Application isolation method and related device

Abstract

The embodiment of the invention provides an application isolation method and a related device, which are used for starting the isolation of an application in a mode of injecting a dynamic library so as to realize the configuration of the application isolation after the application development is completed. The method comprises the steps that if it is detected that an application is imported into a sandbox workspace of a MacOS system, a sandbox dynamic library is injected into the application in the mode of modifying a system executable file of the application or in the mode of drive injection so as to achieve isolation of the application, the sandbox dynamic library is used for realizing at least one of file redirection, clipboard isolation and external equipment isolation.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an application-based isolation method and related devices. Background Art

[0002] MacOS is an operating system using a graphical user interface launched by Apple and is the main operating system for the Macintosh series of computers.

[0003] The existing MacOS system provides system sandbox technology, which enables each application with the sandbox function to run in its own independent "sandbox" and cannot access other applications or key system data. This system sandbox technology can only be enabled by the original application developer when building the original application, and cannot be enabled, disabled or configured at will by the system, users or third-party developers. Summary of the invention

[0004] The embodiment of the present invention provides an application isolation method and related devices, which are used to enable isolation of applications by injecting dynamic libraries, thereby realizing the configuration of application isolation after the application development is completed, and realizing the flexibility and convenience of application isolation configuration.

[0005] The present application embodiment provides an application isolation method, including:

[0006] If it is detected that an application is imported into the sandbox workspace of the MacOS system, the sandbox dynamic library is injected into the application by modifying the system executable file of the application or by driver injection to achieve isolation of the application, wherein the sandbox dynamic library is used to achieve at least one of file redirection, clipboard isolation and external device isolation.

[0007] A second aspect of an embodiment of the present application provides a computer device, including:

[0008] An injection unit is used to, if it detects that an application is imported into the sandbox workspace of the MacOS system, inject a sandbox dynamic library into the application by modifying the system executable file of the application or by driver injection, so as to achieve isolation of the application, wherein the sandbox dynamic library is used to achieve at least one of file redirection, clipboard isolation, and external device isolation. A third aspect of an embodiment of the present application provides a computer device, including a processor, which is used to implement the application isolation method provided in the first aspect of the embodiment of the present application when executing a computer program stored in a memory.

[0009] A fourth aspect of an embodiment of the present application provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, it is used to implement the application isolation method provided in the first aspect of the embodiment of the present application.

[0010] A fifth aspect of an embodiment of the present application provides a computer program product on which a computer program is stored. When the computer program is executed by a processor, it is used to implement the application isolation method provided in the first aspect of the embodiment of the present application.

[0011] It can be seen from the above technical solutions that the embodiments of the present invention have the following advantages:

[0012] The application isolation method based on the MacOS system in the embodiment of the present application includes: if the application is imported into the sandbox workspace of the MacOS system, the sandbox dynamic library is injected into the application by modifying the system executable file of the application or by driver injection to achieve isolation of the application, wherein the sandbox dynamic library is used to achieve at least one of file redirection, clipboard isolation and external device isolation.

[0013] Because when the embodiment of the present application detects that an application is imported into the sandbox workspace of the MacOS system, the sandbox dynamic library is injected into the application by modifying the system executable file of the application or by driver injection to achieve isolation of the application, wherein the sandbox dynamic library is used to implement at least one of file redirection, clipboard isolation and external device isolation, thereby achieving post-configuration of application isolation after the application development is completed, and achieving flexibility and convenience of application isolation configuration. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 This is a schematic diagram of an embodiment of the isolation method used in the embodiments of the present application;

[0015] Figure 2 A schematic diagram of a sandbox workspace in an embodiment of the present application;

[0016] Figure 3 In the embodiment of this application Figure 1 A refinement of step 101 in the embodiment;

[0017] Figure 4 In the embodiment of this application Figure 1 A refinement of step 101 in the embodiment;

[0018] Figure 5 In the embodiment of this application Figure 1 Another refinement of step 101 in the embodiment;

[0019] Figure 6This is a schematic diagram of another embodiment of the application of the isolation method in the embodiments of the present application;

[0020] Figure 7 This is a schematic diagram of another embodiment of the application of the isolation method in the embodiments of the present application;

[0021] Figure 8 A schematic diagram of another embodiment of the application of the isolation method in the embodiment of the present application;

[0022] Fig. 9 It is a schematic diagram of an embodiment of a computer device in an embodiment of the present application. DETAILED DESCRIPTION

[0023] The embodiment of the present invention provides an application isolation method and related devices, which are used to enable isolation of applications by injecting dynamic libraries, thereby realizing the configuration of application isolation after the application development is completed.

[0024] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0025] The terms "first", "second", "third", "fourth", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0026] For ease of understanding, the isolation method used in the embodiment of the present application is described in detail below. Figure 1 , an embodiment of the application isolation method in the implementation of the present application includes:

[0027] 101. If the application is imported into the sandbox workspace of the MacOS system, the sandbox dynamic library is injected into the application by modifying the system executable file of the application or by driver injection to achieve isolation of the application, wherein the sandbox dynamic library is used to achieve at least one of file redirection, clipboard isolation and external device isolation.

