System programmable security access control method and device and medium

Abstract

The invention discloses a programmable security access control method and device for a system and a medium, and the method comprises the steps: defining a security programming language grammar model through a tetrad, and representing different access control models through a configuration condition expression; registering an additional component function to a corresponding slot position, and maintaining a corresponding relation between the function and the slot position; when an access control strategy is received, if a conditional expression statement or a response event is contained, strategy analysis is carried out, and analyzed additional component function information is stored in a strategy library; when an access event occurs in the system, whether access control of a related event exists or not is inquired, if yes, a function address is positioned after function mapping according to corresponding additional component function information, a positioned function is executed and called, and then whether current access is managed, controlled and responded or not is decided. According to the invention, different access control strategies can be flexibly realized, and diversified requirements of system security defense are met.

Description

Technical Field

[0001] The present invention relates to the technical field of security access control, and in particular to a system programmable security access control method, device and medium. Background Art

[0002] Computer security is a measure used to implement and ensure computer system security services, especially access control services. Access control means that only authorized entities (such as users, programs, processes, etc.) are allowed to use system resources according to security policies. Its basic elements include subject, object and access rights. Among them, subject is the entity that can access the object, and object is the entity that receives information, such as files, directories, messages, etc. Access rights refer to the way the subject can access the object, including reading, writing, executing, creating, searching, etc.

[0003] In the prior art, a single access control strategy or security model is usually used for system access control. For example, the Windows operating system implements access control functions based on the SRM (Security Reference Monitor) mechanism, the Linux system uses the LSM (Linux Security Modules) framework as the main access control mechanism, and the macOS and iOS systems use the MAC mechanism for system access control. The above mechanisms have different focuses on the implementation of access control security modules, but they are insufficient in flexibility and scalability, and it is difficult to meet the diverse security needs of the system.

[0004] Among them, the SRM mechanism uses SID to determine whether a process or user has the right to access an object, and determines whether to allow access by comparing the process SID with the ACEs (Access Control Entries) in the resource (Discretionary Access Control List), and compares the process integrity SID with the ACEs in the resource SACL (Access Control Entries) to perform integrity checks. However, this mechanism cannot be extended to different security models and functional requirements, such as the inability to implement authorization of objects by different accounts or subjects. The LSM framework provides a series of security functions to implement security models such as TE, RBAC, and MLS. However, the LSM framework requires developers to define security policies by themselves, and all security modules based on the LSM framework need to maintain policy maintenance programs with similar functions. Not only is the development threshold high, the implementation is difficult, and there are also problems such as redundant development. The MAC mechanism is similar to the LSM framework, and implements security extension by providing a lightweight control framework in the kernel, but there are also problems such as high development thresholds, high implementation difficulties, and inability to extend new security functions outside of its own security model. In the prior art, other types of operating system security mechanisms other than the above often have the problem of frequent modification of the kernel, system and interface to meet different customized requirements, poor flexibility and high customization cost, and the mechanism and strategy are mutually integrated, that is, the degree of coupling between security modules that implement different functions is high.

[0005] With the increasing complexity of network application environments and the dynamic nature of security threats, various operating system security issues are emerging one after another. Traditional single access control strategies or security models cannot solve various current security issues and cannot meet the current diverse needs for system security. Therefore, it is urgent to provide a system security access control method that enables flexible customization of access control security policies, improves the flexibility and scalability of access control security policy implementation, and meets the diverse security defense needs of various systems. Summary of the invention

[0006] The technical problem to be solved by the present invention is: in response to the technical problems existing in the prior art, the present invention provides a system programmable security access control method, device and medium with simple implementation method, low cost, flexibility and strong scalability, which can flexibly implement different access control strategies to meet the diversified needs of system security defense.

