Access control method and electronic device

Abstract

The application discloses an access control method and electronic equipment, and relates to the technical field of digital information transmission, and comprises the following steps: based on an access control request, running a target access control subject, dynamically updating a hash chain of the target access control subject according to an access process, dynamically verifying the integrity of the target access control subject by pre-stored hash values every time the hash chain is updated, and freezing the access process immediately if the verification fails, so as to avoid expanding the influence, and restoring the target access control subject by the pre-stored hash values, so that the target access control subject can pass the integrity verification. In the related art, the technical problem that the integrity verification of the access subject is lacking, it is difficult to detect malicious tampering, and it is difficult to guarantee the security of the system resources of the server. Through dynamic verification of the integrity of the target access control subject, the influence of malicious tampering on server resources is reduced, and external attacks during runtime are prevented.

Description

Technical Field

[0001] This invention relates to the field of digital information transmission technology, and more particularly to access control methods and electronic devices. Background Technology

[0002] In related technologies, access control models such as DAC (Discretionary Access Control), RBAC (Role-Based Access Control), and ABAC (Attribute-Based Access Control) typically perform permission checks when an access control request occurs. Their decisions are based on static information such as user identity, role, or environmental attributes for authentication and static permission allocation. However, they lack integrity verification of the access subject, making it difficult to detect malicious tampering and thus failing to ensure the security of server system resources. Therefore, improvements are urgently needed. Summary of the Invention

[0003] This invention provides an access control method and electronic device to at least solve the problem in related technologies of lacking integrity verification of the access subject, difficulty in detecting malicious tampering, and thus difficulty in ensuring the security of server system resources.

[0004] This invention provides an access control method, comprising the following steps: in response to an access control request from a target access control subject, calculating a dynamic hash value of the target access control subject's current critical area information; generating a hash chain for the target access control subject based on the dynamic hash value and a pre-stored hash value of the target access control subject, or updating the hash chain based on the dynamic hash value, to use the hash chain to detect whether the target access control subject meets a preset integrity condition; in response to the target access control subject not meeting the preset integrity condition, freezing the target access control subject's current access process, and restoring the target access control subject's critical area information using pre-backed-up baseline critical area information, so as to grant the target access control subject access control permissions if the target access control subject meets the preset integrity condition.

[0005] The present invention also provides an access control device, comprising: a calculation module, configured to calculate a dynamic hash value of the current critical area information of the target access control subject in response to an access control request from the target access control subject; a detection module, configured to generate a hash chain of the target access control subject based on the dynamic hash value and a pre-stored hash value of the target access control subject, or update the hash chain based on the dynamic hash value, so as to use the hash chain to detect whether the target access control subject meets a preset integrity condition; and a control module, configured to freeze the current access process of the target access control subject in response to the target access control subject not meeting the preset integrity condition, and restore the critical area information of the target access control subject using pre-backed-up baseline critical area information, so as to grant the target access control subject access control permissions when the target access control subject meets the preset integrity condition.

[0006] The present invention also provides an electronic device, comprising: a memory for storing a computer program; and a processor for implementing the steps of any of the above-described access control methods when executing the computer program.

[0007] The present invention also provides a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of any of the above-described access control methods.

[0008] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of any of the above-described access control methods.

[0009] This invention addresses the technical problem of lacking integrity verification for access control entities, making it difficult to detect malicious tampering, and consequently, ensuring the security of server system resources. By dynamically verifying the integrity of the target access control entity based on access control requests and the execution of the target access control entity's hash chain during each hash chain update, the invention reduces the impact of malicious tampering on server resources and prevents external attacks during runtime. This dynamic verification prevents malicious code from exploiting legitimate identities for unauthorized operations, ensures the program executes according to the expected control flow, prevents attackers from hijacking the control flow to alter program behavior, and immediately freezes the access process in case of verification failure to prevent escalation of the impact. The invention also restores the target access control entity using pre-stored hash values, enabling it to pass integrity verification. Attached Figure Description

[0010] To more clearly illustrate the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 A flowchart of an access control method provided according to an embodiment of the present invention;

[0012] Figure 2 This is a schematic diagram illustrating the principle of an access control method according to an embodiment of the present invention.

