Data access control method and system based on microkernel power mechanism

Abstract

The invention discloses a data access control method and system based on a microkernel power mechanism. The method comprises the following steps: defining an access power type in a power space architecture of a microkernel system; when a system is initialized, a root process is created by a kernel, and the root process is endowed with access capability to all files under a root directory. When the process is created, the parent process creates an independent power branch for the child process based on the own power space, and endows the own access power to the child process. And when the processes run, the first process transmits the access power of the owned file or directory to the second process through power transmission operation. And when the process requests to access the target file, performing multi-level directory power matching verification in the power space of the process based on the path information of the target file, and determining whether access is allowed or not according to a verification result. And when the process requests to cancel the access capability of the target file, positioning and modifying the corresponding capability slot in the capability space of the process based on the information of the capability to be cancelled.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of operating system kernel and data access control, and particularly relates to a data access control method and system based on a microkernel capability mechanism. BACKGROUND

[0002] In a computer system, ensuring data security is a crucial task. The core of guaranteeing data security lies in strictly limiting access to specific data by entities with corresponding permissions, in order to maintain the integrity, confidentiality and availability of data. In this field, microkernel systems exhibit obvious advantages due to their excellent isolation and permission control mechanisms.

[0003] Currently, microkernel systems generally use a capability mechanism to manage process access to kernel objects. A capability is an unforgeable credential that contains both a resource identifier and specific access permissions. Processes can only access corresponding kernel objects through their held capabilities, and cannot perform unauthorized operations. This mechanism enables fine-grained control of kernel object access, effectively preventing security threats such as identity forgery and permission abuse.

[0004] However, existing microkernel capability mechanisms mainly focus on process access control to kernel objects, and do not include data itself in their control range, resulting in a lack of underlying kernel-level protection for direct data access behaviors. Once an attacker successfully bypasses the upper-layer permission check mechanisms such as the file system by exploiting system vulnerabilities, they may directly read or tamper with sensitive data on physical storage devices, posing serious security risks. SUMMARY

[0005] To address the issues of missing data access control and lack of unified kernel-level control in existing microkernel capability mechanisms, the present application proposes a data access control method and system based on a microkernel capability mechanism. This method implements fine-grained control throughout the entire life cycle of capabilities, from derivation, assignment, transmission, verification to revocation, ensuring that each process can only obtain and exercise the minimum permissions necessary to complete its functions, effectively containing the spread and privilege escalation of permissions, and providing core support for building high-security and high-reliability microkernel systems.

[0006] The present application achieves the above-mentioned objectives through the following technical solutions: A data access control method based on a microkernel capability mechanism, comprising: In the capability space architecture of a microkernel system, define access capability types; wherein the capability space is composed of multiple capability slots, and each capability slot is used to manage access capabilities for all files under the same parent directory; During system initialization, the kernel creates a root process and assigns it access capabilities for all files under the root directory; When a process is created, the parent process creates an independent authority branch for the child process based on its own authority space and grants the child process the access authority it possesses; the parent process inherits its access authority from the root process. During process execution, the first process transfers access rights to files or directories it owns to the second process through a power transfer operation; When a process requests access to a target file, it performs multi-level directory permission matching verification in the process's permission space based on the path information of the target file, and determines whether access is allowed based on the verification results. When a process requests to revoke access rights to a target file, the corresponding access slot is located and modified in the process's access space based on the target file information of the access rights to be revoked.

[0007] As a preferred embodiment of the present invention, the data structure of the access rights includes at least: a rights category, a file type identifier, a parent directory ID, a number of files, a file ID array, a number of exception files, and an exception file array; the exception file array contains one or more exception file entries, and each exception file entry includes an exception file type and an exception file ID corresponding to the exception file type.

[0008] As a preferred embodiment of the present invention, the power category includes one or more of the following: read, write, execute, and grant power; the file type identifier is used to distinguish between directory files and non-directory files; the file ID array includes one or more sets of file IDs; for directory files, the exception file array is used to prune the permission scope of the directory.

[0009] As a preferred embodiment of the present invention, when a parent process grants access rights to a child process, the following operation is performed on the slot to be granted access rights: If all permissions are granted to the permission slot, then the entire contents of the permission slot are copied to the permission space of the child process; If some permissions are assigned to the permission slot, the contents of the permission slot are trimmed and copied to the permission space of the child process according to the file type identifier and permission assignment requirements.

[0010] As a preferred embodiment of the present invention, the step of trimming the contents of the permission slot and copying them to the permission space of the child process according to the file type identifier and permission assignment requirements includes: Determine whether the file type identifier in this power slot is a directory file; If it is a directory file, and the permission granting requirement is to grant full access permission to the directory but exclude some subfiles or subdirectories, then copy the directory permission slot from the parent process to the child process, and add the exception file type and exception file ID corresponding to the subfiles or subdirectories to be excluded to the exception file array of the copied permission slot, and update the number of exception files. If it is a directory file, and the permission assignment requirement is to assign it only to the specified non-directory files under the directory, then a new permission slot is created in the permission space of the child process, and the file ID of the specified non-directory file is written into the file ID array of the new permission slot; wherein, the parent directory ID of the new permission slot is the same as that of the directory, and the file type is identified as a non-directory file.

