System programmable security access control method, device and medium

Abstract

The present invention discloses a system programmable security access control method, device and medium. The method comprises the following steps: defining a security programming language syntax model using a quadruple, expressing different access control models by configuring conditional expressions; registering an additional component function to a corresponding slot, and maintaining the corresponding relationship between the function and the slot; upon receiving an access control policy, if it contains a conditional expression statement or a response event, performing policy parsing, and storing the parsed additional component function information in a policy library; when an access event occurs in the system, querying whether there is access control for the relevant event; if so, locating the function address after function mapping based on the corresponding additional component function information, executing and calling the located function, and then deciding whether to control and respond to the current access. The present invention can flexibly implement different access control policies to meet the diverse needs of system security defense.

Description

Technical Field

[0001] The present invention relates to the technical field of secure access control, and in particular to a system programmable secure access control method, device and medium. Background Art

[0002] Computer security refers to measures used to implement and ensure computer system security services, particularly access control services. Access control restricts access to authorized entities (such as users, programs, and processes) according to security policies. Its basic elements include subjects, objects, and access rights. Subjects are entities that can access objects, while objects are entities that receive information, such as files, directories, and messages. Access rights refer to the ways in which subjects can access objects, including read, write, execute, create, and search.

[0003] In the existing technology, a single access control strategy or security model is usually used for system access control. For example, the Windows operating system implements access control functions based on the SRM (Security Reference Monitor) mechanism, the Linux system uses the LSM (Linux Security Modules) framework as the main access control mechanism, and the macOS and iOS systems use the MAC mechanism for system access control. The above mechanisms have different focuses on the implementation of access control security modules, but they are insufficient in flexibility and scalability, and it is difficult to meet the diverse security needs of the system.

[0004] The SRM mechanism uses the SID to determine whether a process or user has permission to access an object. It determines whether access is allowed by comparing the process SID with the ACEs (Access Control Entries) in the resource's Discretionary Access Control List (DACL). It also performs integrity checks by comparing the process integrity SID with the ACEs in the resource's SACL (System Access Control List). However, this mechanism cannot be extended to accommodate different security models and functional requirements; for example, it cannot implement authorization of objects by different accounts or subjects. The LSM framework provides a series of security functions to implement security models such as TE, RBAC, and MLS. However, the LSM framework requires developers to define their own security policies, and all security modules based on the LSM framework must maintain similar policy maintenance programs. This not only creates a high development barrier and implementation difficulties, but also leads to redundant development. The MAC mechanism, similar to the LSM framework, implements security extensions by providing a lightweight control framework within the kernel. However, this mechanism also suffers from high development barriers, implementation difficulties, and the inability to extend new security features beyond its own security model. In the existing technology, other types of operating system security mechanisms other than the above-mentioned ones often have the problem of frequent modification of the kernel, system and interface to meet different customization requirements. They have poor flexibility and high customization costs, and the mechanisms and policies are integrated with each other, that is, the coupling between security modules that implement different functions is high.

[0005] With the increasing complexity of network application environments and the dynamic nature of security threats, various operating system security issues are emerging one after another. Traditional single access control strategies or security models cannot solve these various security issues and cannot meet the current diverse security needs of systems. Therefore, there is an urgent need to provide a system security access control method that can enable flexible customization of access control security policies, improve the flexibility and scalability of access control security policy implementation, and meet the diverse security defense needs of various systems. Summary of the Invention

[0006] The technical problem to be solved by the present invention is: in response to the technical problems existing in the prior art, the present invention provides a system programmable security access control method, device and medium with simple implementation method, low cost, flexibility and strong scalability, which can flexibly implement different access control strategies to meet the diverse needs of system security defense.

[0007] In order to solve the above technical problems, the technical solution proposed by the present invention is:

[0008] A system programmable security access control method, comprising the following steps:

[0009] Use a four-tuple containing subject S, object O, permission P, and conditional expression E<S,O,P,E> Defines a secure programming language syntax model and is implemented by C<S,O,P,E> 、D<S,O,P,E> and R<S,O,P,E> A defines the control, detection, and response of system behavior, respectively, where A represents a response event. The conditional expression E is used to describe the conditional logic in the security policy. Single or multiple functions are used in the conditional expression E and the response event A to express the decidable security issues to achieve programmability. The access control policy is defined by configuring the conditional expression E to represent different access control types, where the functions in the conditional expression E are defined in the add-on component.

