Duplex stacked operating system security mechanism

Abstract

The invention discloses a duplex stacked operating system security mechanism. The mechanism comprises the following steps: S1, system resource classification configuration: carrying out system resource classification and integrity grade division on system resources; carrying out credibility marking and forming a protection configuration table; s2, marking management: carrying out integrity marking on the system resources; s3, forming a mapping relation between the integrity mark and the integrity level; issuing the mapping relation from the user space to the kernel space; issuing the credibility mark and the protection configuration table from the user space to the kernel space; s4, when the software runs, judging whether the software is system software or not; if yes, trusted measurement is carried out, and the step S5 is carried out after success; if the measurement is not successful, directly ending; if the software is not the system software, directly entering the step S5; and S5, carrying out integrity verification on the software, if the verification is successful, allowing the software to access, and if the verification is not successful, directly ending.

Description

Technical Field

[0001] The invention belongs to the field of Linux system security, and in particular relates to a double stack operating system security mechanism. Background Art

[0002] The operating system contains important configuration files and executable programs. Once these configuration files or executable programs are replaced or malicious code is inserted, the operating system may face serious security risks. The system may not start or run normally, or even cause the system to be completely inoperable or leak user information. Therefore, how to ensure that important configuration files and executable programs are not replaced or illegally tampered with is an issue that must be considered.

[0003] The single trusted computing static measurement mechanism control can only determine the legitimacy of the software, but cannot determine the security of the software behavior. When the system cannot determine the legitimacy, it can only leave it to the user to make the decision. Due to the uncertainty of the behavior of desktop ecosystem software, frequent authorization interactions reduce the ease of use of the system. At the same time, the system's flat permission management cannot meet the user's security needs.

[0004] Although a single integrity protection mechanism can protect the security of software behavior, its implementation scheme generally uses SELinux. Although it enhances security, it also increases system overhead, which may affect system performance, especially when dealing with a large number of context decisions. In addition, its system policy writing is complex, application compatibility is poor, it is not easy to ensure the correctness of policy writing, and management is complex, making it difficult to debug and maintain related policies. It is poor in usability, has security risks, and has high technical barriers, and usually cannot meet user needs.

[0005] As users have higher and higher requirements for the security and usability of operating systems, the current system is unable to strike a balance between usability and security, neither changing users' usage habits too much nor ensuring the system's security protection capabilities. Summary of the invention

[0006] To solve the above problems, the present invention provides a double-stacked operating system security mechanism, which realizes double-level permission management through the trusted mechanism and the stacked control design of the security integrity mechanism, effectively avoiding the third-party software from being unable to execute due to the trusted strict mode, affecting the user's business operation, and also reducing the security risks caused by release. At the same time, the present invention also realizes a new integrity verification method, which has good security, low overhead, good ease of use and compatibility.

[0007] The present invention provides a double stack operating system security mechanism, comprising the following steps: Step S1, classification and configuration of system resources: classifying system resources and dividing the integrity levels of system resources in the user space; marking the credibility of system resources to distinguish between system software and application software in system resources, and forming a protection configuration table based on system software; Step S2, tag management: using a tagging algorithm to perform integrity tagging on system resources in user space; Step S3: forming a mapping relationship between the integrity tag and the integrity level of the system resource; sending the mapping relationship between the integrity tag and the integrity level from the user space to the integrity mapping policy library of the kernel space; sending the credibility tag and the protection configuration table from the user space to the kernel space; Step S4: in the kernel space, when the software is running, judging whether the software is system software based on the credibility mark; If the software is system software, the software is verified for trustworthiness based on the protection configuration table, and after the trustworthiness is successfully verified, the process proceeds to step S5; if the trustworthiness is unsuccessful, the process ends directly; if the software is not system software, the process proceeds directly to step S5; Step S5: Call the integrity mapping policy library to perform integrity check on the software when it accesses system resources. If the check succeeds, it is allowed to access the system resources. If the check fails, the process ends directly.

[0008] A further improvement of the present invention is that in step S1, the integrity level of system resources is defined from the dimensions of users, software packages, files and directories, thereby obtaining the integrity level of users, the integrity level of software packages, the integrity level of files and the integrity level of directories; wherein the integrity level of files and the integrity level of directories are defined from the subject and object aspects respectively.

[0009] A further improvement of the present invention is that the integrity mark includes an execution process type and an object type; the execution process type is exec_sid, and the object type is oid; exec_sid and oid are divided into three sections. The first section is pkg_id, which represents the ID of the software package corresponding to the software. The second section is file_id, which represents the absolute path ID of the file. The third section is path_id, which represents the directory. Using the marking algorithm to mark the integrity of system resources in user space means: when setting the integrity level in terms of files, directories, or software packages, mark the value of the segment corresponding to exec_sid or oid; if the integrity level is not set, the value of the corresponding segment is marked as 0; the value of the path_id mark is the path_id of the adjacent parent directory with the integrity level set; When a file or directory is used as the subject, exec_sid is marked with integrity; when a file or directory is used as the object, oid is marked with integrity.