[0011] As a preferred embodiment of the present invention, the first process transfers its access rights to files or directories to the second process through a power transfer operation, including: The first process submits a permission transfer request through the kernel inter-process communication interface; the request includes at least the parent directory ID, file ID, file type identifier, permission category, and identifier of the second process; In the first process's power space, locate the corresponding access power slot based on the parent directory ID of the target file, and verify whether the first process has the power to be passed that matches the request. If the verification passes, the corresponding access permission slot is located in the permission space of the second process based on the parent directory ID of the target file. If the location is successful, then determine whether the file type identifier of the slot is consistent with the target file type; If they match, the slot is reused for updating the permissions to be transferred; if they do not match, a new access permission slot is created for the second process based on the information of the permissions to be transferred. If location fails, a new access permission slot is created for the second process based on the information of the permission to be transferred.

[0012] As a preferred embodiment of the present invention, the verification of whether the first process possesses the transferable authority matching the request includes: Determine whether the file ID array in the located power slot contains the target file ID, and determine whether the power category requested is a subset of the power categories possessed by the located power slot; If the file type of the located power slot is identified as a directory file, then it is further determined whether the power to be passed is not listed as an exception file in the exception file array; If all the conditions are met, the verification passes; if any condition is not met, the power transfer process terminates.

[0013] As a preferred embodiment of the present invention, the multi-level directory authority matching verification based on the path information of the target file in the process's authority space includes: Parse the path information of the target file to obtain the file type identifier, file ID, and directory IDs at each level of the path; In the process's power space, locate the power slot whose parent directory ID is the direct parent directory ID of the target file and whose file type is identified as a non-directory file; If the location is successful and the file ID array of the privilege slot contains the file ID of the target file, then access is allowed; If location fails, or if the file ID array for the specified power slot does not contain the file ID of the target file, then the current directory ID is initialized to the ID of the target file's direct parent directory, and a directory power verification loop is executed. Determine if the current directory ID is the root directory; if it is the root directory, deny access and terminate the loop; if it is not the root directory, perform the following operations: Use the parent directory of the current directory ID as the target parent directory ID; In the process's authority space, locate the authority slot whose parent directory ID is the target parent directory ID and whose file type is a directory file; If the location is successful, and the file ID array of the power slot contains the current directory ID, and the ID of the next level directory of the current directory ID does not appear in the exception file array of the power slot, then access is allowed and the loop is terminated; the ID of the next level directory of the current directory ID is the ID of the next level directory in the target file path located in the current directory. If location fails, or any condition is not met, the current directory ID is updated to the parent directory ID of the current directory ID, and the loop continues.

[0014] As a preferred embodiment of the present invention, the step of locating and modifying the corresponding capability slot in the capability space of the process based on the target file information of the capability to be revoked includes: Based on the parent directory ID of the target file of the power to be revoked, locate the corresponding power slot in the power space; If the location is successful, verify whether the power category of the power slot is consistent with the power category to be revoked; If the verification passes, then determine whether the file ID of the target file to be revoked exists in the file ID array of the located power slot; If the target file does not exist, and the parent directory ID of the target file to be revoked exists in the file ID array of the located power slot, then add the file type and file ID of the target file to the exception file array of the power slot, and update the number of exception files; if it exists, and the target file is not a directory file, then remove the file ID of the target file from the file ID array of the power slot; if the file ID array is empty after removal, then delete the power slot. If it exists and the target file is a directory file, then delete the privilege slot to which the target file belongs.

[0015] A data access control system based on a microkernel empowerment mechanism includes: The permission space management module is used to define access permission types in the permission space architecture of a microkernel system. The permission space consists of multiple permission slots, and each permission slot is used to manage access permissions to all files under the same parent directory. The permission initialization module is used during system initialization to create a root process by the kernel and grant that root process access permissions to all files in the root directory. The permission derivation and assignment module is used when a process is created. The parent process creates an independent permission branch for the child process based on its own permission space and assigns the access permissions it has to the child process. The parent process inherits its access permissions from the root process. The power transfer module is used to allow the first process to transfer access rights to files or directories it owns to the second process during process execution. The authority verification module is used to perform multi-level directory authority matching verification in the process's authority space based on the path information of the target file when the process requests access to the target file, and determine whether access is allowed based on the verification results. The permission revocation module is used to locate and modify the corresponding permission slot in the process's permission space based on the target file information of the permission to be revoked when a process requests the revocation of its access permission to a target file.