[0028] macOS / OS X is an operating system using a graphical user interface launched by Apple. It is the main operating system for Macintosh series computers. In this operating system, applications can be imported into a sandbox workspace to become sandbox applications. Sandbox applications are isolated in a virtual operating environment, thereby achieving mutual isolation between sandbox applications and non-sandbox applications.

[0029] In the present application embodiment, Figure 2 As shown, each sandbox workspace corresponds to a control UI. The user can click Add Program on the UI to import the application. After the import is complete, click the application icon in the space UI to start the application. The applications in the sandbox workspace are not isolated, while the applications in the sandbox workspace and non-sandbox workspace are isolated from each other.

[0030] The following describes the technical process of isolating applications in a sandbox workspace:

[0031] Specifically, when the application is imported into the sandbox workspace of the MacOS system, the system architecture of the MacOS system is obtained, wherein the system architecture of the MacOS system includes an ARM architecture or an X86 architecture.

[0032] As an optional embodiment, the system binary file Mach-O file of the MacOS system records the architecture type of the MacOS system. By reading the Mach-O file, the system architecture of the MacOS system can be obtained. Generally, the architecture type of the MacOS system includes ARM architecture or X86 architecture. If the system architecture is ARM architecture, the system executable file of the application is modified to inject the sandbox dynamic library into the application, that is, the binary file of the system is modified to inject the sandbox dynamic library into the application. The sandbox dynamic library in the embodiment of the present application is responsible for hooking key functions to implement at least one of the application's file redirection, clipboard isolation, and external device isolation.

[0033] Specifically, assuming that the application is Kugou Music, the system executable file of Kugou Music is modified to inject the sandbox dynamic library into Kugou Music.

[0034] The process of how to modify the system executable file to inject the sandbox dynamic library into the application will be described in the following embodiments and will not be repeated here.

[0035] As another optional embodiment, if the system architecture is an X86 architecture, the sandbox dynamic library is injected into the application through the driver, wherein the sandbox dynamic library is used to implement at least one of file redirection, clipboard isolation, and external device isolation. Assuming that the application is Kugou Music, the sandbox dynamic library is injected into Kugou Music through the driver to inject the sandbox dynamic library into Kugou Music.

[0036] The process of how to inject the sandbox dynamic library into the application through the driver will be described in the following embodiments and will not be repeated here.

[0037] In an embodiment of the present application, if it is detected that an application is imported into the sandbox workspace of the MacOS system, the sandbox dynamic library is injected into the application by modifying the system executable file of the application or by driver injection to achieve isolation of the application, wherein the sandbox dynamic library is used to implement at least one of file redirection, clipboard isolation, and external device isolation, thereby achieving post-configuration of application isolation after the application development is completed, and achieving flexibility and convenience of application isolation.

[0038] based on Figure 1 The following describes step 101 in detail. Figure 3 , Figure 3 The detailed steps of step 101 are as follows:

[0039] 301. If the system architecture is ARM architecture, traverse the system executable files of the application;

[0040] If the system architecture of the MacOS system is ARM architecture, all system executable files in the application are traversed, that is, all binary files in the Mach-O format of the application are traversed.

[0041] 302. Parse the system executable file of the application to obtain a loading instruction from the system executable file of the application;

[0042] After obtaining all system executable files (binary files in Mach-O format) in the application, the system executable files of the application are parsed to obtain the loading instructions in the system executable files of the application, wherein the loading instructions here are the Load Commands instructions in the binary files in Mach-O format.

[0043] 303. Insert a dynamic library dependency instruction into the loading instruction, wherein the dynamic library dependency instruction is used to instruct the application to load the sandbox dynamic library.

[0044] After obtaining the load instruction in the binary file in Mach-O format, that is, the LoadCommands instruction in the binary file, a dynamic library dependency instruction (that is, the LC_LOAD_DYLIB instruction) is inserted into the load instruction (Load Commands), wherein the dynamic library dependency instruction (that is, the LC_LOAD_DYLIB instruction) is used to instruct the application to automatically load the sandbox dynamic library at startup.

[0045] During the process of importing the sandbox workspace application, the application in the embodiment of the present application inserts a dependency instruction on the sandbox dynamic library. Therefore, the dynamic linker automatically loads the sandbox dynamic library into the application when the application allows, thereby realizing the injection of the sandbox dynamic library. The sandbox dynamic library in the embodiment of the present application is used to realize the file redirection, clipboard isolation and peripheral isolation functions of the application.

[0046] based on Figure 3 The embodiment described is an optional embodiment. If a security signature is added to the application after development, before executing step 301 (i.e., traversing the system executable file of the application), the security signature of the application needs to be removed first, and after completing step 303 (i.e., inserting the dynamic library dependency instruction in the loading instruction), the application needs to be re-signed to ensure the security of the application during use. As a specific embodiment, the security signature here can be a hash value calculated for the system executable file in the application to generate a hash signature.

