An application isolation method and related apparatus

Abstract

Embodiments of the present application provide an application isolation method and related device, which is used to open the isolation of an application by injecting a dynamic library, so as to realize the configuration of the application isolation after the development of the application is completed. The method comprises: if it is detected that an application is imported into a sandbox workspace of a MacOS system, a sandbox dynamic library is injected into the application by modifying a system executable file of the application or by a driving injection manner, so as to realize the isolation of the application, wherein the sandbox dynamic library is used to realize at least one of file redirection, clipboard isolation and external device isolation.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to an application isolation method and related apparatus. Background Technology

[0002] macOS is a graphical user interface operating system developed by Apple Inc., and it is the main operating system for the Macintosh series of computers.

[0003] The existing macOS system provides system sandbox technology, which makes each application with sandbox enabled run in its own independent "sandbox" and cannot access other applications or critical system data. Moreover, this system sandbox technology can only be enabled by the original application developer when building the original application, and cannot be arbitrarily enabled, disabled or configured by the system, users or third-party developers. Summary of the Invention

[0004] This invention provides an application isolation method and related apparatus, which enables application isolation by injecting dynamic libraries, thereby enabling application isolation configuration after application development is completed, and realizing the flexibility and convenience of application isolation configuration.

[0005] This application provides an application isolation method, including:

[0006] If it is detected that an application is imported into the sandbox workspace of the macOS system, the sandbox dynamic library is injected into the application by modifying the application's system executable file or by driver injection to achieve isolation of the application. The sandbox dynamic library is used to implement at least one of file redirection, clipboard isolation and external device isolation.

[0007] A second aspect of this application provides a computer device, including:

[0008] An injection unit is configured to, if it detects that an application is being imported into the sandbox workspace of a macOS system, inject a sandbox dynamic library into the application by modifying the application's system executable file or by driver injection, thereby isolating the application. The sandbox dynamic library is used to implement at least one of file redirection, clipboard isolation, and external device isolation. A third aspect of this application provides a computer device including a processor, which, when executing a computer program stored in a memory, implements the application isolation method provided in the first aspect of this application.

[0009] A fourth aspect of this application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, is used to implement the application isolation method provided in the first aspect of this application.

[0010] The fifth aspect of this application provides a computer program product having a computer program stored thereon. When the computer program is executed by a processor, it is used to implement the application isolation method provided in the first aspect of this application.

[0011] As can be seen from the above technical solutions, the embodiments of the present invention have the following advantages:

[0012] The application isolation method based on the MacOS system in this application embodiment includes: if an application is imported into the sandbox workspace of the MacOS system, then a sandbox dynamic library is injected into the application by modifying the system executable file of the application or by driver injection, so as to achieve isolation of the application, wherein the sandbox dynamic library is used to implement at least one of file redirection, clipboard isolation and external device isolation.

[0013] Because in this embodiment of the application, when it detects that an application is imported into the sandbox workspace of the MacOS system, the sandbox dynamic library is injected into the application by modifying the application's system executable file or by driver injection, so as to achieve isolation of the application. The sandbox dynamic library is used to implement at least one of file redirection, clipboard isolation and external device isolation, thereby realizing the later configuration of application isolation after the application development is completed, and realizing the flexibility and convenience of application isolation configuration. Attached Figure Description

[0014] Figure 1 This is a schematic diagram of an embodiment of the isolation method applied in this application;

[0015] Figure 2 This is a schematic diagram of the sandbox workspace in an embodiment of this application;

[0016] Figure 3 Examples of embodiments in this application Figure 1 Detailed steps of step 101 in the embodiment;

[0017] Figure 4 Examples of embodiments in this application Figure 1 A refinement of step 101 in the embodiment;

[0018] Figure 5 Examples of embodiments in this application Figure 1 Another detailed step of step 101 in the embodiment;

[0019] Figure 6This is a schematic diagram of another embodiment of the isolation method applied in this application;

[0020] Figure 7 This is a schematic diagram of another embodiment of the isolation method applied in this application;

[0021] Figure 8 Another embodiment of the isolation method applied in this application is illustrated in the diagram below;

[0022] Figure 9 This is a schematic diagram of one embodiment of the computer device described in this application. Detailed Implementation

[0023] This invention provides an application isolation method and related apparatus, which enables application isolation by injecting dynamic libraries, thereby enabling application isolation configuration after application development is completed.

[0024] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0025] The terms "first," "second," "third," "fourth," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0026] For ease of understanding, the isolation method applied in the embodiments of this application is described in detail below. Please refer to [link / reference]. Figure 1 An embodiment of the application isolation method implemented in this application includes:

[0027] 101. If the application is imported into the sandbox workspace of the macOS system, the sandbox dynamic library is injected into the application by modifying the system executable file of the application or by driver injection to achieve isolation of the application. The sandbox dynamic library is used to implement at least one of file redirection, clipboard isolation and external device isolation.

[0028] macOS / OS X is an operating system with a graphical user interface developed by Apple Inc. It is the main operating system for Macintosh computers. In this operating system, applications can be imported into the sandbox workspace, thus becoming sandbox applications. Sandbox applications are isolated in a virtual runtime environment, thereby achieving mutual isolation between sandbox applications and non-sandbox applications.

