Device security protection method, device, program product and medium under eBPF

Abstract

The application discloses a device security protection method, device, program product and medium under eBPF, and relates to the technical field of device security. The method comprises the following steps: determining a target device security policy, and performing policy distribution on the target device security policy; performing policy storage on the distributed target device security policy in a hash mapping form and a bitmap form respectively, so as to obtain first structure data and second structure data correspondingly; capturing an operation event and determining a subject path and an object path in the operation event; performing policy matching on the subject path and the object path with the first structure data respectively, and performing policy matching on the obtained first matching result with the second structure data; determining a permission determination result by using the obtained second matching result, and processing the operation event according to the permission determination result. Through the technical scheme of the application, efficient storage and matching of the device security policy can be realized, and the performance bottleneck and complexity problems in the traditional method are effectively solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of device security, and in particular to a device security protection method under eBPF, a device, a program product and a medium. BACKGROUND

[0002] In modern device security management, the configuration and management of device security policies are important links to protect computer systems from attacks. Traditional security policies are based on the device security mode of the kernel, and usually rely on complex data structures such as rule tables, access control lists (ACLs), etc. These methods may cause performance bottlenecks and management difficulties. eBPF (Extended Berkeley Packet Filter) is an extension mechanism of the Linux kernel that allows developers to execute custom code in the kernel space and is widely used in network traffic filtering, performance monitoring and security analysis. With the rise of eBPF technology, the development of device security protection software based on eBPF enables developers to break away from the dependence on the kernel, thereby avoiding various system problems. However, the mapping mechanism (Maps) provided by eBPF for storing data is not completely suitable for the storage and matching of security policies in device security protection software. Therefore, in practical applications, efficient storage and matching of device security policies under the eBPF environment still face challenges, and the implementation effect is not ideal. SUMMARY

[0003] Therefore, the purpose of the present application is to provide a device security protection method under eBPF, a device, a program product and a medium, which can realize efficient storage and matching of device security policies, and effectively solve the performance bottleneck and complexity problems in traditional methods. The specific scheme is as follows:

[0004] In a first aspect, the present application discloses a device security protection method under eBPF, comprising:

[0005] determining a target device security policy, and performing policy distribution on the target device security policy;

[0006] respectively using a hash mapping form and a bitmap form to store the distributed target device security policy, to obtain first structure data and second structure data accordingly;

[0007] After monitoring an operation event on a file or a directory, determining a subject path and an object path in the operation event; the operation event is an event of a subject operating on an object, the subject is a process operating on a file or a directory, and the object is a file or a directory to be protected;

[0008] Match the subject path and the object path with the first structure data respectively to determine a first matching result, and match the first matching result with the second structure data to determine a second matching result;

[0009] Determine whether the subject in the operation event has operation permission on the object according to the second matching result to obtain a corresponding permission determination result, and process the operation event according to the permission determination result.

[0010] Optionally, before determining the target device security policy, the method further comprises:

[0011] Defining the device security policy according to a preset rule format; wherein the preset rule format comprises an object part, a subject part, a permission part, a rule part and a policy priority part;

[0012] Correspondingly, determining the target device security policy and performing policy distribution on the target device security policy comprises:

[0013] Determining the target device security policy according to a current application scenario, and performing policy distribution on the target device security policy based on a preset format rule.

[0014] Optionally, the permission part in the device security policy comprises:

[0015] Setting a first identifier for the permission to represent that any operation behavior is prohibited;

[0016] Setting a second identifier for the permission to represent read-only permission;

[0017] Setting a third identifier for the permission to represent writable permission;

[0018] Setting a fourth identifier for the permission to represent executable permission.

[0019] Optionally, determining the target device security policy and performing policy distribution on the target device security policy comprises:

[0020] Determining the target device security policy, and performing policy distribution on the target device security policy through a command line or through a graphical user interface.

[0021] Optionally, the target device security policy that has been distributed is stored in a hash mapping form to obtain the first structure data, comprising:

[0022] Constructing an object hash mapping table by using the object part and the policy priority part in the target device security policy;

[0023] Constructing a subject hash mapping table by using the subject part and the policy priority part in the target device security policy;

[0024] The permission hash mapping table is constructed by using the policy priority part and the permission part in the target device security policy;

[0025] The first structure data is determined according to the object hash mapping table, the subject hash mapping table and the permission hash mapping table; wherein the object hash mapping table, the subject hash mapping table and the permission hash mapping table are stored in the form of key-value pairs.

[0026] Optionally, the device security protection method under the eBPF of the application further comprises:

[0027] The first target device security policy and the second target device security policy are determined; wherein the second target device security policy is a device security policy stored after the first target device security policy is stored;

[0028] When it is determined according to the preset rule format that there is a same part between the first target device security policy and the second target device security policy, the target key of the same part in the corresponding mapping table is determined;

[0029] The value corresponding to the target key is updated by using the different part between the second target device security policy and the first target device security policy.