[0010] Registering add-on functions defined in the add-on to corresponding slots and maintaining a correspondence between each add-on function and the slot, wherein the secure programming language syntax model references the corresponding add-on function in the conditional expression E or the response event A according to the required access control policy;

[0011] When a defined access control policy is received, if the access control policy contains a conditional expression statement or a response event, the received access control policy is parsed and the parsed additional component function information is stored in a policy library;

[0012] When an access event occurs in the system, the policy library is queried to see whether there is access control for the relevant event. If so, the function address is located after function mapping based on the corresponding add-on function information in the policy library, and the slot corresponding to the current add-on function is located based on the located function address and the correspondence between each add-on function and slot maintained in the add-on; the located add-on function is executed and called, and then a decision is made whether to control and respond to the current access.

[0013] Furthermore, in the secure programming language syntax model, C<S,O,P,E> Indicates that if and only if the conditional expression E is satisfied, the subject S implements C control when accessing the object O with P permission, where C is allow or deny. When the conditional expression E is not configured, it is converted into a triple C<S,O,P> , used to indicate that C control is performed when subject S performs P permission access to object O; D<S,O,P,E> Indicates that if and only if the conditional expression E is satisfied, the subject S is detected when it performs P permission access on the object O. When the conditional expression E is not configured, it is converted into a triple D<S,O,P> , used to indicate the detection of the behavior of subject S accessing object O under P authority; R<S,O,P,E> A means that if and only if the conditional expression E is satisfied, the subject S will perform action A response when performing P permission access behavior on the object O. When the conditional expression E is not configured, it is converted into a ternary ancestor R<S,O,P> A is used to indicate that when subject S accesses object O under P authority, action A is implemented in response.

[0014] Furthermore, the access control types include role-based access control, attribute-based access control and security attribute-based access control, and the security attribute-based access control includes integrity-based, confidentiality-based and RBAC-based access control.

[0015] Furthermore, the subject S and object O in the secure programming language syntax model support wildcarding, that is, support access permission control for all subjects S or all objects O in the system.

[0016] Furthermore, it also includes defining different access control rules for different security modules, storing the access control rules in different security namespaces, and defining a priority for each security namespace. When there is a policy conflict in the same or different namespaces, the access control policy to be executed first is determined according to the priority of the access control policy.

[0017] Furthermore, the locating of the function address after function mapping based on the corresponding additional component function information in the policy library includes: issuing function information including the function name, the module to which it belongs, and the function ID through the additional component function management module, and locating the function address based on the issued function information and the function name and the module to which it belongs of the corresponding additional component function in the policy library to achieve function mapping.

[0018] A system programmable security access control device, comprising:

[0019] Security language module, used to adopt a four-tuple containing subject S, object O, permission P, and conditional expression E<S,O,P,E> Defines a secure programming language syntax model and is implemented by C<S,O,P,E> 、D<S,O,P,E> and R<S,O,P,E> A defines the control, detection, and response of system behavior, respectively, where A represents a response event. The conditional expression E is used to describe the conditional logic in the security policy. Single or multiple functions are used in the conditional expression E and the response event A to express the decidable security issues to achieve programmability. The access control policy is defined by configuring the conditional expression E to represent different access control types, where the functions in the conditional expression E are defined in the add-on component.

[0020] The security decision module includes a policy management unit and a control execution unit. The policy management unit includes:

[0021] An add-on function dynamic linking subunit is used to register add-on functions defined in the add-on to corresponding slots and maintain a correspondence between each add-on function and the slot. The secure programming language syntax model references the corresponding add-on function in the conditional expression E or the response event A according to the required access control policy;

[0022] The policy parsing subunit is used to parse the received access control policy when it receives a defined access control policy, if the access control policy contains a conditional expression statement or a response event, and store the parsed additional component function information in the policy library;

[0023] The control execution unit is used to query whether there is access control for the relevant event in the policy library when an access event occurs in the system. If so, the function address is located after function mapping based on the corresponding add-on function information in the policy library, and the slot corresponding to the current add-on function is located based on the located function address and the correspondence between each add-on function and the slot maintained in the add-on; the located add-on function is executed and called, and then a decision is made whether to control and respond to the current access.