[0029] In the embodiments of this application, such as Figure 2 As shown, each sandbox workspace corresponds to a UI control. Users can click "Add Program" on the UI to import applications. After importing, they can click the application icon in the workspace UI to launch the application. Applications within a sandbox workspace are not isolated from each other, while applications in sandbox workspaces and non-sandbox workspaces are isolated from each other.

[0030] The technical process for achieving application isolation within the sandbox workspace is described below:

[0031] Specifically, when an application is imported into the macOS sandbox workspace, the macOS system architecture is obtained, which includes either ARM or x86 architecture.

[0032] As an optional implementation, the macOS system's Mach-O file records the macOS system's architecture type. By reading the Mach-O file, the macOS system's architecture can be obtained. Generally, the macOS system's architecture type includes ARM or x86 architecture. If the system architecture is ARM, the application's system executable file is modified to inject the sandbox dynamic library into the application. That is, the system's binary file is modified to inject the sandbox dynamic library into the application. In this embodiment, the sandbox dynamic library is responsible for hooking key functions to achieve at least one of the application's file redirection, clipboard isolation, and external device isolation.

[0033] Specifically, assuming the application is Kugou Music, it involves modifying Kugou Music's system executable file to inject the sandbox dynamic library into Kugou Music.

[0034] The process of modifying the system executable to inject the sandbox dynamic library into the application will be described in the following examples and will not be repeated here.

[0035] As an alternative implementation, if the system architecture is x86, the sandbox dynamic library is injected into the application via a driver. This sandbox dynamic library is used to implement at least one of file redirection, clipboard isolation, and external device isolation. For example, assuming the application is KuGou Music, the sandbox dynamic library is injected into KuGou Music via a driver.

[0036] The process of injecting the sandbox dynamic library into the application through the driver will be described in the following embodiments, and will not be repeated here.

[0037] In this embodiment of the application, if it is detected that an application is imported into the sandbox workspace of the MacOS system, the sandbox dynamic library is injected into the application by modifying the system executable file of the application or by driver injection, so as to achieve isolation of the application. The sandbox dynamic library is used to implement at least one of file redirection, clipboard isolation and external device isolation, thereby realizing the later configuration of application isolation after the application development is completed, and realizing the flexibility and convenience of application isolation.

[0038] based on Figure 1 The embodiment described above will now be described in detail below, focusing on step 101. Please refer to [link / reference]. Figure 3 , Figure 3 Detailed steps for step 101:

[0039] 301. If the system architecture is ARM, then traverse the application's system executable files;

[0040] If the macOS system architecture is ARM, then it iterates through all system executable files in the application, which means it iterates through all Mach-O format binary files in the application.

[0041] 302. Parse the application's system executable file to obtain loading instructions from the application's system executable file;

[0042] After obtaining all the system executable files (Mach-O format binary files) of the application, the application's system executable files are parsed to obtain the loading instructions in the application's system executable files. Here, the loading instructions are the Load Commands instructions in the Mach-O format binary files.

[0043] 303. Insert dynamic library dependency directives into the loading directives, whereby the dynamic library dependency directives are used to instruct the application to load sandbox dynamic libraries.

[0044] After obtaining the load instructions in the Mach-O format binary file, i.e. the LoadCommands instructions in the binary file, the dynamic library dependency instructions (i.e., the LC_LOAD_DYLIB instructions) are inserted into the load commands. The dynamic library dependency instructions (i.e., the LC_LOAD_DYLIB instructions) are used to instruct the application to automatically load the sandbox dynamic library at startup.

[0045] In the process of importing the application into the sandbox workspace, the application in this embodiment inserts a dependency instruction on the sandbox dynamic library. Therefore, the dynamic linker will automatically load the sandbox dynamic library into the application when the application allows it, which means that the sandbox dynamic library is injected. In this embodiment, the sandbox dynamic library is used to implement the application's file redirection, clipboard isolation, and peripheral isolation functions.

[0046] based on Figure 3 In the described embodiment, as an optional implementation, if a security signature is added to the application after development, the security signature needs to be removed before executing step 301 (i.e., traversing the application's system executable files). After completing step 303 (i.e., inserting dynamic library dependency instructions into the loading instructions), the application is re-signed to ensure its security during use. As a specific embodiment, the security signature here can be generated by calculating a hash value from the application's system executable files.

[0047] The following section provides a detailed description of step 101. Please refer to [link / reference]. Figure 4 , Figure 4 Another detailed step of step 101:

[0048] 401. If the system architecture is the X86 architecture, then after the kernel loads the kernel driver function, the kernel information is parsed using the kernel driver function to obtain the random address offset loaded into memory and the address of the kernel data segment in memory from the kernel information;

[0049] If the macOS system architecture is x86, after the kernel loads the kernel driver function, because the kernel driver function and the kernel itself reside in the same memory address space, the kernel driver function needs to parse the kernel information to obtain the random address offset loaded into memory, the address of the kernel code segment in memory, and the address of the kernel data segment in memory.