[0007] In order to solve the above technical problems, the technical solution proposed by the present invention is:

[0008] A system programmable security access control method, the steps comprising:

[0009] Use a four-tuple consisting of subject S, object O, permission P, and conditional expression E<S,O,P,E> Defines a secure programming language grammar model and is implemented by C<S,O,P,E> , D<S,O,P,E> and R<S,O,P,E> A respectively defines the control, detection and response of system behavior, where A represents the response event, and the conditional expression E is used to describe the conditional logic in the security policy. In the conditional expression E and the response event A, a single or multiple functions are used to express the decidable security issues to achieve programmability. The access control policy is defined by configuring the conditional expression E to represent different access control types, where the function in the conditional expression E is defined in the additional component;

[0010] Registering the add-on functions defined in the add-on to the corresponding slots, and maintaining the correspondence between each add-on function and the slot, wherein the secure programming language syntax model references the corresponding add-on function in the conditional expression E or the response event A according to the required access control policy;

[0011] When a defined access control policy is received, if the access control policy contains a conditional expression statement or a response event, the received access control policy is parsed, and the parsed additional component function information is stored in a policy library;

[0012] When an access event occurs in the system, the policy library is queried to see whether there is access control for the relevant event. If so, the function address is located after function mapping based on the corresponding add-on function information in the policy library, and the slot corresponding to the current add-on function is located based on the located function address and the correspondence between each add-on function and the slot maintained in the add-on; the located add-on function is executed and called, and then a decision is made whether to control and respond to the current access.

[0013] Furthermore, in the secure programming language grammar model, C<S,O,P,E> Indicates that if and only if the conditional expression E is satisfied, the subject S implements C control when accessing the object O with P permission, where C is permission or rejection. When the conditional expression E is not configured, it is converted into a triple C<S,O,P> , which is used to indicate that the subject S performs C control when performing P permission access to the object O; D<S,O,P,E> Indicates that if and only if the conditional expression E is satisfied, the subject S is detected when it performs P permission access to the object O. When the conditional expression E is not configured, it is converted into a triple D<S,O,P> , which is used to indicate the detection of the behavior of subject S accessing object O under P authority; R<S,O,P,E> A means that when and only when the conditional expression E is satisfied, the subject S performs action A response when performing P permission access behavior on the object O. When the conditional expression E is not configured, it is converted into a ternary ancestor R<S,O,P> A is used to indicate that when subject S accesses object O with permission P, action A is implemented in response.

[0014] Furthermore, the access control types include role-based access control, attribute-based access control and security attribute-based access control, and the security attribute-based access control includes integrity-based, confidentiality-based and RBAC-based access control.

[0015] Furthermore, the subject S and object O in the secure programming language syntax model support wildcarding, that is, support access permission control for all subjects S or all objects O in the system.

[0016] Furthermore, it also includes defining different access control rules for different security modules, storing the access control rules in different security namespaces, and defining a priority for each security namespace. When there is a policy conflict in the same or different namespaces, the access control policy to be executed first is determined according to the priority of the access control policy.

[0017] Furthermore, the locating of the function address after function mapping according to the corresponding additional component function information in the policy library includes: issuing function information including function name, module and function ID through the additional component function management module, and locating the function address according to the issued function information and the function name and module of the corresponding additional component function in the policy library to realize function mapping.

[0018] A system programmable security access control device, comprising:

[0019] Security language module, used to adopt a four-tuple consisting of subject S, object O, permission P, and conditional expression E<S,O,P,E> Defines a secure programming language grammar model and is implemented by C<S,O,P,E> , D<S,O,P,E> and R<S,O,P,E> A respectively defines the control, detection and response of system behavior, where A represents the response event, and the conditional expression E is used to describe the conditional logic in the security policy. In the conditional expression E and the response event A, a single or multiple functions are used to express the decidable security issues to achieve programmability. The access control policy is defined by configuring the conditional expression E to represent different access control types, where the function in the conditional expression E is defined in the additional component;

[0020] The security decision module includes a policy management unit and a control execution unit. The policy management unit includes:

[0021] The add-on function dynamic linking subunit is used to register the add-on functions defined in the add-on to the corresponding slots and maintain the corresponding relationship between each add-on function and the slot, and the secure programming language syntax model refers to the corresponding add-on function in the conditional expression E or the response event A according to the required access control policy;

[0022] The policy parsing subunit is used to parse the received access control policy when receiving the defined access control policy, if the access control policy contains a conditional expression statement or a response event, and store the parsed additional component function information in the policy library;

[0023] The control execution unit is used to query whether there is access control for related events in the policy library when an access event occurs in the system. If so, the function address is located after function mapping based on the corresponding additional component function information in the policy library, and the slot corresponding to the current additional component function is located based on the located function address and the correspondence between each additional component function and the slot maintained in the additional component; the located additional component function is executed and called, and then a decision is made whether to control and respond to the current access.