[0024] Furthermore, it also includes a security implementation module for implementing access control for different object types, including files, processes, devices, networks, capabilities and kernel modules.

[0025] A computer device includes a processor and a memory, wherein the memory is used to store a computer program, and the processor is used to execute the computer program to perform the above method.

[0026] A computer-readable storage medium storing a computer program, wherein the computer program implements the above method when executed by a processor.

[0027] Compared with the prior art, the advantages of the present invention are:<S,O,P,E> Design and implement a secure programming language grammar model, based on the quad grammar model<S,O,P,E> By introducing the conditional expression E, the access control model can be expanded to manage, detect, and respond to the behavior of programmable quadruple. The behavior and capabilities of access control can be defined through programming languages, thereby realizing the separation of mechanism and policy in the system access control process, and decoupling the implementation of security functions from the system kernel version and architecture. This is not only simpler to implement, but also more flexible and scalable. It can efficiently respond and flexibly customize access control security modules to meet the diverse security needs of the current system. It can also greatly improve the efficiency of security function development and accelerate the response to security needs. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 This is a schematic diagram of the implementation flow of the system programmable security access control method of this embodiment.

[0029] Figure 2 This is a schematic diagram of the principle of implementing dynamic linking of additional component functions in this embodiment.

[0030] Figure 3 This is an implementation example of a security control definition in a specific application embodiment of the present invention.

[0031] Figure 4 This is a specific implementation example of the relevant functions in the test.ko kernel module in a specific application embodiment of the present invention.

[0032] Figure 5 This is a schematic diagram of the structural principle of the system programmable security access control device of this embodiment. DETAILED DESCRIPTION

[0033] The present invention will be further described below in conjunction with the accompanying drawings and specific preferred embodiments, but the scope of protection of the present invention is not limited thereby.

[0034] like Figure 1 As shown, the steps of the system programmable security access control method of this embodiment include:

[0035] Step S01. Use a 4-tuple containing subject S, object O, authority P, and conditional expression E<S,O,P,E> Defines a secure programming language syntax model and is implemented by C<S,O,P,E> 、D<S,O,P,E> and R<S,O,P,E> A defines the control, detection, and response of system behavior, respectively, where A represents a response event. The conditional expression E is used to describe the conditional logic in the security policy. Single or multiple functions are used in the conditional expression E and the response event A to express the decidable security issues to achieve programmability. The access control policy is defined by configuring the conditional expression E to represent different access control types, where the functions in the conditional expression E are defined in the add-on component.

[0036] Step S02. Register the add-on functions defined in the add-on to the corresponding slots, maintain the correspondence between each add-on function and the slot, and reference the corresponding add-on function in the conditional expression E or the response event A according to the required access control policy using the secure programming language syntax model;

[0037] Step S03. When the defined access control policy is received, if the access control policy contains a conditional expression statement or a response event, the received access control policy is parsed and the parsed additional component function information is stored in the policy library;

[0038] Step S04. When an access event occurs in the system, the policy library is queried to see whether there is access control for the relevant event. If so, the function address is located after function mapping based on the corresponding add-on function information in the policy library, and the slot corresponding to the current add-on function is located based on the located function address and the correspondence between each add-on function and the slot maintained in the add-on; the located add-on function is executed and called, and then a decision is made whether to control and respond to the current access.

[0039] In the above steps of this embodiment, a secure programming language grammar model is designed and implemented using a quadruple.<S,O,P,E> Define the syntax model of a secure programming language, in the quad syntax model<S,O,P,E> By introducing the conditional expression E, the access control model can be extended to manage, detect and respond to the behavior of programmable quadruple. This model can be used to define uncertain security models and requirements based on high-level security programming languages. The behavior and capabilities of access control can be defined through programming languages, thereby realizing the separation of mechanism and policy in the system access control process, and decoupling the implementation of security functions from the system kernel version and architecture. This is not only simpler to implement, but also more flexible and scalable. It can efficiently respond and flexibly customize access control security modules to meet the diverse security needs of current systems. It can also greatly improve the efficiency of security function development and accelerate the response to security needs.