[0050] 402. If the kernel calls a necessary function when executing a process through a structure array, then the structure array is obtained based on the random address offset and the address of the kernel data segment in memory;

[0051] For systems below macOS 14.0, the kernel process calls essential functions that the kernel must call when executing a process through structure data. Specifically, when the kernel executes a process, it enters the `exec_activate_imgact` function and then iterates through the `execsw` structure array. The `execsw` structure contains the addresses of three functions: `exec_mach_imgact`, `exec_fat_imgact`, and `exec_shell_imgact`. During execution, `exec_mach_imgact` is an essential function that will always be called by `exec_activate_imgact`.

[0052] To call this necessary function, the address of the execsw structure array must first be obtained. Since the execsw structure array is located in the kernel data segment, this embodiment of the application needs to first obtain the starting position of the kernel data segment based on the random address offset and the address of the kernel data segment in memory. Then, starting from the starting position of the kernel data segment, the kernel data segment is traversed to obtain the execsw structure array located in the kernel data segment. The execsw structure array is located in the constant area of ​​the kernel data segment.

[0053] 403. Obtain the address of the necessary function when the kernel executes the process from the structure array, and modify the address of the necessary function to the address of the kernel driver function through the hook function, wherein the kernel driver function is used to inject the sandbox dynamic library.

[0054] After obtaining the array of execsw structures set in the kernel data segment, since the execsw structure contains the addresses of three functions: exec_mach_imgact, exec_fat_imgact, and exec_shell_imgact, and exec_mach_imgact is a necessary function that will definitely be called by exec_activate_imgact during execution, this embodiment modifies the address of the necessary function to the address of the kernel driver function through a hook function. The kernel driver function is used to inject sandbox dynamic libraries in the x86 architecture of systems below macOS 14.0.

[0055] 404. If the application is running, the kernel driver function will be loaded into the kernel.

[0056] If the system detects that an application is running, it loads the kernel driver function into the kernel.

[0057] Specifically, when a user clicks on an application, the kernel executes a new application process. The new application process then enters kernel mode via the execve or posixspawn system call, and then enters the exec_activate_imgact function. Because the address of the exec_mach_imgact function was previously modified to the address of the kernel driver function, the kernel driver function is loaded into the kernel when the application runs.

[0058] 405. If the application is determined to be an application within the sandbox space using kernel driver functions, then environment changes are inserted into the application's runtime process to inject sandbox dynamic libraries into the application through environment variables. The values ​​of the environment variables are used to indicate the addresses of the sandbox dynamic libraries.

[0059] After the kernel driver function is loaded, it is used to determine whether the application is a sandbox application. If the application is a sandbox application, an environment variable, namely the DYLD_INSERT_LIBRARIES variable, is inserted into the application's running process. This environment variable is used to inject the sandbox dynamic library into the application. The value of this environment variable is used to indicate the address of the sandbox dynamic library.

[0060] This application provides a detailed description of the process of injecting sandbox dynamic libraries in x86 architecture systems below macOS 14.0. The sandbox dynamic library injection in x86 architecture is implemented based on kernel driver functions, which has the advantage of not requiring modification of binary files or the application's own signature compared to the sandbox dynamic library injection scheme in ARM architecture.

[0061] Furthermore, in order to confirm the security of memory data, the data in memory is generally write-protected. Therefore, in this embodiment of the application, write protection needs to be turned off before executing step 403, and write protection needs to be turned on again after step 403 is completed.

[0062] As an optional embodiment, before executing step 403, since the execsw structure array is located in the constant area of ​​the kernel data segment, when disabling write protection, the memory write protection in the read-only constant area is disabled by modifying the CPU cr0 register. After step 403 is executed, the memory write protection in the read-only constant area is enabled by modifying the CPU cr0 register.

[0063] The following section provides a detailed description of step 101. Please refer to [link / reference]. Figure 5 , Figure 5 Another detailed step of step 101:

[0064] 501. If the system architecture is the X86 architecture, then after the kernel loads the kernel driver function, the kernel information is parsed using the kernel driver function to obtain the random address offset loaded into memory and the address of the kernel data segment in memory from the kernel information;

[0065] If the macOS system architecture is x86, after the kernel loads the kernel driver function, because the kernel driver function and the kernel itself are in the same memory address space, the kernel driver function needs to parse the kernel information to obtain the random address offset loaded into memory and the address of the kernel data segment in memory.

[0066] 502. If the kernel directly calls a necessary function when the kernel executes a process, then based on the random address offset and the address of the kernel code segment in memory, obtain the calling code of the necessary function when the kernel executes a process.

[0067] For macOS 14.0, due to compiler optimizations, the kernel's `exec_activate_imgact` function can directly call the required function, that is, it can directly call the `exec_mach_imgact` function without indirectly calling it through the `execsw` structure array. Therefore, when a kernel process directly calls the required function that the kernel executes, it is necessary to obtain the calling code of the required function that the kernel executes based on the random function address offset and the address of the kernel code segment in memory.

[0068] Specifically, since the function is set in the kernel code segment, this embodiment of the application obtains the starting position of the kernel code segment based on the random address offset and the address of the kernel code segment in memory. Then, from the starting position, it finds the code containing the exec_activate_imgact function, and then further finds the binary opcode of the exec_activate_imgact function calling the exec_mach_imgact function, that is, it finds the calling code of the function that must be called when directly calling the kernel to execute the process.

[0069] 503. Modify the address of the required function in the calling code to the address of the kernel driver function through a hook function. The kernel driver function is used to inject the sandbox dynamic library.