[0024] Furthermore, it also includes a security implementation module for implementing access control on different object types, wherein the object types include files, processes, devices, networks, capabilities and kernel modules.

[0025] A computer device comprises a processor and a memory, wherein the memory is used to store a computer program, and the processor is used to execute the computer program to perform the above method.

[0026] A computer-readable storage medium storing a computer program, wherein the computer program implements the above method when executed by a processor.

[0027] Compared with the prior art, the advantages of the present invention are:<S,O,P,E> Design and implement a secure programming language grammar model, based on the quadruple grammar model<S,O,P,E> By introducing the conditional expression E, the access control model can be expanded to manage, detect and respond to the behavior of programmable quadruple. The behavior and capabilities of access control can be defined through programming languages, thereby realizing the separation of mechanism and policy in the system access control process, and decoupling the security function implementation from the system kernel version and architecture. This is not only simpler to implement, but also more flexible and scalable. It can efficiently respond and flexibly customize access control security modules to meet the diverse security needs of the current system. It can also greatly improve the efficiency of security function development and accelerate the response to security needs. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 It is a schematic diagram of the implementation flow of the system programmable security access control method of this embodiment.

[0029] Figure 2 It is a schematic diagram of the principle of implementing dynamic linking of additional component functions in this embodiment.

[0030] Figure 3 It is an implementation example of a security control definition in a specific application embodiment of the present invention.

[0031] Figure 4 It is a specific implementation example of the relevant functions in the test.ko kernel module in a specific application embodiment of the present invention.

[0032] Figure 5 It is a schematic diagram of the structural principle of the system programmable security access control device of this embodiment. DETAILED DESCRIPTION

[0033] The present invention is further described below in conjunction with the accompanying drawings and specific preferred embodiments, but the protection scope of the present invention is not limited thereby.

[0034] like Figure 1 As shown, the steps of the system programmable security access control method of this embodiment include:

[0035] Step S01. Use a 4-tuple including subject S, object O, authority P, and conditional expression E<S,O,P,E> Defines a secure programming language grammar model and is implemented by C<S,O,P,E> , D<S,O,P,E> and R<S,O,P,E> A respectively defines the control, detection and response of system behavior, where A represents the response event, and the conditional expression E is used to describe the conditional logic in the security policy. In the conditional expression E and the response event A, a single or multiple functions are used to express the decidable security issues to achieve programmability. The access control policy is defined by configuring the conditional expression E to represent different access control types, where the function in the conditional expression E is defined in the additional component;

[0036] Step S02. Register the add-on function defined in the add-on to the corresponding slot, and maintain the correspondence between each add-on function and the slot. The secure programming language syntax model references the corresponding add-on function in the conditional expression E or the response event A according to the required access control policy;

[0037] Step S03. When a defined access control policy is received, if the access control policy contains a conditional expression statement or a response event, the received access control policy is parsed, and the parsed additional component function information is stored in the policy library;

[0038] Step S04. When an access event occurs in the system, the policy library is queried to see whether there is access control for the relevant event. If so, the function address is located after function mapping based on the corresponding add-on function information in the policy library, and the slot corresponding to the current add-on function is located based on the located function address and the correspondence between each add-on function and the slot maintained in the add-on; the located add-on function is executed and called, and then a decision is made whether to control and respond to the current access.

[0039] In the above steps of this embodiment, a secure programming language grammar model is designed and implemented, using a four-tuple<S,O,P,E> Define the syntax model of the secure programming language, in the four-tuple syntax model<S,O,P,E> By introducing the conditional expression E, the access control model can be expanded to manage, detect and respond to the behavior of programmable quadruple. This model can be used to define uncertain security models and requirements based on high-level security programming languages. The behavior and capabilities of access control can be defined through programming languages, thereby realizing the separation of mechanism and policy in the system access control process and decoupling the security function implementation from the system kernel version and architecture. This is not only simpler to implement, but also more flexible and scalable. It can efficiently respond and flexibly customize access control security modules to meet the diverse security needs of the current system. It can also greatly improve the efficiency of security function development and accelerate the response to security needs.