[0013] Figure 3 A flowchart of an access control method provided according to an embodiment of the present invention;

[0014] Figure 4 This is a schematic diagram of an access control device according to an embodiment of the present invention. Detailed Implementation

[0015] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of the present invention.

[0016] It should be noted that, in the description of this invention, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. The terms "first," "second," etc., used in this invention are used to distinguish similar objects and are not used to describe a specific order or sequence.

[0017] To enable those skilled in the art to better understand the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0018] In related technologies, permission checks are typically performed when an access control request occurs. The decision is based on static information such as user identity, role, or environmental attributes, and mainly relies on pre-defined policies to determine whether a subject can access an object. The object can be checked for integrity through the Integrity Measurement Architecture (IMA), but the integrity information of the subject is not checked. This means that if the subject performing the access has been tampered with, for example, infected with malicious code, the access control decision will still allow access, which may lead to malicious operations.

[0019] To avoid the above problems, some related technologies use static verification to verify the integrity of static files (such as executable files and configuration files) of the access control subject, i.e., when the program starts, to ensure that they are consistent with expectations.

[0020] However, static verification also presents significant security challenges. For example, since static verification only occurs at startup, runtime memory tampering and code injection cannot be detected; many programs, i.e., access control bodies, dynamically load libraries or code that do not exist at startup, and static verification cannot cover these issues.

[0021] To address the aforementioned issues, embodiments of the present invention can reduce the impact of malicious tampering on server resources and prevent external attacks during runtime through dynamic integrity verification.

[0022] Specifically, such as Figure 1 As shown, an embodiment of the present invention provides an access control method, including the following steps:

[0023] In step S101, in response to the access control request from the target access control subject, the dynamic hash value of the current critical area information of the target access control subject is calculated.

[0024] In actual execution, when the target access control subject initiates an access control request to the server, a static integrity verification is first performed on the target access control subject. After the target access control subject completes the static integrity verification, the target access control subject is allowed to run. When the target access control subject runs to any critical function, the hash value of any critical function is calculated, that is, the dynamic hash value of the current critical area information of the target access control subject is calculated.

[0025] The static integrity verification and dynamic verification processes for the target access control subject will be described in detail below.

[0026] Optionally, in one embodiment of the present invention, before responding to an access control request, the method further includes: obtaining a target instruction sequence of the target access control subject; identifying annotations in the target instruction sequence that satisfy preset integrity conditions, and extracting key functions from the target instruction sequence based on the annotations; storing the location data of the key functions in a preset integrity metadata table, and embedding the preset integrity metadata table into the initial target access control subject generated from the target instruction sequence to obtain the target access control subject.

[0027] The development and compilation phases of the target access control principal are described here.

[0028] For example, in the source code (instruction sequence) of the target access control subject, for critical functions that need to be monitored for runtime integrity, embodiments of the present invention can add annotations (such as __attribute__((__critical_rim__))) to the functions for identification and extraction, that is, by having the developer manually mark the critical functions in the program of the target access control subject.

[0029] By manually annotating functions, this invention can reduce the number of functions that need to be monitored, improve efficiency, and still monitor critical content. It achieves a balance between security and performance.

[0030] During the compilation phase, embodiments of the present invention can obtain key information about key functions defined in the source code through the compiler, so that any subsequent tampering with the business instructions of the target access control subject will cause corresponding changes.

[0031] Taking the gcc compiler as an example, this embodiment of the invention can write a dynamic library (such as librim_pass.so) according to the GCC (GNU Compiler Collection, a compiler suite that supports multiple languages) plugin API (Application Programming Interface) rules, and use it as a GCC plugin. Then, when the program of the target access control subject is compiled, the librim_pass.so plugin is loaded in the compilation command by adding the parameter -fplugin= / path / to / librim_pass.so, so that the plugin's functionality is enabled. In librim_pass.so, the functions to be monitored in the program of the target access control subject can be traversed according to specific rules. For example, if the rule is ALL, all functions in the compilation unit of the target access control subject are traversed; if the rule is ctirical_rim, the critical functions with the annotation __attribute__((__critical_rim__)) are traversed.