[0047] The following is a detailed description of step 101. Figure 4 , Figure 4 Another refinement of step 101:

[0048] 401. If the system architecture is the X86 architecture, after the kernel loads the kernel driver function, the kernel information is parsed using the kernel driver function to obtain a random address offset in the kernel information loaded into the memory and an address of the kernel data segment in the memory;

[0049] If the system architecture of the MacOS system is X86 architecture, after the kernel loads the kernel driver function, because the kernel driver function and the kernel itself are in the same memory address space, the kernel driver function needs to parse the kernel information to obtain the random address offset loaded into the memory in the kernel information, the address of the kernel code segment in the memory, and the address of the kernel data segment in the memory.

[0050] 402. If the kernel calls a necessary function when the kernel executes a process through a structure array, then obtain the structure array according to the random address offset and the address of the kernel data segment in the memory;

[0051] For systems below macOS 14.0, the kernel process is a necessary function when calling the kernel execution process through structure data. Specifically, the kernel will enter the exec_activate_imgact function when executing the process, and then traverse the execsw structure array. The execsw structure contains the addresses of the three functions exec_mach_imgact, exec_fat_imgact, and exec_shell_imgact. During the execution process, exec_mach_imgact is a necessary function that will definitely be called by exec_activate_imgact.

[0052] If you want to call this required function, you need to first obtain the address of the execsw structure array, and the execsw structure array is set in the kernel data segment. Therefore, the embodiment of the present application needs to first obtain the starting position of the kernel data segment based on the random address offset and the address of the kernel data segment in the memory, and then traverse the kernel data segment from the starting position of the kernel data segment to obtain the execsw structure array set in the kernel data segment from the kernel data segment, wherein the execsw structure array is located in the constant area of ​​the kernel data segment.

[0053] 403. Obtain the necessary function address when the kernel executes the process from the structure array, and modify the necessary function address to the kernel driver function address through a hook function, wherein the kernel driver function is used to inject the sandbox dynamic library.

[0054] After obtaining the execsw structure array set in the kernel data segment from the kernel data segment, because the execsw structure contains the addresses of three functions, exec_mach_imgact, exec_fat_imgact, and exec_shell_imgact, during the execution process, exec_mach_imgact is a necessary function that will definitely be called by exec_activate_imgact. Therefore, the embodiment of the present application modifies the address of the necessary function to the address of the kernel driver function through a hook function, wherein the kernel driver function is used to inject the sandbox dynamic library into the X86 architecture of systems below macOS14.0.

[0055] 404. If the application is run, a kernel driver function is loaded into the kernel;

[0056] If the system detects that the application is running, the kernel driver function is loaded into the kernel.

[0057] Specifically, when the user clicks on the application, the kernel will execute a new application process, and then the new application process will enter the kernel state through the execve or posixspawn system call, and then enter the exec_activate_imgact function. Because the exec_mach_imgact function address was previously modified to the address of the kernel driver function, the kernel driver function will be loaded into the kernel when the application is run.

[0058] 405. If the application is determined to be an application in the sandbox space by using the kernel driver function, an environment change is inserted into the running process of the application to inject the sandbox dynamic library into the application through the environment variable, wherein the value of the environment variable is used to indicate the address of the sandbox dynamic library.

[0059] After completing the loading of the kernel driver function, the kernel driver function is used to determine whether the application is a sandbox space application. If the application is a sandbox space application, the environment variable is inserted into the running process of the application, that is, the DYLD_INSERT_LIBRARIES variable is inserted to inject the sandbox dynamic library into the application through the environment variable, wherein the value of the environment change is used to indicate the address of the sandbox dynamic library.

[0060] The embodiment of the present application describes in detail the process of injecting sandbox dynamic libraries into the X86 architecture of system versions below macOS 14.0, and the injection of sandbox dynamic libraries in the X86 architecture is implemented based on kernel driver functions. Therefore, compared with the injection scheme of sandbox dynamic libraries in the ARM architecture, it has the advantages of not needing to modify binary files or the application's own signature.

[0061] Furthermore, in order to ensure the security of memory data, the data in the memory is generally write-protected. Therefore, the embodiment of the present application needs to turn off the write protection before executing step 403, and turn on the write protection again after step 403 is completed.

[0062] As an optional embodiment, before executing step 403, because the execsw structure array is located in the constant area in the kernel data segment, when turning off the write protection, the memory write protection in the read-only constant area is turned off by modifying the CPU cr0 register, and after step 403 is executed, the memory write protection in the read-only constant area is enabled by modifying the CPU cr0 register.

[0063] The following is a detailed description of step 101. Figure 5 , Figure 5 Another refinement of step 101:

[0064] 501. If the system architecture is the X86 architecture, after the kernel loads the kernel driver function, the kernel information is parsed using the kernel driver function to obtain a random address offset in the kernel information loaded into the memory and an address of the kernel data segment in the memory;

[0065] If the system architecture of the MacOS system is X86 architecture, after the kernel loads the kernel driver function, because the kernel driver function and the kernel itself are in the same memory address space, the kernel driver function needs to parse the kernel information to obtain the random address offset loaded into the memory in the kernel information and the address of the kernel data segment in the memory.

