Protection method and system based on permission model

Abstract

The invention relates to the technical field of electric digital data processing, in particular to protection of distributed programs or contents. According to the technical scheme, the method comprises the following steps: scanning a file on a host, calculating a feature value of an executable file, and endowing a permission type; the trusted signature certificate is imported into a database, and a protection strategy is configured and protection is started according to actual protection requirements; obtaining the permission type of the parent process and calculating the target permission type every time a new target is started; and judging whether operation can be carried out according to the matched strategy. The problems of high cost, poor safety and low applicability in the prior art are solved, the protection method and system based on the authority model are provided, and the purposes of high automation level, good safety performance, dynamic authority management and flexible protection are achieved.

Description

Technical Field

[0001] The present invention relates to the technical field of electronic digital data processing, and in particular to protecting distributed programs or contents. Background Art

[0002] In industrial production environments, whitelist program protection software is usually installed on the host to prevent the operation of malware and viruses. The basic operating principle of this type of software is: when deployed, all executable files in the host are scanned, and the characteristic values ​​and other information of the files are extracted and stored in the database. In the subsequent production process, all programs to be run are monitored at the operating system level, and the characteristic values ​​and other information of the program files are calculated again, and compared with the data in the database. Based on the comparison results, it is decided to allow / disable the program to run. In the existing common whitelist program protection solutions, the characteristic values ​​of the above files are usually summaries of the file contents.

[0003] For example, a Chinese patent with publication number CN104025103B discloses a system and method for transitioning to a whitelist mode during a malware attack in a network environment, and provides the following technical solutions: receiving a signal for enabling a whitelist mode on a host in a network; terminating the process if the process executed on the host is not verified; and preventing the execution of the software object if the software object on the host is not represented on the whitelist. In a more specific embodiment, the method further includes: identifying the process on a process list, the process list enumerating one or more processes executed on the host. Another embodiment includes: isolating the host if the second process on the process list is a critical process and if the second process is not verified. A more specific embodiment includes: identifying and restarting another process on the process list if the process memory has been modified. However, in the above-mentioned system and method for transitioning to a whitelist mode during a malware attack in a network environment, after the software is updated, the administrator must manually scan the updated file and store the new feature value. This is very inconvenient in an environment with frequent updates, and has high requirements for administrators, which may lead to update delays or operational errors. To prevent normal software from being blocked, exceptions are opened under specific paths. This approach is easily exploited by malicious programs, resulting in potential security vulnerabilities. It usually only targets executable programs, resulting in the inability to effectively monitor scripts when they are executed through their interpreters. This allows malicious scripts to run without being blocked, posing a security risk. Directly disabling all script interpreters may cause normal scripts to fail to run, affecting the normal functions of the system and applications, and limiting applicability. Different policies need to be formulated according to different usage scenarios, increasing the complexity and cost of management. Summary of the invention

[0004] The present invention solves the problems of high cost, poor security and low applicability in the prior art, and proposes a protection method and system based on a permission model, achieving the goals of high automation level, good security performance, dynamic permission management and flexible protection.

[0005] To achieve the above object, the present invention adopts the following technical solution: A protection method based on a permission model includes the following steps: S1: Scan the files on the host, calculate the feature values ​​of the executable files and assign permission types; S2: Import the trusted signature certificate into the database, configure the protection strategy and enable protection according to the actual protection requirements; S3: Every time a new program is started, the permission type of the parent process is obtained and the permission type of the target program is calculated; S4: Determine whether the program can run based on the matching strategy.

[0006] A protection system based on a permission model includes: an underlying protection module, a protection configuration module and a database. The underlying protection module is located at the zero ring layer. The underlying protection module sets a hook to the operating system kernel to capture and control all program startup behaviors. The protection configuration module configures the software.

[0007] The benefit of this design is that it ensures that each executable file is accurately evaluated and configured with permissions, providing more precise and detailed security protection. It also utilizes kernel-level protection mechanisms to monitor and control program startup behavior in real time, providing in-depth security protection.

[0008] Preferably, in step S3, after the protection is started, the underlying protection module works, and each time a new program is to be started, a decision-making process is entered; the decision-making process includes obtaining the permission type of the parent process from the process permission type table, and then calculating the target program permission type and matching the policy. During the policy matching process, the underlying protection module will traverse the policies one by one, and use the permission type of the parent process and the permission type data of the target program to match the policy until a policy match is successful.

