management device is used to modify the system call function of kernel-mode file copying, obtain security attributes such as file size, file access count, file access time, etc. from the source file, and set them to the extended attributes of the target file to ensure that the extended attributes are copied together when the file is copied.

[0061] The file copy system call interface is copy_file_range, which means copying part of a file to another file.

[0062] The method of this embodiment can implement file access control of the trusted operating system through the method disclosed in Example 1.

[0063] The file access control method and system based on operating system file extension attributes provided by the present invention are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A file access control method based on operating system file extension attributes, characterized in that: It is used to implement mandatory access control of files from multiple dimensions in the Xinchuang operating system, including the following steps: Construct a user-mode file attribute management module and a kernel-mode extended attribute management module, set security mark attributes for a specified file through the user-mode file attribute management module to obtain extended attributes, the user-mode file attribute management module calls the kernel-mode extended attribute management module through a system call interface, and configures the extended attributes of the specified file through the kernel-mode extended attribute management module; Construct a kernel-mode file access control module, configure the module initialization method and module exit method of the kernel-mode file access control module, implement the file access control implementation function based on the file_permission interface in the module initialization method, add a security control strategy to the file access control implementation function, and the security control strategy is used to perform access control on the read and write operations of the file based on the extended attributes set by the user; When the user state performs read and write operations on the specified file, the kernel state file read and write operations are accessed through the system call interface. When the kernel state performs file read and write operations, the file access control module configured in the kernel state is called. The file access control module calls the file access control function based on the file_permission interface, performs access control on the read and write operations of the specified file based on the security control policy in the file access control function, and writes the read and write operation information of the specified file and the current time into the audit log; When a file copy operation is performed on a specified file in user mode, the file copy operation in kernel mode is accessed through a system call interface. When the specified file is read from a source file in kernel mode and the specified file is copied to a target file, the extended attributes of the specified file are read from the source file and copied to the target file.

2. The file access control method based on operating system file extended attributes according to claim 1, characterized in that: The user-mode file attribute management module is a command line tool for supporting users to set and configure extended attributes for specified files based on commands; The commands in the user-mode file attribute management module include protect, unprotect, show, and help. protect is a protection mode that supports users to set extended attributes. unprotect is a non-protection mode that supports users to configure extended attributes. show is used to display the security attribute value of the specified file. help is used for command help information. Configuring the extended attributes of the specified file includes adding, modifying, deleting and viewing the extended attributes of the specified file.

3. The file access control method based on operating system file extended attributes according to claim 1, characterized in that: The user sets the security tag attributes of the file size File-Size-Limit, access count Access-Count, and access time Time-Field for the specified file, and obtains the security attributes as extended attributes, where the extended attributes include access-count-max, access-count-min, file-size-limit, time-field-end, and time-field-start. Access-count-max means the upper limit of the interval for limiting the number of file accesses, access-count-min means the lower limit of the interval for limiting the number of file accesses, file-size-limit means the upper limit of the file read and write size, time-field-end means the end time of the file read and write, and time-field-start means the start time of the file read and write. Correspondingly, the security control strategies include the following: Time-based read and write access control: When the security tag attribute Time-Field is not NULL, it indicates the time range in which read and write operations are allowed. When the time when the read and write access behavior occurs is within the Time-Field, the read and write operation is allowed and the file content is output. Otherwise, access denial information is returned. Read and write operation access control based on access count: When the security tag Access-Count is not NULL, it indicates the number of times that read and write operations are allowed. When the access count of read and write operations is less than or equal to min times or greater than or equal to max times, read and write operations are allowed and file contents are output. Otherwise, access denial information is returned. Read and write operation access control based on file size: When the security tag File-Size-Limit is not NULL, it indicates the maximum file size allowed for read and write operations. When the file is less than or equal to the predetermined bytes, read and write operations are allowed and the file content is output. Otherwise, access denial information is returned.

4. The file access control method based on operating system file extension attributes according to claim 1, characterized in that: When writing the read and write operation information of the specified file and the current time into the audit log, the format is: xx year xx month xx day, xx hour xx minute xx second, xx attempts to read xx file, success / failure, violation / compliance, time / number of accesses / file size access control policy.

5. The file access control method based on operating system file extended attributes according to claim 1, characterized in that: The system call interface includes fsetxattr, fgetxattr, fremovexattr and copy_file_range. fsetxattr means setting the extended attributes of a file, fgetxattr means getting the extended attributes of a file, fremovexattr means removing the extended attributes of a file, and copy_file_range means copying part of a file to another file.