[0030] Optionally, the target device security policy is stored in the form of a bitmap to obtain second structure data, comprising:

[0031] The bitmap is constructed based on the policy priority part in the target device security policy, and each bit in the bitmap corresponds to a target device security policy, to obtain the second structure data; wherein the lower the bit in the second structure data, the higher the priority of the target device security policy corresponding to the bit.

[0032] Optionally, the subject path and the object path are respectively used for policy matching with the first structure data to generate a first matching result, comprising:

[0033] The subject path is matched with the subject hash mapping table to determine a first priority corresponding to the subject path;

[0034] The object path is matched with the object hash mapping table to determine a second priority corresponding to the object path;

[0035] The first priority and the second priority are subjected to a bitwise AND operation to determine the first matching result.

[0036] Optionally, the first matching result is subjected to policy matching with the second structure data to determine a second matching result, comprising:

[0037] performing a bitwise AND operation on the first matching result and a complement of the first matching result, and matching a generated bitmap result with the second structure data to determine a second matching result.

[0038] Optionally, matching the generated bitmap result with the second structure data to determine the second matching result comprises:

[0039] determining a first low bit that is not 0 in the bitmap result, and determining a target priority corresponding to the low bit according to the second structure data; the target priority is a priority corresponding to an operation right when performing an operation behavior in the operation event;

[0040] Correspondingly, determining whether the subject in the operation event has the operation right on the object according to the second matching result to obtain a corresponding right determination result comprises:

[0041] matching the target priority with a right hash mapping table to determine a target right corresponding to the target priority;

[0042] determining whether the subject in the operation event has the operation right on the object according to the target right to obtain the corresponding right determination result.

[0043] Optionally, processing the operation event according to the right determination result comprises:

[0044] when the subject in the operation event has the operation right on the object, performing a release processing on the operation behavior in the operation event;

[0045] when the subject in the operation event does not have the operation right on the object, performing an interception processing on the operation behavior in the operation event.

[0046] Optionally, the device security protection method under the eBPF of the present application further comprises:

[0047] when there is a third target device security policy that needs to be deleted in the target device security policy, deleting the current first structure data and the current second structure data, and determining new first structure data and new second structure data based on the third target device security policy.

[0048] In a second aspect, the present application discloses an electronic device, comprising:

[0049] a memory for storing a computer program;

[0050] a processor for loading and executing the computer program to implement the aforementioned device security protection method under the eBPF.

[0051] In a third aspect, the present application discloses a computer program product comprising computer programs / instructions which, when executed by a processor, implement the steps of the device security protection method under eBPF.

[0052] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the device security protection method under eBPF.

[0053] The present application provides a device security protection method under eBPF, comprising: determining a target device security policy, and performing policy distribution on the target device security policy; performing policy storage on the distributed target device security policy in a hash mapping form and a bitmap form respectively, to obtain first structure data and second structure data correspondingly; determining a subject path and an object path in an operation event of a file or a directory after monitoring the operation event; the operation event is an event of a subject operating on an object, the subject is a process of operating on a file or a directory, and the object is a file or a directory to be protected; performing policy matching on the subject path and the object path with the first structure data respectively to determine a first matching result, and performing policy matching on the first matching result with the second structure data to determine a second matching result; determining whether the subject in the operation event has an operation permission on the object according to the second matching result, to obtain a corresponding permission determination result, and processing the operation event according to the permission determination result.

[0054] The present application has the beneficial technical effects that: the mapping mechanism provided by the kernel is used to store data structures under the eBPF environment, and the present application applies the bitmap to the eBPF environment by using the storage forms of the hash mapping and the bitmap. As a kind of efficient data structure, the bitmap can process a large amount of data with small memory occupation and fast speed, and realizes effective storage and efficient matching of the device security policy in the eBPF environment.

[0055] In addition, the device security protection device, program product and medium under eBPF provided by the present application correspond to the device security protection method under eBPF described above, and have the same effects. BRIEF DESCRIPTION OF DRAWINGS

[0056] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiment or prior art description. Obviously, the drawings in the following description are only embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor based on the provided drawings.

[0057] Figure 1 A device security protection method under eBPF disclosed by the present application is shown in the flowchart;

[0058] Figure 2 A device security protection system block diagram under eBPF is disclosed in the present application.

[0059] Figure 3 A policy storage schematic diagram is disclosed in the present application.

[0060] Figure 4 A device security protection policy storage and matching schematic diagram under eBPF is disclosed in the present application.

[0061] Figure 5 A device security protection device structure schematic diagram under eBPF is disclosed in the present application.

[0062] Figure 6 An electronic device structure diagram is disclosed in the present application. DETAILED DESCRIPTION

[0063] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0064] In the field of device security, a common function of security policy is to protect a file, that is, whether a process under a user has read, write, and execute permissions on the file. To achieve this function, the usual approach is to mount a hook on the kernel function __x64_sys_open and __x64_sys_execve corresponding to the open function and the execve function; then in the hook function, the absolute path of the subject and the object and the expected operation are obtained; the obtained absolute path is matched with the rules in the rule library to determine whether to allow or prohibit the operation of the subject on the object. In such a traditional kernel-based device security mode, the rules in the rule library are stored according to a double-linked list, and it is relatively easy to implement the addition, deletion, modification, and matching of the policy, and a node in the list as the head of another list. However, the traditional device security protection software is developed based on the kernel mode, which is extremely easy to cause system crash, thereby causing irreparable consequences to the customer business.