[0010] A further improvement of the present invention is that the mapping relationship between the integrity mark and integrity level of the system resources includes: the mapping relationship between the integrity mark corresponding to the software package and the integrity level corresponding to the software package, the mapping relationship between the integrity marks corresponding to the files and directories as subjects and objects respectively and the integrity levels corresponding to the files and directories as subjects and objects respectively, and the mapping relationship between the user uid and the corresponding integrity level.

[0011] A further improvement of the present invention is that, in step S5, the access of the software to the system resources is abstracted as the access of the subject process to the object process or the object file; The step S5 comprises the following steps: Step S51: Obtain the integrity mark corresponding to the security domain of the subject process, call the integrity mapping policy library to obtain the corresponding integrity level, and calculate the integrity level of the subject process according to the integrity level algorithm of the subject process; Step S52: obtaining the integrity mark corresponding to the security domain of the object process or object file, calling the integrity mapping policy library to obtain the corresponding integrity level, and calculating the integrity level of the object process or object file according to the integrity level algorithm of the object process or object file; Step S53: Based on the integrity level of the subject process, the integrity level of the object process or object file and the set integrity access rules, determine whether the software's access to system resources complies with the integrity access rules. If it complies with the integrity access rules, the integrity check succeeds and it is allowed to access the system resources. If it does not comply with the integrity access rules, the integrity check fails and ends directly.

[0012] A further improvement of the present invention is that step S51 includes the following steps: Step S511: Determine the values ​​of sid and orig_sid of the security domain of the subject process, thereby determining the integrity marks of file_id, path_id and pkg_id of sid of the subject process and the integrity marks of file_id, path_id and pkg_id of orig_sid of the subject process; Step S512: Call the integrity mapping policy library to determine the integrity level corresponding to the file_id, path_id and pkg_id of the sid of the subject process, the integrity level corresponding to the file_id, path_id and pkg_id of the orig_sid of the subject process, and the integrity level corresponding to the user uid based on the mapping relationship between the integrity tag and the integrity level; Step S513: Calculate the integrity level of the subject based on the integrity levels corresponding to the file_id, path_id and pkg_id of the subject process sid, the integrity levels corresponding to the file_id, path_id and pkg_id of the subject's orig_sid, and the integrity level of the user uid.

[0013] A further improvement of the present invention is that in step S511, the value of the sid of the security domain of the main process depends on whether the main process is an independent application. If it is an independent application, the value of sid is the corresponding value of orig_sid; if it is not an independent application, the value of sid inherits the sid of its parent process; The value of orig_sid of the security domain of the main process is the value of the corresponding exec_sid.

[0014] The following are the criteria for determining whether the main process is an independent application: (1) If the process is the head process in a process group, it is considered an independent application; (2) If the process is started by the init process, the process is considered an independent application; (3) If the parent process of a process is equal to the parent process of its group process, there are two cases: the first is that the process is the head process of the process group, that is, the case shown in step (1), then the process is considered an independent application; the second is that the process and the head process are sibling processes, and the process as the brother process of the head process is also considered an independent application; (4) If the parent process of the process is the head process, or its group process is equal to the group process of the parent process, the process is considered a non-independent application; (5) When the terminal process group id (tpgid) of the process is valid, if tgpid is the parent process pid or process group id, the process is a non-independent application; otherwise, the process is considered an independent application; (6) In other cases, the process is considered an independent application.