[0040] In this embodiment, the security control definition refers to the definition of access control policy based on the security programming language syntax model. The security programming language syntax model is the control of the system behavior consisting of the four-tuple of subject S, object O, permission P, and conditional expression E. The traditional definition of system behavior is the triple<S,O,P> , that is, using access control triples<S,O,P> Defines a grammatical model that allows subject S to have permission P over object O. This model mainly controls the behavior of triples and can only express deterministic system behavior and cannot be dynamically expanded. Compared with traditional access control triples<S,O,P> Syntax model, this embodiment uses the four-tuple grammar model<S,O,P,E> The introduction of conditional expression E expands the access control model to manage, detect, and respond to programmable quadruple behaviors. Conditional expression E can be defined on demand through programming, and its additional functions can be used to express any decidable security issues, thereby achieving the purpose of programmability.

[0041] For example, the conditional expression E in the secure programming language syntax model is optional, enabling backward compatibility with the traditional triple syntax model. When conditional expression E is not configured, it is converted to the traditional triple syntax model, making it compatible with both triple and quad syntax models. By defining the access control model using quads with nondeterministic expressions, compared to the traditional deterministic triple expressions, it can flexibly describe diverse security scenarios and requirements, enabling the definition of security functions in a secure language.

[0042] Specifically, in the secure programming language syntax model, C<S,O,P,E> Indicates that if and only if the conditional expression E is satisfied, the subject S implements C control when accessing the object O with P permission, where C is allow or deny. When the conditional expression E is not configured, it is converted into a triple C<S,O,P> , used to indicate that C control is performed when subject S performs P permission access to object O; D<S,O,P,E> Indicates that if and only if the conditional expression E is satisfied, the subject S is detected when it performs P permission access on the object O. When the conditional expression E is not configured, it is converted into a triple D<S,O,P> , used to indicate the detection of the behavior of subject S accessing object O under P authority; R<S,O,P,E> A means that if and only if the conditional expression E is satisfied, the subject S will perform action A response when performing P permission access behavior on the object O. When the conditional expression E is not configured, it is converted into a ternary ancestor R<S,O,P> A is used to indicate that when subject S responds to object O's access with permission P, it will take action A. The above conditional expression E and response event A use functions to express a decidable security problem, thereby achieving programmability and achieving an infinite computing model.

[0043] By adopting the above-mentioned security syntax, this embodiment can meet the basic capabilities of management, detection, and response, while covering various demand scenarios of security functions. It uses the security programming syntax model in the security control definition to define access control capabilities and goals, thereby realizing flexible definition of different security modules and security scenarios.

[0044] The four access control definition methods included in the above-mentioned secure programming language syntax model are specifically shown in Table 1. Specifically, in the secure language module, the secure programming language compiler implements the lexical and grammatical semantics according to Table 1.

[0045] Table 1: Access control definitions for secure programming language syntax models

[0046]

[0047]

[0048] In this embodiment, the conditional expression E is a Boolean operation performed by one or more functions, used to express a decidable security problem, thereby achieving programmability and an infinite computational model, thereby satisfying Turing completeness. The response event E is the parallel execution of one or more functions. The functions in the conditional expression and response event are implemented by add-ons, such as kernel modules (ko) or eBPF programs. Add-ons can be defined and implemented in general-purpose programming languages, such as C, C++, Python, and Go, and referenced within the syntax of the secure programming language.

[0049] In this embodiment, the access control types include role-based access control, attribute-based access control, and security attribute-based access control, wherein the security attribute-based access control includes integrity-based, confidentiality-based, and RBAC-based access control, etc., and the required access control type is selected by configuring the conditional expression E. That is, based on the conditional expression, the security language module can express different access control types such as role-based, attribute-based, and policy-based by configuring the conditional expression, such as access control models such as integrity, confidentiality, and RBAC. For example, the security language can configure access control definitions such as "processes with network connections cannot use sensitive commands such as passwd and useradd", "remote login users cannot perform system management operations", and "processes with damaged data integrity cannot run". At the same time, the security language module can also respond to abnormal behavior by configuring response events. For example, configure the access control definition of "blocking and killing dangerous processes when it is detected that the sensitive file passwd has been modified".

[0050] Optionally, the subject S and object O in the secure programming language syntax model can also support wildcarding, that is, support access permission control for all subjects S or all objects O in the system, making the access control policy configuration process more flexible and efficient.