[0040] In this embodiment, the security control definition refers to the access control policy definition based on the security programming language syntax model. The security programming language syntax model is the control of the system behavior of the four-tuple consisting of subject S, object O, permission P, and conditional expression E. The traditional definition of system behavior is a triple<S,O,P> , that is, using the access control triplet<S,O,P> The grammatical model that defines the permission P of subject S to object O mainly controls the behavior of triples, which can only express deterministic system behavior and cannot be dynamically expanded. Compared with the traditional access control triples<S,O,P> Syntax model, this embodiment uses the four-tuple grammar model<S,O,P,E> The introduction of conditional expression E expands the access control model to manage, detect and respond to the behavior of programmable quadruple. The conditional expression E can be defined on demand through programming, and any decidable security issues can be expressed through the additional functions therein, thereby achieving the purpose of programmability.

[0041] For example, the conditional expression E in the secure programming language syntax model is optional, so it is backward compatible with the traditional triple syntax model. When the conditional expression E is not configured, it is converted into the traditional triple syntax model, which is compatible with the triple and quad syntax models. By using the quad definition access control model with uncertain expression, compared with the traditional triple deterministic expression, it can flexibly describe diverse security scenarios and requirements, and realize the definition of security functions in a secure language.

[0042] Specifically, in the secure programming language syntax model, C<S,O,P,E> Indicates that if and only if the conditional expression E is satisfied, the subject S implements C control when accessing the object O with P permission, where C is permission or rejection. When the conditional expression E is not configured, it is converted into a triple C<S,O,P> , which is used to indicate that the subject S performs C control when performing P permission access to the object O; D<S,O,P,E> Indicates that if and only if the conditional expression E is satisfied, the subject S is detected when it performs P permission access to the object O. When the conditional expression E is not configured, it is converted into a triple D<S,O,P> , which is used to indicate the detection of the behavior of subject S accessing object O under P authority; R<S,O,P,E> A means that when and only when the conditional expression E is satisfied, the subject S performs action A response when performing P permission access behavior on the object O. When the conditional expression E is not configured, it is converted into a ternary ancestor R<S,O,P> A is used to indicate that when subject S responds to object O's access to P authority, action A is implemented. The above conditional expression E and response event A use functions to express a decidable security problem, thereby achieving the purpose of programmability and achieving an infinite computing mode.

[0043] By adopting the above-mentioned security syntax, this embodiment can meet the basic capabilities of management, detection, and response, while covering various demand scenarios of security functions, and use the security programming syntax model in the security control definition to define access control capabilities and objectives, thereby realizing flexible definition of different security modules and security scenarios.

[0044] The four access control definition methods included in the above secure programming language syntax model are specifically shown in Table 1. Specifically, in the secure language module, the secure programming language compiler implements the lexical and grammatical semantics according to Table 1.

[0045] Table 1: Access control definitions for the secure programming language syntax model

[0046]

[0047]

[0048] In this embodiment, the conditional expression E is a Boolean operation performed by a single or multiple functions, which is used to express a decidable security problem, thereby achieving the purpose of programmability and achieving an infinite computing mode, thereby satisfying Turing completeness. The response event E is the parallel execution of a single or multiple functions. The functions in the conditional expression and the response event are specifically implemented by additional components, which can be kernel modules ko or ebpf programs. Additional components can be defined and implemented based on general programming languages, including C, C++, Python, go, etc., and are referenced in the syntax of the secure programming language.

[0049] In this embodiment, the access control types include role-based access control, attribute-based access control and security attribute access control, wherein the security attribute access control includes integrity-based, confidentiality-based and RBAC-based access control, etc., and the required access control type is selected by configuring the conditional expression E. That is, based on the conditional expression, the security language module can express different access control types such as role-based, attribute-based, and policy-based by configuring the conditional expression, such as access control models such as integrity, confidentiality, and RBAC. For example, the security language can configure access control definitions such as "processes with network connections cannot use sensitive commands such as passwd and useradd", "remote login users cannot perform system management operations", and "processes with destroyed data integrity cannot run". At the same time, the security language module can also respond to abnormal behaviors by configuring response events. For example, configure the access control definition of "blocking and killing dangerous processes when the sensitive file passwd is detected to be modified".

[0050] Optionally, the subject S and object O in the secure programming language syntax model can also support wildcarding, that is, support access permission control for all subjects S or all objects O in the system, so that the access control policy configuration process can be more flexible and efficient.