[0066] 502. If the kernel directly calls a necessary function when the kernel executes the process, obtain a calling code of the necessary function when the kernel executes the process according to the random address offset and the address of the kernel code segment in the memory;

[0067] For macOS14.0 system, due to the optimization of the compiler, the kernel's exec_activate_imgact function can directly call the necessary function, that is, it can directly call the exec_mach_imgact function, instead of indirectly calling it through the execsw structure array. Therefore, when the kernel process directly calls the necessary function of the kernel execution process, it is necessary to obtain the calling code of the necessary function when directly calling the kernel execution process based on the random function address offset and the address of the kernel code segment in the memory.

[0068] Specifically, because the function is set in the kernel code segment, the embodiment of the present application obtains the starting position of the kernel code segment based on the random address offset and the address of the kernel code segment in the memory, and then finds the code containing the exec_activate_imgact function from the starting position, and then further finds the binary opcode of the exec_activate_imgact function calling the exec_mach_imgact function, that is, finds the calling code of the necessary function when directly calling the kernel execution process.

[0069] 503. Modify the required function address in the calling code into a kernel driver function address through a hook function, wherein the kernel driver function is used to inject the sandbox dynamic library.

[0070] After obtaining the binary opcode of the exec_activate_imgact function calling the exec_mach_imgact function in step 502, that is, obtaining the calling code of the necessary function when directly calling the kernel execution process, the necessary function address (exec_mach_imgact function address) in the calling code is modified to the kernel driver function address through the hook function, wherein the sandbox dynamic library is injected into the kernel driver function.

[0071] Specifically, the address of the exec_mach_imgact function is modified to the kernel driver function address in the calling code, and the kernel driver function is used to inject the sandbox dynamic library into the X86 architecture of the macOS14.0 system.

[0072] 503. If the application is run, a kernel driver function is loaded into the kernel;

[0073] If the system detects that the application is running, the kernel driver function is loaded in the kernel. Specifically, when the user clicks on the application, the kernel will execute a new application process, and then the new application process enters the kernel state through the execve or posix_spawn system call, and then enters the exec_activate_imgact function. Because the exec_mach_imgact function address was previously modified to the address of the kernel driver function, the kernel driver function is loaded in the kernel accordingly.

[0074] 504. If the application is determined to be an application in the sandbox space by using the kernel driver function, an environment change is inserted into the running process of the application to inject the sandbox dynamic library into the application through the environment variable, wherein the value of the environment variable is used to indicate the address of the sandbox dynamic library.

[0075] After completing the loading of the kernel driver function, the kernel driver function is used to determine whether the application is a sandbox space application. If the application is a sandbox space application, the environment variable is inserted into the running process of the application, that is, the DYLD_INSERT_LIBRARIES variable is inserted to inject the sandbox dynamic library into the application through the environment variable, wherein the value of the environment change is used to indicate the address of the sandbox dynamic library.

[0076] The embodiment of the present application describes in detail the process of injecting sandbox dynamic libraries into the X86 architecture macOS system of the macOS 14.0 system version, and the injection of the sandbox dynamic library of the X86 architecture is implemented based on the kernel driver function. Therefore, compared with the injection scheme of the sandbox dynamic library of the ARM architecture, it has the advantages of not needing to modify the binary file or the application's own signature.

[0077] Furthermore, in order to ensure the security of memory data, the data in the memory is generally write-protected. Therefore, the embodiment of the present application needs to turn off the write protection before executing step 503, and turn on the write protection again after step 503 is completed.

[0078] As an optional embodiment, before executing step 403, because the calling code of the required function when directly calling the kernel execution process is located in the kernel code segment, when turning off the write protection, the memory write protection of the read-only code segment is turned off by modifying the CPU cr0 register, and after step 503 is completed, the memory write protection of the read-only code segment is enabled by modifying the CPU cr0 register.

[0079] The following describes the isolation process of the application in the sandbox after the dynamic library is injected into the application. Figure 6 :

[0080] 601. If the application is run, the sandbox dynamic library is loaded into the application;

[0081] After the sandbox dynamic library is injected into the application in the sandbox workspace, the sandbox dynamic library is loaded into the application accordingly when the application is run.

[0082] 602. If the sandbox dynamic library is used to implement file redirection, when the application accesses the non-sandbox application in the non-sandbox workspace, the access interface of the application is redirected to a preset storage address.

[0083] If the sandbox dynamic library is used to implement file redirection, when a sandbox application (that is, an application in a sandbox workspace) accesses a non-sandbox application (that is, an application in a non-sandbox workspace), the application's file access interface is redirected to a preset storage address to achieve isolation between the sandbox application and the non-sandbox application.

[0084] 603. If the sandbox dynamic library is used to implement clipboard isolation, when the application creates a clipboard, the clipboard setting interface is redirected to the shared clipboard of the sandbox workspace application;

[0085] If the sandbox dynamic library is used to implement clipboard isolation, the clipboard settings interface is hijacked when the clipboard is created, and then the data in the clipboard is stored in the shared clipboard of the sandbox workspace, that is, the clipboard settings interface is redirected to the shared clipboard of the sandbox workspace application.

[0086] 604. When the application reads the content of the clipboard, the corresponding read content is obtained from the shared clipboard.