[0032] After identifying the critical functions, the librim_pass.so plugin records information such as the function name, its relative address and size in the binary file, the calling function name, its relative address and size, and the called function name and its relative address and size. Simultaneously, librim_pass.so inserts an identifier into the source code binary file. This identifier is written to a kernel-managed contiguous buffer during function execution, awaiting use and verification by the subsequent runtime program. In the final stage of compilation, having completed the collection of information for all critical functions, the librim_pass.so plugin generates a structured data table from the collected function information and inserts this table into the final executable file or shared library of the target access control body, as a read-only region named .rim_meta. At this point, the baseline value of the initial compiled binary executable file is obtained. This ensures the accuracy of the baseline value.

[0033] Optionally, in one embodiment of the present invention, before calculating the dynamic hash value of the current critical area information of the target access control principal, the method further includes: detecting whether the operating system of the server has completed the initialization action; if the operating system has completed the initialization action, then starting the target access control principal and loading the preset integrity metadata table into the kernel memory of the operating system.

[0034] Furthermore, in this embodiment of the invention, when system initialization is complete, the information in security.rim can be read into the task_struct->rim_baseline member to provide a data source for subsequent baseline comparison. The structured data table .rim_meta contained in the binary file of the target access control subject is loaded into kernel memory.

[0035] In order to ensure data reliability, this embodiment of the invention can set permissions for the area in kernel memory used to store integrity metadata tables, making it an unalterable area.

[0036] By performing initialization checks on the operating system to ensure the target access control principal runs in a secure environment, the accuracy of verification is improved. Furthermore, by loading the integrity metadata table into the operating system's kernel memory, a baseline can be established for subsequent integrity verification, and data recovery is facilitated in the event of problems with the target access control principal.

[0037] Optionally, in one embodiment of the present invention, before calculating the dynamic hash value of the current critical area information of the target access control subject, the method further includes: determining the number of critical areas of the target access control subject based on a preset integrity metadata table; matching the target memory in the kernel memory based on the number, forming a correctness buffer that meets preset read / write conditions in the target memory, and using the correctness buffer to store the preset integrity metadata table; and creating a continuous buffer that meets preset size conditions based on the size of the correctness buffer, so as to use the continuous buffer to store the current critical area information.

[0038] This invention can determine the number of critical regions for a target access control subject based on an integrity metadata table. For example, it first detects how many critical functions are contained in the .rim_meta data. Based on the number of critical functions, it allocates memory to generate a circular, continuous correctness buffer that is writable but not readable by the process, used to store the metadata in .rim_meta. Simultaneously, based on the size of the correctness buffer, a continuous buffer of N (N>=1) times its size is created to store continuous identifiers inserted during program execution or to generate hash chains. Through reasonable allocation of storage area sizes, this invention can reduce memory usage and ensure the normal operation performance of accessed objects, such as servers.

[0039] The continuation buffer is circular and reusable, which ensures that the continuation buffer has enough space to store continuation identifier metadata and avoids resource waste during long-term operation.

[0040] Optionally, in one embodiment of the present invention, before calculating the dynamic hash value of the current critical area information of the target access control subject, the method further includes: obtaining the initial baseline critical area information of the target access control subject based on a preset integrity metadata table; obtaining the file extension attributes of the target access control subject; detecting whether the target access control subject meets preset update conditions based on the file extension attributes; if the preset update conditions are met, updating the initial baseline critical area information based on the file extension attributes to obtain the baseline critical area information.

[0041] In some embodiments, the system can also detect whether the target access control principal has the file extension attribute `security.rim`. If it exists, it updates the attribute; if not, it creates it. Simultaneously, permissions for the `security.rim` attribute are set to be limited to specific structures that can be updated, preventing unauthorized tampering. Information recorded in `security.rim` is persistently stored to avoid recalculating the hash value of the baseline critical area information each time principal A is started.

[0042] Optionally, in one embodiment of the present invention, after obtaining the baseline key area information, the method further includes: reading the key area information in the memory of the target access control subject; calculating the actual hash value of the target access control subject based on the key area information; calculating the pre-stored hash value using the baseline key area information; detecting whether the target access control subject meets the preset operating conditions using the actual hash value and the pre-stored hash value; if the preset operating conditions are met, allowing the target access control subject to run, and calculating the dynamic hash value of the current key area information of the target access control subject.