[0051] Optionally, it also includes defining different access control rules for different security modules, storing the access control rules in different security namespaces, and defining a priority for each security namespace. When there is a policy conflict in the same or different namespaces, the access control policy to be executed first is determined according to the priority of the access control policy. For example, different access control rules can be defined for different security vendors or security modules. These independent access control rules are stored in different security namespaces. Each security namespace has a priority, and the access control policy with a higher priority is executed first. By introducing security namespaces and priority definitions, policy conflicts in the same or different namespaces are identified and processed, thereby further realizing policy isolation.

[0052] Optionally, the syntax in the secure programming language syntax model can also support the control isolation of different security programs, which is set by the priority of the namespace. At the same time, the syntax model is not oriented to specific security models and access control requirements, but freely describes and defines access control function mechanisms through the secure programming language.

[0053] In step S02 of this embodiment, the functions in the additional components can be registered to the corresponding slots through the dynamic linking process of the additional component functions, and the one-to-one correspondence between the function unique identifier id and the function slot can be maintained, and the additional function can be dynamically addressed. Based on the conditional expression syntax of the language, this embodiment can realize the function of self-definition of constraint functions, and then combined with the additional component module function address relocation technology, it can achieve the goal of multi-factor programming development for different security scenarios, and can be compatible with various types of high-level languages ​​such as C, Python, Go, etc., so that the security language meets Turing completeness.

[0054] In step S04 of this embodiment, locating the function address after function mapping according to the corresponding additional component function information in the policy library includes: issuing function information including function name, module, and function id through the additional component function management module, and locating the function address according to the issued function information and the function name and module of the corresponding additional component function in the policy library to achieve function mapping. By locating the function address through function mapping, the function slot can be located, and finally the mapping relationship between the function and the function slot can be obtained, and then the located additional component function can be executed and called, and then it can be decided whether to control and respond to the current access, and the security decision-making process is completed.

[0055] like Figure 2As shown, the process of dynamically linking additional component functions can be done in the following steps:

[0056] (1) The additional component defines and implements functions for specific security scenarios, and calls the function registration interface to register the function address to the corresponding slot;

[0057] (2) Maintain the additional function names, modules and other information in all access control policies through the additional component function management, and assign a unique identifier to each function, which is recorded as the function id. The additional component function management sends function information including the function name, module and function id and performs function mapping. During the function mapping process, the function address is located according to the function name and module, and then the function slot is located, thereby obtaining the mapping relationship between the function id and the function slot;

[0058] (3) When the security control definition module issues an access control policy, if the policy contains expression statements and response events, the security control module will parse the additional component function information and store it in the policy library;

[0059] (4) When an access event occurs in the system, the security control module will query the policy library to see whether there is access control for the relevant event, query the corresponding function slot through the function ID in the policy library, and further obtain the function address, so as to execute and call the additional component function, and then decide whether to control and respond to the access.

[0060] The above-mentioned additional function dynamic linking process can be specifically implemented by the security decision module, that is, by dynamically linking the additional function in the security decision module to locate the address of the additional function, the description of the security issue and the specific control mechanism can be completed in the additional component without having to be embedded in the kernel, thereby realizing the separation of mechanism and policy.

[0061] The present invention is further described below by taking the above method of the present invention in a specific application embodiment as an example, and the detailed steps are as follows:

[0062] Step S01. Define a secure programming language syntax model

[0063] Specifically, Figure 3As shown in the figure, in the policy file a.policy written according to the security language syntax, lines 1-5 define the name of the current security namespace as test, the priority as 80, the built-in audit switch is turned on, and the device control switch and file protection grouping variable are defined at the same time; line 7 defines the control behavior, which only allows the specified program of a specific user to see the protected file, otherwise it is hidden, and the object in the policy statement is a reference to the grouping variable; lines 8-9 are integrity protection policies implemented based on conditional expressions. Line 8 defines that when the subject integrity level is lower than the object integrity level, write operations are prohibited, that is, "no writing", and line 9 defines that when the subject integrity level is greater than the object integrity level, read operations are prohibited, that is, "no reading"; line 10 performs fine-grained control of device objects based on conditional expressions. When the device switch is turned on, it is controlled by pid and vid; line 11 defines the detection strategy, and all behaviors of reading the / etc / passwd file will be monitored and audited; line 12 defines the response strategy. When the httpd service calls the passwd command, the strategy will execute the response event, that is, kill the dangerous process httpd. All expression functions in the policy file a.policy are implemented in the add-on, which has the same name as the security namespace. Figure 4 It is the specific implementation of related functions in the test.ko kernel module.

