H5 light application and applet security detection method based on parallel tangent plane of system kernel

Abstract

The invention relates to the technical field of software development, in particular to a system kernel parallel section-based H5 light application and applet security detection method, which comprises the following steps of: S10, implementing tangency points including LSM, syscale, network and a kernel function capable of performing kprobe instrumentation in a kernel mode of an operating system; s20, the tangency points of the LSM, the syscale and the networking in the step S10 have monitoring and intercepting capabilities, and the tangency point of the kernel function only has the monitoring capability; s30, in the application system user mode, the effect that the container safety section acts on the safety containers is achieved, and each safety container is provided with an exclusive application kernel; s40, realizing that the security parallel section of the operating system acts on a system kernel layer through the security parallel section of the operating system, and limiting and monitoring behaviors of the application program and the container by loading corresponding security policies at all tangency points; and potential safety hazards of H5 light applications and applets of enterprises are solved.

Description

Technical Field

[0001] The present invention relates to the field of software development technology, and in particular to a method for detecting the security of H5 light applications and small programs based on parallel sections of a system kernel. Background Art

[0002] After informatization construction, China Southern Power Grid has built a centralized data center and an integrated information integration platform, which effectively supports the construction and application of integrated enterprise-level information systems and lays a good foundation for the further cloudification of various IT resources. Enterprise H5 light applications and mini-programs are composed of backend cloud infrastructure, cloud platform components, cloud service centers and cloud security suites, which can achieve integrated management of IT resources such as facilities, data, services and applications. At the same time, the platforms and products provided by H5 light application and mini-program manufacturers contain a large number of components. Whether there are security vulnerabilities and compliance risks in the introduction and calling of these components requires effective supervision and emergency response by enhancing the perception capabilities of the cloud platform's trust-building kernel.

[0003] Enterprises are undergoing digital transformation, and new digital infrastructure is being built at an accelerated pace. We will continue to optimize the support capabilities and user experience of the basic platform, improve the robustness of the platform, and strengthen the construction of technical service components and the adaptation of trusted innovation components. At present, enterprise H5 light applications and mini-programs use a multi-cloud architecture based on a trusted innovation kernel to deploy their IT systems. However, while this architecture provides convenience for enterprises, it also brings new security challenges. For example, a large number of open source components are widely used in operating systems, middleware, and business systems, and the loading and operation of components lack supervision. The security risks of H5 light applications and mini-programs have become a major hidden danger to the safe operation of business systems; therefore, it is necessary to conduct security supervision of H5 light applications and mini-programs through the operating system kernel layer. Summary of the invention

[0004] The purpose of the present invention is to address the defects and shortcomings of the prior art, provide an H5 light application and mini-program security detection method based on system kernel parallel slices, and solve the security risks of enterprise H5 light applications and mini-programs.

[0005] The H5 light application and mini-program security detection method based on system kernel parallel slices of the present invention adopts the following steps:

[0006] S10: Implement cut points in the operating system kernel state, including LSM, syscall, network, and kernel functions that can be kprobe-inserted;

[0007] S20: The LSM, syscall, and networking cut points in step S10 have monitoring and interception capabilities, while the kernel function cut point only has monitoring capabilities;

[0008] S30: Implement container security aspects in the user state of the application system to act on the security container. Each security container has its own dedicated application kernel.

[0009] S40: The operating system's security parallel slices are implemented through the operating system's security parallel slices to act on the system kernel layer, and the behavior of applications and containers is restricted and monitored by loading corresponding security policies at each slice point.

[0010] Furthermore, the scope of the pointcut in step S10 includes processes, files, networks, capabilities, and system calls of applications and nodes.

[0011] Furthermore, the application kernel in step S30 runs in user mode, implementing a traditional Unix-like system call interface, making it easy to modify and customize the system call implementation.

[0012] Furthermore, in step S30, a unified monitoring capability is added to the system call layer of the application kernel to perform unified monitoring on key system calls.

[0013] Furthermore, key system calls include process creation class, file access class, and network connection class.