[0043] In this embodiment of the invention, after the server stores the benchmark key area information, a complete static verification is performed first.

[0044] When an access control request occurs, embodiments of the present invention can calculate the actual hash value Q of the memory critical region information of the target access control subject, such as the code segment and read-only data segment information. Simultaneously, it obtains the pre-stored hash value H of the initial state runtime integrity information from the `task_struct->rim_baseline` member. The values ​​of H and Q are compared; if they are the same, the verification passes, and access permission is granted. The pre-stored hash value H can be calculated from the baseline critical region information and stored separately.

[0045] When performing hash value calculation, this embodiment of the invention can immediately calculate the cryptographic hash value of the key areas (such as code segment .text, read-only data segment .rodata, .rim_meta) in the memory of the target access control subject after completing system initialization and triggering access control request, and merge multiple hash values ​​into the same hash value.

[0046] In this embodiment of the invention, the pre-stored hash value can be calculated using the benchmark key area information, and the actual hash value can be calculated using the key function extracted from the target access control subject as a whole.

[0047] By comparing the actual hash value with the pre-stored hash value, it is determined whether the target access control principal has been tampered with, and thus whether it can be allowed to run. In this embodiment of the invention, the hash value H of runtime integrity information can also be obtained directly from the memory task_struct->rim_baseline member, which is much faster than obtaining it from security.rim in the file extension attributes.

[0048] In step S102, a hash chain of the target access control subject is generated based on the dynamic hash value and the pre-stored hash value of the target access control subject, or the hash chain is updated based on the dynamic hash value, so as to use the hash chain to detect whether the target access control subject meets the preset integrity conditions.

[0049] Furthermore, embodiments of the present invention can dynamically verify the critical function information of the target access control subject. During the execution of the target access control subject, when the execution flow of the target access control subject's program passes through the critical functions recorded during the compiler compilation process (critical functions annotated with __attribute__((__critical__)), the verification logic is automatically executed to obtain the critical information of the currently running critical functions, such as: function name, address and size during execution, calling function name, address and size of the calling function during execution, and the called function name, address and size of the called function during execution, etc., and compare this information with the data stored in the correctness buffer.

[0050] Optionally, in one embodiment of the present invention, updating the hash chain of the target access control subject based on the dynamic hash value to detect whether the target access control subject meets the preset integrity conditions using the hash chain includes: running the target access control subject; when the execution flow of the target access control subject passes through any key point function, obtaining the identifier of any key point function; storing the identifier in a continuity buffer to update the hash chain of the target access control subject in combination with the identifier already stored in the continuity buffer.

[0051] When the target access control entity is running, the execution flow performs dynamic hash calculation at each critical function. The pre-stored hash value is used as the starting point of the hash chain. Each time the execution flow passes through a critical function, a dynamic hash value node is added during circular storage, thus forming a hash chain. The hash chain and pre-stored hash value are used to detect the target access control entity so that malicious code can be injected into the program in a timely manner. Furthermore, by detecting the hash chain, this embodiment of the invention can also confirm whether the program is executing in the expected order, thus avoiding program execution errors.

[0052] In step S103, in response to the target access control subject not meeting the preset integrity conditions, the current access process of the target access control subject is frozen, and the key area information of the target access control subject is restored using the pre-backed-up baseline key area information, so that access control permissions are granted to the target access control subject when the target access control subject meets the preset integrity conditions.

[0053] In actual execution, if the integrity condition is met, the comparison passes and the function continues execution; if the integrity condition is not met, the comparison fails. This embodiment of the invention can immediately freeze the target access control principal, preserving the complete runtime context and preventing further damage. Simultaneously, the complete memory context (core dump) of the process is saved to disk for subsequent forensic analysis, and a security alert is sent to the user. The target access control principal is then restored using the baseline key information area information corresponding to the pre-stored hash value. After restoration, this embodiment of the invention can unfreeze the process, allowing it to resume execution from the breakpoint after repair, achieving uninterrupted business operations and rapid execution recovery.