[0064] In the additional component, additional functions are defined and implemented based on a general programming language and referenced in the secure programming language syntax model. The additional function name, module, and other information in all access control policies are maintained in the additional component function management, and a unique identifier is assigned to each function, which is recorded as a function id. In a specific application embodiment, the additional function information corresponding to the security control definition is shown in Table 2.

[0065] Table 2: Add-on function definitions

[0066] Add-on function name Add-on modules Function id subject_integrity_level test 1 object_integrity_level test 2 usb_allow_by_id test 3 kill_httpd test 4

[0067] The additional function is further dynamically addressed through the additional function dynamic linking process. The additional function dynamic linking process can be divided into the following steps:

[0068] (1) The additional component defines and implements the functions of the specific security scenario, and calls the function registration interface provided by the security stacking module to register the function address to the corresponding slot. For example, assume that the usb_allow_by_id function address is registered to slot 1;

[0069] (2) The additional function management module sends function information including function name, module, and function id, and the secure stacking module performs function mapping. During the function mapping process, the function address is located according to the function name and module, and then the function slot is located, so as to obtain the mapping relationship between the function id and the function slot. For example, the function address can be located according to the function name usb_allow_by_id and the module test, and further located to its corresponding slot 1, so that the function with function id 3 corresponds to the function address of slot 1;

[0070] (3) When the security control definition module issues an access control policy, if the policy contains expression statements and response events, the security decision module parses the additional function information and stores it in the policy library;

[0071] (4) When an access event occurs in the system, the security decision module queries the policy library to see whether there is access control for the relevant event, queries the corresponding function slot through the function ID in the policy library, and further obtains the function address, so as to execute and call the attached function, and then decide whether to control and respond to the access.

[0072] like Figure 5 As shown, the system programmable security access control device of this embodiment includes:

[0073] Security language module, used to adopt a four-tuple consisting of subject S, object O, permission P, and conditional expression E<S,O,P,E> Defines a secure programming language grammar model and is implemented by C<S,O,P,E> , D<S,O,P,E> and R<S,O,P,E> A respectively defines the control, detection and response of system behavior, where A represents the response event, and the conditional expression E is used to describe the conditional logic in the security policy. In the conditional expression E and the response event A, a single or multiple functions are used to express the decidable security issues to achieve programmability. The access control policy is defined by configuring the conditional expression E to represent different access control types, where the function in the conditional expression E is defined in the additional component;

[0074] The security decision module includes a policy management unit and a control execution unit. The policy management unit includes:

[0075] The add-on function dynamic link subunit is used to register the add-on functions defined in the add-on to the corresponding slots and maintain the corresponding relationship between each add-on function and the slot. The secure programming language syntax model refers to the corresponding add-on function in the conditional expression E or the response event A according to the required access control policy;

[0076] The policy parsing subunit is used to parse the received access control policy when receiving the defined access control policy, if the access control policy contains a conditional expression statement or a response event, and store the parsed additional component function information in the policy library;

[0077] The control execution unit is used to query whether there is access control for related events in the policy library when an access event occurs in the system. If so, the function address is located after function mapping based on the corresponding add-on function information in the policy library, and the slot corresponding to the current add-on function is located based on the located function address and the correspondence between each add-on function and the slot maintained in the add-on; the located add-on function is executed and called, and then a decision is made whether to control and respond to the current access.

[0078] In this embodiment, a security implementation module is also included to implement access control for different object types, including files, processes, devices, networks, capabilities, and kernel modules, to provide access control capabilities, and can also be configured to support providing a security control interface for third-party security modules. The security implementation module supports the expansion of security management and control capabilities, and can implement access control capabilities for different object types such as files, processes, devices, networks, capabilities, and kernel modules.