[0009] The advantage of this design is that the permissions of the program can be determined dynamically when the program is started, so that the system can adjust the security policy according to the real-time situation, thereby improving the flexibility and effectiveness of security.

[0010] Preferably, the process of calculating the target program permissions includes the following steps: S3.1: Calculate the characteristic value of the target program file content and search in the database; S3.2: If the feature value of the file is not found in the database, proceed to step S3.3; if found, proceed to step S3.5; S3.3: Obtain the signature information of the file and search for the corresponding information in the database; S3.4: If the information can be found in the database, proceed to step S3.5; if not, the target program is an unknown program; S3.5: grant the target program the permission type recorded in the database.

[0011] The advantage of this design is that, through step-by-step verification and database comparison of characteristic values, the identity and permissions of each program can be accurately determined, thereby effectively identifying and handling unknown or potentially dangerous programs.

[0012] Preferably, after the policy matches successfully, the target program is allowed to run, and based on whether the policy records permission conversion information, if so, the target program runs with the permission type recorded in the policy, if not, it runs with the permission type of the target program itself.

[0013] The advantage of this design is that it implements a policy-driven permission management mechanism to ensure the compliance of program running permissions, while allowing flexible permission adjustments to adapt to different security requirements.

[0014] Preferably, in step S3.4, when the target program is an unknown program, the permission type of the target program is set to an unauthorized type.

[0015] The benefit of this design is that unauthorized programs will not run in the system, thus effectively protecting the system from potential threats from malware and unverified programs.

[0016] Preferably, in step S1, the scan is divided into a full disk scan and a specified path scan. When deployed for the first time, a full disk scan is performed; a default permission type is assigned to the scanned result; after the scan is completed, the permission type of the scanned program file is adjusted according to actual needs, and finally the file feature information and permission type are stored in the database.

[0017] The advantage of this design is that it can fully detect and set basic permissions for all programs when the system is first deployed, and provide flexible subsequent adjustment capabilities to ensure the accuracy and applicability of permission allocation.

[0018] Preferably, in step S1, for the scanned results, according to the added custom rules, the set program files are automatically identified and their permission types are automatically set.

[0019] The advantage of this design is that it can quickly identify and process common procedures through custom rules, reduce manual intervention, and improve operational efficiency and accuracy.

[0020] Preferably, in step S4, the target program that is determined to be allowed can be run, and the underlying protection module records the permission type of the target program into the process permission type table, while the target program that is determined to be prohibited will be blocked from running.

[0021] The benefit of this design is that it ensures that the execution permissions of all programs are effectively recorded and managed, and immediately blocks programs that do not comply with security policies, thereby improving system security.

[0022] Preferably, the database includes a program permission database and a policy database, and the policy database stores a number of permission protection policy data; the underlying protection module has read-only access to the data in the database, and the protection configuration software has read-write access to the data in the database; a process permission type unit is provided in the underlying protection module, and the process permission type unit is generated and modified after the operating system is started.

[0023] The benefit of this design is that it ensures data integrity and security by separating database access permissions, while supporting flexible policy and permission management.

[0024] Compared with the prior art, the invention has the following beneficial effects.

[0025] 1. The present invention uses program permission types so that each program is dynamically assigned a permission type when it is started. Dynamic permission management can respond to program needs and behaviors in real time, ensuring that only programs that meet specific conditions can obtain corresponding permissions, thereby improving security. This flexible permission allocation mechanism can effectively prevent malicious programs from abusing permissions.

[0026] 2. Through the design of permission protection strategy, the present invention enables the system to accurately match strategies according to the permission types of the parent process and the target program, and can configure fine-grained protection strategies according to actual needs, so that the system can make more reasonable decisions when facing different program startups. This refined protection mechanism not only improves the protection effect, but also reduces the occurrence of misjudgment and improves the user experience.

[0027] 3. Through clear permission management and dynamic decision-making processes, the system of the present invention can effectively prevent the execution of unauthorized programs and improve overall security. At the same time, real-time monitoring and policy matching can quickly identify and respond to potential threats, reduce security risks, and ensure the stable operation of the system and the integrity of data. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 This is a flowchart of the process of starting a program by the bottom-level protection module of the present invention.

[0029] Figure 2This is an implementation flow chart of the deployment / maintenance of the present invention.

[0030] Figure 3 The flowchart of the present invention is a method for calculating the permission type of a target program.