[0087] Then, when the sandbox application reads the contents of the clipboard, the read interface is hijacked, and then the corresponding read content is obtained from the shared clipboard.

[0088] 605. If the sandbox dynamic library is used to implement external device isolation, when the application accesses the external device interface, the external device interface is redirected to a preset external device interface, wherein the preset external device interface is used to prevent the application from communicating data with the external device, and the external device interface includes at least one of a Bluetooth device interface, a printer interface, and an AirDrop interface.

[0089] If the sandbox dynamic library is used to achieve external device isolation, then when the application accesses the external device interface, the external device interface will be redirected to the preset external device interface, where the preset external device interface is used to place the application in data communication with the external device, and the external device interface here includes at least one of a Bluetooth device interface, a printer device interface, and an AirDrop interface.

[0090] In the embodiments of the present application, a detailed description is given of the process of running the sandbox application after injecting the sandbox dynamic library into the sandbox application to achieve isolation between the sandbox application and the non-sandbox application. In the embodiments of the present application, data isolation between the sandbox application and the non-sandbox application is achieved specifically through file redirection, clipboard redirection and preset external device interface redirection technology. Because there is no process data isolation between sandbox applications, free data communication between applications in the sandbox can be achieved.

[0091] Further, based on the above embodiments, in order to further prevent certain sandbox applications from escaping the sandbox due to the failure of file redirection, the embodiments of the present application can further isolate the sandbox space files, please refer to Figure 7 :

[0092] 701. Receive a file access event of a target application based on a driver;

[0093] Specifically, in order to prevent the sandbox from escaping due to the failure of file redirection, the embodiments of the present application can further filter the access of non-sandbox applications to sandbox application files through sandbox file isolation. Specifically, it can be based on the driver to receive file access events of the target application, wherein different drivers are used for different system structures. For example, when the macOS system is an ARM architecture, then in the ARM driver, file isolation is based on the endpoint security framework, and when the macOS system is an X86 architecture, then in the X86 driver, file isolation is based on the kernel authorization framework.

[0094] 702. If it is determined based on the file access event that the file to be accessed is a file in the sandbox workspace, and the target application is an application in the sandbox workspace, then access to the file to be accessed is allowed to the target application;

[0095] When the driver receives a file access event from the target application, it determines whether the file to be accessed is a file in the sandbox workspace based on the file access event, and determines whether the target application is an application in the sandbox workspace. When the file to be accessed is a file in the sandbox workspace and the target application is an application in the sandbox workspace, the target application is allowed to access the file to be accessed.

[0096] Furthermore, in the embodiment of the present application, when the file to be accessed is a file in a sandbox workspace and the target application is an application in a non-sandbox workspace, access to the file to be accessed by the target application is denied.

[0097] 703. If it is determined based on the file access event that the file to be accessed is a file in a non-sandbox workspace, and the target application is an application in a non-sandbox workspace, then the target application is allowed to access the file to be accessed.

[0098] When the driver receives a file access event of the target application, if it is determined based on the file access event that the file to be accessed is a file in a non-sandbox workspace and the target application is an application in a non-sandbox workspace, the target application is allowed to access the file to be accessed.

[0099] Furthermore, in the embodiment of the present application, when the file to be accessed is a file in a non-sandbox workspace and the target application is an application in the sandbox workspace, access to the file to be accessed by the target application is denied.

[0100] In an embodiment of the present application, the system uses file isolation of the sandbox space based on the driver to achieve mutual isolation of data between sandbox applications and non-sandbox applications, thereby preventing and remedying sandbox escape of sandbox applications when sandbox application file redirection fails.

[0101] Furthermore, the embodiments of the present application can also use sandbox network isolation to achieve IP-level network isolation, please refer to Figure 8 :

[0102] 801. Receive a network access request of a target application through a network filter driver;

[0103] Specifically, in order to achieve IP-level network isolation for sandbox applications, the embodiments of the present application can also receive network access requests from target applications through a network filtering driver. Specifically, when the macOS system is an ARM architecture, in the ARM driver, the network filtering driver uses a filtering framework based on network extension (such as the NEFilterDataProvider filtering framework), and when the macOS system is an X86 architecture, the network filtering driver uses a filtering framework based on a kernel driver (such as the SocketFilter framework).

[0104] 802. If it is determined according to the network access request that the target application is an application in a sandbox workspace, and the access request is for local communication, then obtaining a peer application accessed by the target application;

[0105] When a network access request from the target application is received, the network quintuple information (source IP address, target IP address, source port, target port and protocol type) is obtained based on the network access request, and the target application is determined to be an application within the sandbox workspace based on the network quintuple information. When the access request is for local communication, the peer application accessed by the target application is obtained.

[0106] 803. If the peer application and the target application belong to the same sandbox workspace, allow the target application to access the peer application.

[0107] When the peer application (ie, the accessed application) and the target application belong to the same sandbox workspace, the target application is allowed to access the peer application, and when the peer application and the target application do not belong to the same sandbox workspace, the target application is denied access to the peer application.