[0054] Optionally, in one embodiment of the present invention, recovering the critical area information of the target access control subject using a pre-stored hash value includes: when recovering the critical area information of the target access control subject, querying the pre-backed-up baseline critical area information from memory using a tag as an index; and recovering the critical area information using the pre-backed-up baseline critical area information.

[0055] Furthermore, after the access control subject is compromised, embodiments of the present invention can recover the key information of the target access control subject through pre-stored baseline key information area information.

[0056] After freezing, this embodiment of the invention can obtain the baseline key information area information of the target access control subject, replace the tampered part in the current process memory, and then unfreeze, so that the process can continue to execute from the breakpoint after repair, achieving uninterrupted business and rapid recovery of execution.

[0057] After a successful recovery, the target access control principal can continue to execute other processes for obtaining access control permissions without affecting business continuity or the user's awareness.

[0058] Optionally, in one embodiment of the present invention, the method further includes: associating baseline critical area information with the thread identifier of the running target access control subject; storing the baseline critical area information in the memory of the server that meets preset security conditions using the thread identifier and a pre-stored hash value as tags, thereby generating pre-backed-up baseline critical area information; and after the target access control subject exits, searching for the pre-backed-up baseline critical area information in memory using the tags as indexes, and deleting the pre-backed-up baseline critical area information and tags.

[0059] To facilitate data retrieval, ensure data security, and conserve system space, this embodiment of the invention can back up baseline critical area information, such as code segments and read-only data segments, to a hardware secure area (such as the secure storage space of a TPM), providing a clean data source for subsequent recovery operations. The memory critical area information stored in the hardware secure area uses thread number D + runtime integrity hash value H (pre-stored hash value) as the key, and D+H as a unique index for easy subsequent lookup.

[0060] Finally, when the target access control main program exits, the hardware security zone is searched for content with thread number D + runtime integrity hash value H as the key, and the pre-backed-up baseline critical area information stored therein is deleted. This prevents the unlimited growth of information in the hardware security zone.

[0061] Combination Figure 2 and Figure 3 As shown, the working principle of the access control method of the present invention will be explained in detail with reference to an embodiment.

[0062] This invention can be applied to Linux systems by adding specific markers to the source code and writing these markers into the binary program or dynamic library file during compilation. Then, during program execution, the kernel verifies the integrity of the binary program.

[0063] The Linux kernel process descriptor's `task_struct` structure has a new member: `rim_baseline`. When the target access control principal starts, the information from `security.rim` is read into `task_struct->rim_baseline`. When the target access control principal requests access control permissions, the Linux system calculates the hash value of the target access control principal's critical memory information and compares it with the value of `task_struct->rim_baseline`. If the comparison is successful, access control permissions are granted; if the comparison fails, the target access control principal's process is frozen, all process information is saved to disk for analysis of the cause of the target access control principal's tampering, and an alert is issued. After the alert is issued, the initial information of the process is obtained from the hardware security area, replaced with the memory information, and then execution continues, achieving the goal of restoring the principal process information without interrupting business operations.

[0064] like Figure 2 and Figure 3 As shown, embodiments of the present invention may include the following steps:

[0065] Step S201, System Security Initialization. In this embodiment of the invention, the Linux system can be initialized first. In the Linux system, a file extension attribute `security.rim` can be added to store runtime integrity metrics of the access control principal. During system initialization, in a secure state, proceed to step S202.

[0066] Step S202: The target access control principal is started.

[0067] Step S203: Calculate the actual hash value of the target access control principal. For example... Figure 3 As shown, after successful startup, the hash values ​​of the target access control subject's memory key information are calculated, such as the hash values ​​of the code segment (.text) in memory, the read-only segment (.rodata) in memory, and (.rim_meta). Based on the metadata table, the baseline key area is determined, and the corresponding pre-stored hash values ​​are calculated. The pre-stored hash values ​​are recorded in security.rim, and the information of the code segment (.text) and read-only segment (.rodata) in memory is saved to a hardware-secured area.

[0068] Step S204: Back up the baseline critical area information to the hardware security area.

[0069] Step S205: Read the pre-stored hash value from security.rim.