[0016] The beneficial effects of this invention are as follows: by abstracting file and directory access permissions into powers and incorporating them into the power space of a microkernel for management, the data access control logic is ultimately deeply integrated into the operating system kernel layer. This low-level integration mechanism ensures that all file access requests must undergo kernel power legitimacy verification, fundamentally blocking illegal access paths such as hijacking upper-layer services and bypassing application-layer verification, completely avoiding security vulnerabilities of traditional upper-layer control, and significantly improving the overall system's anti-attack capability and data security. For non-directory files, they are categorized and stored in the same power slot according to their parent directory ID. This design not only simplifies the power management process, but also allows for quick locking of the target power slot by parent directory ID during power location and access verification, eliminating the need to traverse scattered individual file permissions, thus improving the response efficiency of power query and matching. When granting directory access permissions, these permissions directly override all subfiles within that directory, eliminating the need for individual file-by-file authorization and greatly simplifying batch permission configuration. Simultaneously, by introducing an exception file information mechanism, access permissions for specific subfiles or subdirectories within a directory can be precisely excluded without modifying the underlying structure of directory permissions. This maintains the efficiency of coarse-grained authorization while meeting the needs of fine-grained permission control in special scenarios. During process creation, the permission space of a child process is derived from and initialized by the parent process, strictly adhering to the principle of only granting what it already possesses. That is, the parent process cannot grant permissions it does not possess to the child process; it can only selectively prune and pass on its existing permissions. This mechanism ensures that the permission scale does not expand from the source of permission transfer, achieving minimal inheritance of permissions in child processes and effectively avoiding security risks caused by disordered permission diffusion. During process runtime, dynamic transfer and revocation of specific permissions between processes are supported through permission transfer operations. This allows for the on-demand allocation of temporary permissions to processes based on business needs, and also enables the real-time revocation of permissions when they are no longer needed, avoiding security risks caused by long-term idle permissions. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein: Figure 1 This is a flowchart of a data access control method based on a microkernel empowerment mechanism proposed in this invention; Figure 2 This is a schematic diagram of the overall structure of the power space in an embodiment of the present invention; Figure 3 This is a schematic diagram of the power space tree structure formed by power derivation in an embodiment of the present invention; Figure 4 This is a flowchart of the access permission transfer process in an embodiment of the present invention; Figure 5 This is a flowchart of the access permission verification process in an embodiment of the present invention; Figure 6 This is a flowchart of the access right revocation process in an embodiment of the present invention; Figure 7 This is a schematic diagram of the modular structure of a data access control system based on a microkernel empowerment mechanism proposed in this invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the described embodiments of the present invention are within the scope of protection of the present invention.

[0019] Existing microkernel permission mechanisms primarily focus on process access control to kernel objects, neglecting data access itself. This results in a lack of underlying kernel protection for direct data access. If attackers exploit system vulnerabilities to bypass upper-level permission checks, they could directly read and write sensitive data on physical storage devices, posing serious security risks. To address these issues, this invention proposes a data access control method and system based on a microkernel permission mechanism. This method abstracts file and directory access permissions into unified permission objects and incorporates them into the microkernel's permission space for centralized management. This deeply integrates data access control logic into the operating system kernel layer, achieving unified low-level control over data access behavior. Furthermore, this permission management mechanism covers the entire process, from the creation of root process permissions during system initialization, the derivation and assignment of permissions during process creation, the dynamic transfer and revocation of permissions during process runtime, to the final reclamation of permissions when they are no longer needed. When a process requests access to a target file, a bottom-up, multi-level permission matching verification is performed in the permission space based on the file path information to determine whether access is permitted. Through this combination of low-level control and multi-level verification, all file access behavior is ensured to undergo kernel-level security verification.

[0020] like Figure 1 As shown, this is an embodiment of the present invention, which provides a data access control method based on a microkernel empowerment mechanism. The method includes: S11 defines access permission types within the permission space architecture of a microkernel system. The permission space consists of multiple permission slots, each managing access permissions to all files within the same parent directory.

[0021] like Figure 2 The diagram shown is a schematic representation of the overall structure of the power space in an embodiment of the present invention.

[0022] In a microkernel system, the process's capability data structure is defined by a capability space structure. This structure is the top-level management unit of the process's capability space. The structure contains an array of capability nodes, the number of child processes, and pointers to the capability spaces of the child processes. The functions and relationships of each member are as follows: A power node is a power storage unit that stores all the power information of the process itself. This power information is stored in the power slot structure within the node. The power node structure includes the number of slots and a power slot array. The number of slots declares the total number of power slots contained in the current power node and is used for boundary checks and memory management. The power slot array stores all power slots sequentially, with each element in the array corresponding to an independent power, supporting fast location of the target power slot via index.

[0023] Each power slot stores one power. The power slot structure includes the power type and the power content. The power type is an enumeration type, where TYPE_FUNC represents a function power and TYPE_OBJ represents an object power. This invention adds a TYPE_ACCESS type to represent access powers, achieving compatibility with existing power types.

[0024] The data structure for access permissions should include at least: permission category, file type identifier, parent directory ID, number of files, file ID array, number of exception files, and exception file array. The functions and relationships of each member are as follows: The power categories include one or more of the following: read, write, execute, and grant.