[0070] After obtaining the binary opcode of the exec_activate_imgact function calling the exec_mach_imgact function in step 502, that is, after obtaining the call code of the necessary function when directly calling the kernel to execute the process, the address of the necessary function (the address of the exec_mach_imgact function) in the call code is modified to the address of the kernel driver function through the hook function. The kernel driver function is injected with a sandbox dynamic library.

[0071] Specifically, the address of the exec_mach_imgact function is modified to the address of the kernel driver function in the calling code. The kernel driver function is used to inject sandbox dynamic libraries into the x86 architecture of macOS 14.0.

[0072] 503. If the application is running, the kernel driver function will be loaded into the kernel.

[0073] If the system detects that an application is running, it loads the kernel driver function in the kernel. Specifically, when the user clicks on the application, the kernel executes a new application process. The new application process then enters kernel mode through the execve or posix_spawn system call, and then enters the exec_activate_imgact function. Because the address of the exec_mach_imgact function was previously modified to the address of the kernel driver function, the kernel driver function is loaded in the kernel accordingly.

[0074] 504. If the application is determined to be an application within the sandbox space using kernel driver functions, then environment changes are inserted into the application's runtime process to inject the sandbox dynamic library into the application through environment variables. The value of the environment variable is used to indicate the address of the sandbox dynamic library.

[0075] After the kernel driver function is loaded, it is used to determine whether the application is a sandbox application. If the application is a sandbox application, an environment variable, namely the DYLD_INSERT_LIBRARIES variable, is inserted into the application's running process. This environment variable is used to inject the sandbox dynamic library into the application. The value of this environment variable is used to indicate the address of the sandbox dynamic library.

[0076] This application describes in detail the process of injecting sandbox dynamic libraries into the macOS system with x86 architecture in macOS 14.0. The sandbox dynamic library injection for x86 architecture is implemented based on kernel driver functions, which has the advantage of not needing to modify binary files or the application's own signature compared to the sandbox dynamic library injection scheme for ARM architecture.

[0077] Furthermore, in order to confirm the security of memory data, the data in memory is generally write-protected. Therefore, in this embodiment of the application, write protection needs to be turned off before executing step 503, and write protection needs to be turned on again after step 503 is completed.

[0078] As an optional embodiment, before executing step 403, since the calling code of the necessary function when directly calling the kernel to execute the process is located in the kernel code segment, when disabling write protection, the memory write protection of the read-only code segment is disabled by modifying the CPU cr0 register, and after step 503 is executed, the memory write protection of the read-only code segment is enabled by modifying the CPU cr0 register.

[0079] The following section describes the isolation process for applications within the sandbox after injecting dynamic libraries into the application. Please refer to [link to relevant documentation]. Figure 6 :

[0080] 601. If the application is running, load the sandbox dynamic library in the application;

[0081] Once the sandbox dynamic library is injected into an application within the sandbox workspace, the sandbox dynamic library will be loaded into the application when it runs.

[0082] 602. If the sandbox dynamic library is used to implement file redirection, then when the application accesses a non-sandbox application in the non-sandbox workspace, the application's access interface will be redirected to a preset storage address.

[0083] If the sandbox dynamic library is used to implement file redirection, then when a sandbox application (i.e., an application within the sandbox workspace) accesses a non-sandbox application (i.e., an application outside the sandbox workspace), the application's file access interface is redirected to a preset storage address to achieve isolation between sandbox applications and non-sandbox applications.

[0084] 603. If the sandbox dynamic library is used to implement clipboard isolation, then when the application creates a clipboard, the clipboard settings interface is redirected to the shared clipboard of the sandbox workspace application.

[0085] If the sandbox dynamic library is used to implement clipboard isolation, then when the clipboard is created, the clipboard settings interface is hijacked, and the data in the clipboard is stored in the shared clipboard of the sandbox workspace. In other words, the clipboard settings interface is redirected to the shared clipboard of the sandbox workspace application.

[0086] 604. When the application reads the contents of the clipboard, retrieve the corresponding contents from the shared clipboard.

[0087] Then, when the sandbox application reads the contents of the clipboard, the read interface is hijacked, and the corresponding read content is obtained from the shared clipboard.

[0088] 605. If the sandbox dynamic library is used to implement external device isolation, when the application accesses the external device interface, the external device interface is redirected to a preset external device interface. The preset external device interface is used to prevent the application from communicating with the external device. The external device interface includes at least one of Bluetooth device interface, printer interface and AirDrop interface.

[0089] If the sandbox dynamic library is used to implement external device isolation, when the application accesses the external device interface, the external device interface will be redirected to a preset external device interface. The preset external device interface is used to place the application and the external device for data communication. The external device interface includes at least one of Bluetooth device interface, printer device interface and AirDrop interface.

[0090] In this embodiment, the process of injecting a sandbox dynamic library into a sandbox application and then running the sandbox application to achieve isolation between the sandbox application and non-sandbox applications is described in detail. In this embodiment, data isolation between sandbox applications and non-sandbox applications is achieved through file redirection, clipboard redirection, and preset external device interface redirection technologies. Since there is no process data isolation between sandbox applications, free data communication between applications within the sandbox can be achieved.