[0065] With the rise of eBPF technology, eBPF-based device security protection software development enables developers to break away from the dependence on the kernel, thereby avoiding various system problems. eBPF uses the mapping mechanism provided by the kernel to store data structures, which can be used to store device security protection policies. Commonly used mapping types include hash tables, arrays, queues, and the like. However, the disadvantages of these mapping types are also obvious. For example, eBPF-based file access control, due to the unordered nature of the hash map, when rules are added to the rule base, it is not necessarily the first to match when matching; one disadvantage of array mapping is that elements in the mapping cannot be deleted, which cannot make the array smaller; that is, after adding rules, rules cannot be deleted; regarding queue mapping, when initializing the mapping, the size of the key must be 0, and when writing elements into the mapping, the key must be empty. Therefore, the key of the mapping cannot be used for lookup. It can be seen that efficient device security policy storage and matching under the eBPF environment still faces challenges, especially when dealing with large-scale policy sets and real-time updates.

[0066] To this end, the present application provides a device security protection scheme under eBPF, which can realize efficient storage and matching of device security policies, and can effectively solve the problem of system downtime caused by traditional methods, and the problem of ineffective storage and efficient matching of policies in the eBPF environment.

[0067] The embodiment of the application discloses a device security protection method under eBPF, referring to Figure 1 The method comprises the following steps:

[0068] Step S11: Determine the target device security policy, and perform policy distribution on the target device security policy.

[0069] Device security policy is an important measure to ensure the security of devices in computer systems and network environments, and can usually determine whether to allow or prohibit the operation of the subject on the object. As long as there is a judgment on the operation permission of the object in different application scenarios, the corresponding device security policy needs to be set, which is widely used in the fields of network traffic filtering, performance monitoring and security analysis. For example, the device security policy can be a policy at the operating system security level, a policy at the data security level, a policy at the network security level, a policy at the application program security level, and the like. For ease of understanding, the target device security policy in the following embodiments is taken as an example to illustrate the policy configured by the system administrator for protection of files or directories.

[0070] In the embodiments of the present application, the composition of the policy is defined first before the policy is issued. Specifically, the device security policy is defined according to a preset rule format; wherein the preset rule format includes an object part, a subject part, a permission part, a rule part and a policy priority part. As can be seen, each policy is composed of five parts, namely, object, subject, mode, rule id and priority. Among them, the object indicates the file or directory to be protected, the subject indicates the process of operating the file or directory, the mode indicates the type of operation allowed or denied, such as read, write and execute, the rule id indicates the number of each policy, and the priority indicates the priority of each policy, which is used to determine which policy to use when there is a conflict.

[0071] Further, after determining the target device security policy according to the current application scenario, the target device security policy is issued based on the preset format rule. That is, the target device security policy required is issued according to the composition part of the policy definition.

[0072] Step S12: The issued target device security policy is stored in the form of hash mapping and bitmap respectively, so as to obtain first structure data and second structure data correspondingly.

[0073] In the embodiments of the present application, after the target device security policy is issued, the issued policy is stored in the form of hash mapping and bitmap respectively. Specifically, it is stored in three hash maps and corresponding bitmaps.

[0074] In a specific embodiment, the issued target device security policy is stored in the form of hash mapping to obtain first structure data, specifically including: constructing an object hash map using the object part and the policy priority part in the target device security policy; constructing a subject hash map using the subject part and the policy priority part in the target device security policy; constructing a permission hash map using the policy priority part and the permission part in the target device security policy; determining the first structure data according to the object hash map, the subject hash map and the permission hash map; wherein the object hash map, the subject hash map and the permission hash map are stored in the form of key-value pairs.

[0075] It can be seen that, since the mapping mechanism provided by the kernel can be used to store data structures under eBPF, the target device security policy is stored in the form of a hash map. The first structure data obtained includes three hash map tables, namely the object hash map table, the subject hash map table, and the permission hash map table. When adding a policy, the corresponding parameter values are stored in the tables. The hash map table is stored in the form of key-value pairs, and the corresponding value can be queried according to the corresponding key.

[0076] In another specific embodiment, the target device security policy is stored in the form of a bitmap to obtain second structure data, which specifically includes: constructing a bitmap based on the policy priority part of the target device security policy, and letting each bit in the bitmap correspond to a target device security policy to obtain the second structure data; wherein the lower the bit in the second structure data, the higher the priority of the corresponding target device security policy.

[0077] It can be seen that the second structure data corresponds to bitmap storage. As an efficient data structure, a bitmap can process a large amount of data with small memory usage and fast speed. The bitmap structure has a fixed size and simple bit operations, and the priority of the policy can be determined according to the bitmap. One bit in the bitmap represents one policy, and a bit of 1 indicates that there is a policy, and a bit of 0 indicates that there is no policy. Applying the bitmap to the eBPF environment can achieve efficient storage and matching of device security policies.