[0015] A further improvement of the present invention is that the integrity level of the main process is integrity_level, The steps for calculating the integrity level of the main process in step S513 are as follows: Step S51301: set integrity_level to a default value; Step S51302: Check whether the integrity level corresponding to the file_id of sid has been configured. If yes, assign the integrity level corresponding to the file_id of sid to integrity_level and execute step S51305. If no, execute step S51303. Step S51303: Check whether the integrity level corresponding to the path_id of sid has been configured. If yes, assign the integrity level corresponding to the path_id of sid to integrity_level; otherwise, traverse the path_id pairs corresponding to the path_id, and after finding that the integrity level corresponding to one of the path_ids has been configured, jump out of the loop, take the minimum of the configured integrity level and integrity_level, and assign it to integrity_level, and then continue to execute step S51304; Step S51304: Check whether the integrity level corresponding to the pkg_id of the sid has been configured. If yes, assign the minimum of the integrity level corresponding to the pkg_id of the sid and integrity_level to integrity_level, and then execute step S51305. If no, directly execute step S51305. Step S51305: Check whether the integrity level corresponding to the file_id of orig_sid has been configured. If yes, take the minimum of the integrity level corresponding to the file_id of orig_sid and integrity_level and assign it to integrity_level, and execute step S51308. If no, execute step S51306. Step S51306: Check whether the integrity level corresponding to the path_id of orig_sid has been configured. If so, take the minimum of the integrity level corresponding to the path_id of orig_sid and integrity_level and assign it to integrity_level, and then continue to execute step S51307; otherwise, traverse the path_id pairs corresponding to the path_id until a path_id corresponding to the integrity level that has been configured is found, then jump out of the loop, take the minimum of the configured integrity level and integrity_level and assign it to integrity_level, and then execute step S51307; Step S51307: Check whether the integrity level corresponding to the pkg_id of orig_sid has been configured. If yes, assign the minimum of the integrity level corresponding to the pkg_id of orig_sid and integrity_level to integrity_level, and then execute step S51308. If no, directly execute step S51308; Step S51308: Determine whether integrity_level is the default value, if yes, execute step S51311, if no, execute step S51309; Step S51309: Check whether the integrity level of user uid has been configured, if not, execute step S51311, if yes, execute step S51310; Step S51310: Take the minimum of the integrity level of user uid and integrity_level and assign it to integrity_level; Step S51311: Set the integrity level of the main process to integrity_level and return.

[0016] A further improvement of the present invention is that, in step S52, the method for determining the sid and orig_sid of the object process is consistent with the method for determining the sid and orig_sid of the subject process; the method for calculating the integrity level of the object process is consistent with the method for calculating the integrity level of the subject process; The value of the oid of the object file's security domain is taken from the oid of the corresponding executable file; the integrity level of the object file is obtained based on the integrity levels corresponding to the file_id, path_id and pkg_id of the object file's oid and the integrity level of the user uid.

[0017] Beneficial effects of the present invention: The present invention proposes a double stack operating system security mechanism, which adopts a classification measurement method to avoid the third-party software from being unable to execute due to the trusted strict mode, affecting the user's business operation, or the bad user experience caused by frequent authorization and information tampering caused by erroneous authorization operations; at the same time, an integrity protection mechanism is adopted, trusted applications are granted high integrity levels, and untrusted applications are granted low integrity level permissions, reducing the security risks caused by release. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 It is a basic flow chart of the method of the present invention. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention is further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings. It should be understood that these descriptions are only exemplary and are not intended to limit the scope of the present invention. In addition, in the following description, the description of well-known structures and technologies is omitted to avoid unnecessary confusion of the concept of the present invention.

[0021] The present invention provides a double stack operating system security mechanism, which classifies system resources in user space and divides system resources into integrity levels, marks system resources for integrity according to classification, and converts the mapping relationship between system resources and integrity levels into the relationship between corresponding integrity marks and integrity levels, thereby forming an integrity policy. The integrity policy of the user space will be saved in the integrity mapping policy library of the kernel space.

[0022] The integrity mapping policy library is called in the kernel space to perform integrity check on the currently running software to determine whether it complies with the access rules of system resources.

[0023] like Figure 1 As shown, the specific steps are as follows: Step S1, system resource classification configuration: classify system resources and divide the integrity levels of system resources in user space.

[0024] From the software perspective, system resources are divided into system software and application software, and credibility is marked to distinguish whether credibility measurement is needed; specifically, system software and application software in system resources are distinguished by the security.ima extension attribute, so credibility marking is performed based on the security.ima extension attribute.

[0025] Only executable files and dynamically loadable files that need to be protected in the system need to be trusted. Therefore, when the system is initialized, the executable files and dynamically loadable files in the system software package are formed into a protection configuration table for trust measurement, and only the files in the protection configuration table are marked with credibility.

[0026] System resources define integrity levels from the dimensions of users, software packages, files, and directories; among them, files and directories need to define integrity levels from both the subject and object aspects.

[0027] Specifically, the internal relationship between the software packages (system software and application software) in the system resources is sorted out, and the integrity levels are finely divided from the two dimensions of users and applications. For files and directories in the software package that need additional definition or do not belong to any software package, the integrity levels can be divided from the dimensions of subject and object. The division method is strictly based on the degree of trust to ensure the accuracy and consistency of the data and prevent unauthorized modification and destruction. In this embodiment, there are 5 integrity levels, namely untrusted, low, medium, high, and system. Through this step, the integrity level of the user, the integrity level of the software package, the integrity level of the file, and the integrity level of the directory can be obtained; among them, the integrity level of the file and the integrity level of the directory are defined from the two aspects of subject and object respectively.