[0025] The file type identifier is used to identify the type of file referred to by the file ID in this capability slot. If the type is a single file, such as a regular file, device file, or symbolic link, it means that this capability slot has permission to access this file, and the specific permissions are specified by the capability category. If the type is a directory file, it means that the capability applies to all files under this directory file, and the specific permissions are specified by the capability category. The scope of permissions can be narrowed by exception file information.

[0026] The parent directory ID identifies the parent directory to which the target file belongs. Access permissions for files within the same parent directory are uniformly stored in the permission slot corresponding to the parent directory ID. This design facilitates the rapid location and merging of permission slots.

[0027] File IDs are unsigned integers and are globally unique identifiers assigned to each file by the file system, similar to inode numbers in Unix-like systems or MFT entry numbers in Windows systems. Their values ​​are bound to the file system's underlying indexing mechanism, ensuring that the file system can quickly locate the file's storage location using this ID. The number of files determines the size of the file ID array, where each element is a corresponding file ID.

[0028] This feature takes effect when the file type is a directory file and is used to prune the permission scope of directory files, excluding files in the directory that do not require permission. The "Exception Files Count" records the total number of exception files. The exception file array contains one or more exception file entries, each including the exception file type and the corresponding exception file ID. The array length is dynamically determined by the exception file count to ensure accurate location of exception files.

[0029] The number of child processes records the total number of child processes directly derived from the current process, used for the length constraint and index management of the child process permission space pointer array. Each element in the child process permission space pointer array is a pointer to a child process permission space structure, forming a tree-like hierarchical relationship between the parent and child process permission spaces, enabling fast indexing of the child process permission space. The array length is equal to the number of child processes.

[0030] In this way, by abstracting file and directory access permissions into permissions and managing them within the microkernel's permission space, data access control logic is ultimately deeply integrated into the operating system kernel layer. This low-level integration mechanism ensures that all file access requests must undergo kernel permission legitimacy verification, fundamentally blocking illegal access paths such as hijacking upper-layer services and bypassing application-layer verification. This completely avoids security vulnerabilities of traditional upper-layer control and significantly improves the system's overall attack resistance and data security.

[0031] S12, during system initialization, the kernel creates a root process and grants that root process access rights to all files in the root directory.

[0032] Furthermore, when a microkernel operating system boots up, the kernel constructs a global capability space during the initialization phase. This space is independent of the user-mode process address space and is accessed only through a dedicated kernel inter-process communication interface provided by the kernel.

[0033] The kernel synchronously creates the first root process, and all subsequent processes are derived directly or indirectly from this root process. The root process is granted access rights to all files under the root node by the kernel, and the file IDs in its permission entries are mapped to the root node identifier.

[0034] S13, during process creation, the parent process creates an independent power branch for the child process based on its own power space, and grants the child process the access rights it possesses. The parent process inherits its access rights from the root process.

[0035] Furthermore, when a parent process spawns a child process, access permissions are granted synchronously, strictly adhering to the permission subset principle. This means the child process can only acquire a subset of the permissions already held by the parent process, and cannot exceed the parent process's permission scope. Subsequent child processes spawning their own subprocesses also follow this principle. This ensures that the permission scale does not expand, achieving minimal inheritance of permissions within child processes and effectively avoiding the security risks caused by the disordered diffusion of permissions.

[0036] During process permission derivation, the parent process creates an independent permission branch for the child process within the child process permission space pointer array of its own permission space structure. After multi-level derivation, the system will form a tree-like permission space structure, such as... Figure 3 As shown.

[0037] When a parent process grants access rights to a child process, the following operations are performed on the slots to which the access rights are granted: If all permissions are granted to the permission slot, the entire contents of the permission slot are copied to the permission space of the child process.

[0038] If some permissions are granted to the permission slot, the contents of the permission slot are trimmed and copied to the permission space of the child process according to the file type identifier and permission granting requirements.

[0039] Specifically, the permission slot content, after being trimmed and copied to the child process's permission space based on file type identifiers and permission assignment requirements, includes: Determine whether the file type identifier in the power slot is a directory file.

[0040] If it is a directory file, and the permission granting requirement is to grant full access permission to the directory but exclude some subfiles or subdirectories, then copy the directory permission slot from the parent process to the child process, add the exception file type and exception file ID corresponding to the subfiles or subdirectories to be excluded to the exception file array of the copied permission slot, and update the number of exception files.

[0041] If it is a directory file, and the permission assignment requirement is to assign it only to the specified non-directory files under the directory, then a new permission slot is created in the permission space of the child process, and the file ID of the specified non-directory file is written into the file ID array of the new permission slot; wherein, the parent directory ID of the new permission slot is the same as that of the directory, and the file type is identified as a non-directory file.

[0042] Furthermore, the specific process for creating a new capability slot is as follows: First, allocate memory space for the capability slot. Second, populate the basic fields, setting the capability category to the permission to be granted; setting the file type identifier to the category of the target file; writing the ID of the target file's parent directory to the parent directory ID; setting the number of files to 1, and creating a file ID array, setting the number of files; and writing the target file's ID to the file ID array.