[0078] Step S13: When the operation event on the file or directory is monitored, the subject path and the object path in the operation event are determined.

[0079] The operation event is an event in which the subject operates on the object. The subject is a process that operates on the file or directory, and the object is the file or directory to be protected.

[0080] Further, the subject path is the location information of the subject. In the scenario of protecting the file or directory, the subject may be a user process, and the location of the executable file of this process is the subject path. For example, under a certain operating system, assuming that a user operates on a file through the “ / user / bin / touch” process, the path of “ / user / bin / touch” is the subject path, which represents the location information of the initiator of the operation. The object path is the location information of the object. In the scenario of protecting the file or directory, since the object is the object of the subject's operation, the object path at this time is the path of the file or directory (such as read, write, delete, etc.) to be operated. For example, under a certain operating system, when a process wants to modify the “ / root / a.txt” file, the path of “ / root / a.txt” is the object path, which represents the location information of the file in the storage device.

[0081] Step S14: respectively using the subject path and the object path to perform policy matching with the first structure data to determine a first matching result, and performing policy matching between the first matching result and the second structure data to determine a second matching result.

[0082] In the embodiments of the present application, when the eBPF program monitors the operation event on the file, the subject path and the object path of the event are obtained, and are matched with the policies stored in the first structure data and the second structure data in turn. The process of policy matching is used to determine whether the subject in the operation event has the operation permission on the object, and therefore, in the scenario of protecting the file or the directory, the process of policy matching is to determine whether a process can perform the corresponding operation on the file or the directory.

[0083] It should be noted that the first matching result and the second matching result are both in the form of a bitmap value. When the subject path and the object path are matched with the first structure data respectively, the corresponding priority of each is obtained, and the two priorities are further used to determine the first matching result. Since the second structure data can be used to determine how many policies are currently stored and what the corresponding priority is. In the second structure data, the lower the bit, the higher the priority corresponding to the target device security policy. Therefore, after the first matching result is matched with the second structure data, the second matching result obtained can be used to represent the target priority corresponding to the permission when the operation behavior in the operation event is executed, and how many target device security policies are matched.

[0084] Step S15: determining whether the subject in the operation event has the operation permission on the object according to the second matching result to obtain a corresponding permission determination result, and processing the operation event according to the permission determination result.

[0085] After the policy matching, since the second matching result can be used to represent the target priority corresponding to the permission when the operation behavior in the operation event is executed, the corresponding permission can be determined according to the target priority. Further, the permission determination result of whether the subject has the operation permission on the object in the current operation event is determined according to the permission. According to the permission determination result, it can be determined how to process the operation event, that is, whether to intercept or pass the operation behavior. It can be understood that if the subject has the operation permission on the object, the operation behavior in the operation event is passed; if the subject does not have the operation permission on the object, the operation behavior in the operation event is intercepted.

[0086] As Figure 2The overall structure of a system for bitmap-based device security policy storage and matching under eBPF is shown according to an exemplary embodiment. First, the components of the policy are defined, then the required policy is issued, and the issued policy is stored in three hash mapping tables and corresponding bitmaps. When an operation event on a file is monitored, the subject and object paths of the event are obtained, and the policy stored in the hash mapping table and bitmap is matched to determine whether to intercept or pass.

[0087] The beneficial technical effects of the present application are that the mapping mechanism provided by the kernel is used to store data structures under the eBPF environment, and the present application applies bitmaps to the eBPF environment by using hash mapping and bitmap storage. As a highly efficient data structure, bitmaps can process a large amount of data with small memory occupation and fast speed, and effectively store and efficiently match device security policies in the eBPF environment.

[0088] In a specific embodiment, if the current application scenario is a file protection scenario, the policy is issued using a command line or a graphical user interface when the policy is issued. When the policy is issued using a graphical user interface, a management platform can be developed to issue the policy on the graphical interface. When the policy is issued using a command line, the target device security policy is issued in a command line according to the preset format rule when the policy is defined.

[0089] For example, using a command line, such as. / config mac_file add 1 / usr / bin / touch 0 / root / a.txt 1, a policy is issued. The id of the rule part is 1, the subject part is / usr / bin / touch, the permission part of the subject to the object is 0, the object part is / root / a.txt, and the priority of the rule is specified as 1.

[0090] In a feasible embodiment, when defining the permission part of the device security policy, the following steps can be included: setting a first identifier for the permission to represent any prohibited operation; setting a second identifier for the permission to represent read-only permission; setting a third identifier for the permission to represent writeable permission; and setting a fourth identifier for the permission to represent executable permission.

[0091] For example, permission 0 represents any prohibited operation, permission 1 represents read-only permission, permission 2 represents writeable permission, and permission 4 represents executable permission.