[0108] 804. If it is determined that the target application is an application in the sandbox workspace according to the network access request, and the access request is an outbound network request, then obtain an outbound target IP address and a target port;

[0109] If the network five-tuple information (source IP address, target IP address, source port, target port and protocol type) is obtained based on the network access request, and the target application is determined to be an application within the sandbox workspace based on the network five-tuple information, and the access request is an outbound network request, then the outbound target IP address and target port are obtained.

[0110] 805. If it is determined according to the network isolation configuration that the target application is allowed to access the outbound target IP address and target port, access to the outbound target IP address and target port is allowed, wherein the network isolation configuration records the IP address and access port that the target application is allowed to access.

[0111] If it is determined based on the network isolation configuration that the target application is allowed to access the outbound target IP address and target port, access to the outbound target IP address and target port is allowed, wherein the network isolation configuration records the IP address and access port that the target application is allowed to access; if it is determined that the target application is not allowed to access the outbound target IP address and target port, access to the outbound target IP address and target port is denied.

[0112] 806. If it is determined that the target application is an application in the sandbox workspace according to the network access request, and the access request is an inbound network request, then the inbound source IP address and source port are obtained;

[0113] Furthermore, if the target application is determined to be an application within the sandbox workspace based on the network access request, and the access request is an inbound network request, the network quintuple information is obtained based on the network request, and the inbound source IP address and source port are obtained based on the network quintuple information.

[0114] 807. If it is determined according to the network isolation configuration that the target application allows access to the receiving source IP address and source port, then the receiving IP address and source port access the target application, wherein the network isolation configuration also records the source IP address and source port that the target application allows to receive.

[0115] If it is determined according to the network isolation configuration that the target application allows access to the receiving source IP address and source port, then the receiving IP address and source port access the target application, wherein the network isolation configuration also records the source IP address and source port that the target application allows to receive.

[0116] 808. If it is determined according to the network access request that the target application is an application not in the sandbox workspace, the network access request of the target application is allowed.

[0117] Further, if it is determined according to the network access request that the target application is an application not in the sandbox workspace, the network access request to the target application is allowed.

[0118] The embodiment of the present application can achieve IP-level network isolation for the sandbox application through network isolation, thereby further reducing the granularity of network isolation and achieving smaller-granularity network isolation.

[0119] It is understandable that, in various embodiments of the present invention, the sequence numbers of the above steps do not mean the order of execution. The order of execution of the steps should be determined by their functions and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0120] The embodiment of the present application also provides a computer program product, on which a computer program is stored. When the computer program is executed by a processor, it is used to implement the various steps in the method embodiment of the present application.

[0121] The above describes in detail the application isolation method based on the MacOS system in the embodiment of the present application. Next, the computer device in the embodiment of the present application is described. Fig. 9 , an embodiment of the computer device in the embodiment of the present application includes:

[0122] The injection unit 901 is used to, if it is detected that an application is imported into the sandbox workspace of the MacOS system, inject the sandbox dynamic library into the application by modifying the system executable file of the application or by driver injection, so as to achieve isolation of the application, wherein the sandbox dynamic library is used to achieve at least one of file redirection, clipboard isolation and external device isolation.

[0123] Preferably, the ARM dynamic library injection module 902 in the injection unit 901 is specifically used for:

[0124] If the system architecture is the ARM architecture, traversing the system executable file of the application;

[0125] Parsing the system executable file of the application to obtain a loading instruction from the system executable file of the application;

[0126] A dynamic library dependency instruction is inserted into the loading instruction, wherein the dynamic library dependency instruction is used to instruct the application to load the sandbox dynamic library.

[0127] Preferably, the ARM dynamic library injection module 902 is also used for:

[0128] Before traversing the system executable file of the application, removing the signature of the application;

[0129] After inserting the dynamic library dependency instruction into the loading instruction, the application is re-signed.

[0130] Preferably, the X86 driver module 903 in the injection unit 901 is specifically used for:

[0131] If the system architecture is the X86 architecture, after the kernel loads the kernel driver function, the kernel information is parsed using the kernel driver function to obtain the random address offset loaded into the memory in the kernel information and the address of the kernel data segment in the memory;

[0132] If the kernel process calls a necessary function when the kernel executes the process through a structure array, the structure array is obtained according to the random address offset and the address of the kernel data segment in the memory;

[0133] Obtain the necessary function address when the kernel executes the process from the structure array, and modify the necessary function address to the kernel driver function address through the hook function, wherein the sandbox dynamic library is injected into the kernel driver function.

[0134] Preferably, the X86 driver module 903 is specifically used for:

[0135] If the system architecture is the X86 architecture, after the kernel loads the kernel driver function, the kernel information is parsed using the kernel driver function to obtain the random address offset loaded into the memory in the kernel information and the address of the kernel code segment in the memory;

[0136] If the kernel process directly calls a necessary function when the kernel executes the process, obtaining a calling code of the necessary function when the kernel executes the process directly according to the random address offset and the address of the kernel code segment in the memory;

[0137] The necessary function address in the calling code is modified into the kernel driver function address through the hook function, wherein the sandbox dynamic library is injected into the kernel driver function.