[0043] S14, during process execution, the first process transfers access rights to the files or directories it owns to the second process through a power transfer operation.

[0044] Furthermore, the transfer of access rights is applicable to scenarios where a process needs to call other processes to complete file access. For example, if process A has read and write rights to a file but needs to rely on process B's decoding ability to process the file data, process A can transfer the file access rights to process B.

[0045] The transfer process strictly adheres to the principle that "powers cannot be created out of thin air and cannot exceed the original scope of powers." Transfer can only be initiated when the transferring process (such as the first process) actually possesses the access power to the target file. The access powers acquired by the receiving process (such as the second process) through transfer can only be a subset of the powers of the transferring process. For example, if the first process possesses "read + write" powers for a directory file, only "read" powers or "read + write" powers can be transferred, not "execute" powers; if the first process's directory powers contain exception file information, the exception rules must be fully preserved during transfer, or the scope of exceptions must be further expanded, and the original exceptions cannot be deleted.

[0046] like Figure 4 As shown, the first process transfers access rights to a file or directory to the second process through a power transfer operation, including: The first process submits a permission transfer request through the kernel inter-process communication interface. The request includes at least the parent directory ID of the target file, the file ID, the file type identifier, the permission category, and the identifier of the second process.

[0047] Within the first process's authority space, the corresponding access authority slot is located based on the target file's parent directory ID, and it is verified whether the first process possesses the authority to be passed on that matches the request. Verifying whether the first process possesses the authority to be passed on that matches the request includes: Determine whether the file ID array in the located power slot contains the target file ID, and determine whether the power category requested is a subset of the power categories possessed by the located power slot.

[0048] If the file type identifier of the located power slot is a directory file, then it is further determined whether the power requested to be passed is not listed as an exception file in the exception file array.

[0049] If all conditions are met, the verification passes. If any condition is not met, the power transfer process terminates.

[0050] If the verification passes, the corresponding access permission slot is located in the permission space of the second process based on the parent directory ID of the target file.

[0051] If the location is successful, then determine whether the file type identifier of the slot is consistent with the target file type.

[0052] If they match, the slot is reused for updating the permissions to be transferred. If they do not match, a new access permission slot is created for the second process based on the information of the permissions to be transferred.

[0053] If location fails, a new access permission slot is created for the second process based on the information of the permission to be transferred.

[0054] Furthermore, a new access permission slot is created for the second process. This involves allocating memory first, then filling in basic fields such as "permission category, file type identifier, and parent directory ID", and initializing "number of files" to 0, "file ID array" to empty, "number of exception files" to 0, and "array of exception files" to empty.

[0055] The update of the second process's power slots involves the following steps: If the access rights to a non-directory file are passed, write the file ID of the target file into the access rights slot and update the file count.

[0056] If the access rights to a directory file are being transferred, the access type, number of files, and directory file ID of the access rights to be transferred must be copied to the access slot receiving the access rights. At the same time, the "exception file information" must be copied completely to ensure that the directory access exception rules of the receiving process are consistent with those of the transferring process. They must not be modified without authorization.

[0057] S15: When a process requests access to a target file, based on the path information of the target file, a multi-level directory authority matching verification is performed in the process's authority space, and the access is determined based on the verification result.

[0058] Furthermore, when a process initiates a file access operation, the kernel proactively triggers a permission check. The kernel first parses the request parameters through the file system to obtain the file identification information, then traverses the process's permission space to check if there is a matching access permission, and finally decides whether to allow access.

[0059] like Figure 5 As shown, based on the path information of the target file, multi-level directory authority matching verification in the process's authority space includes: Parse the path information of the target file to obtain the file type identifier, file ID, and directory IDs at each level of the path.

[0060] Furthermore, the kernel standardizes the file path in the request to obtain an absolute path. If it is a relative path, it is converted into an absolute path by combining the process's current working directory; if the path contains symbolic links, the kernel will recursively parse the symbolic links until it obtains the actual physical path; if the path has a syntax error, the kernel returns "path format error" and terminates the verification.

[0061] The kernel passes the parsed absolute path to the file system, which then traverses its own directory tree structure based on the path to extract the file type identifier and file ID of the target file, while also recording the directory IDs at each level along the path.

[0062] For example, if the absolute path of the file to be accessed is / home / user / docs / report.txt, then the file type identifier and file ID of the file report.txt are recorded, as well as the ID of its parent directory docs, and the IDs of the two directories / home and / home / user are also recorded for permission lookup.

[0063] In the process's power space, locate the power slot whose parent directory ID is the direct parent directory ID of the target file and whose file type is identified as a non-directory file.

[0064] Furthermore, the kernel uses the process ID to locate the process control block in the system, obtains a pointer to the process's power space structure from the process control block, and completes the entry point location of the power space.

[0065] Read the number of slots in the power node and the power slot array to determine the traversal range. Then, traverse the power slot array and filter out the power slots with the power type of access power to form a list of access power slots to be matched.