[0092] According to the set identifier, two policies are continuously issued,. / config mac_file add 2 / usr / bin / touch 1 / root / a.txt 2,. / config mac_file add 3 / usr / bin / touch 4 / root / b.txt 4.

[0093] Based on the foregoing embodiment, when storing the policies, the storage strategy of 3 hash maps and 1 bitmap is adopted. When adding a policy, the corresponding parameter values are respectively stored in the table. The hash map table is stored in the form of key-value pairs, and the corresponding value can be queried according to the corresponding key.

[0094] As shown in Figure 3 Since the object hash map is constructed by using the object part and the policy priority part in the target device security policy, in the object hash map, the key (keyid) corresponds to the rule id, and the value (value) corresponds to the object path (object_path) and the priority (prior). For example, when adding the first policy, the key in the object hash map is 1, and the value is composed of two parts, which are the object path “ / root / a.txt” and the priority 1=2^0.

[0095] Similarly, since the subject hash map is constructed by using the subject part and the policy priority part in the target device security policy, in the subject hash map, the key (keyid) corresponds to the rule id, and the value (value) corresponds to the subject path (subject_path) and the priority (prior). When adding the first policy, the key in the subject hash map is 1, and the value is composed of two parts, which are the subject path “ / usr / bin / touch” and the priority 2^0.

[0096] Since the permission hash map is constructed by using the policy priority part and the permission part in the target device security policy, in the permission hash map, the key (keyid) corresponds to the priority (prior), and the value (value) corresponds to the permission (mode). When adding the first policy, the key in the permission hash map is 2^0, and the value is the access permission 0.

[0097] It should be noted that for the policies issued in the embodiment, the first structure data can be updated after storing the first policy and then storing the second policy when storing the policies. In a specific implementation, the process of storing multiple target device security policies can include the following steps:

[0098] Determine the security policy for the first target device and the security policy for the second target device; wherein, the security policy for the second target device is the device security policy stored after the security policy for the first target device is stored;

[0099] When it is determined, according to the preset rule format, that there is a common part between the security policies of the first target device and the security policies of the second target device, the target key of the common part in the corresponding mapping table is determined.

[0100] The value corresponding to the target key is updated by utilizing the differences between the second target device security policy and the first target device security policy.

[0101] like Figure 3 As shown, when adding the second policy, the key in the object hash map is 2, the object path in the value is " / root / a.txt", and the priority should ideally be 2 = 2^1. However, since the object path is the same for both the second and first policies, the two policies can be merged in the object hash map. That is, based on the first policy, the priority in the value is updated to 3 = 2^0 | 2^1. Similarly, in the subject hash map, since the subject is the same for both the second and first policies, only the priority needs to be updated based on the first policy; the updated priority is 3 = 2^0 | 2^1. In the permission hash map, the priority is 2^1 and the permission is 1.

[0102] When adding the third strategy, in the object hash map table, since the first two strategies were merged, the key is 2, the object path in the value is " / root / b.txt", and the priority is 4 = 2^2. In the subject hash map table, since the subject of the third strategy is the same as the first two strategies, we only need to update the priority based on the first two strategies. The updated priority is 7 = 2^0 | 2^1 | 2^2.

[0103] Furthermore, based on the foregoing embodiments, this embodiment will specifically describe S14 in the above embodiments. The process of performing strategy matching with the first structural data using the subject path and object path respectively to generate a first matching result may include the following steps:

[0104] Match the main path with the main hash map to determine the first priority corresponding to the main path;

[0105] Match the object path with the object hash map to determine the second priority corresponding to the object path;

[0106] Perform a bitwise AND operation between the first priority and the second priority to determine the first match result.

[0107] The current device security protection software under eBPF is developed based on a kernel module, and a slight mistake can cause system downtime; and the eBPF technology can solve the problem of system downtime, but the data structure provided by the eBPF technology cannot effectively store and efficiently match the device security policy. Therefore, the present application proposes a policy storage form of bitmap+hash map under eBPF, which includes a guest part, a subject part, a permission part, a rule part and a policy priority part. Each policy is respectively stored in three hash map tables, and when matching the policy, each matching item is respectively matched with the corresponding hash map, the two priors found are operated by bitwise AND (intersection), and a bitmap value is obtained, which is the first matching result.

[0108] For example, to execute touch / root / a.txt, through traversing the subject hash map table, / usr / bin / touch can be matched, and then the first priority is obtained as 7=2^0 | 2^1 | 2^2; through traversing the guest hash map table, / root / a.txt can be matched, and then the second priority is obtained as 3=2^0 | 2^1; the first matching result is obtained by performing bitwise AND operation on the two priorities, that is, 0011=3&7, which means that two policies with the same subject and different permissions are matched.

[0109] It should be pointed out that after obtaining the first matching result, the first matching result is matched with the second structure data to determine the second matching result, specifically: performing bitwise AND operation on the first matching result and the complement of the first matching result, and matching the generated bitmap result with the second structure data to determine the second matching result. Wherein, matching the generated bitmap result with the second structure data to determine the second matching result, specifically: determining the first low bit that is not 0 in the bitmap result, and determining the target priority corresponding to the low bit according to the second structure data; the target priority is the priority corresponding to the permission when the operation behavior in the operation event is executed.