[0051] Optionally, it also includes defining different access control rules for different security modules, storing the access control rules in different security namespaces, and defining a priority for each security namespace. When there is a policy conflict in the same or different namespaces, the access control policy to be executed first is determined according to the priority of the access control policy. For example, different access control rules can be defined for different security vendors or security modules. These independent access control rules are stored in different security namespaces. Each security namespace has a priority, and the access control policy with a high priority is executed first. By introducing security namespaces and priority definitions, policy conflicts in the same or different namespaces are identified and processed, thereby further realizing policy isolation.

[0052] Optionally, the syntax in the secure programming language syntax model can also support the control isolation of different security programs, which can be set through the priority of the namespace. At the same time, the syntax model is not oriented towards specific security models and access control requirements, but freely describes and defines access control function mechanisms through the secure programming language.

[0053] In step S02 of this embodiment, the functions in the add-on can be registered to the corresponding slots through the dynamic linking process of the add-on functions, and a one-to-one correspondence between the function unique identifier ID and the function slot can be maintained, while the address of the add-on function can be dynamically located. This embodiment, based on the language's conditional expression syntax, can implement the custom function constraint function. Subsequently, combined with the add-on module function address relocation technology, it can achieve multi-factor programming development goals for different security scenarios. It is compatible with various high-level languages ​​such as C, Python, and Go, ensuring that the security language meets Turing completeness.

[0054] In step S04 of this embodiment, locating the function address after function mapping based on the corresponding add-on function information in the policy library includes: issuing function information including the function name, module, and function ID through the add-on function management module, and locating the function address based on the issued function information and the function name and module of the corresponding add-on function in the policy library to implement function mapping. Locating the function address through function mapping can then locate the function slot, ultimately obtaining a mapping relationship between the function and the function slot. The located add-on function is then executed and called, and a decision can be made as to whether to control and respond to the current access, completing the security decision-making process.

[0055] like Figure 2As shown, the process of dynamically linking additional component functions can be done in the following steps:

[0056] (1) The additional component defines and implements the function for a specific security scenario, and calls the function registration interface to register the function address to the corresponding slot;

[0057] (2) The additional function name, module, and other information in all access control policies are maintained through the additional component function management, and a unique identifier is assigned to each function, which is recorded as the function id. The additional component function management distributes function information including the function name, module, and function id and performs function mapping. During the function mapping process, the function address is located according to the function name and module, and then the function slot is located, thereby obtaining the mapping relationship between the function id and the function slot;

[0058] (3) When the security control definition module issues an access control policy, if the policy contains expression statements and response events, the security control module will parse the additional component function information and store it in the policy library;

[0059] (4) When an access event occurs in the system, the security control module will query the policy library to see whether there is access control for the relevant event, query the corresponding function slot through the function ID in the policy library, and further obtain the function address, so as to execute and call the additional component function, and then decide whether to control and respond to the access.

[0060] The above-mentioned dynamic linking process of additional functions can be specifically implemented by the security decision module, that is, by dynamically linking additional functions in the security decision module to locate the address of additional functions, the description of security issues and specific control mechanisms can be completed in additional components without having to be embedded in the kernel, thereby realizing the separation of mechanism and policy.

[0061] The present invention is further described below by taking the above method of the present invention as an example in a specific application embodiment. The detailed steps are as follows:

[0062] Step S01. Define a secure programming language syntax model

[0063] Specifically, if Figure 3As shown in the figure, in the policy file a.policy, written according to the security language syntax, lines 1-5 define the name of the current security namespace as test, the priority as 80, the built-in audit switch as enabled, and also define the device control switch and file protection group variable. Line 7 defines the control behavior, allowing only specified programs of specific users to see the protected file; otherwise, the file is hidden. The object in the policy statement is a reference to the group variable. Lines 8-9 implement the integrity protection policy based on conditional expressions. Line 8 defines that when the subject integrity level is lower than the object integrity level, write operations are prohibited, that is, "no write", and line 9 defines that when the subject integrity level is higher than the object integrity level, read operations are prohibited, that is, "no read". Line 10 performs fine-grained control of device objects based on conditional expressions. When the device switch is turned on, control is performed using the PID and VID. Line 11 defines the detection policy, which monitors and audits all reads of the / etc / passwd file. Line 12 defines the response policy. When the httpd service calls the passwd command, this policy executes a response event, namely, killing the dangerous httpd process. All expression functions in the policy file a.policy are implemented in the additional component, which has the same name as the security namespace. Figure 4 It is the specific implementation of related functions in the test.ko kernel module.