[0138] Preferably, the X86 driver module 903 is also used for:

[0139] If the application is run, the kernel driver function is loaded into the kernel;

[0140] If the kernel driver function is used to determine that the application is an application within the sandbox workspace, an environment variable is inserted into the running process of the application to inject the sandbox dynamic library into the application through the environment variable, wherein the value of the environment variable is used to indicate the address of the sandbox dynamic library.

[0141] Preferably, the X86 driver module 903 is also used for:

[0142] Before modifying the necessary function address to the kernel driver function address through the hook function, disabling memory write protection;

[0143] After the necessary function address is modified to the sandbox dynamic library address through the hook function, the memory write protection is enabled.

[0144] Preferably, the injection unit 901 in the computer device further includes:

[0145] The sandbox dynamic library module 904 is used to:

[0146] If the application is run, the sandbox dynamic library is loaded into the application;

[0147] If the sandbox dynamic library is used to implement the file redirection, when the application accesses a non-sandbox application in a non-sandbox workspace, the access interface of the application is redirected to a preset storage address.

[0148] Preferably, the sandbox dynamic library module 904 is also used for:

[0149] If the application is run, the sandbox dynamic library is loaded into the application;

[0150] If the sandbox dynamic library is used to implement the clipboard isolation, then when the application creates a clipboard, the clipboard setting interface is redirected to the shared clipboard of the sandbox workspace application;

[0151] When the application reads the content of the clipboard, the corresponding read content is obtained from the shared clipboard.

[0152] Preferably, the sandbox dynamic library module 904 is also used for:

[0153] If the application is run, the sandbox dynamic library is loaded into the application;

[0154] If the sandbox dynamic library is used to implement the external device isolation, then when the application accesses the external device interface, the external device interface is redirected to a preset external device interface, wherein the preset external device interface is used to prevent the application from communicating data with the external device, and the external device interface includes at least one of a Bluetooth device interface, a printer interface, and an AirDrop interface.

[0155] Preferably, the injection unit 901 in the computer device further includes: an ARM driver module 905,

[0156] The ARM driver module 905 and the X86 driver module 903 are respectively used for:

[0157] Receive file access events of target applications based on the driver;

[0158] If it is determined based on the file access event that the file to be accessed is a file in the sandbox workspace, and the target application is an application in the sandbox workspace, then allowing the target application to access the file to be accessed;

[0159] If it is determined based on the file access event that the file to be accessed is a file in a non-sandbox workspace, and the target application is an application in the non-sandbox workspace, the target application is allowed to access the file to be accessed.

[0160] Preferably, the driver in the ARM driver module 905 is a driver based on an endpoint security framework, and the driver in the X86 driver module 903 is a driver based on a kernel authorization framework.

[0161] Preferably, the ARM driver module 905 and the X86 driver module 903 are respectively used for:

[0162] Receiving a network access request from a target application through a network filter driver;

[0163] If it is determined according to the network access request that the target application is an application in a sandbox workspace, and the access request is for local communication, then obtaining a peer application accessed by the target application;

[0164] If the peer application and the target application belong to the same sandbox workspace, the target application is allowed to access the peer application.

[0165] If it is determined that the target application is an application in the sandbox workspace according to the network access request, and the access request is an outbound network request, then obtaining an outbound target IP address and a target port;

[0166] If it is determined according to the network isolation configuration that the target application is allowed to access the outbound target IP address and target port, access to the outbound target IP address and target port is allowed, wherein the network isolation configuration records the IP address and access port that the target application is allowed to access.

[0167] If it is determined that the target application is an application in a sandbox workspace according to the network access request, and the access request is an inbound network request, then obtaining the inbound source IP address and source port;

[0168] If it is determined according to the network isolation configuration that the target application is allowed to receive access from the source IP address and the source port, then access to the target application from the IP address and the source port is received, wherein the network isolation configuration also records the source IP address and source port that the target application is allowed to receive.

[0169] Preferably, the network isolation of the network filter driver in the ARM driver module 905 is a filtering framework based on network extension, and the network isolation of the network filter driver in the X86 driver module 903 is a filtering framework based on kernel driver.

[0170] For the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0171] In an embodiment of the present application, if it is detected that an application is imported into the sandbox workspace of the MacOS system, the injection unit 901 injects the sandbox dynamic library into the application by modifying the system executable file of the application or by driver injection to achieve isolation of the application, wherein the sandbox dynamic library is used to achieve at least one of file redirection, clipboard isolation, and external device isolation, thereby achieving post-configuration of application isolation after the application development is completed, and achieving flexibility and convenience of application isolation.

[0172] The computer device in the embodiment of the present invention is described above from the perspective of modular functional entities. The computer device in the embodiment of the present invention is described below from the perspective of hardware processing:

[0173] An embodiment of the computer device in the embodiment of the present invention includes:

[0174] Processor and memory;

[0175] When the memory is used to store a computer program and the processor is used to execute the computer program stored in the memory, each step in the above method embodiment can be implemented.