[0110] For example, because the lower the bit is, the higher the priority is, and the earlier the matching is, the first matching result is matched with the complement of the first matching result. That is, bitmap&=-bitmap operation is performed to obtain a binary number with only one bit as 1. For example, 0011&(-0011) can obtain 0001=1, that is, the bit with the lowest bit as 1 is obtained. After matching the bitmap result with the second structure data, the second matching result corresponding to the priority corresponding to the permission when the current operation behavior is executed is determined as 1.

[0111] Further, the second matching result is used to determine whether the subject has operation permission on the object in the operation event, to obtain a corresponding permission determination result. Specifically, the target priority is matched with the permission hash mapping table to determine the target permission corresponding to the target priority; and whether the subject has operation permission on the object in the operation event is determined according to the target permission, to obtain a corresponding permission determination result. For example, the obtained 1 is used to query the permission hash mapping table, and the value of the permission is 0, that is, all operations are prohibited, so the execution of touch / root / a.txt is intercepted, which meets the expectation.

[0112] As shown in Figure 4 is a schematic diagram of storage and matching of device security policies. When the policies are stored, the policies need to be defined and issued. Each policy is composed of five parts when the policy is defined, and then the required policy is issued, and finally the issued policy is stored in three hash maps and the corresponding bitmap. When the policy is matched, the operation event of the user on the file is first captured, such as reading, writing, and executing; and then the object path and the subject path of the operation event are obtained. By matching with the subject hash mapping table and the object hash mapping table, two priorities are obtained, and the final bitmap result is calculated by using the two priorities. The value of the bitmap result can represent the priority value corresponding to the operation event. If the operation permission of the file is determined according to the second structure data, that is, the data stored in the bitmap, to be consistent with the operation permission corresponding to the actual operation event, the expectation is met, and the interception or release action of the operation is determined according to the related permission, for example, if the permission is to prohibit any operation, the operation will be intercepted according to the permission; if the permission is read-only permission, the operation will be released to read only.

[0113] Based on the above embodiment, in a feasible implementation, when a target device security policy is deleted, the following steps can also be included:

[0114] When the target device security policy includes a third target device security policy that needs to be deleted, the current first structure data and the current second structure data are deleted, and new first structure data and new second structure data are determined based on the third target device security policy.

[0115] In this embodiment, when a policy is deleted, all policies are deleted, and the remaining policies are read from the database and reloaded. That is, the process of storing the policy is re-executed to determine the new first structure data and the new second structure data.

[0116] In addition, in a possible implementation, further, since the device security policy is used to control the operation behavior of the subject operating the object, if no relevant policy is matched according to the first structure data and the second structure data when the current operation event is used for policy matching, for example, no same subject as in the current operation event is matched in the subject hash mapping table, at least one of the following operations can be performed: releasing the subject related in the operation event, and issuing a prompt of security policy matching failure for the current operation event. The two operations described above can be used alone or in combination. For example, if no same subject as in the current operation event is matched in the subject hash mapping table, the subject in the current operation behavior can be directly released, which means that the operation behavior of the subject is not limited, the operation behavior of the subject does not need to be controlled, and no security threat is caused. For example, if no same object as in the current operation event is matched in the object hash mapping table, it is indicated that no security policy for the object is currently matched, and a prompt of security policy matching failure can be issued to make the administrator further confirm whether to specify a corresponding security policy for the object based on the prompt.

[0117] Correspondingly, the embodiment of the application further discloses a device security protection device under eBPF, as shown in Figure 5 The device comprises:

[0118] A policy issuing module 11 is configured to determine a target device security policy and perform policy issuing on the target device security policy.

[0119] A policy storage module 12 is configured to perform policy storage on the issued target device security policy in a hash mapping form and a bitmap form respectively, to obtain first structure data and second structure data respectively.

[0120] A subject and object path acquisition module 13 is configured to determine a subject path and an object path in an operation event after monitoring the operation event on a file or a directory. The operation event is an event of a subject operating an object, the subject is a process of operating the file or the directory, and the object is a file or a directory to be protected.

[0121] A policy matching module 14 is configured to perform policy matching on the subject path and the object path with the first structure data respectively, to determine a first matching result, and perform policy matching on the first matching result with the second structure data, to determine a second matching result.

[0122] An event processing module 15 is configured to determine whether the subject in the operation event has an operation permission on the object according to the second matching result, to obtain a corresponding permission determination result, and process the operation event according to the permission determination result.

[0123] The more specific working processes of the above modules can refer to the corresponding contents disclosed in the foregoing embodiments, and will not be described here in detail.