[0070] Step S206: Store the information in the process's task_struct->rim_baseline. The information in security.rim is read into the task_struct->rim_baseline member to provide a data source for subsequent baseline comparisons.

[0071] Step S207: The target access control principal obtains the access control permissions of the object. In this embodiment of the invention, the completeness of the target access control principal can be determined by comparing the actual hash value with the pre-stored hash value, and by combining this with user permission authentication, the permission of the target access control principal can be determined to be allowed to run.

[0072] Step S208: Calculate the dynamic hash value of the target access control principal. For example... Figure 3 As shown, in this embodiment of the invention, when the target access control principal is running, a dynamic hash value is calculated every time a key function is passed, and the integrity is dynamically verified by comparing the dynamic hash value with the pre-stored hash value.

[0073] Step S209: Determine whether the hash chain passes. This embodiment of the invention can obtain the continuous buffer data stored in the kernel memory. Because the data in this buffer contains identifiers inserted during the execution of each critical function of the target access control entity during runtime, the execution order of critical functions can be verified. By comparing the execution order in the continuous buffer with the preset critical function execution data, the integrity of the target access control entity can be verified.

[0074] Step S210: Grant access permissions. If successful, grant access permissions.

[0075] Step S211: Instantly freeze the process while preserving the complete memory state. If this fails, this embodiment of the invention can freeze the process.

[0076] Step S212: Save the full process information (core dump) to disk.

[0077] Step S213: Send a security alarm.

[0078] Step S214: Obtain the baseline critical region information from the hardware security region.

[0079] Step S215: Replace the corrupted information in the current process's memory.

[0080] Step S216: Unfreeze the process to allow it to continue execution.

[0081] In summary, embodiments of the present invention can identify critical functions or code blocks by analyzing the source code during the compilation phase, based on developer annotations (such as __attribute__((critical_rim))) or all functions. Subsequently, an integrity metadata table containing the precise locations of these critical code regions is generated and embedded as a read-only specific segment (such as .rim_meta) into the final executable file.

[0082] By utilizing a circular continuity buffer, the target access control entity automatically writes an identifier into the buffer whenever its execution flow passes through a key point (such as a marked function) during runtime, upgrading integrity verification from "static memory image comparison" to "dynamic behavior continuity proof".

[0083] The system utilizes the Linux kernel's extended file attributes (security.rim) to persistently store baseline information; it leverages new members in the process descriptor (task_struct) to achieve fast access in memory; and it uses a hardware secure zone (TPM) to securely store backups of the original code.

[0084] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0085] like Figure 4 As shown, an embodiment of the present invention also provides an access control device 10 including: a first calculation module 100, a first detection module 200 and a control module 300.

[0086] Specifically, the first calculation module 100 is used to calculate the dynamic hash value of the current critical area information of the target access control subject in response to the access control request of the target access control subject.

[0087] The first detection module 200 is used to generate a hash chain of the target access control subject based on the dynamic hash value and the pre-stored hash value of the target access control subject, or to update the hash chain based on the dynamic hash value, so as to use the hash chain to detect whether the target access control subject meets the preset integrity conditions.

[0088] The control module 300 is configured to, in response to the target access control subject not meeting the preset integrity conditions, freeze the current access process of the target access control subject and restore the key area information of the target access control subject using pre-backed-up baseline key area information, so as to grant the target access control subject access control permissions when the target access control subject meets the preset integrity conditions.

[0089] Optionally, in one embodiment of the present invention, the access control device 10 further includes: a first acquisition module, an advance module, and an embedding module.

[0090] The first acquisition module is used to acquire the target instruction sequence of the target access control subject.

[0091] The advance module is used to identify annotations that meet preset integrity conditions in the target instruction sequence, and extract key functions from the target instruction sequence based on the annotations.

[0092] The embedding module is used to store the location data of key functions in a preset integrity metadata table, and embed the preset integrity metadata table into the initial target access control body generated by the target instruction sequence to obtain the target access control body.

[0093] Optionally, in one embodiment of the present invention, it further includes a second detection module and a loading module.

[0094] The second detection module is used to detect whether the server's operating system has completed the initialization process.