[0079] In this embodiment, the additional component function dynamic linking subunit in the security decision module is responsible for registering the functions in the additional components to the corresponding slots, and maintaining the one-to-one correspondence between the function unique identifier id and the function slot. The additional function is addressed through the additional function dynamic linking, so that the description of the security problem and the specific control mechanism can be completed in the additional component, realizing the separation of mechanism and policy. The policy parsing subunit converts the policy issued by the security control definition module into data that can be searched and calculated by the program. The control execution unit is used to associate with the kernel hook to execute access control decisions, and control the corresponding system behavior according to the decision results, and can expand the system control objects from the traditional LSM control objects to devices, modules and capabilities, while adding the function of hiding operations on directory items, etc., to achieve more comprehensive control objects and operation behaviors.

[0080] In this embodiment, the security decision module also includes a policy isolation unit, which identifies and handles policy conflicts in the same or different namespaces by introducing security namespaces and priority definitions, so that different security vendors or security modules can maintain their own independent security mechanisms and prioritize the execution of high-priority access control policies through priority settings. The security decision module also includes an audit subunit for auditing access control operations and storing audit logs.

[0081] like Figure 5As shown, general programming goes through the steps of compilation, parsing and execution in sequence. In the secure programming process of the present invention, the secure programming language grammar model is defined by the secure language module to realize the programmable definition of the access control strategy; the security decision module is used to provide policy maintenance and decision auditing of access control. When the defined access control strategy is received by the security decision module, if the access control strategy contains conditional expression statements or response events, the received access control strategy is parsed, and the parsed additional component function information is stored in the policy library. When an access event occurs in the system, the policy library is queried to see whether there is access control for the related event. If so, the function address is located after function mapping, and then the corresponding slot is located. The located additional component function is executed and called, and then a decision is made whether to manage and respond to the current access. Finally, the security implementation module provides access control capabilities to realize access control of different object types.

[0082] The system programmable security access control device of this embodiment corresponds one to one with the above-mentioned system programmable security access control method, and will not be described one by one here.

[0083] This embodiment further provides a computer device, including a processor and a memory, wherein the memory is used to store a computer program, and the processor is used to execute the computer program to perform the above method.

[0084] It is understandable that the above method of this embodiment can be executed by a single device, such as a computer or server, etc., and can also be applied to a distributed scenario and completed by multiple devices in cooperation with each other. In the case of a distributed scenario, one of the multiple devices can only execute one or more steps in the above method of this embodiment, and multiple devices interact to complete the above method. The processor can be implemented in the form of a general-purpose CPU, a microprocessor, an application-specific integrated circuit, or one or more integrated circuits, etc., for executing related programs to implement the above method of this embodiment. The memory can be implemented in the form of a read-only memory ROM, a random access memory RAM, a static storage device, and a dynamic storage device. The memory can store an operating system and other applications. When the above method of this embodiment is implemented by software or firmware, the relevant program code is stored in the memory and called and executed by the processor.

[0085] This embodiment further provides a computer-readable storage medium storing a computer program, and when the computer program is executed by a processor, the above method is implemented.

[0086] Those skilled in the art will appreciate that the above-mentioned embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes. The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, may be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the functions in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the functions specified in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0087] The above is only a preferred embodiment of the present invention, and does not limit the present invention in any form. Although the present invention has been disclosed as a preferred embodiment, it is not intended to limit the present invention. Therefore, any simple modification, equivalent change and modification made to the above embodiment according to the technical essence of the present invention without departing from the content of the technical solution of the present invention shall fall within the scope of protection of the technical solution of the present invention.

Claims

1. A system programmable security access control method, characterized in that the steps include: Use a four-tuple consisting of subject S, object O, permission P, and conditional expression E<S,O,P,E> Defines a secure programming language grammar model and is implemented by C<S,O,P,E> , D<S,O,P,E> and R<S,O,P,E> A respectively defines the control, detection and response of system behavior, where A represents the response event, and the conditional expression E is used to describe the conditional logic in the security policy. In the conditional expression E and the response event A, a single or multiple functions are used to express the decidable security issues to achieve programmability. The access control policy is defined by configuring the conditional expression E to represent different access control types, where the function in the conditional expression E is defined in the additional component; Registering the add-on functions defined in the add-on to the corresponding slots, and maintaining the correspondence between each add-on function and the slot, wherein the secure programming language syntax model references the corresponding add-on function in the conditional expression E or the response event A according to the required access control policy; When a defined access control policy is received, if the access control policy contains a conditional expression statement or a response event, the received access control policy is parsed, and the parsed additional component function information is stored in a policy library; When an access event occurs in the system, the policy library is queried to see whether there is access control for the relevant event. If so, the function address is located after function mapping based on the corresponding add-on function information in the policy library, and the slot corresponding to the current add-on function is located based on the located function address and the correspondence between each add-on function and the slot maintained in the add-on; the located add-on function is executed and called, and then a decision is made whether to control and respond to the current access.