[0124] It can be seen that, by the above scheme of the embodiment, the target device security policy is determined, and the target device security policy is issued; the issued target device security policy is stored in a hash mapping form and a bitmap form respectively to obtain first structure data and second structure data; when an operation event on a file or a directory is monitored, a subject path and an object path in the operation event are determined; the operation event is an event in which a subject operates on an object, the subject is a process of operating on a file or a directory, and the object is a file or a directory to be protected; the subject path and the object path are used for policy matching with the first structure data respectively to determine a first matching result, and the first matching result is used for policy matching with the second structure data to determine a second matching result; whether the subject in the operation event has an operation permission on the object is determined according to the second matching result to obtain a corresponding permission determination result, and the operation event is processed according to the permission determination result.

[0125] The beneficial technical effects of the present application are: using the mapping mechanism provided by the kernel to store data structures in the eBPF environment, the present application applies the bitmap to the eBPF environment by using the storage forms of the hash mapping and the bitmap. As a kind of efficient data structure, the bitmap can process a large amount of data with small memory occupation and fast speed, and realizes effective storage and efficient matching of the device security policy in the eBPF environment.

[0126] Further, the embodiment of the present application further discloses an electronic device, Figure 6 It is an electronic device 20 structure diagram according to an exemplary embodiment, and the contents in the figure cannot be considered as any limitation on the use range of the present application.

[0127] Figure 6 A structure schematic diagram of an electronic device 20 is provided for the embodiment of the present application. The electronic device 20 can specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25 and a communication bus 26. The memory 22 is used to store a computer program, the computer program is loaded and executed by the processor 21 to realize the related steps in the device security protection method under eBPF disclosed in any of the foregoing embodiments. In addition, the electronic device 20 in the embodiment can be a computer.

[0128] In this embodiment, the power supply 23 is configured to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 is configured to create a data transmission channel between the electronic device 20 and external devices, and the communication protocol followed by the communication interface 24 can be any communication protocol applicable to the technical solution of the present application, which will not be specifically limited herein; the input / output interface 25 is configured to obtain external input data or output data to the outside, and the specific interface type can be selected according to the specific application needs, which will not be specifically limited herein.

[0129] In addition, the memory 22 as a carrier for storing resources can be a read-only memory, a random access memory, a magnetic disk or an optical disk, etc., and the resources stored thereon can include an operating system 221, a computer program 222 and data 223, etc., and the data 223 can include various data. The storage mode can be temporary storage or permanent storage.

[0130] The operating system 221 is configured to manage and control each hardware device on the electronic device 20 and the computer program 222, and can be Windows Server, Netware, Unix, Linux, etc. In addition to the computer program capable of completing the device security protection method under eBPF executed by the electronic device 20 disclosed in any of the foregoing embodiments, the computer program 222 can further include a computer program capable of completing other specific work.

[0131] Further, the present application also discloses a computer readable storage medium, which includes a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a magnetic disk or an optical disk, or any other form of storage medium known in the technical field. The computer program is executed by the processor to implement the foregoing device security protection method under eBPF. For the specific steps of the method, reference can be made to the corresponding content disclosed in the foregoing embodiments, which will not be described herein again.

[0132] Further, the present application also provides a computer program product, which includes a computer program / instruction, and the computer program / instruction is executed by the processor to implement any of the foregoing device security protection methods under eBPF.

[0133] The various embodiments described in the specification are progressive in nature, and each embodiment highlights the differences from other embodiments. The same or similar parts between the various embodiments can be mutually referred to. For the device disclosed by the embodiments, since it corresponds to the method disclosed by the embodiments, the description is relatively simple, and the relevant parts can be referred to the method part.

[0134] The steps of the device security protection method or algorithm under eBPF described in combination with the embodiments disclosed herein can be implemented directly by hardware, software modules executed by a processor, or a combination of both. The software modules can be placed in random access memory (RAM), memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs, or any other form of storage medium known in the art.

[0135] Finally, it should be noted that in this paper, relationship terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between the entities or operations. Moreover, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. Without more limitations, the element defined by the statement "including a" does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0136] The above describes in detail the device security protection method, device, program product and medium under eBPF provided by the present application. The principles and implementation modes of the present application are described by applying specific examples in this paper. The above embodiment description is only used to help understand the method of the present application and its core idea; at the same time, for those skilled in the art, according to the idea of the present application, the specific implementation mode and application range will be changed; in summary, the content of the specification should not be understood as a limitation of the present application.

Claims

1. A device security protection method under eBPF, characterized in that, The method comprises the following steps: determining a target device security policy and performing policy distribution on the target device security policy; respectively adopting a hash mapping form and a bitmap form to perform policy storage on the distributed target device security policy, and correspondingly obtaining first structure data and second structure data; the first structure data comprises a subject hash mapping table, an object hash mapping table and a permission hash mapping table; after monitoring an operation event on a file or a directory, determining a subject path and an object path in the operation event; the operation event is an event in which a subject operates on an object; the subject is a process of operating on a file or a directory; the object is a file or a directory to be protected; respectively performing policy matching on the first structure data by using the subject path and the object path to determine a first matching result, and performing policy matching on the second structure data by using the first matching result to determine a second matching result; determining whether the subject in the operation event has an operation permission on the object according to the second matching result to obtain a corresponding permission determination result, and processing the operation event according to the permission determination result; respectively performing policy matching on the first structure data by using the subject path and the object path to generate a first matching result, comprising: matching the subject path with the subject hash mapping table to determine a first priority corresponding to the subject path; matching the object path with the object hash mapping table to determine a second priority corresponding to the object path; performing a bitwise AND operation on the first priority and the second priority to determine a first matching result.

