Application-oriented software operation security protection method and system
By collecting data and building security policies at the kernel level, the problem of insufficient application security in traditional computer systems is solved. Real-time protection of environment variables, dynamic libraries, file access and program call paths is achieved, improving the runtime security and flexibility of applications.
Patent Information
- Application Number
- CN202510944067.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-07-09
- Publication Date
- 2025-11-04
AI Technical Summary
In traditional computer systems, application security protection relies on external software, lacks comprehensive monitoring of dynamic operating environments, and static strategies are difficult to adapt to different system operating environments, resulting in high maintenance costs and insufficient security.
The system collects application runtime data through the operating system kernel, generates log files, and parses them into security policies, including environment variables, dynamic library paths, program call paths, etc. It then constructs a program call tree and dynamically adjusts security policies to achieve real-time protection at the kernel level.
It provides multi-dimensional security protection for applications, improves the integrity checks of environment variables, dynamic libraries, file access, and program call paths, enhances runtime security and flexibility, and reduces operation and maintenance costs.
Smart Images
Figure CN120893034A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of information security technology, specifically relating to a software runtime security protection method and system for application programs. Background Technology
[0002] In traditional computer systems, application security primarily relies on external security software, lacking comprehensive monitoring of the dynamic runtime environment. Furthermore, existing security policies are typically statically predefined, making them difficult to adapt to different system operating environments. Static policies are fixed before software execution and cannot be dynamically adjusted based on runtime environment, user behavior, or new threats, easily leading to overly lenient or overly strict access control. Modifying static policies usually requires redeployment, configuration, or service restarts, resulting in a heavy operational burden, especially in complex or distributed systems, leading to high maintenance costs. These limitations result in insufficient runtime security for applications.
[0003] Therefore, there is an urgent need for a new method to protect software runtime security and improve the security of applications during runtime. Summary of the Invention
[0004] Purpose of the invention: To address the shortcomings of traditional systems in providing adequate security protection for application runtime environments, file access, and program calls, this invention proposes a software runtime security protection method for applications.
[0005] Technical solution:
[0006] This invention proposes a software runtime security protection method for application applications, comprising:
[0007] (1) The operating system kernel collects application running data and generates log files;
[0008] (2) Parse the log file and generate a security policy, including:
[0009] Parse each environment variable, dynamic library full path record, and program call path in the log file, calculate the hash value of the above content, and save each environment variable, dynamic library full path record, program call path and corresponding hash value to the security policy;
[0010] Parse the full file path and access method records in the log file, and save the full file path and file access method to the security policy;
[0011] The program call paths in the log files are parsed sequentially, a program call tree is constructed starting from the program, and the program call tree is saved to the security policy.
[0012] (3) The kernel performs software operation security protection according to the security policy.
[0013] Furthermore, the kernel's program control block includes a program protection status field and a program call path field. The program protection status includes a no-protection status, a running data collection status, and a security protection status.
[0014] Furthermore, the kernel collects application runtime data and generates log files, including:
[0015] (1) Before the application runs, the program protection control policy is loaded into the kernel;
[0016] (2) When the kernel executes the application, the program protection control policy is found based on the full path of the application. If it needs to be collected, the program's runtime log file is created and the next step is continued.
[0017] (3) Traverse the application's environment variables and record the names and contents of key environment variables in the runtime log file;
[0018] (4) When the application loads a dynamic library, the full path of the dynamic library is recorded in the runtime log file;
[0019] (5) When the application accesses a file, the full path of the file and the access method are recorded in the runtime log file;
[0020] (6) When an application directly or indirectly calls other programs, the program call path starting from the application and ending at the called program will be recorded in the log file. The recorded content is the complete path of all programs in the call path.
[0021] Furthermore, the key environment variables include PATH, LD_PRELOAD, and LD_LIBRARY_PATH. Modifying these key environment variables will result in the loading and execution of illegal programs or dynamic libraries.
[0022] Furthermore, the security protection of applications through kernel and security policies includes:
[0023] (1) Before the application runs, the program protection control policy is loaded into the kernel;
[0024] (2) When the application is running, the application protection control policy is found based on the full path of the application. If security protection is required, the application's security policy is loaded based on the full path of the application.
[0025] (3) Traverse the environment variables in the security policy, calculate the hash value of the corresponding environment variable when the program runs, and compare it with the hash value of the environment variable in the security policy. If they are inconsistent, prevent the program from running.
[0026] (4) When the program loads a dynamic library, it calculates the hash value of the loaded dynamic library and searches for it in the security policy based on the full path of the dynamic library. If the dynamic library is not in the security policy or the hash value in the security policy is inconsistent with the calculated hash value, the program is prevented from running.