[0176] It is understandable that when the processor in the computer device described above executes the computer program, it can also implement the functions of the various units in the above-mentioned corresponding device embodiments, which will not be repeated here. Exemplarily, the computer program can be divided into one or more modules / units, and the one or more modules / units are stored in the memory and executed by the processor to complete the present invention. The one or more modules / units can be a series of computer program instruction segments that can perform specific functions, and the instruction segments are used to describe the execution process of the computer program in the computer device. For example, the computer program can be divided into the various units in the above-mentioned computer device, and each unit can implement the specific functions described in the above-mentioned corresponding computer device.

[0177] The computer device may be a computing device such as a desktop computer, a notebook, a PDA, and a cloud server. The computer device may include, but is not limited to, a processor and a memory. Those skilled in the art will appreciate that a processor and a memory are merely examples of computer devices and do not constitute a limitation of the computer device. The computer device may include more or fewer components, or a combination of certain components, or different components. For example, the computer device may also include input and output devices, network access devices, buses, and the like.

[0178] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the computer device, and uses various interfaces and lines to connect various parts of the entire computer device.

[0179] The memory can be used to store the computer program and / or module, and the processor realizes various functions of the computer device by running or executing the computer program and / or module stored in the memory, and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function, etc.; the data storage area can store data created according to the use of the terminal, etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0180] The present invention also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the processor can be used to execute each step in the above method embodiment.

[0181] It is understandable that if the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a corresponding computer-readable storage medium. Based on such an understanding, the present invention implements all or part of the processes in the above-mentioned corresponding embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0182] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0183] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0184] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0185] As described above, the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features thereof may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An application isolation method, characterized in that: include: If it is detected that an application is imported into the sandbox workspace of the MacOS system, the sandbox dynamic library is injected into the application by modifying the system executable file of the application or by driver injection to achieve isolation of the application, wherein the sandbox dynamic library is used to achieve at least one of file redirection, clipboard isolation and external device isolation.

2. The method according to claim 1, characterized in that: The method of injecting the sandbox dynamic library into the application by modifying the system executable file of the application includes: Traversing the system executable files of the application; Parsing the system executable file of the application to obtain a loading instruction from the system executable file of the application; A dynamic library dependency instruction is inserted into the loading instruction, wherein the dynamic library dependency instruction is used to instruct the application to load the sandbox dynamic library.

3. The method according to claim 1, characterized in that The step of injecting the sandbox dynamic library into the application by driver injection includes: After the kernel loads the kernel driver function, the kernel information is parsed using the kernel driver function to obtain the random address offset loaded into the memory in the kernel information and the address of the kernel data segment in the memory; If the kernel calls a necessary function when the kernel executes a process through a structure array, the structure array is obtained according to the random address offset and the address of the kernel data segment in the memory; Obtain the necessary function address when the kernel executes the process from the structure array, and modify the necessary function address to the kernel driver function address through the hook function, wherein the kernel driver function is used to inject the sandbox dynamic library.

4. The method according to claim 1, characterized in that: The method further comprises: If the application is run, the sandbox dynamic library is loaded into the application; If the sandbox dynamic library is used to implement the file redirection, then when the application accesses a non-sandbox application in a non-sandbox workspace, the access interface of the application is redirected to a preset storage address; if the sandbox dynamic library is used to implement the clipboard isolation, then when the application creates a clipboard, the clipboard setting interface is redirected to the shared clipboard of the sandbox workspace application; When the application reads the content of the clipboard, obtaining the corresponding read content from the shared clipboard; If the sandbox dynamic library is used to implement the external device isolation, then when the application accesses the external device interface, the external device interface is redirected to a preset external device interface, wherein the preset external device interface is used to prevent the application from communicating data with the external device, and the external device interface includes at least one of a Bluetooth device interface, a printer interface, and an AirDrop interface.

5. The method according to claim 1, characterized in that The method further comprises: Receive file access events of target applications based on the driver; If it is determined based on the file access event that the file to be accessed is a file in the sandbox workspace, and the target application is an application in the sandbox workspace, then allowing the target application to access the file to be accessed; If it is determined based on the file access event that the file to be accessed is a file in a non-sandbox workspace, and the target application is an application in the non-sandbox workspace, the target application is allowed to access the file to be accessed.

6. The method according to claim 1, characterized in that The method further comprises: Receiving a network access request from a target application through a network filter driver; If it is determined according to the network access request that the target application is an application in a sandbox workspace, and the access request is for local communication, then obtaining a peer application accessed by the target application; If the peer application and the target application belong to the same sandbox workspace, the target application is allowed to access the peer application.

7. A computer device, characterized in that: include: An injection unit is used to, if it is detected that an application is imported into a sandbox workspace of a MacOS system, inject a sandbox dynamic library into the application by modifying the system executable file of the application or by driver injection, so as to achieve isolation of the application, wherein the sandbox dynamic library is used to achieve at least one of file redirection, clipboard isolation and external device isolation.

8. A computer device comprising a processor, characterized in that: When executing a computer program stored in the memory, the processor is used to implement the application isolation method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it is used to implement the application isolation method according to any one of claims 1 to 6.

10. A computer program product having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it is used to implement the application isolation method according to any one of claims 1 to 6.

Images