[0031] Figure 4 The figure is a schematic diagram of a protection system based on a permission model of the present invention. DETAILED DESCRIPTION

[0032] In order to make the purpose, technical scheme and advantages of the present disclosure clearer, the following will further describe the embodiments of the present disclosure in detail with reference to the accompanying drawings. The proportions of the components are not drawn according to the actual proportions, and the proportions and sizes shown in the accompanying drawings should not limit the substantial technical scheme of the present invention. These embodiments do not describe all the details in detail, nor do they limit the invention to the specific embodiments described.

[0033] See also Figure 1-4 As shown, a protection method based on a permission model includes the following steps: S1: Scan the files on the host, calculate the feature values ​​of the executable files and assign permission types; S2: Import the trusted signature certificate into the database, configure the protection strategy and enable protection according to the actual protection requirements; S3: Every time a new program is started, the permission type of the parent process is obtained and the permission type of the target program is calculated; S4: Determine whether the program can run based on the matching strategy.

[0034] A protection system based on a permission model includes: an underlying protection module, a protection configuration module and a database. The underlying protection module is located at the zero ring layer. The underlying protection module sets a hook to the operating system kernel to capture and control all program startup behaviors. The protection configuration module configures the software.

[0035] like Figure 1 In one embodiment shown, Figure 1 This is a flowchart of the process of the underlying protection module of the present invention to start the program. The detailed description of the process is as follows: 1. Detecting the start of a new program. When a program attempts to start in the operating system, the underlying protection module will immediately capture this event. The module monitors the creation events of all programs by setting up a hook mechanism at the operating system kernel layer. Whenever a new process starts, the system will send a notification to the underlying protection module so that it can respond in time.

[0036] 2. Get the parent process permission type. After capturing the new program launch event, the underlying protection module will first determine the parent process that launched the program. Through the API provided by the system, the protection module can query the relevant information of the parent process, including its permission type. The permission type of the parent process reflects the level of operations that the process allows its child processes to perform, which is an important basis for judging the security and credibility of the new program.

[0037] 3. Calculate the permission type of the target program. Next, the protection module needs to calculate the permission type of the newly started program (target program). This process includes multiple steps: First, the module will calculate the file feature value of the target program and compare it with the feature value in the database. If a match is found in the database, the corresponding permission type will be assigned according to the record; if no match is found, it is necessary to further obtain the signature information of the target program to verify its credibility. In this way, the system can dynamically determine the security and applicability of the target program.

[0038] 4. Traverse matching policies. Once the permission types of the parent process and the target program are obtained, the protection module will start traversing the pre-configured protection policies. These policies are set by the administrator according to specific needs and are used to define the permission control rules for program startup in different scenarios. The module will parse these policies one by one and check whether they match the permission types of the current parent process and the target program.

[0039] 5. Parse the policy to determine whether it matches. Each policy consists of "parent process permission type", "target program permission type" and "conversion permission type". When parsing the policy, the module will first check whether the permission type of the parent process matches the conditions in the policy. If they match, the module will further check the permission type of the target program. If both match, the policy is considered valid and proceed to the next step.

[0040] 6. Determine whether it includes permission conversion. If the current policy matches successfully, the system will determine whether the policy contains permission conversion information. If the policy defines conversion permissions, the protection module will convert the permission type of the target program to the permission type specified in the policy based on the information. This means that even if the target program itself has low permissions, the system can restrict it to run in high-privilege mode according to policy requirements to enhance security.

[0041] 7. Determine whether the policy has reached the end. If the current policy does not contain permission conversion, the protection module will continue to check whether the policy has been traversed to the end. If it has not reached the end, it will return to the previous step and continue to parse the next policy. The purpose of this is to ensure that the system has checked all possible policies to find a suitable match.

[0042] 8. Prohibit or allow running. If a matching policy is found during the traversal process, the system will decide whether to allow the target program to run according to the policy content; if no matching policy is found, the system will prohibit the program from running. In this way, the system can effectively protect the host from being affected by unauthorized or malicious programs.