[0064] In add-ons, additional functions are defined and implemented using a general-purpose programming language and referenced within the secure programming language syntax model. The add-on function management maintains information such as the names of all additional functions in all access control policies, including the module they belong to, and assigns each function a unique identifier, referred to as a function ID. In a specific application embodiment, the additional function information corresponding to the security control definition is shown in Table 2.

[0065] Table 2: Add-on function definitions

[0066] Add-on function name Add-on modules Function ID subject_integrity_level test 1 object_integrity_level test 2 usb_allow_by_id test 3 kill_httpd test 4

[0067] The additional function is further dynamically addressed through the additional function dynamic linking process. The additional function dynamic linking process can be divided into the following steps:

[0068] (1) The additional component defines and implements functions for specific security scenarios, and calls the function registration interface provided by the security stacking module to register the function address to the corresponding slot. For example, assume that the usb_allow_by_id function address is registered to slot 1;

[0069] (2) The additional function management module issues function information including the function name, module, and function ID. The secure stacking module performs function mapping. During the function mapping process, the function address is located based on the function name and module, and then the function slot is located, thereby obtaining the mapping relationship between the function ID and the function slot. For example, based on the function name usb_allow_by_id and the module test, the function address can be located, and further located to its corresponding slot 1, thus knowing that the function with function ID 3 corresponds to the function address in slot 1;

[0070] (3) When the security control definition module issues an access control policy, if the policy contains expression statements and response events, the security decision module parses the additional function information and stores it in the policy library;

[0071] (4) When an access event occurs in the system, the security decision module queries the policy library to see whether there is access control for the relevant event, queries the corresponding function slot through the function ID in the policy library, and further obtains the function address, so as to execute and call the attached function, and then decide whether to control and respond to the access.

[0072] like Figure 5 As shown, the system programmable security access control device of this embodiment includes:

[0073] Security language module, used to adopt a four-tuple containing subject S, object O, permission P, and conditional expression E<S,O,P,E> Defines a secure programming language syntax model and is implemented by C<S,O,P,E> 、D<S,O,P,E> and R<S,O,P,E> A defines the control, detection, and response of system behavior, respectively, where A represents a response event. The conditional expression E is used to describe the conditional logic in the security policy. Single or multiple functions are used in the conditional expression E and the response event A to express the decidable security issues to achieve programmability. The access control policy is defined by configuring the conditional expression E to represent different access control types, where the functions in the conditional expression E are defined in the add-on component.

[0074] The security decision module includes a policy management unit and a control execution unit. The policy management unit includes:

[0075] The add-on function dynamic linking subunit is used to register the add-on functions defined in the add-on to the corresponding slots and maintain the correspondence between each add-on function and the slot. The secure programming language syntax model references the corresponding add-on function in the conditional expression E or the response event A according to the required access control policy;

[0076] The policy parsing subunit is used to parse the received access control policy when it receives a defined access control policy, if the access control policy contains a conditional expression statement or a response event, and store the parsed additional component function information in the policy library;

[0077] The control execution unit is used to query whether there is access control for the relevant event in the policy library when an access event occurs in the system. If so, the function address is located after function mapping based on the corresponding add-on function information in the policy library, and the slot corresponding to the current add-on function is located based on the located function address and the correspondence between each add-on function and the slot maintained in the add-on; the located add-on function is executed and called, and then a decision is made whether to control and respond to the current access.

[0078] This embodiment also includes a security enforcement module for implementing access control for different object types, including files, processes, devices, networks, capabilities, and kernel modules. This module provides access control capabilities and can also be configured to provide a security control interface for third-party security modules. The security enforcement module supports the expansion of security management and control capabilities, enabling access control capabilities for different object types, such as files, processes, devices, networks, capabilities, and kernel modules.