[0091] Furthermore, based on the above embodiments, in order to further prevent certain sandbox applications from escaping the sandbox due to file redirection failure, this application embodiment can further isolate sandbox space files. Please refer to [link to relevant documentation]. Figure 7 :

[0092] 701. Receive file access events from the target application based on the driver;

[0093] Specifically, to prevent sandbox escape due to ineffective file redirection, this application embodiment can further filter access to sandbox application files by non-sandbox applications through sandbox file isolation. Specifically, it can be based on receiving file access events of the target application by the driver. Different drivers are used for different system architectures. For example, when the macOS system is based on the ARM architecture, the file isolation in the ARM driver uses an endpoint security framework, while when the macOS system is based on the x86 architecture, the file isolation in the x86 driver uses a kernel authorization framework.

[0094] 702. If the file to be accessed is determined to be a file within the sandbox workspace based on the file access event, and the target application is an application within the sandbox workspace, then the target application is allowed to access the file to be accessed.

[0095] When the driver receives a file access event from the target application, it determines whether the file to be accessed is a file within the sandbox workspace and whether the target application is an application within the sandbox workspace. If both the file to be accessed and the target application are applications within the sandbox workspace, the driver allows the target application to access the file to be accessed.

[0096] Furthermore, in this embodiment of the application, when the file to be accessed is a file within the sandbox workspace and the target application is an application outside the sandbox workspace, access to the file to be accessed by the target application is denied.

[0097] 703. If the file to be accessed is determined to be a file outside the sandbox workspace based on the file access event, and the target application is an application outside the sandbox workspace, then the target application is allowed to access the file to be accessed.

[0098] When the driver receives a file access event from the target application, if it determines from the file access event that the file to be accessed is a file outside the sandbox workspace, and the target application is an application outside the sandbox workspace, then the target application is allowed to access the file to be accessed.

[0099] Furthermore, in this embodiment of the application, when the file to be accessed is a file outside the sandbox workspace, and the target application is an application within the sandbox workspace, access to the file to be accessed by the target application is denied.

[0100] In this embodiment, the system uses file isolation in the sandbox space based on the driver to achieve mutual isolation of data between sandbox applications and non-sandbox applications, thereby realizing the prevention and remedy of sandbox escape when sandbox application file redirection fails.

[0101] Furthermore, embodiments of this application can also employ sandbox network isolation to achieve IP-level network isolation; please refer to [link to relevant documentation]. Figure 8 :

[0102] 801. Receive network access requests from target applications via network filtering driver;

[0103] Specifically, in order to achieve IP-level network isolation for sandbox applications, this application embodiment can also receive network access requests from target applications through a network filtering driver. Specifically, when the macOS system is based on the ARM architecture, the network filtering driver in the ARM driver uses a filtering framework based on network extensions (such as the NEFilterDataProvider filtering framework), while when the macOS system is based on the x86 architecture, the network filtering driver uses a filtering framework based on the kernel driver (such as the SocketFilter framework).

[0104] 802. If, based on the network access request, it is determined that the target application is an application within the sandbox workspace, and the access request is local communication, then obtain the peer application accessed by the target application.

[0105] When a network access request from a target application is received, the network 5-tuple information (source IP address, target IP address, source port, target port, and protocol type) is obtained based on the network access request. The target application is determined to be an application within the sandbox workspace based on the network 5-tuple information. If the access request is for local communication, the peer application accessed by the target application is obtained.

[0106] 803. If the peer application and the target application belong to the same sandbox workspace, then the target application is allowed to access the peer application.

[0107] If the peer application (i.e., the application being accessed) and the target application belong to the same sandbox workspace, then the target application is allowed to access the peer application; if the peer application and the target application do not belong to the same sandbox workspace, then the target application is denied access to the peer application.

[0108] 804. If, based on the network access request, it is determined that the target application is an application within the sandbox workspace, and the access request is an outbound network request, then obtain the outbound target IP address and target port.

[0109] If, based on the network access request, the network 5-tuple information (source IP address, destination IP address, source port, destination port, and protocol type) is obtained, and the target application is determined to be an application within the sandbox workspace based on the network 5-tuple information, and the access request is an outbound network request, then the outbound destination IP address and destination port are obtained.

[0110] 805. If, based on the network isolation configuration, it is determined that the target application is allowed to access the outbound target IP address and target port, then access to the outbound target IP address and target port is permitted. The network isolation configuration records the IP address and access port that the target application is allowed to access.

[0111] If, based on the network isolation configuration, it is determined that the target application is allowed to access the outbound target IP address and target port, then access to the outbound target IP address and target port is allowed. The network isolation configuration records the IP address and access port that the target application is allowed to access. If it is determined that the target application is not allowed to access the outbound target IP address and target port, then access to the outbound target IP address and target port is denied.

[0112] 806. If, based on the network access request, the target application is determined to be an application within the sandbox workspace, and the access request is an inbound network request, then obtain the source IP address and source port of the inbound request.

[0113] Furthermore, if the target application is determined to be an application within the sandbox workspace based on the network access request, and the access request is an inbound network request, then the network 5-tuple information is obtained based on the network request, and the source IP address and source port of the inbound application are obtained based on the network 5-tuple information.