[0043] The design of this process has significant security and flexibility. First, through real-time monitoring of new program startup events, the underlying protection module can intervene and perform security checks before the program is executed, which provides the first line of defense for the system and reduces the chances of successful operation of malicious programs. Secondly, the step of obtaining the parent process permission type ensures that the source of program startup is fully reviewed, which is crucial to preventing malicious programs from attacking through the "disguise" of legitimate programs. When calculating the target program permission type, the dual verification mechanism of file feature values ​​and signature information is combined to make the credibility assessment of the program more comprehensive. Even if there are unknown programs, the system can perform reasonable permission control through preset protection strategies to ensure that only verified programs can be executed. The process of traversing and matching strategies provides a flexible security management method. Administrators can set multiple strategies according to actual needs, and the system improves the accuracy of security protection by dynamically matching and parsing strategies. In particular, the concept of permission conversion is introduced in the strategy, so that the process is not limited to simple "whitelist" protection, but through flexible permission control, the operation of the program is finely managed. In addition, if no effective strategy is matched, the system will promptly block the operation of unknown programs to prevent potential security threats. This mechanism ensures that even newly introduced programs will not affect the overall security of the system, but will only be able to run after strict permission review.

[0044] like Figure 2 In one embodiment shown, Figure 2 This is an implementation flow chart for the deployment / maintenance of the present invention. The specific process steps are: when the system is started or security maintenance is performed, the administrator can choose to scan the specified file path or the entire system file. At this time, the system protection module will traverse the file system and read the file information one by one, including the file name, path, size, modification date, etc., and calculate the file's feature value (such as hash value). This process ensures that all potential executable files are identified and included in the security review. During the scanning process, the system checks whether custom type rules have been set for each file. These rules are pre-defined by the administrator based on actual needs, and may include security policies or trust levels for specific file types. If the file is found to comply with a custom rule, the system will set the file's permission type according to the content of the rule. For example, some files may be identified as "high risk", so their permission type will be limited to "restricted" to ensure that they do not pose a threat to the system during operation.

[0045] For files that do not have custom type rules set, the system will automatically set their permission types to default values. This default permission type may be "normal" or "default", which is intended to give files basic operating permissions without clear risks. This ensures that even if some files are not specifically marked, the system will not deny their legitimate operating needs. After the scan is completed, the system will generate a detailed scan report that lists the permission types of all scanned files and their corresponding status. The administrator will check this report to see if the file permission settings meet the expected requirements. At this stage, the administrator can modify the permission type according to the actual situation. For example, change some files that are incorrectly marked as "high risk" to "normal" permission types so that they can be used normally. After the administrator confirms the permission types of all files, the system will save these results to the database. The database will store the file's feature values, permission types, and other metadata related to the file. This process not only helps with subsequent permission verification and monitoring, but also provides important data support for future security audits.

[0046] The design of this process has multiple benefits. First, through a detailed scan of all files, the system can fully identify potential executable files, thereby providing basic data for subsequent security management. This comprehensive review mechanism effectively reduces the risk of unauthorized program operation and ensures the overall security of the system. Secondly, the setting of custom type rules gives administrators flexible permission control capabilities. Administrators can set the permission type of specific files according to business needs and security policies, thereby achieving fine-grained security management. This flexibility not only improves the security of the system, but also ensures the smooth progress of normal business processes. In addition, the setting of the default permission type provides a certain amount of operating space for files that do not have clear risks, avoiding unnecessary security obstacles. This balanced strategy ensures that the system can operate effectively while ensuring security, and improves the user experience. Finally, the administrator's inspection and modification link provides a human-machine combined management method, so that the automated security system can better adapt to actual needs. Through manual review, administrators can correct possible incorrect settings in a timely manner, thereby further reducing the risk of false positives and false negatives.

[0047] like Figure 3 In one embodiment shown, Figure 3The flowchart of calculating the permission type of the target program of the present invention is as follows: First, the system needs to confirm the target program to be reviewed. For example, when the program is started or the file is executed, the system will read the path and name of the program and mark it as the current target program for further security verification. Once the target program is confirmed, the system will calculate the characteristic value of its file content. The characteristic value is usually a unique identifier obtained by processing the file content through a hash algorithm (such as SHA-256). This step is crucial because the characteristic value provides an objective standard for the uniqueness of the file and helps to quickly determine the identity of the file. After calculating the characteristic value, the system will compare it with a pre-established security database. The database stores the characteristic values ​​of known programs and their corresponding security type records. If the characteristic value of the target program finds a match in the database, the system will set the permission type of the program according to the database record, such as "safe", "trusted" or "high risk", etc. If the characteristic value of the target program does not find a corresponding record in the database, the system will further check whether there is a digital signature in the file. Digital signature is a verification mechanism for the identity of the software publisher. The process of checking the signature can not only help determine the source of the program, but also confirm whether it has been tampered with during transmission.