[0079] In this embodiment, the additional component function dynamic linking subunit in the security decision module is responsible for registering the functions in the additional components to the corresponding slots, and maintaining a one-to-one correspondence between the function unique identifier id and the function slot. The additional function is addressed by the additional function dynamic linking, so that the description of the security problem and the specific control mechanism can be completed in the additional component, realizing the separation of mechanism and policy. The policy parsing subunit converts the policy issued by the security control definition module into data that can be searched and calculated by the program. The control execution unit is used to associate with the kernel hook to execute access control decisions, and to control the corresponding system behavior according to the decision results, and can expand the system control objects from the traditional LSM control objects to devices, modules and capabilities, while adding the function of hiding operations on directory items, etc., to achieve more comprehensive control objects and operation behaviors.

[0080] In this embodiment, the security decision module also includes a policy isolation unit. By introducing security namespaces and priority definitions, it identifies and handles policy conflicts within or across the same or different namespaces. This allows different security vendors or security modules to maintain their own independent security mechanisms, and prioritizes the execution of higher-priority access control policies. The security decision module also includes an audit subunit for auditing access control operations and storing audit logs.

[0081] like Figure 5As shown, general programming goes through the compilation, parsing and execution steps in sequence. In the secure programming process of the present invention, the secure programming language syntax model is defined by the secure language module to realize the programmable definition of the access control policy; the security decision module is used to provide policy maintenance and decision auditing of access control. When the defined access control policy is received by the security decision module, if the access control policy contains conditional expression statements or response events, the received access control policy is parsed, and the parsed additional component function information is stored in the policy library. When an access event occurs in the system, the policy library is queried to see whether there is access control for the relevant event. If so, the function address is located after function mapping, and then the corresponding slot is located. The located additional component function is executed and called, and then a decision is made whether to manage and respond to the current access. Finally, the security implementation module provides access control capabilities to realize access control of different object types.

[0082] The system programmable security access control device of this embodiment corresponds one-to-one to the above-mentioned system programmable security access control method, and will not be described in detail here.

[0083] This embodiment further provides a computer device, including a processor and a memory, wherein the memory is used to store a computer program, and the processor is used to execute the computer program to perform the above method.

[0084] It is understandable that the above method of this embodiment can be executed by a single device, such as a computer or server, etc., and can also be applied to a distributed scenario and completed by multiple devices cooperating with each other. In the case of a distributed scenario, one of the multiple devices can only execute one or more steps in the above method of this embodiment, and multiple devices interact to complete the above method. The processor can be implemented in the form of a general-purpose CPU, a microprocessor, an application-specific integrated circuit, or one or more integrated circuits, etc., for executing relevant programs to implement the above method of this embodiment. The memory can be implemented in the form of a read-only memory ROM, a random access memory RAM, a static storage device, and a dynamic storage device. The memory can store an operating system and other application programs. When the above method of this embodiment is implemented by software or firmware, the relevant program code is stored in the memory and called and executed by the processor.

[0085] This embodiment further provides a computer-readable storage medium storing a computer program, which implements the above method when executed by a processor.

[0086] Those skilled in the art will appreciate that the above-mentioned embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application may take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, may be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including the instruction device, which implements the function specified in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0087] The above description is merely a preferred embodiment of the present invention and does not constitute any form of limitation to the present invention. Although the present invention has been disclosed above with reference to the preferred embodiment, it is not intended to limit the present invention. Therefore, any simple modifications, equivalent variations, and modifications to the above embodiment that do not depart from the technical solution of the present invention and are based on the technical essence of the present invention shall fall within the scope of protection of the technical solution of the present invention.

Claims

1. A system programmable security access control method, characterized in that the steps include: Use a four-tuple containing subject S, object O, permission P, and conditional expression E<S,O,P,E> Defines a secure programming language syntax model and is implemented by C<S,O,P,E> 、D<S,O,P,E> and R<S,O,P,E> A defines the control, detection, and response of system behavior, respectively, where A represents a response event. The conditional expression E is used to describe the conditional logic in the security policy. Single or multiple functions are used in the conditional expression E and the response event A to express the decidable security issues to achieve programmability. The access control policy is defined by configuring the conditional expression E to represent different access control types, where the functions in the conditional expression E are defined in the add-on component. Registering add-on functions defined in the add-on to corresponding slots and maintaining a correspondence between each add-on function and the slot, wherein the secure programming language syntax model references the corresponding add-on function in the conditional expression E or the response event A according to the required access control policy; When a defined access control policy is received, if the access control policy contains a conditional expression statement or a response event, the received access control policy is parsed and the parsed additional component function information is stored in a policy library; When an access event occurs in the system, the policy library is queried to see whether there is access control for the relevant event. If so, the function address is located after function mapping based on the corresponding add-on function information in the policy library, and the slot corresponding to the current add-on function is located based on the located function address and the correspondence between each add-on function and slot maintained in the add-on; the located add-on function is executed and called, and then a decision is made whether to control and respond to the current access.