[0095] The loading module is used to start the target access control principal and load the preset integrity metadata table into the kernel memory of the operating system when the initialization action of the operating system is detected.

[0096] Optionally, in one embodiment of the present invention, the access control device 10 further includes: a determination module, a matching module, and a creation module.

[0097] The determination module is used to determine the number of key areas of the target access control subject based on a preset integrity metadata table.

[0098] The matching module is used to match the target memory in the kernel memory based on the quantity, and form a correctness buffer in the target memory that meets the preset read and write conditions, and use the correctness buffer to store the preset integrity metadata table.

[0099] The module creates a continuous buffer that meets preset size conditions based on the size of the correctness buffer, so as to store the current critical area information using the continuous buffer.

[0100] Optionally, in one embodiment of the present invention, the access control device 10 further includes: a second acquisition module, a third acquisition module, a third detection module, and an update module.

[0101] The second acquisition module is used to obtain the initial baseline key area information of the target access control subject based on the preset integrity metadata table.

[0102] The third acquisition module is used to acquire the file extended attributes of the target access control subject.

[0103] The third detection module is used to detect whether the target access control subject meets the preset update conditions based on file extended attributes.

[0104] The update module is used to update the initial baseline key region information based on the file extended attributes, under the condition that the preset update conditions are met, so as to obtain the baseline key region information.

[0105] Optionally, in one embodiment of the present invention, the access control device 10 further includes: a reading module, a second calculation module, a third calculation module, a fourth detection module, and a fourth calculation module.

[0106] The reading module is used to read key area information from the memory of the target access control subject.

[0107] The second calculation module is used to calculate the actual hash value of the target access control subject based on the key area information.

[0108] The third calculation module is used to calculate the pre-stored hash value using the baseline key area information.

[0109] The fourth detection module is used to detect whether the target access control subject meets the preset operating conditions using the actual hash value and the pre-stored hash value.

[0110] The fourth calculation module is used to allow the target access control subject to run under preset operating conditions, and to calculate the dynamic hash value of the current key area information of the target access control subject.

[0111] Optionally, in one embodiment of the present invention, the control module 300 includes an acquisition unit and an update unit.

[0112] The acquisition unit is used to run the target access control principal and acquire the identifier of any key point function when the execution flow of the target access control principal passes through any key point function.

[0113] An update unit is used to store an identifier into a continuation buffer to update the hash chain of the target access control principal in combination with the identifier already stored in the continuation buffer.

[0114] Optionally, in one embodiment of the present invention, the access control device 10 further includes an association module, a storage module, and a deletion module.

[0115] The association module is used to associate the baseline key area information with the thread identifier of the running target access control subject.

[0116] The storage module is used to store the baseline critical area information into the server's memory that meets preset security conditions, using thread identifiers and pre-stored hash values ​​as tags, and to generate pre-backup baseline critical area information.

[0117] The deletion module is used to locate the pre-backup baseline critical area information in memory by using the tag as an index after the target access control subject exits, and then delete the pre-backup baseline critical area information and tags.

[0118] Optionally, in one embodiment of the present invention, the control module 300 includes a query unit and a recovery unit.

[0119] The query unit is used to query the pre-backed baseline critical area information from memory using tags as indexes when restoring the critical area information of the target access control subject.

[0120] The recovery unit is used to recover critical area information using pre-backed-up baseline critical area information.

[0121] For a description of the features in the embodiment corresponding to the access control device, please refer to the relevant description of the embodiment corresponding to the access control method, which will not be repeated here.

[0122] Embodiments of the present invention also provide an electronic device, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above-described access control method embodiments.

[0123] Embodiments of the present invention also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above-described access control method embodiments when it is run.

[0124] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0125] Embodiments of the present invention also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above-described access control method embodiments.

[0126] Embodiments of the present invention also provide another computer program product, including a non-volatile computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps in any of the above-described access control method embodiments.

[0127] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0128] The access control method and electronic device provided by the present invention have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only intended to help understand the method and core ideas of the present invention. It should be noted that those skilled in the art can make various improvements and modifications to the present invention without departing from its principles, and these improvements and modifications also fall within the protection scope of the claims of the present invention.