[0048] After confirming the presence of a signature in the file, the system will extract the signer's information, including the publisher's name and the validity of the certificate. This information is crucial for subsequent security judgments. The system will then check whether the signer is in the security database. If the signer's identity has been verified and recorded, the system will set permissions for the program based on the type recorded in the database to ensure that it runs within the authorized scope. If the signer is not in the database, the system will mark the program as "unauthorized type." This category usually applies to programs that have not undergone security review, which means that the program may pose a security risk, so the system will restrict its running permissions. If the target program itself does not contain any digital signature, the system will directly set it as "unauthorized type." This step ensures that uncertified programs cannot be executed in the system, fundamentally reducing potential security threats.

[0049] This process has significant benefits in program security management and control. First, by confirming the target program and calculating the file content feature value, the system establishes a strict review of the program identity. The calculation of this feature value and the database comparison mechanism can quickly identify known and safe programs and effectively prevent the intrusion of malware. Secondly, the use of digital signatures provides a means of identity authentication for the publisher of the program. By checking the signature, the system can evaluate the source and integrity of the software, and only those publishers who have been certified can obtain the corresponding permissions. This mechanism effectively reduces the risk of counterfeit software and ensures that the programs used by users are trustworthy. In addition, the process provides flexible security policy management. The system marks programs with different permission types, providing administrators with controllable security settings. Administrators can determine the corresponding access and execution permissions based on the type and credibility of the program. This flexibility allows enterprises to formulate and adjust corresponding security policies according to their own security needs and adapt to the rapidly changing network environment. By marking unauthorized programs as high-risk, the system effectively limits the operating space of potential threats. This not only reduces the occupation of system resources by malware and unauthorized programs, but also reduces the risk of data leakage and system damage. Ultimately, the entire process improves the overall security and stability of the system.

[0050] comprehensive Figures 1 to 3 From the above, the present invention uses the permission model to construct an effective whitelist program protection mechanism, which mainly includes the following steps: S1: File scanning and permission type assignment Full disk scan and specified path scan: When the system starts, a full disk scan is performed to ensure that all executable files are identified. After that, the administrator can choose to perform a specified path scan on a specific directory; Calculate feature value: For each executable file, the system calculates the feature value (such as hash value) of its file content, which is an important basis for identifying the file identity; Default permission type assignment: During the initial scan, all identified executable files will be assigned a default permission type, usually "Normal" or "Executable"; Adjust permission type: After the scan is completed, the administrator can adjust the permission type of each file according to actual needs and store this information in the database; Custom rule application: The system supports automatic identification of specific program files based on user-preset custom rules and automatically sets their permission types, for example, marking certain key applications as "high trust".

[0051] S2: Trust certificate import and protection policy configuration Import trusted signature certificates: The system allows administrators to import trusted signature certificates into the database to ensure the legitimacy of the program source; Protection strategy configuration: Based on actual protection needs, administrators can configure corresponding protection strategies, decide which programs can run, how to manage permissions, and enable protection mechanisms.

[0052] S3: Decision-making process when starting a new program Obtaining the parent process permission type: Whenever a new program is started, the underlying protection module obtains the permission type of its parent process to determine the context in which it runs; S3.1: Calculate the characteristic value of the target program file content and search it in the database; S3.2: If the feature value of the file is not found in the database, proceed to step S3.3; if it is found, proceed to step S3.5; S3.3: Obtain signature information of the file and search for corresponding information in the database; S3.4: If the signer's information can be found in the database, proceed to step S3.5; if not, the target program is determined to be an unknown program. If the target program is an unknown program, its permission type is set to "unauthorized type".

[0053] S3.5: Assign the target program the permission type recorded in the database; S4: Strategy matching and operational decision making Policy matching success: If the permission type of the target program matches the defined policy, the system will allow it to run; Permission conversion information: If the policy records permission conversion information, the target program will run according to the permission type recorded in the policy; otherwise, it will run according to the permission type of the target program itself.

[0054] The permission types of programs that are allowed to run will be recorded in the process permission type table to facilitate subsequent inspection. Prohibited programs will be blocked from running to ensure system security.