[0028] Step S2, tag management: marking the integrity of system resources in user space; Integrity marking (marking): Specifically, after the operating system boot service system is started, the marking script is executed to scan the system resources in full, calculate the integrity tags for all system resources according to the marking algorithm, and mark them. Setting integrity tags from the dimensions of software packages, files, and directories makes it convenient to use integrity tags to classify system resources, and also simplifies the subsequent integrity check function. When installing new system software, during the installation process, the marking script is called to mark all files in the software package according to the marking algorithm.

[0029] Since files and directories can be either subjects or objects when being accessed, they need to be labeled from both the subject and object aspects.

[0030] The integrity tag uses the security.integrity extended attribute and is divided into two parts: the execution process type (exec_sid) and the object type (oid). Using the tagging algorithm to tag the integrity of system resources in user space means: when setting the integrity level in terms of files, directories, and software packages, the value of the segment corresponding to exec_sid or oid is marked. When the integrity level of a file or directory is set as the subject, exec_sid is marked, and when the integrity level is set as the object, oid is marked.

[0031] exec_sid and oid are divided into three parts. The first part represents the id of the software package to which the file or directory belongs (i.e., pkg_id), the second part represents the absolute path id of the file (i.e., file_id), and the third part represents the directory (i.e., path_id). The software package name, absolute path name of the file, and directory name corresponding to each part are encrypted with sm3 and the last 64 bits are taken to ensure uniqueness. The value of the path_id tag is the path_id of the adjacent parent directory with a set integrity level.

[0032] The segment corresponding to exec_sid or oid is marked only after the integrity level of system resources is set, otherwise the corresponding field is marked as 0.

[0033] When setting integrity tags in the directory dimension, the same integrity level is set for all files or directories under a directory. At this time, all files under the directory have an identity to mark which directory they belong to. This identity is called path_id. In the implementation of this recursive directory control solution, it is necessary to build a parent-child hierarchical relationship for the directory, using a "path_id pair" representation in the format of (path_id: parent path_id), and pass this relationship to the kernel space (kernel), which builds the hierarchical relationship of path_id. It is worth noting that the parent path_id is not necessarily the parent directory, but the first different path_id found along the directory network.

[0034] Furthermore, in order to ensure that the path_id of a certain file is the closest parent directory with set integrity level, that is, when the integrity level of directories / etc / and / etc / network / is set at the same time, the path_id of / etc / network / interfaces comes from / etc / network instead of / etc / . To ensure this purpose, before marking the directory, it needs to be sorted to ensure that when the integrity level of the parent directory and its subdirectories is set at the same time, first recursively scan all files or directories under the parent directory, set their path_id to the path_id value of the parent directory, mark it as id1, and then recursively scan all files and directories under the subdirectory, update their path_id value to the path_id value of the subdirectory, mark it as id2, and store id2 and id1 as a directory pair. When all directories are marked, all directory pairs are sent to the kernel.

[0035] Step S3: Send the mapping relationship between the integrity mark and the integrity level from the user space to the integrity mapping policy library of the kernel space. Send the credibility mark and the protection configuration table from the user space to the kernel space.

[0036] First, the mapping relationship between the software package and the corresponding integrity level is converted into the mapping relationship between the integrity mark of the software package and the corresponding integrity level; the mapping relationship between the integrity levels of the subject and object corresponding to the files and directories is converted into the mapping relationship between the integrity marks corresponding to the files and directories and the corresponding integrity levels of the subject and object; the mapping relationship between the user name and the corresponding integrity level is converted into the mapping relationship between the user uid and the corresponding integrity level.

[0037] Secondly, according to the message format agreed with the kernel, the three converted mapping relationships, namely the integrity mapping strategies, are sent to the integrity mapping strategy library of the kernel space (kernel) by writing them into the memory file system interface file provided by the kernel.

[0038] Finally, check all configured integrity mapping policies through the memory file system interface file provided by the kernel to ensure that all integrity mapping policies are successfully delivered.

[0039] Step S4: In the kernel space, when the software is running, judging whether the software is system software based on the credibility mark; If the software is system software, the software is verified for trustworthiness based on the protection configuration table, and after the verification of trustworthiness is successful, the process proceeds to step S5; if the verification of trustworthiness is unsuccessful, the process ends directly; If the software is not system software, the software directly enters step S5.

[0040] Specifically, since the system software and application software in the system resources are distinguished by the security.ima extension attribute, at the beginning of the kernel's ima hooks function, a judgment on whether the security.ima extension attribute exists is added to judge whether the currently running software is system software or application software.

[0041] If it does not exist, it is application software, so the application software does not need to be trusted. If it exists, the software is system software, and the software needs to be verified by trust measurement.

[0042] Trusted measurement verification refers to the trusted measurement of executable files and dynamically loadable type files in the system software based on the trusted computing measurement technology and the protection configuration table to determine whether the software is trusted software.