[0027] (5) When the program accesses a file, it searches for the file in the security policy based on the file's full path. If the file path is not in the security policy or the current file access method exceeds the access method in the security policy, then access to the file is blocked.
[0028] (6) When a program directly or indirectly calls another program, it searches in the program call tree of the security policy according to the program call path recorded during the operation. If it does not exist, the execution of the program call is blocked. If it exists, the hash value of the program is calculated and compared with the program hash value in the security policy. If the comparison result is inconsistent, the execution of the program is blocked.
[0029] Furthermore, the program protection control strategy includes the complete program path and control switches, wherein the control switches include a shutdown mode, a collection mode, and a protection mode, and this strategy is written into the kernel by the application.
[0030] Furthermore, the process of setting the program protection status includes:
[0031] When the program starts, it reads the program protection status field of the parent process. If the parent process is in running data collection status or security protection status, the program protection status field of the program is set to the same value. Otherwise, the program protection status control field is searched for and set in the program protection control policy according to the full path of the program.
[0032] Furthermore, the program call path field is used to record the program call path, including:
[0033] (1) When the program starts, after the program protection status field is set, the value of the field is read. If it is a running data collection status or a security protection status, the hash value of the complete path of the program is calculated, and the program call path field of the parent process is read.
[0034] (2) If the program call path field of the parent process is empty, set the program call path field of the program to the hash value of the program's full path;
[0035] (3) If the parent process's program call path field is not empty, then the hash value of the parent process's program call path field and the complete path of the program are merged by special characters and saved to the program call path field of the program.
[0036] This invention also proposes a software runtime security protection system for application applications, comprising:
[0037] The collection module is used to collect application runtime data through the kernel and generate log files;
[0038] The generation module is used to parse log files and generate security policies, including:
[0039] Parse each environment variable, dynamic library full path record, and program call path in the log file, calculate the hash value of the above content, and save each environment variable, dynamic library full path record, program call path and corresponding hash value to the security policy;
[0040] Parse the logs for the full path and access method of the files, and record the full path and access method of the files in the security policy;
[0041] The program call paths in the log files are parsed sequentially, and a program call tree starting from the program is constructed. After the construction is completed, the program call tree is saved to the security policy.
[0042] The protection module is used to provide security protection for applications through kernel and security policies.
[0043] The kernel's program control block includes a program protection status field and a program call path field. The program protection status includes no protection status, running data collection status, and security protection status.
[0044] The present invention also proposes a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the aforementioned method.
[0045] Beneficial effects:
[0046] This application introduces a kernel-level data collection mechanism to achieve comprehensive collection of application runtime data, including detailed recording of key information such as environment variables, dynamic libraries, file access, and program call paths. This addresses the shortcomings of traditional monitoring methods and provides a strong foundation for subsequent security protection.
[0047] This application constructs a security policy that includes information on multiple aspects such as environment variable integrity, dynamic library integrity, executable program integrity, file access integrity, and program call path integrity by parsing previously generated log files. The security policy obtained through this invention is more flexible than traditional static security policies and can dynamically adjust as the operating environment changes.
[0048] This application implements a security protection mechanism at the kernel level, which not only improves the depth of protection but also achieves more efficient runtime detection. By loading dynamically built security policies into the kernel, it enables real-time checks on the integrity of environment variables, dynamic libraries, executable programs, file access, and program call paths, thus preventing potential security threats. Attached Figure Description
[0049] Figure 1 A flowchart illustrating the software runtime security protection method of this invention;
[0050] Figure 2 Example of a log file generated by this invention;
[0051] Figure 3 An example of a security policy file generated by this invention. Detailed Implementation
[0052] The present invention will be further illustrated below with reference to the accompanying drawings and specific embodiments. It should be understood that the following specific embodiments are for illustrative purposes only and are not intended to limit the scope of the invention. After reading the present invention, any modifications of the present invention in various equivalent forms by those skilled in the art will fall within the scope defined by the appended claims.
[0053] The present invention will be further described below with reference to the accompanying drawings and embodiments. For example... Figure 1 As shown, a software runtime security protection method for application applications includes the following steps:
[0054] Step 1: Collect application runtime data and generate log files through the kernel, such as... Figure 2 The image shows an example of a log file generated in an embodiment of the present invention. The process of generating the log file includes:
[0055] A1) Before the program runs, the program protection control policy is loaded into the kernel. The program protection control policy includes the full program path and control switches, where the control switches include a shutdown mode, a collection mode, and a protection mode. This policy is written into the kernel by the application.
[0056] A2) When the kernel executes an application, it searches for the program protection control policy based on the full path of the application, determines whether collection is required based on the full path of the application, and if collection is required, creates the program's runtime log file and continues to the next step.