[0114] 807. If, based on the network isolation configuration, it is determined that the target application is allowed to receive access from the source IP address and source port, then the target application is allowed to receive access from the source IP address and source port. The network isolation configuration also records the source IP address and source port that the target application is allowed to receive.

[0115] If, based on the network isolation configuration, it is determined that the target application is allowed to receive access from the source IP address and source port, then the target application will receive access from the source IP address and source port. The network isolation configuration also records the source IP address and source port that the target application is allowed to receive.

[0116] 808. If, based on the network access request, it is determined that the target application is an application outside the sandbox workspace, then the network access request of the target application is allowed.

[0117] Furthermore, if the target application is determined to be an application outside the sandbox workspace based on the network access request, then the network access request for the target application is allowed.

[0118] This application embodiment can achieve IP-level network isolation for sandbox applications through network isolation, thereby further reducing the granularity of network isolation and realizing more granular network isolation.

[0119] It is understood that, in various embodiments of the present invention, the order of the steps does not imply the order of execution. The execution order of each step should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0120] This application also provides a computer program product on which a computer program is stored. When the computer program is executed by a processor, it is used to implement the various steps in the method embodiments of this application.

[0121] The application isolation method based on the MacOS system in the embodiments of this application has been described in detail above. The computer device in the embodiments of this application will be described below. Please refer to [link / reference]. Figure 9 One embodiment of the computer device in this application includes:

[0122] The injection unit 901 is configured to, if it detects that an application is being imported into the sandbox workspace of the MacOS system, inject a sandbox dynamic library into the application by modifying the system executable file of the application or by driver injection, so as to achieve isolation of the application. The sandbox dynamic library is used to implement at least one of file redirection, clipboard isolation and external device isolation.

[0123] Preferably, the ARM dynamic library injection module 902 in the injection unit 901 is specifically used for:

[0124] If the system architecture is the ARM architecture, then traverse the system executable files of the application;

[0125] Parse the system executable file of the application to obtain loading instructions from the system executable file of the application;

[0126] Insert a dynamic library dependency instruction into the loading instruction, wherein the dynamic library dependency instruction is used to instruct the application to load the sandbox dynamic library.

[0127] Preferably, the ARM dynamic library injection module 902 is also used for:

[0128] Remove the application's signature before iterating through the application's system executable files;

[0129] After inserting dynamic library dependency instructions into the loading instructions, the application is re-signed.

[0130] Preferably, the X86 driver module 903 in the injection unit 901 is specifically used for:

[0131] If the system architecture is the X86 architecture, then after the kernel loads the kernel driver function, the kernel information is parsed using the kernel driver function to obtain the random address offset loaded into memory and the address of the kernel data segment in memory from the kernel information;

[0132] If a kernel process calls a necessary function when the kernel executes the process through a structure array, then the structure array is obtained based on the random address offset and the address of the kernel data segment in memory;

[0133] The addresses of the necessary functions that the kernel execution process must pass through are obtained from the structure array, and the addresses of the necessary functions are modified to the addresses of the kernel driver functions through hook functions, wherein the sandbox dynamic library is injected into the kernel driver functions.

[0134] Preferably, the X86 driver module 903 is specifically used for:

[0135] If the system architecture is the X86 architecture, then after the kernel loads the kernel driver function, the kernel information is parsed using the kernel driver function to obtain the random address offset loaded into memory and the address of the kernel code segment in memory from the kernel information;

[0136] If a kernel process directly calls a function that the kernel must execute when executing the process, then the calling code of the function that the kernel must execute when executing the process is obtained based on the random address offset and the address of the kernel code segment in memory;

[0137] The address of the required function in the calling code is modified to the address of the kernel driver function through a hook function, wherein the sandbox dynamic library is injected into the kernel driver function.

[0138] Preferably, the X86 driver module 903 is also used for:

[0139] If the application is run, the kernel driver function is loaded into the kernel;

[0140] If the kernel driver function determines that the application is an application within the sandbox workspace, then an environment variable is inserted into the running process of the application to inject the sandbox dynamic library into the application through the environment variable, wherein the value of the environment variable is used to indicate the address of the sandbox dynamic library.

[0141] Preferably, the X86 driver module 903 is also used for:

[0142] Before modifying the address of the required function to the address of the kernel driver function through the hook function, disable memory write protection;

[0143] After modifying the address of the required function to the address of the sandbox dynamic library using a hook function, memory write protection is enabled.

[0144] Preferably, the injection unit 901 in the computer device further includes:

[0145] Sandbox dynamic library module 904 is used for:

[0146] If the application is run, the sandbox dynamic library is loaded in the application;

[0147] If the sandbox dynamic library is used to implement the file redirection, then when the application accesses a non-sandbox application in the non-sandbox workspace, the application's access interface will be redirected to a preset storage address.

[0148] Preferably, the sandbox dynamic library module 904 is also used for:

[0149] If the application is run, the sandbox dynamic library is loaded in the application;

[0150] If the sandbox dynamic library is used to implement the clipboard isolation, then when the application creates the clipboard, the clipboard settings interface is redirected to the shared clipboard of the sandbox workspace application;

[0151] When the application reads the contents of the clipboard, the corresponding read content is obtained from the shared clipboard.