[0043] Trusted metric verification uses the system's own ima / evm, and on this basis, it is modified to meet the requirements. When the trusted metric verification system is started, configure ima_appraise to enforce.

[0044] Step S5: Call the integrity mapping policy library to perform integrity check on the software when it accesses system resources. If the check succeeds, it is allowed to access the system resources. If the check fails, the process ends directly.

[0045] As mentioned above, when software accesses system resources, it can be abstracted as the main process of the software accessing the object file or object process.

[0046] Therefore, integrity checking refers to assigning different integrity levels to the main process and object process or object file in the system. When the main process in the system operates the object process or file, it strictly follows the integrity access rules corresponding to the integrity level. If the access rules are not met, access is prohibited, thereby ensuring the security of information in the system.

[0047] Specifically, a new integrity check module is added in the kernel using the LSM framework, and the integrity check function is implemented in the module.

[0048] Add a memory file system interface file in the integrity check module for interaction between kernel space and user space: receive the integrity mapping policy configured from the user space, save it in the integrity mapping policy library, display all configured integrity mapping policies to the user, and clear the integrity mapping policy.

[0049] The integrity check module uses the hook functions security_file_permission and security_inode_permission of the LSM framework to implement the integrity check function.

[0050] First, obtain the integrity mark corresponding to the security domain of the main process of the software, query the integrity mapping policy library, obtain the corresponding integrity level, and then calculate the integrity level of the main process according to the integrity level algorithm of the main process; Secondly, the integrity mark corresponding to the security domain of the object file or object process is converted into the integrity level of the object file or object process in the same way; finally, based on the integrity level of the subject process, the integrity level of the object process or object file and the set integrity access rules, the legality of the access is judged. If it is legal, access is allowed; if it is illegal, access is denied.

[0051] For processes and files, the security domain structures ksaf_task_security and ksaf_inode_security are set in the kernel to correspond to the hook functions of the LSM framework.

[0052] The structure ksaf_inode_security of the file's security domain contains the fields exec_sid and oid, which correspond to the exec_sid and oid marked as the integrity of the file in the previous chapter.

[0053] The ksaf_task_security structure of the process's security domain sets the fields sid and orig_sid, indicating the current sid of the process and the sid of the original main file respectively. When the software process starts, the hook function bprm_creds_for_exec of the LSM framework is used to set the values ​​of sid and orig_sid for the process respectively. The value of orig_sid is the value of the integrity mark of the corresponding exec_sid.

[0054] The sid is set according to the situation, and its value is the corresponding exec_sid (which is the same as orig_sid in this case), or the sid of the parent process.

[0055] The principle of sid value selection: If the process is regarded as an independent application, the sid value is the value of the integrity mark of the corresponding exec_sid (execution process type); otherwise, sid inherits the sid of the parent process.

[0056] The division method is as follows: (1) If the process is the head process in the software process group, it is considered an independent application; (2) If the process is started by the init process, the process is considered an independent application to prevent the init process's permissions from being inherited and to avoid the risk of expansion; (3) If the parent process of a process is equal to the parent process of its group process, there are two cases: the first is that the process is the head process of the process group, that is, the case shown in step (1), then the process is considered an independent application; the second is that the process and the head process are sibling processes. Since the head process is considered an independent application, the process as the brother process of the head process is also considered an independent application; (4) If the parent process of the process is the head process, or its group process is equal to the group process of the parent process, the process is considered a non-independent application; (5) When the terminal process group id (tpgid) of the process is valid, if tgpid is the parent process pid or process group id, the process is a non-independent application; otherwise, the process is considered an independent application; (6) In other cases, the process is considered an independent application.

[0057] After determining the values ​​of the integrity tags corresponding to the sid and orig_sid of the process, the integrity level corresponding to the file_id, path_id and pkg_id of the sid of the process and the integrity level corresponding to the file_id, path_id and pkg_id of the orig_sid of the process can be determined based on the mapping relationship in the integrity mapping policy library. The integrity level of the user uid refers to the integrity level corresponding to the user uid of the currently logged in user.

[0058] For a process as a subject, its integrity level is affected by multiple factors, including the integrity level corresponding to the file_id, path_id and pkg_id of the process's sid, the integrity level corresponding to the file_id, path_id and pkg_id of the process's orig_sid, and the integrity level of the user uid.

[0059] The integrity level of the main process is calculated as follows: (1) Set integrity_level to the default value.