6. A file access control system based on operating system file extension attributes, characterized in that: Used to implement file access control by a file access control method based on operating system file extended attributes as described in any one of claims 1 to 5, the system comprising a user state file attribute management device, a kernel state file access control device, a file read and write operation management device, and a file copy operation management device; The user state file attribute management device is used to perform the following: construct a user state file attribute management module and a kernel state extended attribute management module, set a security mark attribute on a specified file through the user state file attribute management module to obtain an extended attribute, the user state file attribute management module calls the kernel state extended attribute management module through a system call interface, and configures the extended attribute of the specified file through the kernel state extended attribute management module; The kernel state file access control device is used to perform the following: construct a kernel state file access control module, configure a module initialization method and a module exit method of the kernel state file access control module, in the module initialization method, implement a file access control implementation function based on the file_permission interface, add a security control strategy to the file access control implementation function, and the security control strategy is used to perform access control on the read and write operations of the file based on the extended attributes set by the user; The file read and write operation management device is used to perform the following: when performing read and write operations on a specified file in the user state, access the file read and write operations in the kernel state through the system call interface, and when performing file read and write operations in the kernel state, call the file access control module configured in the kernel state, the file access control module calls the file access control function based on the file_permission interface, performs access control on the read and write operations of the specified file based on the security control policy in the file access control function, and writes the read and write operation information of the specified file and the current time into the audit log; The file copy operation management device is used to perform the following: when a file copy operation is performed on a designated file in user mode, the file copy operation in kernel mode is accessed through a system call interface; when a designated file is read from a source file in kernel mode and the designated file is copied to a target file, the extended attributes of the designated file are read from the source file and the extended attributes are copied to the target file.

7. The file access control system based on operating system file extension attributes according to claim 6, characterized in that: The user-mode file attribute management module is a command line tool for supporting users to set and configure extended attributes for specified files based on commands; The commands in the user-mode file attribute management module include protect, unprotect, show, and help. protect is a protection mode that supports users to set extended attributes. unprotect is a non-protection mode that supports users to configure extended attributes. show is used to display the security attribute value of the specified file. help is used for command help information. Configuring the extended attributes of the specified file includes adding, modifying, deleting and viewing the extended attributes of the specified file.

8. The file access control system based on operating system file extension attributes according to claim 6, characterized in that: The user sets the security tag attributes of the file size File-Size-Limit, access count Access-Count, and access time Time-Field for the specified file, and obtains the security attributes as extended attributes, where the extended attributes include access-count-max, access-count-min, file-size-limit, time-field-end, and time-field-start. Access-count-max means the upper limit of the interval for limiting the number of file accesses, access-count-min means the lower limit of the interval for limiting the number of file accesses, file-size-limit means the upper limit of the file read and write size, time-field-end means the end time of the file read and write, and time-field-start means the start time of the file read and write. Correspondingly, the security control strategies include the following: Time-based read and write access control: When the security tag attribute Time-Field is not NULL, it indicates the time range in which read and write operations are allowed. When the time when the read and write access behavior occurs is within the Time-Field, the read and write operation is allowed and the file content is output. Otherwise, access denial information is returned. Read and write operation access control based on access count: When the security tag Access-Count is not NULL, it indicates the number of times that read and write operations are allowed. When the access count of read and write operations is less than or equal to min times or greater than or equal to max times, read and write operations are allowed and file contents are output. Otherwise, access denial information is returned. Read and write operation access control based on file size: When the security tag File-Size-Limit is not NULL, it indicates the maximum file size allowed for read and write operations. When the file is less than or equal to the predetermined bytes, read and write operations are allowed and the file content is output. Otherwise, access denial information is returned.

9. The file access control system based on operating system file extension attributes according to claim 6, characterized in that: When writing the read and write operation information of the specified file and the current time into the audit log, the format is: xx year xx month xx day, xx hour xx minute xx second, xx attempts to read xx file, success / failure, violation / compliance, time / number of accesses / file size access control policy.

10. The file access control system based on operating system file extension attributes according to claim 6, characterized in that: The system call interface includes fsetxattr, fgetxattr, fremovexattr and copy_file_range. fsetxattr means setting the extended attributes of a file, fgetxattr means getting the extended attributes of a file, fremovexattr means removing the extended attributes of a file, and copy_file_range means copying part of a file to another file.

Images