[0152] Preferably, the sandbox dynamic library module 904 is also used for:

[0153] If the application is run, the sandbox dynamic library is loaded in the application;

[0154] If the sandbox dynamic library is used to implement the external device isolation, then when the application accesses the external device interface, the external device interface is redirected to a preset external device interface. The preset external device interface is used to prevent the application from communicating with the external device. The external device interface includes at least one of a Bluetooth device interface, a printer interface, and an AirDrop interface.

[0155] Preferably, the injection unit 901 in the computer device further includes: an ARM driver module 905.

[0156] The ARM driver module 905 and the x86 driver module 903 are respectively used for:

[0157] Based on the driver, file access events from the target application are received;

[0158] If the file to be accessed is determined to be a file within the sandbox workspace based on the file access event, and the target application is an application within the sandbox workspace, then the target application is allowed to access the file to be accessed.

[0159] If the file to be accessed is determined to be a file outside the sandbox workspace based on the file access event, and the target application is an application outside the sandbox workspace, then the target application is allowed to access the file to be accessed.

[0160] Preferably, the driver in the ARM driver module 905 is a driver based on the endpoint security framework, and the driver in the x86 driver module 903 is a driver based on the kernel licensing framework.

[0161] Preferably, the ARM driver module 905 and the x86 driver module 903 are respectively used for:

[0162] The network filtering driver receives network access requests from the target application.

[0163] If, based on the network access request, it is determined that the target application is an application within the sandbox workspace, and the access request is local communication, then the peer application accessed by the target application is obtained.

[0164] If the peer application and the target application belong to the same sandbox workspace, then the target application is allowed to access the peer application.

[0165] If, based on the network access request, it is determined that the target application is an application within the sandbox workspace, and the access request is an outbound network request, then the outbound target IP address and target port are obtained.

[0166] If, according to the network isolation configuration, it is determined that the target application is allowed to access the outbound target IP address and target port, then access to the outbound target IP address and target port is permitted. The network isolation configuration records the IP address and access port that the target application is allowed to access.

[0167] If, based on the network access request, it is determined that the target application is an application within the sandbox workspace, and the access request is an inbound network request, then the source IP address and source port of the inbound request are obtained.

[0168] If, according to the network isolation configuration, it is determined that the target application is allowed to receive access from the source IP address and the source port, then the access from the IP address and the source port to the target application is received. The network isolation configuration also records the source IP address and source port that the target application is allowed to receive.

[0169] Preferably, the network isolation of the network filter driver in the ARM driver module 905 is based on a network extension-based filtering framework, and the network isolation of the network filter driver in the X86 driver module 903 is based on a kernel driver-based filtering framework.

[0170] For ease of description and brevity, the specific working process of the system, device and unit described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0171] In this embodiment of the application, if it is detected that an application is imported into the sandbox workspace of the MacOS system, the injection unit 901 injects the sandbox dynamic library into the application by modifying the system executable file of the application or by driver injection, so as to achieve isolation of the application. The sandbox dynamic library is used to implement at least one of file redirection, clipboard isolation and external device isolation, thereby realizing the later configuration of application isolation after the application development is completed, and realizing the flexibility and convenience of application isolation.

[0172] The computer device in the embodiments of the present invention has been described above from the perspective of modular functional entities. The computer device in the embodiments of the present invention will now be described below from the perspective of hardware processing:

[0173] One embodiment of the computer device in this invention includes:

[0174] Processor and memory;

[0175] The memory is used to store computer programs, and when the processor executes the computer programs stored in the memory, it can implement the various steps in the above method embodiments.

[0176] It is understood that when the processor in the computer device described above executes the computer program, it can also implement the functions of each unit in the corresponding device embodiments described above, which will not be repeated here. For example, the computer program can be divided into one or more modules / units, which are stored in the memory and executed by the processor to complete the present invention. The one or more modules / units can be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program in the computer device. For example, the computer program can be divided into units in the aforementioned computer device, and each unit can implement the specific functions described in the corresponding computer devices above.

[0177] The computer device may be a desktop computer, laptop, handheld computer, or cloud server, etc. The computer device may include, but is not limited to, a processor and memory. Those skilled in the art will understand that the processor and memory are merely examples of a computer device and do not constitute a limitation on the computer device. It may include more or fewer components, or a combination of certain components, or different components. For example, the computer device may also include input / output devices, network access devices, buses, etc.

[0178] The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. The processor is the control center of the computer device, connecting various parts of the computer device via various interfaces and lines.

[0179] The memory can be used to store the computer programs and / or modules. The processor implements various functions of the computer device by running or executing the computer programs and / or modules stored in the memory and by calling data stored in the memory. The memory may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function, etc.; the data storage area may store data created according to the use of the terminal, etc. In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, RAM, plug-in hard disk, smart media card (SMC), secure digital card (SD), flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0180] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the processor can be used to perform the various steps in the above method embodiments.

[0181] It is understood that if the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a corresponding computer-readable storage medium. Based on this understanding, all or part of the processes in the above-described embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the above-described method embodiments. The computer program includes computer program code, which can be in the form of source code, object code, executable file, or some intermediate form. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drive, portable hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium can be appropriately added or removed according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electrical carrier signals and telecommunication signals.

[0182] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between apparatuses or units through some interfaces, and may be electrical, mechanical, or other forms.