[0060] (2) Check whether the integrity level corresponding to the file_id of the process sid has been configured. If so, assign this value to integrity_level and execute step (5); if not, execute step (3); (3) Check whether the integrity level corresponding to the path_id of process sid has been configured. If so, assign this value to integrity_level. Otherwise, traverse the "path_id pairs" until a path_id corresponding to the integrity level that has been configured is found. Then, exit the loop and assign the minimum of this value and integrity_level to integrity_level, and then continue to execute step (4). (4) Check whether the integrity level corresponding to the pkg_id of the process sid has been configured. If so, take the minimum of this value and integrity_level and assign it to integrity_level, then execute step (5). If not, execute step (5) directly. (5) Check whether the integrity level corresponding to the file_id of process orig_sid has been configured. If so, take the minimum of this value and integrity_level and assign it to integrity_level, and execute step (8). If not, execute step (6). (6) Check whether the integrity level corresponding to the path_id of process orig_sid has been configured. If so, take the minimum of this value and integrity_level and assign it to integrity_level, and then continue to execute step (7). Otherwise, traverse the "path_id pairs" until a path_id corresponding to the integrity level that has been configured is found, then jump out of the loop, take the minimum of this value and integrity_level and assign it to integrity_level, and then execute step (7). (7) Check whether the integrity level corresponding to the pkg_id of the process orig_sid has been configured. If so, take the minimum of this value and integrity_level and assign it to integrity_level, then execute step (8). If not, execute step (8) directly. (8) Determine whether integrity_level is the default value. If so, execute step (11); if not, execute step (9); (9) Check whether the integrity level of user uid (current user) has been configured. If not, go to step (11). If yes, go to step (10). (10) Take the minimum of the integrity level of user uid and integrity_level and assign it to integrity_level.

[0061] (11) Set the integrity level of the main process to integrity_level and return.

[0062] Similarly, the integrity level of the object process is calculated in the same way as the subject process.

[0063] That is, for a process as an object, its integrity level is also affected by multiple factors, including the integrity level corresponding to the file_id, path_id and pkg_id of the process's sid, the integrity level corresponding to the file_id, path_id and pkg_id of the process's orig_sid, and the integrity level of the user uid.

[0064] The integrity level of the object process is calculated as follows: (1) Set integrity_level to the default value.

[0065] (2) Check whether the integrity level corresponding to the file_id of the process sid has been configured. If so, assign this value to integrity_level and execute step (5); if not, execute step (3); (3) Check whether the integrity level corresponding to the path_id of process sid has been configured. If so, assign this value to integrity_level. Otherwise, traverse the "path_id pairs" until a path_id corresponding to the integrity level that has been configured is found. Then, exit the loop and assign the minimum of this value and integrity_level to integrity_level, and then continue to execute step (4). (4) Check whether the integrity level corresponding to the pkg_id of the process sid has been configured. If so, take the minimum of this value and integrity_level and assign it to integrity_level, then execute step (5). If not, execute step (5) directly. (5) Check whether the integrity level corresponding to the file_id of the process orig_sid has been configured. If so, take the minimum of this value and integrity_level and assign it to integrity_level, and execute step (8); if not, execute step (6) (6) Check whether the integrity level corresponding to the path_id of process orig_sid has been configured. If so, take the minimum of this value and integrity_level and assign it to integrity_level, and then continue to execute step (7). Otherwise, traverse the "path_id pairs" until a path_id corresponding to the integrity level that has been configured is found, then jump out of the loop, take the minimum of this value and integrity_level and assign it to integrity_level, and then execute step (7). (7) Check whether the integrity level corresponding to the pkg_id of the process orig_sid has been configured. If so, take the minimum of this value and integrity_level and assign it to integrity_level, then execute step (8). If not, execute step (8) directly. (8) Determine whether integrity_level is the default value. If so, execute step (11); if not, execute step (9); (9) Check whether the integrity level of user uid (current user) has been configured. If not, go to step (11). If yes, go to step (10). (10) Take the minimum of the integrity level of user uid and integrity_level and assign it to integrity_level.

[0066] (11) Set the integrity level of the object process to integrity_level and return.

[0067] The integrity level of the object file is affected by multiple factors, including the integrity level corresponding to the file_id, path_id and pkg_id of the file's oid and the integrity level of the user uid.

[0068] The integrity level of the object file is calculated as follows: (1) Set integrity_level to the default value.

[0069] (2) Check whether the integrity level corresponding to the file_id of the file's oid has been configured. If so, assign this value to integrity_level and execute step (5). If not, execute step (3). (3) Check whether the integrity level corresponding to the path_id of the file's oid has been configured. If so, assign this value directly to integrity_level and then execute step (4). Otherwise, traverse the "path_id pairs" until a path_id corresponding to the integrity level that has been configured is found. Then exit the loop and take the minimum of this value and integrity_level and assign it to integrity_level, then execute step (4). (4) Check whether the integrity level corresponding to the pkg_id of the file's oid has been configured. If so, assign the minimum value of this value and integrity_level to integrity_level, and then execute step (5). If not, execute step (5) directly. (5) Determine whether integrity_level is the default value. If so, execute step (8); if not, execute step (6); (6) Check whether the integrity level of the current user uid has been configured. If yes, go to step (7); if not, go to step (8); (7) Take the minimum of the integrity level of user uid and integrity_level and assign it to integrity_level; (8) Set the integrity level of the object file to integrity_level and return.