[0014] The beneficial effects of the present invention are as follows: the H5 light application and mini-program security detection method based on system kernel parallel slices described in the present invention realizes the security parallel slices of the operating system acting on the system kernel layer through the security parallel slices of the operating system, and restricts and monitors the behavior of applications and containers by loading corresponding security policies at each slice point. The H5 light application and mini-program security detection method based on system kernel parallel slices has built-in security, active defense, and overall defense as its main features, which solves the security risks of enterprise H5 light applications and mini-programs. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of the present application, but do not constitute an improper limitation of the present invention. In the drawings:

[0016] Figure 1 is a topological schematic diagram of the present invention; DETAILED DESCRIPTION

[0017] The present invention will be described in detail below in conjunction with the accompanying drawings and specific embodiments, wherein the illustrative embodiments and descriptions are only used to explain the present invention but are not intended to limit the present invention.

[0018] like Figure 1 As shown, the H5 light application and mini-program security detection method based on system kernel parallel slices described in this specific implementation adopts the following steps:

[0019] S10: Implement cut points in the operating system kernel state, including LSM, syscall, network, and kernel functions that can be kprobe-inserted;

[0020] S20: The LSM, syscall, and networking cut points in step S10 have monitoring and interception capabilities, while the kernel function cut point only has monitoring capabilities;

[0021] S30: Implement container security aspects in the user state of the application system to act on the security container. Each security container has its own dedicated application kernel.

[0022] S40: The operating system's security parallel slices are implemented through the operating system's security parallel slices to act on the system kernel layer, and the behavior of applications and containers is restricted and monitored by loading corresponding security policies at each slice point.

[0023] Furthermore, key system calls include process creation class, file access class, network connection class

[0024] Furthermore, the scope of the pointcut in step S10 includes processes, files, networks, capabilities, and system calls of applications and nodes.

[0025] Furthermore, the application kernel in step S30 runs in user mode, implementing a traditional Unix-like system call interface, making it easy to modify and customize the system call implementation.

[0026] Furthermore, in step S30, a unified monitoring capability is added to the system call layer of the application kernel to perform unified monitoring on key system calls.

[0027] Furthermore, key system calls include process creation class, file access class, and network connection class.

[0028] The present invention intercepts and analyzes the key data and operation calls of H5 light applications and small programs by inserting stubs in the operating system kernel, thereby analyzing and detecting the corresponding security risks. Compared with traditional external port scanning and penetration testing, the H5 light application and small program security detection method based on the parallel section of the system kernel has built-in security, active defense, and overall defense as its main features, that is, security can penetrate into the business logic and is no longer plug-in security; the business is online with default security capabilities, and cross-dimensional detection, response and protection are realized; at the same time, the security capabilities are programmable and extensible, and evolve independently from the business.

[0029] The present invention is based on the H5 light application and mini-program security detection method of the system kernel parallel section. The security parallel section of the operating system is used to implement the security parallel section of the operating system on the system kernel layer, and the behavior of the application and container is restricted and monitored by loading the corresponding security policy at each section point.

[0030] In the present invention, Figure 1 As shown, the specific description is as follows:

[0031] (1) The cut points implemented in the kernel state of the operating system include LSM, syscall, network, and kernel functions that can be kprobe-inserted. Among them, the cut points of LSM, syscall, and networking have monitoring and interception capabilities, and the cut points of kernel functions only have monitoring capabilities. The scope of the cut points includes the processes, files, networks, capabilities, and system calls of applications and nodes. By flexibly loading the cut-point code on the corresponding kernel subsystem cut-point, the behavior of applications and nodes can be finely controlled.

[0032] (2) Implement container security aspects in the user state of the application system and apply them to the secure container. Each secure container has its own dedicated application kernel. The application kernel runs in the user state and implements the traditional Unix-like system call interface, which makes it very convenient and flexible to modify and customize the system call implementation. In order to enhance the monitoring capability of the secure container, a unified monitoring capability can be added to the system call layer of the application kernel to uniformly monitor key system calls. These key system calls include process creation classes such as execve, file access classes such as open, and network connection classes such as connect.