2. The device security protection method under eBPF according to claim 1, wherein, Before the step of determining the target device security policy, the method further comprises the following steps: defining a device security policy according to a preset rule format; wherein the preset rule format comprises an object part, a subject part, a permission part, a rule part and a policy priority part; correspondingly, the steps of determining the target device security policy and performing policy distribution on the target device security policy comprise the following steps: determining a target device security policy according to a current application scenario, and performing policy distribution on the target device security policy based on the preset rule format.

3. The device security protection method under eBPF according to claim 2, characterized in that, the steps of defining the permission part in the device security policy comprise the following steps: setting a first identifier for the permission to represent an inhibition of any operation behavior; setting a second identifier for the permission to represent a read-only permission; setting a third identifier for the permission to represent a writable permission; setting a fourth identifier for the permission to represent an executable permission.

4. The device security protection method under eBPF according to claim 1, characterized in that, the steps of determining the target device security policy and performing policy distribution on the target device security policy comprise the following steps: determining a target device security policy, and performing policy distribution on the target device security policy through a command line or a graphical user interface.

5. The device security protection method under eBPF according to claim 2, characterized in that, the step of performing policy storage on the distributed target device security policy in the hash mapping form to obtain the first structure data comprises the following steps: constructing an object hash mapping table by using the object part and the policy priority part in the target device security policy; constructing a subject hash mapping table by using the subject part and the policy priority part in the target device security policy; constructing a permission hash mapping table by using the policy priority part and the permission part in the target device security policy; determining the first structure data according to the object hash mapping table, the subject hash mapping table and the permission hash mapping table; wherein the object hash mapping table, the subject hash mapping table and the permission hash mapping table are stored in the form of key-value pairs.

6. The device security protection method under eBPF according to claim 5, characterized in that, Further comprising: determining a first target device security policy and a second target device security policy; wherein the second target device security policy is a device security policy stored after the first target device security policy; when it is determined according to a preset rule format that there is a same part between the first target device security policy and the second target device security policy, determining a target key of the same part in the mapping table to which the same part belongs; updating a value corresponding to the target key by using a different part between the second target device security policy and the first target device security policy.

7. The device security protection method under eBPF according to claim 2, characterized in that, performing policy storage on the target device security policy in the form of a bitmap to obtain second structure data, comprising: constructing a bitmap based on the policy priority part in the target device security policy, and letting each bit in the bitmap correspond to a target device security policy to obtain second structure data; wherein the lower the bit in the second structure data, the higher the priority corresponding to the target device security policy.

8. The device security protection method under eBPF according to claim 5, characterized in that, the policy matching of the first matching result with the second structure data to determine a second matching result, comprising: performing a bitwise AND operation on the first matching result and the complement of the first matching result, and matching the generated bitmap result with the second structure data to determine a second matching result.

9. The device security protection method under eBPF according to claim 8, characterized in that, the matching of the generated bitmap result with the second structure data to determine a second matching result, comprising: determining a first low bit that is not 0 in the bitmap result, and determining a target priority corresponding to the low bit according to the second structure data; the target priority is the priority corresponding to the permission when performing the operation behavior in the operation event; correspondingly, the determining of whether the subject in the operation event has operation permission on the object according to the second matching result to obtain a corresponding permission determination result, comprising: matching the target priority with the permission hash mapping table to determine a target permission corresponding to the target priority; determining whether the subject in the operation event has operation permission on the object according to the target permission to obtain a corresponding permission determination result.

10. The device security protection method under eBPF according to claim 1, characterized in that, the processing of the operation event according to the permission determination result, comprising: when the subject in the operation event has operation permission on the object, releasing the operation behavior in the operation event; when the subject in the operation event does not have operation permission on the object, intercepting the operation behavior in the operation event.

11. The device security protection method under eBPF according to any one of claims 1 to 10, characterized in that, Further comprising: When there is a third target device security policy that needs to be deleted in the target device security policy, the current first structure data and the current second structure data are deleted, and new first structure data and new second structure data are re-determined based on the third target device security policy.

12. An electronic device, comprising: Comprising: a memory for storing a computer program; a processor for loading and executing the computer program to implement the device security protection method under eBPF as claimed in any one of claims 1 to 11.

13. A computer program product comprising computer programs / instructions, characterized in that, The computer program / instructions, when executed by the processor, implement the steps of the device security protection method under eBPF as claimed in any one of claims 1 to 11.

14. A computer-readable storage medium, characterized in that, a memory for storing a computer program; wherein the computer program, when executed by the processor, implements the device security protection method under eBPF as claimed in any one of claims 1 to 11.

Images