[0066] Iterate through the list of access permission slots to be matched, and locate the permission slot whose parent directory ID is the direct parent directory ID of the target file and whose file type is not a directory file.

[0067] If the location is successful and the file ID array of the privilege slot contains the file ID of the target file, then access is allowed; If location fails, or if the file ID array for the specified power slot does not contain the file ID of the target file, then the current directory ID is initialized to the ID of the target file's direct parent directory, and a directory power verification loop is executed. Determine if the current directory ID is the root directory. If it is the root directory, deny access and terminate the loop. If it is not the root directory, perform the following operations: Use the parent directory of the current directory ID as the target parent directory ID.

[0068] In the process's power space, locate the power slot whose parent directory ID is the target parent directory ID and whose file type is a directory file.

[0069] If the location is successful, and the file ID array of the power slot contains the current directory ID, and the ID of the next level directory of the current directory ID does not appear in the exception file array of the power slot, then access is allowed and the loop is terminated; the ID of the next level directory of the current directory ID is the ID of the next level directory in the target file path located in the current directory. If location fails, or any condition is not met, the current directory ID is updated to the parent directory ID of the current directory ID, and the loop continues.

[0070] In some embodiments, when process A attempts to access the file / home / user / docs / report.txt, the system performs the following verification: By parsing the file path through the file system, we can obtain the target file ID and the IDs of each level of directory. Assuming the result is / 101 / 201 / 301 / 404, that is, the ID of the directory / home is 101, the ID of the directory / home / user is 201, the ID of the directory / home / user / docs is 301, and the ID of the file report.txt is 401.

[0071] The kernel traverses the privilege space of process A, finds all access privileges, and then checks whether there is a privilege slot with parent directory ID 301.

[0072] If a privilege slot with parent directory ID 301 exists, then the file ID array for that privilege slot is traversed, and the array is checked to see if file ID 401 exists. If a match is found, it means that process A has the privilege to access this file, and the kernel allows the access.

[0073] If the slot with parent directory ID 301 does not contain the permissions for this file, or if the slot with parent directory ID 301 is not found, the kernel iterates through all access slots again, checking if a slot with parent directory ID 201 exists. If a match is found, and the file type is a directory file, the file ID is 301, and the file ID 401 is not in the exception file ID array, then process A has the permission to access this file, and the kernel allows the access. Otherwise, proceed to the next step.

[0074] The kernel then checks again to see if a slot with parent directory 101 exists in the access permission slots. If a match is found, and the file type is a directory file, the file ID is 201, and file ID 301 is not in the exception file ID array, then process A has the permission to access this file, and the kernel allows the access. Otherwise, since the kernel has already checked to the root node and found no matching access permission, it returns "no matching permission" and rejects the access.

[0075] S16, when a process requests to revoke access rights to a target file, the corresponding access slot is located and modified in the process's access space based on the target file information of the access rights to be revoked.

[0076] The system kernel sometimes needs to revoke a process's access permissions to a file. The process of revoking access permissions includes: Based on the parent directory ID of the target file of the power to be revoked, locate the corresponding power slot in the power space.

[0077] If the location is successful, verify whether the power category of the power slot is consistent with the power category to be revoked; If the verification passes, then determine whether the file ID of the target file to be revoked exists in the file ID array of the located power slot; If the target file to be revoked does not exist, and the parent directory ID of the target file exists in the file ID array of the located power slot, then the file type and file ID of the target file are added to the exception file array of the power slot, and the number of exception files is updated.

[0078] Furthermore, the `realloc` function is used to dynamically expand the exception file array, adding a space for one element, writing the ID of the target file into the exception file array, and incrementing the number of exception files by 1.

[0079] If it exists and the target file is not a directory file, then remove the file ID of the target file from the file ID array of the power slot; if the file ID array is empty after removal, then delete the power slot.

[0080] Furthermore, remove this file ID from the file ID array, and decrement the file count by 1. If there are no other file IDs in the array after removal, delete this power slot directly, and update the process's power node structure, decrementing the slot count by 1.

[0081] If it exists and the target file is a directory file, then delete the permissions belonging to that target file.

[0082] Furthermore, while deleting a power slot, the process's power node structure is updated, and the number of slots is reduced by 1.

[0083] like Figure 7The diagram shown illustrates the modular structure of a data access control system based on a microkernel-based power mechanism proposed in this invention. The system includes a power space management module, a power initialization module, a power derivation and assignment module, a power transfer module, a power verification module, and a power revocation module.

[0084] The permission space management module is used to define access permission types in the permission space architecture of a microkernel system. The permission space consists of multiple permission slots, and each permission slot is used to manage access permissions to all files under the same parent directory. The permission initialization module is used during system initialization to create a root process by the kernel and grant that root process access permissions to all files in the root directory. The permission derivation and assignment module is used when a process is created. The parent process creates an independent permission branch for the child process based on its own permission space and assigns the access permissions it has to the child process. The parent process inherits its access permissions from the root process. The power transfer module is used to allow the first process to transfer access rights to files or directories it owns to the second process during process execution. The authority verification module is used to perform multi-level directory authority matching verification in the process's authority space based on the path information of the target file when the process requests access to the target file, and determine whether access is allowed based on the verification results. The permission revocation module is used to locate and modify the corresponding permission slot in the process's permission space based on the target file information of the permission to be revoked when a process requests the revocation of its access permission to a target file.