[0070] After the integrity level is calculated for the first time, it is cached in the subject security domain, and the timestamp at this moment is also saved as the subject timestamp. When it is used next time, if the subject timestamp is newer than the update time of the integrity mapping policy library, the last calculation result is used directly; otherwise, it means that the integrity mapping policy library has been updated after the integrity level was calculated last time, and the integrity level needs to be recalculated. Reduce the number of library queries and optimize system performance.

[0071] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. A multi-stack operating system security mechanism, characterized in that: The steps include: Step S1, classification and configuration of system resources: classifying system resources and dividing the integrity levels of system resources in the user space; marking the credibility of system resources to distinguish between system software and application software in system resources, and forming a protection configuration table based on system software; Step S2, tag management: using a tagging algorithm to perform integrity tagging on system resources in user space; Step S3: forming a mapping relationship between the integrity tag and the integrity level of the system resource; sending the mapping relationship between the integrity tag and the integrity level from the user space to the integrity mapping policy library of the kernel space; Send the credibility mark and protection configuration table from the user space to the kernel space; Step S4: in the kernel space, when the software is running, judging whether the software is system software based on the credibility mark; If the software is system software, a trust measurement check is performed on the software based on the protection configuration table, and after the trust measurement is successful, the process proceeds to step S5; If the trust measurement is unsuccessful, the process ends directly; if the software is not system software, the process goes directly to step S5; Step S5: Call the integrity mapping policy library to perform integrity check on the software when it accesses system resources. If the check succeeds, it is allowed to access the system resources. If the check fails, the process ends directly.

2. A dual stack operating system security mechanism according to claim 1, characterized in that: In step S1, the integrity level of system resources is defined from the dimensions of user, software package, file and directory, thereby obtaining the integrity level of the user, the integrity level of the software package, the integrity level of the file and the integrity level of the directory; wherein the integrity level of the file and the integrity level of the directory are defined from the subject and object aspects respectively.

3. A dual stack operating system security mechanism according to claim 2, characterized in that: The integrity tag includes an execution process type and an object type; the execution process type is exec_sid, and the object type is oid; exec_sid and oid are divided into three sections. The first section is pkg_id, which represents the ID of the software package corresponding to the software. The second section is file_id, which represents the absolute path ID of the file. The third section is path_id, which represents the directory. Using the marking algorithm to mark the integrity of system resources in user space means: when setting the integrity level in terms of files, directories, or software packages, mark the value of the segment corresponding to exec_sid or oid; if the integrity level is not set, the value of the corresponding segment is marked as 0; the value of the path_id mark is the path_id of the adjacent parent directory with the integrity level set; When a file or directory is used as the subject, exec_sid is marked with integrity; when a file or directory is used as the object, oid is marked with integrity.

4. A dual stack operating system security mechanism according to claim 3, characterized in that: The mapping relationship between the integrity tag and integrity level of system resources includes: the mapping relationship between the integrity tag corresponding to the software package and the integrity level corresponding to the software package, the mapping relationship between the integrity tags corresponding to the files and directories as subjects and objects respectively and the integrity levels corresponding to the files and directories as subjects and objects respectively, and the mapping relationship between the user uid and the corresponding integrity level.

5. A dual stack operating system security mechanism according to claim 1, characterized in that: In step S5, the access of the software to the system resources is abstracted as the access of the subject process to the object process or the object file; The step S5 comprises the following steps: Step S51: Obtain the integrity mark corresponding to the security domain of the subject process, call the integrity mapping policy library to obtain the corresponding integrity level, and calculate the integrity level of the subject process according to the integrity level algorithm of the subject process; Step S52: obtaining the integrity mark corresponding to the security domain of the object process or object file, calling the integrity mapping policy library to obtain the corresponding integrity level, and calculating the integrity level of the object process or object file according to the integrity level algorithm of the object process or object file; Step S53: Based on the integrity level of the subject process, the integrity level of the object process or object file and the set integrity access rules, determine whether the software's access to system resources complies with the integrity access rules. If it complies with the integrity access rules, the integrity check succeeds and it is allowed to access the system resources. If it does not comply with the integrity access rules, the integrity check fails and ends directly.