2. The system programmable security access control method according to claim 1, characterized in that: In the secure programming language grammar model, C<S,O,P,E> Indicates that if and only if the conditional expression E is satisfied, the subject S implements C control when accessing the object O with P permission, where C is permission or rejection. When the conditional expression E is not configured, it is converted into a triple C<S,O,P> , which is used to indicate that the subject S performs C control when performing P permission access to the object O; D<S,O,P,E> Indicates that if and only if the conditional expression E is satisfied, the subject S is detected when it performs P permission access to the object O. When the conditional expression E is not configured, it is converted into a triple D<S,O,P> , which is used to indicate the detection of the behavior of subject S accessing object O under P authority; R<S,O,P,E> A means that when and only when the conditional expression E is satisfied, the subject S performs action A response when performing P permission access behavior on the object O. When the conditional expression E is not configured, it is converted into a ternary ancestor R<S,O,P> A is used to indicate that when subject S accesses object O with permission P, action A is implemented in response.

3. The system programmable security access control method according to claim 1, characterized in that: The access control types include role-based access control, attribute-based access control and security attribute-based access control. The security attribute-based access control includes integrity-based, confidentiality-based and RBAC-based access control.

4. The system programmable security access control method according to claim 1, characterized in that: The subject S and object O in the secure programming language syntax model support wildcarding, that is, support access permission control for all subjects S or all objects O in the system.

5. The system programmable security access control method according to any one of claims 1 to 4, characterized in that: It also includes defining different access control rules for different security modules, storing the access control rules in different security namespaces, and defining priorities for each security namespace. When there is a policy conflict in the same or different namespaces, the access control policy to be executed first is determined according to the priority of the access control policy.

6. The system programmable security access control method according to any one of claims 1 to 4, characterized in that: The method of locating the function address after function mapping based on the corresponding additional component function information in the policy library includes: issuing function information including function name, module and function ID through the additional component function management module, and locating the function address based on the issued function information and the function name and module of the corresponding additional component function in the policy library to achieve function mapping.

7. A system programmable security access control device, characterized in that: include: Security language module, used to adopt a four-tuple containing subject S, object O, permission P, and conditional expression E<S,O,P,E> Defines a secure programming language grammar model and is implemented by C<S,O,P,E> , D<S,O,P,E> and R<S,O,P,E> A respectively defines the control, detection and response of system behavior, where A represents the response event, and the conditional expression E is used to describe the conditional logic in the security policy. In the conditional expression E and the response event A, a single or multiple functions are used to express the decidable security issues to achieve programmability. The access control policy is defined by configuring the conditional expression E to represent different access control types, where the function in the conditional expression E is defined in the additional component; The security decision module includes a policy management unit and a control execution unit. The policy management unit includes: The add-on function dynamic linking subunit is used to register the add-on functions defined in the add-on to the corresponding slots and maintain the corresponding relationship between each add-on function and the slot, and the secure programming language syntax model refers to the corresponding add-on function in the conditional expression E or the response event A according to the required access control policy; The policy parsing subunit is used to parse the received access control policy when receiving the defined access control policy, if the access control policy contains a conditional expression statement or a response event, and store the parsed additional component function information in the policy library; The control execution unit is used to query whether there is access control for related events in the policy library when an access event occurs in the system. If so, the function address is located after function mapping based on the corresponding additional component function information in the policy library, and the slot corresponding to the current additional component function is located based on the located function address and the correspondence between each additional component function and the slot maintained in the additional component; the located additional component function is executed and called, and then a decision is made whether to control and respond to the current access.

8. The system programmable security access control device according to claim 7, characterized in that: The system also includes a security implementation module for implementing access control to different object types, including files, processes, devices, networks, capabilities, and kernel modules.

9. A computer device comprising a processor and a memory, wherein the memory is used to store a computer program, wherein: The processor is configured to execute the computer program to perform the method according to any one of claims 1 to 6.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images