[0085] In summary, this invention proposes a data access control method and system based on a microkernel power mechanism. This method abstracts file and directory access permissions into powers and manages them within the microkernel's power space, thereby deeply integrating data access control logic into the operating system kernel layer. This low-level integration mechanism ensures that all file access requests undergo kernel power legitimacy verification, blocking illegal data access through hijacking upper-layer services or bypassing application-layer verification at the architectural level, fundamentally improving system security and anti-attack capabilities. In terms of security management, kernel-mandated verification ensures that all file access behaviors are controlled by powers. Regarding power management efficiency, a power slot design based on parent directory IDs is adopted, categorizing non-directory files by parent directory, simplifying the power structure, and quickly locating power slots through parent directory IDs, improving power query and matching efficiency. Regarding the flexibility of permission granting, when granting directory access permissions, directory permissions can directly override all sub-files under that directory, supporting batch authorization. Simultaneously, by introducing an exception file information mechanism, specific sub-items can be finely excluded without modifying the basic permission structure, balancing coarse-grained authorization efficiency with fine-grained control requirements. In terms of process permission management, when a process is created, the permission space of a child process is derived from and initialized by the parent process, strictly adhering to the principle of only granting what it already possesses. That is, the parent process cannot grant permissions it does not possess to the child process; it can only selectively prune and pass on its existing permissions. This mechanism ensures that the permission scale does not expand from the source of permission transfer, achieving minimal inheritance of child process permissions and effectively avoiding the security risks caused by disordered permission diffusion. During process runtime, dynamic transfer and revocation of specific permissions between processes are supported through permission transfer and revocation operations. This allows for the on-demand allocation of temporary permissions to processes based on business needs, and the real-time revocation of permissions when they are no longer needed, avoiding security risks caused by long-term idle permissions. By optimizing data access control logic from multiple dimensions, including security management, management efficiency, authorization flexibility, and process authority management, comprehensive protection is provided for the high security and high reliability of the microkernel system.

[0086] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various variations or substitutions within the technical scope disclosed in this application, and these should all be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A data access control method based on a microkernel empowerment mechanism, characterized in that, include: In the permission space architecture of a microkernel system, access permission types are defined; the permission space consists of multiple permission slots, and each permission slot is used to manage access permissions to all files under the same parent directory; During system initialization, the kernel creates a root process and grants that root process access rights to all files in the root directory. When a process is created, the parent process creates an independent authority branch for the child process based on its own authority space and grants the child process the access authority it possesses; the parent process inherits its access authority from the root process. During process execution, the first process transfers access rights to files or directories it owns to the second process through a power transfer operation; When a process requests access to a target file, it performs multi-level directory permission matching verification in the process's permission space based on the path information of the target file, and determines whether access is allowed based on the verification results. When a process requests to revoke access rights to a target file, the corresponding access slot is located and modified in the process's access space based on the target file information of the access rights to be revoked.

2. The data access control method based on a microkernel empowerment mechanism according to claim 1, characterized in that, The data structure of the access rights includes at least: rights category, file type identifier, parent directory ID, number of files, file ID array, number of exception files, and exception file array; the exception file array contains one or more exception file entries, and each exception file entry includes the exception file type and the exception file ID corresponding to the exception file type.

3. The data access control method based on a microkernel empowerment mechanism according to claim 2, characterized in that, The power categories include one or more of the following: read, write, execute, and grant power; the file type identifier is used to distinguish between directory files and non-directory files. The file ID array includes one or more sets of file IDs; for directory files, the exception file array is used to prune the permission scope of the directory.

4. The data access control method based on a microkernel empowerment mechanism according to claim 2, characterized in that, When a parent process grants access rights to a child process, the following operations are performed on the slots to which the access rights are granted: If all permissions are granted to the permission slot, then the entire contents of the permission slot are copied to the permission space of the child process; If some permissions are assigned to the permission slot, the contents of the permission slot are trimmed and copied to the permission space of the child process according to the file type identifier and permission assignment requirements.

5. A data access control method based on a microkernel empowerment mechanism according to claim 4, characterized in that, The step of pruning the contents of the permission slot and copying them to the permission space of the child process based on the file type identifier and permission assignment requirements includes: Determine whether the file type identifier in this power slot is a directory file; If it is a directory file, and the permission granting requirement is to grant full access permission to the directory but exclude some subfiles or subdirectories, then copy the directory permission slot from the parent process to the child process, and add the exception file type and exception file ID corresponding to the subfiles or subdirectories to be excluded to the exception file array of the copied permission slot, and update the number of exception files. If it is a directory file, and the permission assignment requirement is to assign it only to the specified non-directory files under the directory, then a new permission slot is created in the permission space of the child process, and the file ID of the specified non-directory file is written into the file ID array of the new permission slot; wherein, the parent directory ID of the new permission slot is the same as that of the directory, and the file type is identified as a non-directory file.