Claims

1. An access control method, characterized in that, Includes the following steps: In response to an access control request from the target access control subject, calculate the dynamic hash value of the target access control subject's current critical area information; The hash chain of the target access control subject is generated based on the dynamic hash value and the pre-stored hash value of the target access control subject, or the hash chain is updated based on the dynamic hash value, so as to use the hash chain to detect whether the target access control subject meets the preset integrity conditions; In response to the target access control subject not meeting the preset integrity condition, the current access process of the target access control subject is frozen, and the critical area information of the target access control subject is restored using the pre-backed-up baseline critical area information, so that access control permissions are granted to the target access control subject when the target access control subject meets the preset integrity condition. Prior to responding to the access control request, the method further includes: obtaining a target instruction sequence of the target access control subject; identifying annotations that satisfy preset integrity conditions in the target instruction sequence, and extracting key functions from the target instruction sequence based on the annotations; storing the location data of the key functions in a preset integrity metadata table, and embedding the preset integrity metadata table into an initial target access control subject generated from the target instruction sequence to obtain the target access control subject.

2. The access control method according to claim 1, characterized in that, Before calculating the dynamic hash value of the current critical area information of the target access control subject, the method further includes: Check whether the server's operating system has completed the initialization process; If the initialization action is detected to have been completed by the operating system, the target access control principal is started, and the preset integrity metadata table is loaded into the kernel memory of the operating system.

3. The access control method according to claim 2, characterized in that, Before calculating the dynamic hash value of the current critical area information of the target access control principal, the following steps are also included: The number of key areas of the target access control subject is determined based on the preset integrity metadata table; Based on the quantity, the target memory in the kernel memory is matched, and a correctness buffer that meets the preset read and write conditions is formed in the target memory. The preset integrity metadata table is stored in the correctness buffer. Based on the size of the correctness buffer, a continuous buffer that meets the preset size conditions is created to store the current critical area information.

4. The access control method according to claim 3, characterized in that, Before calculating the dynamic hash value of the current critical area information of the target access control principal, the following steps are also included: The initial baseline key area information of the target access control subject is obtained based on the preset integrity metadata table; Obtain the file extended attributes of the target access control principal; Based on the file extension attributes, it is detected whether the target access control subject meets the preset update conditions; If the preset update conditions are met, the initial baseline key region information is updated based on the file extended attributes to obtain the baseline key region information.

5. The access control method according to claim 3, characterized in that, After obtaining the benchmark key region information, the process also includes: Read the key area information in the memory of the target access control subject; Calculate the actual hash value of the target access control subject based on the key area information; The pre-stored hash value is calculated using the benchmark key area information; The actual hash value and the pre-stored hash value are used to detect whether the target access control subject meets the preset operating conditions; If the preset operating conditions are met, the target access control entity is allowed to run, and the dynamic hash value of the current critical area information of the target access control entity is calculated.

6. The access control method according to claim 3, characterized in that, The step of updating the hash chain of the target access control subject based on the dynamic hash value, so as to use the hash chain to detect whether the target access control subject meets the preset integrity conditions, includes: Run the target access control principal, and when the execution flow of the target access control principal passes through any key point function, obtain the identifier of any key point function; The identifier is stored in the continuity buffer to update the hash chain of the target access control principal in combination with the identifier already stored in the continuity buffer.

7. The access control method according to claim 3, characterized in that, Also includes: Associate the baseline key area information with the thread identifier running the target access control entity; Using the thread identifier and the pre-stored hash value as tags, the baseline critical area information is stored in the memory of the server that meets preset security conditions to generate the pre-backup baseline critical area information; After the target access control subject exits, the pre-backup baseline critical area information is retrieved from the memory using the tag as an index, and the pre-backup baseline critical area information and the tag are deleted.

8. The access control method according to claim 7, characterized in that, The step of recovering the key area information of the target access control subject using the pre-stored hash value includes: When restoring the critical area information of the target access control subject, the pre-backed-up baseline critical area information is queried from the memory using the tag as an index; The critical area information is recovered using the pre-backed-up baseline critical area information.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the access control method as described in any one of claims 1 to 8 when executing the computer program.

Images