[0033] The present invention, through the above-mentioned H5 light application and mini-program security detection method based on system kernel parallel slices, can realize the following H5 light application and mini-program security detection.

[0034] 1) Rapid bleeding of vulnerabilities: When a vulnerability is exposed in the software or kernel of the system, relevant mitigation features can be extracted according to the way the vulnerability is exploited, and the corresponding BPF program can be generated to achieve rapid bleeding.

[0035] 2) Protect online business: For compatibility and stability reasons, online business sometimes has to run with problems. Through the operating system security aspect, protection can be provided on the critical path, with a certain degree of security protection capabilities;

[0036] 3) Intrusion detection: General security tools cannot detect some new vulnerability attacks. The security aspects of the operating system can be detected by customizing various security rules;

[0037] 4) Data collection: The security aspect of the operating system can flexibly load related BPF programs to collect information about assets, such as application port monitoring;

[0038] 5) Chaos Engineering: Due to the interception capability of the aspect, the security aspect of the operating system can be used in chaos engineering to actively inject network, system and other related failures into the application to test the robustness of the application;

[0039] 6) Support security enhancement of domestic operating systems: Domestic operating systems are basically Linux operating systems, which use high-intensity access control to enhance security mechanisms, but have shortcomings in depth protection and protection against new vulnerability attacks. Security parallel aspects also support deployment on domestic operating systems. On the basis of fine-grained high-security access control systems, they can significantly increase the system's in-depth security defense capabilities, quickly stop bleeding of vulnerabilities, and block attack codes. Due to the flexibility of the security parallel aspect strategy, it is possible to load new security protection strategies without upgrading the system, thereby achieving the purpose of security enhancement.

[0040] The present invention is aimed at H5 light applications and small programs, which are composed of background cloud infrastructure, cloud platform components, cloud service centers and cloud security suites. Traditional external scanning of their security detection is difficult to find the operation risks of their cloud platforms and cloud components. It is proposed to insert piles in the operating system kernel to establish a safe parallel section for security detection, which can comprehensively analyze and find the security risks of internal applications, components and middleware of H5 light applications and small programs. Enterprise security personnel can track and prevent malicious network attacks across dimensions through such parallel spaces, or expand low-dimensional spaces through such high-dimensional space perspectives and make emergency interventions or in-depth audits.

[0041] The above description is only a preferred embodiment of the present invention, so all equivalent changes or modifications made according to the features and principles described in the scope of the patent application of the present invention are included in the scope of the patent application of the present invention.

Claims

1. A security detection method for H5 light applications and mini-programs based on parallel sections of the system kernel, characterized by: Use the following steps: S10: Implement cut points in the operating system kernel state, including LSM, syscall, network, and kernel functions that can be kprobe-inserted; S20: The LSM, syscall, and networking cut points in step S10 have monitoring and interception capabilities, while the kernel function cut point only has monitoring capabilities; S30: Implement container security aspects in the user state of the application system to act on the security container. Each security container has its own dedicated application kernel. S40: The operating system's security parallel slices are implemented through the operating system's security parallel slices to act on the system kernel layer, and the behavior of applications and containers is restricted and monitored by loading corresponding security policies at each slice point.

2. The H5 light application and mini-program security detection method based on system kernel parallel sections according to claim 1 is characterized by: The scope of the pointcut in step S10 includes the processes, files, networks, capabilities, and system calls of applications and nodes.

3. The H5 light application and mini-program security detection method based on system kernel parallel sections according to claim 1 is characterized by: The application kernel in step S30 runs in user mode, implementing a traditional Unix-like system call interface, making it easy to modify and customize the system call implementation.

4. The H5 light application and mini-program security detection method based on system kernel parallel sections according to claim 1 is characterized by: In step S30, a unified monitoring capability is added to the system call layer of the application kernel to perform unified monitoring on key system calls.

5. The H5 light application and mini-program security detection method based on system kernel parallel sections according to claim 4 is characterized by: Key system calls include process creation class, file access class, and network connection class.

Images