[0057] A3) Iterate through the program's environment variables and record the names and contents of the environment variables PATH, LD_PRELOAD, and LD_LIBRARY_PATH to the runtime log file.
[0058] A4) When the program loads a dynamic library, it records the full path of the dynamic library to the runtime log file.
[0059] A5) When the program accesses a file, it records the file's full path and access method in the runtime log file.
[0060] A6) When the program directly or indirectly calls other programs, the program call path, starting from the program and ending at the called program, will be recorded in the log file. The recorded content will be the complete path of all programs in the call path.
[0061] Step 2: Parse the log file and generate a security policy, such as... Figure 3 The image shows a policy file generated in an embodiment of the present invention. The process of generating the security policy includes:
[0062] B1) Parse each environment variable in the log, calculate the SM3 value of the environment variable, and save the environment variable name and SM3 value to the security policy. Figure 3 The "env" field in the text. The SM3 value is a hash value calculated using the SM3 hash algorithm. Essentially, it is a hash value. The method of this invention for calculating hash values is not limited to the SM3 hash algorithm used in this embodiment.
[0063] B2) Parse the full path records of dynamic libraries in the logs, calculate the SM3 value of each dynamic library, and save the full path and SM3 value of the dynamic library to the security policy. Figure 3 The dynamic library part in the "lib+proc" field.
[0064] B3) Parse the logs for the full file path and access method records, and record the full file path and access method in the security policy accordingly. Figure 3 The "file" field in the document.
[0065] B4) Parse the program call paths in the log files sequentially, perform SM3 operations on the content of each program involved, and save the full program path and its SM3 value to the security policy. Figure 3 The executable program part in the "lib+proc" field.
[0066] B5) Parse the program call paths in the log files sequentially, construct a program call tree starting from the program, and save the program call tree to the security policy after construction. Figure 3 The "call" field in the document.
[0067] Step 3: Provide security protection for the application through kernel and security policies, including:
[0068] C1) Before the program runs, the program protection and control policy is loaded into the kernel.
[0069] C2) When the application is running, the program's protection and control policies are located based on the program's full path. It is then determined whether security protection needs to be run. If security protection needs to be run, the next step is performed.
[0070] C3) Load the program's security policy based on the program's full path.
[0071] C4) Iterate through the environment variables in the security policy, calculate the SM3 value of the corresponding environment variable when the program runs, and compare it with the SM3 value of the environment variable in the security policy. If they are inconsistent, prevent the program from running.
[0072] C5) When the program loads a dynamic library, it calculates the SM3 value of the loaded dynamic library and searches for it in the security policy based on the full path of the dynamic library. If the dynamic library is not in the security policy or the SM3 value in the security policy is inconsistent with the calculated SM3 value, the program is prevented from running.
[0073] C6) When a program accesses a file, it searches for the file's full path in the security policy. If the file path is not found in the security policy or the current file access method exceeds the access method specified in the security policy, then access to the file is blocked.
[0074] C7) When a program directly or indirectly calls another program, it searches the program call tree in the security policy based on the program call path recorded during the operation. If it cannot be found, the execution of the program call is blocked. If it exists, the SM3 value of the program is calculated and compared with the program SM3 value in the security policy. If they are inconsistent, the execution of the program is blocked.
[0075] The kernel's program control block includes a program protection status field to enable runtime data collection and security protection. Program protection statuses include no protection required, runtime data collection, and security protection. The status setting process is as follows: When a program starts, it reads the parent process's program protection status field. If the parent process is in runtime data collection or security protection mode, the program protection status field for that program is set to the same value. Otherwise, the program protection control policy is located based on the program's full path, and the program protection status control field is set accordingly.
[0076] The kernel's program control block includes a program call path field to record program call paths, including:
[0077] D1) When the program starts, after the program protection status field is set, read the value of the field. If it is in the running data collection status or security protection status, calculate the SM3 value of the program's full path and read the program call path field of the parent process.
[0078] D2) If the parent process's program call path field is empty, set the program call path field of this program to the SM3 value of the program's full path.
[0079] D3) If the parent process's program call path field is not empty, then merge the parent process's program call path field and the SM3 value of the program's full path using special characters, and save them to the program call path field of the program.
[0080] This invention achieves security protection for the integrity of application environment variables, dynamic libraries, calling programs, file access, and program call paths by using technologies such as multi-dimensional data collection of application runtime at the kernel level, security policy construction and parsing, and kernel-level security protection, thereby effectively improving the security of applications.