[0055] The whitelist program protection method based on the permission model of the present invention significantly improves the security of the system through comprehensive file scanning and permission management. First, the initial full disk scan ensures that all potential executable files are included in the monitoring scope, providing a reliable basis for subsequent security reviews. By assigning a reasonable permission type to each file, the administrator can finely control the execution of the program and minimize the impact of unauthorized programs on the system. Secondly, the introduction of the mechanism of trust signature certificates increases the credibility of the source of the program and effectively prevents the injection of counterfeit software. In addition, the system's custom rules and dynamic policy matching enable the protection strategy to be flexibly adjusted according to actual needs, ensuring efficient and effective security management. Through these measures, the method not only improves the defense capability against malware, but also optimizes the user experience and ensures the smooth operation of normal programs. In short, this comprehensive protection solution provides a solid security barrier for enterprises and individuals, ensuring the integrity of data and the stability of the system.

[0056] like Figure 4 In one embodiment shown, Figure 4 The schematic diagram of a protection system based on a permission model of the present invention. The components of a protection system based on a permission model designed by the present invention include: a bottom-level protection module, a protection configuration software, and a database. Among them, the bottom-level protection module works at the ring0 layer of the operating system. When it is started, it will set a hook to the operating system kernel to capture the behavior of all program startups. The bottom-level protection module can control all captured program startup behaviors through the hook. A "process permission type table" is maintained in the bottom-level protection module, and the table is generated and modified after the operating system is started. The protection configuration software is a desktop application, and the administrator can perform various configurations on the software through operations. The database contains two sub-databases: a program permission database and a policy database. Two types of data are stored in the program permission database: "Program file feature value: program permission type" data and "Program signer information: program permission type" data. Several permission protection policy data are stored in the policy database. The data in the two databases can be read-only accessed by the bottom-level protection module, and can also be accessed in read-write form by the protection configuration software.

[0057] In one embodiment, the program permission type is a literal value used to identify what permissions the program has. All programs have a permission type, where the permission type of the program file is configured by the administrator, and the permission type of the running program will be automatically determined based on the configured information. The permission protection policy is a basis for determining how the underlying protection software operates when a new program is about to start. A permission protection policy consists of "parent process permission type", "target program permission type", and "conversion permission type", where the parent process permission type and target program permission type are required items and wildcards can be used; the conversion permission type is optional and wildcards cannot be used. A permission protection is in the form of: *-python:limited. Among them, * (wildcard) is the parent process permission type, indicating any permission type, python is the target program permission type, and limited indicates the conversion permission type.

[0058] The present invention establishes a dynamic program operation control based on whitelist protection and permission type. After the protection is turned on, the permission type and permission access policy of the program will work together. In the underlying protection module, each program will be assigned a permission type when it is started. For each captured program startup behavior, the permission type of the parent process will be obtained, and the permission type of the target program will be calculated based on the file feature value and signature of the target program. After that, the permission protection policy will be matched one by one according to the two permission types, and the control of allowing / disallowing will be selected according to the matching results.

[0059] The present invention is implemented in the following steps: 1. File scanning: During deployment / maintenance, the administrator scans the files on the host. The scan is divided into full disk scan (i.e., scanning all files on the host) and specified path scan. A full disk scan should be performed during the initial deployment. During the scan, the protection configuration software traverses the files, calculates the feature value of each executable file, and finally summarizes all the data and displays it. For the scanned results, the default permission type is assigned by default. In particular, some common program files (such as the interpreter program of Python scripts) can be automatically identified and their permission types can be automatically set by adding custom rules. After the scan is completed, the administrator can further adjust the permission type of the scanned program files in the result display interface according to actual needs. After the administrator modifies and checks that they are correct, apply the results and store the file feature information and permission type in the database.

[0060] 2. Import of signature certificates: Administrators can import trusted signature certificates into the database through the protection configuration software. The imported certificates will serve as the basis for the underlying protection module to identify file signatures.

[0061] 3. Configuration strategy: The administrator manually configures and saves the protection strategy by operating the protection configuration software based on actual protection needs.

[0062] 4. Enable protection: After completing the above file scanning and policy configuration steps, the administrator uses the protection configuration software to enable protection, and the protection will run. If necessary, the administrator can also disable protection in the protection configuration software.