2. The system programmable security access control method according to claim 1, characterized in that: In the secure programming language syntax model, C<S,O,P,E> Indicates that if and only if the conditional expression E is satisfied, the subject S implements C control when accessing the object O with P permission, where C is allow or deny. When the conditional expression E is not configured, it is converted into a triple C<S,O,P> , used to indicate that C control is performed when subject S performs P permission access to object O; D<S,O,P,E> Indicates that if and only if the conditional expression E is satisfied, the subject S is detected when it performs P permission access on the object O. When the conditional expression E is not configured, it is converted into a triple D<S,O,P> , used to indicate the detection of the behavior of subject S accessing object O under P authority; R<S,O,P,E> A means that if and only if the conditional expression E is satisfied, the subject S will perform action A response when performing P permission access behavior on the object O. When the conditional expression E is not configured, it is converted into a ternary ancestor R<S,O,P> A is used to indicate that when subject S accesses object O under P authority, action A is implemented in response.

3. The system programmable security access control method according to claim 1, characterized in that: The access control types include role-based access control, attribute-based access control and security attribute-based access control. The security attribute-based access control includes integrity-based, confidentiality-based and RBAC-based access control.

4. The system programmable security access control method according to claim 1, characterized in that: The subject S and object O in the secure programming language syntax model support wildcarding, that is, support access permission control for all subjects S or all objects O in the system.

5. The system programmable security access control method according to any one of claims 1 to 4, characterized in that: It also includes defining different access control rules for different security modules, storing the access control rules in different security namespaces, and defining a priority for each security namespace. When there is a policy conflict in the same or different namespaces, the access control policy to be executed first is determined according to the priority of the access control policy.

6. The system programmable security access control method according to any one of claims 1 to 4, characterized in that: The method of locating the function address after function mapping based on the corresponding additional component function information in the policy library includes: issuing function information including function name, module and function ID through the additional component function management module, and locating the function address based on the issued function information and the function name and module of the corresponding additional component function in the policy library to realize function mapping.

7. A system programmable security access control device, characterized in that: include: Security language module, used to adopt a four-tuple containing subject S, object O, permission P, and conditional expression E<S,O,P,E> Defines a secure programming language syntax model and is implemented by C<S,O,P,E> 、D<S,O,P,E> and R<S,O,P,E> A defines the control, detection, and response of system behavior, respectively, where A represents a response event. The conditional expression E is used to describe the conditional logic in the security policy. Single or multiple functions are used in the conditional expression E and the response event A to express the decidable security issues to achieve programmability. The access control policy is defined by configuring the conditional expression E to represent different access control types, where the functions in the conditional expression E are defined in the add-on component. The security decision module includes a policy management unit and a control execution unit. The policy management unit includes: An add-on function dynamic linking subunit is used to register add-on functions defined in the add-on to corresponding slots and maintain a correspondence between each add-on function and the slot. The secure programming language syntax model references the corresponding add-on function in the conditional expression E or the response event A according to the required access control policy; The policy parsing subunit is used to parse the received access control policy when it receives a defined access control policy, if the access control policy contains a conditional expression statement or a response event, and store the parsed additional component function information in the policy library; The control execution unit is used to query whether there is access control for the relevant event in the policy library when an access event occurs in the system. If so, the function address is located after function mapping based on the corresponding add-on function information in the policy library, and the slot corresponding to the current add-on function is located based on the located function address and the correspondence between each add-on function and the slot maintained in the add-on; the located add-on function is executed and called, and then a decision is made whether to control and respond to the current access.

8. The system programmable security access control device according to claim 7, characterized in that: The system also includes a security enforcement module for implementing access control for different object types, including files, processes, devices, networks, capabilities, and kernel modules.

9. A computer device comprising a processor and a memory, wherein the memory is used to store a computer program, wherein: The processor is configured to execute the computer program to perform the method according to any one of claims 1 to 6.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images