Claims
1. A software runtime security protection method for application applications, characterized in that, include: (1) The operating system kernel collects application running data and generates log files; (2) Parse the log file and generate a security policy, including: Parse each environment variable, dynamic library full path record, and program call path in the log file, calculate the hash value of the above content, and save each environment variable, dynamic library full path record, program call path and corresponding hash value to the security policy; Parse the full file path and access method records in the log file, and save the full file path and file access method to the security policy; The program call paths in the log files are parsed sequentially, a program call tree is constructed starting from the program, and the program call tree is saved to the security policy. (3) The kernel performs software operation security protection according to the security policy.
2. The software operation security protection method according to claim 1, characterized in that, The kernel's program control block includes a program protection status field and a program call path field. The program protection status includes a no-protection status, a running data collection status, and a security protection status.
3. The software operation security protection method according to claim 2, characterized in that, The kernel collects application runtime data and generates log files, including: (1) Before the application runs, the program protection control policy is loaded into the kernel; (2) When the kernel executes the application, the program protection control policy is found based on the full path of the application. If it needs to be collected, the program's runtime log file is created and the next step is continued. (3) Traverse the application's environment variables and record the names and contents of key environment variables in the runtime log file; (4) When the application loads a dynamic library, the full path of the dynamic library is recorded in the runtime log file; (5) When the application accesses a file, the full path of the file and the access method are recorded in the runtime log file; (6) When an application directly or indirectly calls other programs, the program call path starting from the application and ending at the called program will be recorded in the log file. The recorded content is the complete path of all programs in the call path.
4. The software operation security protection method according to claim 3, characterized in that, The critical environment variables include PATH, LD_PRELOAD, and LD_LIBRARY_PATH. Modifying these critical environment variables will result in the loading and execution of illegal programs or dynamic libraries.
5. The software operation security protection method according to claim 4, characterized in that, The security protection of applications through kernel and security policies includes: (1) Before the application runs, the program protection control policy is loaded into the kernel; (2) When the application is running, the application protection control policy is found based on the full path of the application. If security protection is required, the application's security policy is loaded based on the full path of the application. (3) Traverse the environment variables in the security policy, calculate the hash value of the corresponding environment variable when the program runs, and compare it with the hash value of the environment variable in the security policy. If they are inconsistent, prevent the program from running. (4) When the program loads a dynamic library, it calculates the hash value of the loaded dynamic library and searches for it in the security policy based on the full path of the dynamic library. If the dynamic library is not in the security policy or the hash value in the security policy is inconsistent with the calculated hash value, the program is prevented from running. (5) When the program accesses a file, it searches for the file in the security policy based on the file's full path. If the file path is not in the security policy or the current file access method exceeds the access method in the security policy, then access to the file is blocked. (6) When a program directly or indirectly calls another program, it searches in the program call tree of the security policy according to the program call path recorded during the operation. If it does not exist, the execution of the program call is blocked. If it exists, the hash value of the program is calculated and compared with the program hash value in the security policy. If the comparison result is inconsistent, the execution of the program is blocked.
6. The software operation security protection method according to claim 5, characterized in that, The program protection control strategy includes the complete program path and control switches, wherein the control switches include a shutdown mode, a collection mode, and a protection mode. This strategy is written into the kernel by the application.
7. The software operation security protection method according to claim 6, characterized in that, The process of setting the program protection status includes: When the program starts, it reads the program protection status field of the parent process. If the parent process is in running data collection status or security protection status, the program protection status field of the program is set to the same value. Otherwise, the program protection status control field is searched for and set in the program protection control policy according to the full path of the program.
8. The software operation security protection method according to claim 7, characterized in that, The program call path field is used to record the program call path, including: (1) When the program starts, after the program protection status field is set, the value of the field is read. If it is a running data collection status or a security protection status, the hash value of the complete path of the program is calculated, and the program call path field of the parent process is read. (2) If the program call path field of the parent process is empty, set the program call path field of the program to the hash value of the program's full path; (3) If the parent process's program call path field is not empty, then the hash value of the parent process's program call path field and the complete path of the program are merged by special characters and saved to the program call path field of the program.
9. A software runtime security protection system for application applications, characterized in that, include: The collection module is used to collect application runtime data through the operating system kernel and generate log files; The generation module is used to parse log files and generate security policies, including: Parse each environment variable, dynamic library full path record, and program call path in the log file, calculate the hash value of the above content, and save each environment variable, dynamic library full path record, program call path and corresponding hash value to the security policy; Parse the full file path and access method records in the log file, and save the full file path and file access method to the security policy; The program call paths in the log files are parsed sequentially, a program call tree is constructed starting from the program, and the program call tree is saved to the security policy. The protection module is used to perform software operation security protection through the kernel according to the security policy.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 8.