[0063] 5. Protection takes effect: After the protection is started, the underlying protection module will work. Every time a new program is to be started, a decision-making process will be entered. The underlying protection module first obtains the permission type of the parent process from the process permission type table, and then calculates the permission type of the target program and matches the policy. In the process of calculating the permissions of the target program, the feature value of the target program file content is first calculated and searched in the database. For most files, their feature values ​​will be stored in the database through scanning in step 1. If the feature value of the file is not found in the database, the signature information of the file is obtained again, and the corresponding information is searched in the database. The trusted signature information is imported in step 2. If the information can be found in the database, the permission type recorded in the database is assigned to the target program. If it is not found, it means that the target program is an unknown program. According to the principle of the whitelist, the permission type of the target program will be unauthorized. In the process of policy matching, the underlying protection module will traverse the policies one by one, and use the permission type of the parent process and the permission type data of the target program to match the policy until one policy is successfully matched. If a policy is successfully matched, the target program is allowed to run, and depending on whether the policy records permission conversion information, it is decided whether the target program runs with the permission type recorded in the policy or with the permission type of the target program itself. Finally, the target program that is determined to be allowed can run, and the underlying protection module records the permission type of the target program in the process permission type table; the target program that is determined to be prohibited will be blocked from running, realizing the startup protection of unknown programs.

[0064] The present invention is not limited to the above-mentioned embodiments. No matter any changes are made in the shape or material composition, any structural design provided by the present invention is a variation of the present invention and should be considered to be within the protection scope of the present invention.

Claims

1. A protection method based on a permission model, characterized in that: The following steps are involved: S1: Scan the files on the host, calculate the feature values ​​of the executable files and assign permission types; S2: Import the trusted signature certificate into the database, configure the protection strategy and enable protection according to the actual protection requirements; S3: Every time a new target is started, obtain the permission type of the parent process and calculate the target permission type; S4: Determine whether it can be run based on the matching strategy.

2. According to the protection method based on the permission model of claim 1, it is characterized in that: In the step S3, after the protection is started, the bottom protection module works, and each time there is a new target to be started, it enters the decision-making process; The decision-making process includes obtaining the permission type of the parent process from the process permission type table, then calculating the target permission type and matching the policy. During the policy matching process, the underlying protection module will traverse the policies one by one, using the permission type of the parent process and the target permission type data to match the policy until a policy match is successful.

3. A protection method based on a permission model according to claim 1 or 2, characterized in that: The process of calculating the target permissions includes the following steps: S3.1: Calculate the feature value of the target file content and search in the database; S3.2: If the feature value of the file is not found in the database, proceed to step S3.3; if found, proceed to step S3.5; S3.3: Obtain the signature information of the file and search for the corresponding information in the database; S3.4: If the information can be found in the database, proceed to step S3.

5. If not, the target is unknown. S3.5: Assign the target the permission type recorded in the database.

4. A protection method based on a permission model according to claim 2, characterized in that: After the policy matches successfully, the target is allowed to run, and based on whether the policy records permission conversion information, if so, the target runs with the permission type recorded in the policy, if not, it runs with the permission type of the target itself.

5. The protection method based on the permission model according to claim 3 is characterized in that: In step S3.4, when the target is unknown, the permission type of the target is set to an unauthorized type.

6. A protection method based on a permission model according to claim 1, 4 or 5, characterized in that: In step S1, the scanning is divided into full disk scanning and specified path scanning. When the system is first deployed, a full disk scanning is performed; and a default permission type is assigned to the scanned result. After the scan is completed, the permission type of the scanned file is adjusted according to actual needs, and finally the file feature information and permission type are stored in the database.

7. A protection method based on a permission model according to claim 6, characterized in that: In the step S1, for the scanned results, according to the added custom rules, the set files are automatically identified and their permission types are automatically set.

8. A protection method based on a permission model according to claim 1, characterized in that: In step S4, the target determined to be allowed can be run, and the underlying protection module records the target's permission type in the process permission type table, while the target determined to be prohibited will be blocked from running.

9. A protection system based on a permission model, using a protection method based on a permission model according to any one of claims 1 to 8, characterized in that: include: The bottom layer protection module, protection configuration module and database, the bottom layer protection module is located in the zero ring layer, the bottom layer protection module sets a hook to the operating system kernel, captures all target startup behaviors and controls them, and the protection configuration module configures the software.

10. A protection system based on a permission model according to claim 9, characterized in that: The database includes a permission database and a policy database, and the policy database stores a number of permission protection policy data; the underlying protection module only accesses the data in the database in read-only form, and the protection configuration software accesses the data in the database in read-write form; the underlying protection module is provided with a process permission type unit, and the process permission type unit is generated and modified after the operating system is started.

Images