6. A data access control method based on a microkernel empowerment mechanism according to claim 2, characterized in that, The first process transfers access rights to files or directories it owns to the second process through a power transfer operation, including: The first process submits a permission transfer request through the kernel inter-process communication interface; the request includes at least the parent directory ID, file ID, file type identifier, permission category, and identifier of the second process; In the first process's power space, locate the corresponding access power slot based on the parent directory ID of the target file, and verify whether the first process has the power to be passed that matches the request. If the verification passes, the corresponding access permission slot is located in the permission space of the second process based on the parent directory ID of the target file. If the location is successful, then determine whether the file type identifier of the slot is consistent with the target file type; If they match, the slot is reused for updating the permissions to be transferred; if they do not match, a new access permission slot is created for the second process based on the information of the permissions to be transferred. If location fails, a new access permission slot is created for the second process based on the information of the permission to be transferred.

7. A data access control method based on a microkernel empowerment mechanism according to claim 6, characterized in that, The verification of whether the first process possesses the pending authority matching the request includes: Determine whether the file ID array in the located power slot contains the target file ID, and determine whether the power category requested is a subset of the power categories possessed by the located power slot; If the file type of the located power slot is identified as a directory file, then it is further determined whether the power to be passed is not listed as an exception file in the exception file array; If all the conditions are met, the verification passes; if any condition is not met, the power transfer process terminates.

8. A data access control method based on a microkernel empowerment mechanism according to claim 2, characterized in that, The multi-level directory authority matching verification based on the path information of the target file in the process's authority space includes: Parse the path information of the target file to obtain the file type identifier, file ID, and directory IDs at each level of the path; In the process's power space, locate the power slot whose parent directory ID is the direct parent directory ID of the target file and whose file type is identified as a non-directory file; If the location is successful and the file ID array of the privilege slot contains the file ID of the target file, then access is allowed; If location fails, or if the file ID array for the specified power slot does not contain the file ID of the target file, then the current directory ID is initialized to the ID of the target file's direct parent directory, and a directory power verification loop is executed. Determine if the current directory ID is the root directory; if it is the root directory, deny access and terminate the loop; if it is not the root directory, perform the following operations: Use the parent directory of the current directory ID as the target parent directory ID; In the process's authority space, locate the authority slot whose parent directory ID is the target parent directory ID and whose file type is a directory file; If the location is successful, and the file ID array of the power slot contains the current directory ID, and the ID of the next level directory of the current directory ID does not appear in the exception file array of the power slot, then access is allowed and the loop is terminated; the ID of the next level directory of the current directory ID is the ID of the next level directory in the target file path located in the current directory. If location fails, or any condition is not met, the current directory ID is updated to the parent directory ID of the current directory ID, and the loop continues.

9. A data access control method based on a microkernel empowerment mechanism according to claim 2, characterized in that, The step of locating and modifying the corresponding capability slot in the process's capability space based on the target file information of the capability to be revoked includes: Based on the parent directory ID of the target file of the power to be revoked, locate the corresponding power slot in the power space; If the location is successful, verify whether the power category of the power slot is consistent with the power category to be revoked; If the verification passes, then determine whether the file ID of the target file to be revoked exists in the file ID array of the located power slot; If the target file does not exist, and the parent directory ID of the target file to be revoked exists in the file ID array of the located power slot, then add the file type and file ID of the target file to the exception file array of the power slot, and update the number of exception files; if it exists, and the target file is not a directory file, then remove the file ID of the target file from the file ID array of the power slot; if the file ID array is empty after removal, then delete the power slot. If it exists and the target file is a directory file, then delete the privilege slot to which the target file belongs.

10. A data access control system based on a microkernel empowerment mechanism, comprising a data access control method based on a microkernel empowerment mechanism as described in any one of claims 1 to 9, characterized in that, include: The permission space management module is used to define access permission types in the permission space architecture of a microkernel system. The permission space consists of multiple permission slots, and each permission slot is used to manage access permissions to all files under the same parent directory. The permission initialization module is used during system initialization to create a root process by the kernel and grant that root process access permissions to all files in the root directory. The permission derivation and assignment module is used when a process is created. The parent process creates an independent permission branch for the child process based on its own permission space and assigns the access permissions it has to the child process. The parent process inherits its access permissions from the root process. The power transfer module is used to allow the first process to transfer access rights to files or directories it owns to the second process during process execution. The authority verification module is used to perform multi-level directory authority matching verification in the process's authority space based on the path information of the target file when the process requests access to the target file, and determine whether access is allowed based on the verification results. The permission revocation module is used to locate and modify the corresponding permission slot in the process's permission space based on the target file information of the permission to be revoked when a process requests the revocation of its access permission to a target file.

Images