[0183] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0184] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0185] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An application isolation method, characterized by, The method comprises the following steps: If it is detected that the application is imported into the sandbox workspace of the MacOS system, a sandbox dynamic library is injected into the application by modifying the system executable file of the application or by means of driver injection, so as to realize the isolation of the application, wherein the sandbox dynamic library is used to realize at least one of file redirection, clipboard isolation and external device isolation, and wherein: The sandbox dynamic library is injected into the application by modifying the system executable file of the application, which comprises the following steps: Traverse the system executable file of the application; Parse the system executable file of the application to obtain a loading instruction from the system executable file of the application; Insert a dynamic library dependency instruction in the loading instruction, wherein the dynamic library dependency instruction is used to instruct the application to load the sandbox dynamic library; The sandbox dynamic library is injected into the application by means of driver injection, which comprises the following steps: According to the calling mode of the necessary function when the kernel calls the kernel execution process, the address of the necessary function is modified into the address of the kernel driver function, wherein the address of the kernel driver function is used to inject the sandbox dynamic library.

2. The method of claim 1, wherein, According to the calling mode of the necessary function when the kernel calls the kernel execution process, the address of the necessary function is modified into the address of the kernel driver function, which comprises the following steps: After the kernel loads the kernel driver function, the kernel information is parsed by using the kernel driver function to obtain a random address offset loaded into the memory and an address of a kernel data segment in the memory in the kernel information; If the kernel calls the necessary function when the kernel execution process is called through a structure array, the structure array is obtained according to the random address offset and the address of the kernel data segment in the memory; The address of the necessary function when the kernel execution process is called is obtained from the structure array, and the address of the necessary function is modified into the address of the kernel driver function by using a hook function.

3. The method of claim 1, wherein, According to the calling mode of the necessary function when the kernel calls the kernel execution process, the address of the necessary function is modified into the address of the kernel driver function, which comprises the following steps: After the kernel loads the kernel driver function, the kernel information is parsed by using the kernel driver function to obtain a random address offset loaded into the memory and an address of a kernel data segment in the memory in the kernel information; If the kernel directly calls the necessary function when the kernel execution process is called, the calling code of the necessary function when the kernel execution process is called is obtained according to the random address offset and the address of the kernel code segment in the memory; The address of the necessary function in the calling code is modified into the address of the kernel driver function by using a hook function.

4. The method of claim 1, wherein, The method further comprises the following steps: If the application is run, the sandbox dynamic library is loaded in the application; If the sandbox dynamic library is used to realize the file redirection, an access interface of the application is redirected to a preset storage address when the application accesses a non-sandbox application in a non-sandbox workspace; if the sandbox dynamic library is used to realize the clipboard isolation, a setting interface of the clipboard is redirected to a shared clipboard of the sandbox workspace application when the application creates the clipboard; When the application reads the content of the clipboard, the corresponding read content is obtained from the shared clipboard; If the sandbox dynamic library is used to implement the external device isolation, when the application accesses an external device interface, the external device interface is redirected to a preset external device interface, wherein the preset external device interface is used to prevent the application from communicating data with an external device, and the external device interface includes at least one of a Bluetooth device interface, a printer interface, and a cast interface.

5. The method of claim 1, wherein, The method further includes: based on driving a file access event of a target application; If it is determined based on the file access event that the file to be accessed is a file in the sandbox workspace and the target application is an application in the sandbox workspace, the target application is allowed to access the file to be accessed. If it is determined based on the file access event that the file to be accessed is a file in a non-sandbox workspace and the target application is an application in the non-sandbox workspace, the target application is allowed to access the file to be accessed.

6. The method of claim 1, wherein, The method further includes: filtering a network access request of a target application through a network; If it is determined according to the network access request that the target application is an application in a sandbox workspace and the access request is local communication, a peer application accessed by the target application is obtained; If the peer application and the target application belong to the same sandbox workspace, the target application is allowed to access the peer application.

7. A computer apparatus, comprising: It includes: an injection unit, if it is detected that an application is imported into a sandbox workspace of a MacOS system, a sandbox dynamic library is injected into the application by modifying a system executable file of the application or by driving injection, so as to implement isolation of the application, wherein the sandbox dynamic library is used to implement at least one of file redirection, clipboard isolation, and external device isolation; The injection unit is specifically used for: traversing the system executable file of the application; parsing the system executable file of the application to obtain a loading instruction from the system executable file of the application; inserting a dynamic library dependency instruction in the loading instruction, wherein the dynamic library dependency instruction is used to instruct the application to load the sandbox dynamic library; Or, The injection unit is specifically used for: According to the calling mode of the kernel when the kernel calls the kernel execution process, the address of the mandatory function is modified to the address of the kernel driving function, wherein the address of the kernel driving function is used to inject the sandbox dynamic library.

8. A computer apparatus comprising a processor, characterised in that, The processor, when executing the computer program stored in the memory, is used to implement the application isolation method according to any one of claims 1 to 6.

9. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program, when executed by the processor, is used to implement the application isolation method according to any one of claims 1 to 6.

10. A computer program product having stored thereon a computer program, characterized in that, The computer program, when executed by the processor, is used to implement the application isolation method according to any one of claims 1 to 6. The computer program, when executed by the processor, is used to implement the application isolation method according to any one of claims 1 to 6.

Images