6. A dual stack operating system security mechanism according to claim 5, characterized in that: Step S51 includes the following steps: Step S511: Determine the values ​​of sid and orig_sid of the security domain of the subject process, thereby determining the integrity marks of file_id, path_id and pkg_id of sid of the subject process and the integrity marks of file_id, path_id and pkg_id of orig_sid of the subject process; Step S512: Call the integrity mapping policy library to determine the integrity level corresponding to the file_id, path_id and pkg_id of the sid of the subject process, the integrity level corresponding to the file_id, path_id and pkg_id of the orig_sid of the subject process, and the integrity level corresponding to the user uid based on the mapping relationship between the integrity tag and the integrity level; Step S513: Calculate the integrity level of the subject based on the integrity levels corresponding to the file_id, path_id and pkg_id of the subject process sid, the integrity levels corresponding to the file_id, path_id and pkg_id of the subject's orig_sid, and the integrity level of the user uid.

7. A dual stack operating system security mechanism according to claim 6, characterized in that: In step S511, the value of sid of the security domain of the main process depends on whether the main process is an independent application. If it is an independent application, the value of sid is the corresponding value of orig_sid; if it is not an independent application, the value of sid inherits the sid of its parent process; the value of orig_sid of the security domain of the main process is the corresponding value of exec_sid.

8. A multi-stack operating system security mechanism according to claim 7, characterized in that: The integrity level of the main process is integrity_level, The steps for calculating the integrity level of the main process in step S513 are as follows: Step S51301: set integrity_level to a default value; Step S51302: Check whether the integrity level corresponding to the file_id of sid has been configured. If yes, assign the integrity level corresponding to the file_id of sid to integrity_level and execute step S51305. If no, execute step S51303. Step S51303: Check whether the integrity level corresponding to the path_id of sid has been configured. If yes, assign the integrity level corresponding to the path_id of sid to integrity_level; otherwise, traverse the path_id pairs corresponding to the path_id, and after finding that the integrity level corresponding to one of the path_ids has been configured, jump out of the loop, take the minimum of the configured integrity level and integrity_level, and assign it to integrity_level, and then continue to execute step S51304; Step S51304: Check whether the integrity level corresponding to the pkg_id of the sid has been configured. If yes, assign the minimum of the integrity level corresponding to the pkg_id of the sid and integrity_level to integrity_level, and then execute step S51305. If no, directly execute step S51305. Step S51305: Check whether the integrity level corresponding to the file_id of orig_sid has been configured. If yes, take the minimum of the integrity level corresponding to the file_id of orig_sid and integrity_level and assign it to integrity_level, and execute step S51308. If no, execute step S51306. Step S51306: Check whether the integrity level corresponding to the path_id of orig_sid has been configured. If so, take the minimum of the integrity level corresponding to the path_id of orig_sid and integrity_level and assign it to integrity_level, and then continue to execute step S51307; otherwise, traverse the path_id pairs corresponding to the path_id until a path_id corresponding to the integrity level that has been configured is found, then jump out of the loop, take the minimum of the configured integrity level and integrity_level and assign it to integrity_level, and then execute step S51307; Step S51307: Check whether the integrity level corresponding to the pkg_id of orig_sid has been configured. If yes, assign the minimum of the integrity level corresponding to the pkg_id of orig_sid and integrity_level to integrity_level, and then execute step S51308. If no, directly execute step S51308; Step S51308: Determine whether integrity_level is the default value, if yes, execute step S51311, if no, execute step S51309; Step S51309: Check whether the integrity level of user uid has been configured, if not, execute step S51311, if yes, execute step S51310; Step S51310: Take the minimum of the integrity level of user uid and integrity_level and assign it to integrity_level; Step S51311: Set the integrity level of the main process to integrity_level and return.

9. A multi-stack operating system security mechanism according to claim 8, characterized in that: In step S52, the method for determining the sid and orig_sid of the object process is consistent with the method for determining the sid and orig_sid of the subject process; the method for calculating the integrity level of the object process is consistent with the method for calculating the integrity level of the subject process; The value of the oid of the object file's security domain is taken from the oid of the corresponding executable file; the integrity level of the object file is obtained based on the integrity levels corresponding to the file_id, path_id and pkg_id of the object file's oid and the integrity level of the user uid.

10. A multi-stack operating system security mechanism according to claim 7, characterized in that: Whether the main process is an independent application is divided as follows: If the main process is the head process in the process group, the main process is regarded as an independent application; If the main process is started by the init process, the main process is considered an independent application; If the parent process of the main process is equal to the parent process of its group process, the main process is considered an independent application; If the parent process of the main process is the head process or its group process is equal to the group process of the parent process, the main process is considered a non-independent application; When the terminal process group id of the main process is valid, if the terminal process group id is the parent process pid or process group id, the main process is regarded as a non-independent application, otherwise, it is regarded as an independent application.

Images